APPROVED IT-RELATED VENDOR LIST - For ETSU Internal Use Only
-
What is the purpose of a security review?
Security reviews are intended to exclude the use of high risk vendors. This action reduces the likelihood that a cybersecurity incident will impede academic progress by ETSU Students or lead to a breach of sensitive ETSU data. Security reviews also help reduce costly replication of services by multiple vendors. Security reviews are required for ETSU to comply with State regulations, cybersecurity insurance requirements, and with ETSU policy. Security reviews promote the selection of secure vendors and help build trust with the ETSU Community. -
Can I purchase products from the approved list?
Yes! Refer to the list of ETSU approved vendors linked near the top of this table. Use keywords to search the list for the type of product you are after. If there is an approved product already in use, you should use that product, particularly if there is an enterprise level contract in place. Remember, duplication of services increases costs to the University and, in turn, to Students. If contacted by Procurement, ITS will confirm that the products is security-approved. -
Should I use a vendor who receives a high risk rating?
Using vendors who receive a high risk rating (2.3% of those reviewed) increases the potential liability to the University in the event of a data breach or loss and is strongly discouraged. Internal and State audit-enforced compliance, insurance regulations, and ETSU policy require that we perform risk assessments on third-party vendors. The intent of such reviews is not simply to assign a risk value but also to reduce risk to the ETSU Community by excluding the use of high risk vendors. -
Does a low risk rating mean that a vendor will not experience a breach or loss of data?
No. Regardless of how many security controls a vendor has in place, there are no guarantees that they will not experience a cybersecurity incident resulting in a breach or loss of data. Cybercriminals target virtually every organization found on the world wide web. Evolving threats and zero day vulnerabilities mean that no one is completely safe from a cyberattack. -
How long does a security review take?
Security reviews generally take 1-2 weeks but may take more or less time based on several factors: A vendor may not respond to requests for security documentation - we send repeat requests at roughly 3 day intervals. The vendor may have pre-existing recognized certifications that can be confirmed from a certification authority, which greatly reduces the time required for review. The vendor may require that a signed NDA is in place with ETSU before the vendor will release security documentation, which requires additional time for Legal processing. Occasionally, a vendor has recently undergone a divestiture or acquisition and their personnel are uncertain who is responsible for responses to security questions and this adds time to the review. -
Are security reviews performed on vendors who provide instructional materials?
Purely instructional technologies are exempted from review. Major textbook publishers and their homework sites are generally exempted from review. A security review would be required, however, if identifiable student information and/or grades, beyond those circumscribed by the publisher-developed homework assignments, were to be shared with a vendor. -
Are any other vendors exempt from security review?
Yes. Vendors who hold certain current internationally or nationally recognized security certifications may be exempted from review. If a vendor is exempted from review, we will provide you with an email to share as needed with Legal or Procurement. As mentioned elsewhere, purely instructional applications are not subject to security review. -
Is it possible to make software purchases with a pro-card?
Software purchases on a pro-card must be approved by Ray Webb in CTS (webbr@etsu.edu). Ray consults with Security to determine if a security review is required prior to approval. -
How often are vendors reviewed?
Full vendor security reviews are considered valid for 3 calendar years, although we may periodically check to determine if a vendor has made changes to their security controls or their privacy policy.