Mitchell Hamline School of Law

Mitchell Hamline Policy Repository

Vendor Management Policy

Posted: May 18, 2023

Applies to: Faculty, Staff

Policy Holder: Administrative Information Technology

Responsible Office: Administrative Information Technology

Contact Information: Chief Information Officer

Effective Date: March 1, 2023

Last Review Date: March 1, 2023

Approved by: Vice President of Finance and Administration

1.0 Background and Purpose

The purpose of the Mitchell Hamline School of Law (MHSL) Vendor Management Policy is to describe the actions and behaviors required to ensure that due care is taken to avoid inappropriate risks to MHSL, its business partners, and its stakeholders from any of its vendors.

1.1 Who Needs to Know?

The MHSL Vendor Management Policy applies to any individuals that interacts, sets up, or manages any MHSL vendors.

2.0 Policy

Assessments

  • Vendors granted access to MHSL Information Resources must sign the MHSL Vendor Non-Disclosure Agreement.
  • Vendors must be evaluated prior to the start of any service and thereafter on an annual basis.
  • High risk findings must be followed up to verify remediation.
  • A vendor risk assessment must be performed on vendors with physical or logical access to confidential information or that are considered critical vendors.
  • Risk assessments must be performed on all requested cloud providers before approval.
  • Vendors with PCI DSS compliance requirements must have their status reviewed on an annual basis.

Management

  • Vendor agreements and contracts must specify:
    • The MHSL information the vendor should have access to,
    • How MHSL information is to be protected by the vendor,
    • How MHSL information is to be transferred between MHSL and the vendor,
    • Acceptable methods for the return, destruction, or disposal of MHSL information in the vendor’s possession at the end of the contract,
    • Minimum information security requirements,
    • Incident response requirements,
    • Right for MHSL to audit vendor.
  • If a vendor subcontracts part of the information technology service provided to the vendor, the vendor is required to ensure appropriate information security practices throughout the supply chain and to notify MHSL.
  • The vendor must only use MHSL Information Resources for the purpose of the business agreement.
  • Work outside of defined parameters in the contract must be approved in writing by the appropriate MHSL point of contact.
  • Vendor performance must be reviewed annually to measure compliance to implemented contracts or Service Level Agreements (SLA). In the event of non-compliance with contracts or SLAs regular meetings will be conducted until performance requirements are met.
  • Vendor’s major IT work activities must be entered into or captured in a log and available to MHSL IT management upon request. Logs must include, but are not limited to, events such as personnel changes, password changes, project milestones, deliverables, and arrival and departure times.
  • Any other MHSL information acquired by the vendor in the course of the contract cannot be used for the vendor’s own purposes or divulged to others.
  • Vendor personnel must report all security incidents directly to the appropriate MHSL IT personnel within the timeframe defined in the contract.
  • MHSL IT will provide a technical point of contact for the vendor. The point of contact will work with the vendor to make certain the vendor is in compliance with these policies.
  • New vendors must provide MHSL a list of key personnel working on the contract.
  • Vendors with logical access to information resources must provide non-repudiation authentication mechanisms.
  • Vendors must provide MHSL with notification of key staff changes within 24 hours of change.
  • Upon departure of a vendor employee from the contract for any reason, the vendor will ensure that all sensitive information is collected and returned to MHSL or destroyed within 24 hours.
  • Upon termination of contract, vendors must be reminded of confidentiality and non-disclosure requirements.
  • Upon termination of contract or at the request of MHSL, the vendor must surrender all MHSL badges, access cards, equipment and supplies immediately. Equipment and/or supplies to be retained by the vendor must be documented by authorized MHSL IT management.