Vendor Security Assessment Program

A service overview and catalog of Vendor Security Assessment Program provided by the UC Berkeley IT Service Hub.

Description

The Vendor Security Assessment (VSA) service provides a rigorous, third-party evaluation of a vendor’s ability to safeguard University data and systems. Managed by the Information Security Office (ISO), this service ensures that any external partner handling sensitive information meets the University’s high standards for technical, administrative, and physical security.

Benefits & Features

Comprehensive Review: Evaluation of vendor security plans and industry-standard attestations (e.g., SOC2)
Gap Identification: Detailed analysis of vendor responses to identify potential vulnerabilities before they become liabilities.
Informed Decision-Making: Empowers units to negotiate from a position of knowledge and proactively work with vendors to address security gaps before a contract is finalized.

Scope & Deliverables

Service Scope: Required for all new agreements, renegotiations, or renewals involving data or systems classified at Protection Level P3 or P4.
VSA Report: Upon completion, stakeholders receive a comprehensive report featuring an overall risk rating, a summary of identified risks, and actionable mitigation recommendations.

For more information, see Details about the Vendor Security Assessment Service.

Getting Started

To ensure a smooth assessment, please complete the following steps before submitting your request.

1. Gather Documentation from the Vendor

Ask your vendor contact for the following items:

Vendor Product Name: Collect the name of the vendor product/service being purchased.
Contact Details: Name, title, email, and phone of the person who will work with Venminder to conduct the assessment.
Security Attestations: A SOC 2 Type II report (preferred).
PCI Compliance: If the vendor handles credit cards, request the Attestation of Compliance (AOC) or Self-Assessment Questionnaire and Attestation of Compliance (SAQ).

Inform the vendor that Venminder will contact them to conduct the assessment on behalf of UC Berkeley.

2. Prepare Usage Details

Ensure you have these details ready for the intake form:

Unit & Contact Information: Details for the Requester and the Procurement Buyer.
Business Use Case: A clear description of how the product/service will be used.
IT Resources: Collect information regarding the UCB systems the vendor will have access to or integrate with.
Data Classification: Completion of Appendix DS Exhibit 1, which identifies the types of data involved. (Contact the Privacy Office if you need help with this form).

3. Coordinate with your Buyer

Before submitting the VSA request, work with your Buyer to confirm:

The vendor accepts the Appendix DS terms without modification.
The vendor carries adequate cybersecurity insurance.

4. Submit the Form

Once the above steps are complete:

Submit your BearBUY requisition.
Complete the Request a Vendor Security Assessment form (CalNet login required).

Service Details

Eligibility	This service is available to Faculty and Staff.
Contact	Technical Support: Request a Vendor Security Assessment (CalNet login required) or email questions to security-assessments@berkeley.edu.
Availability	Available 24/7. Support is provided Monday–Friday, 8:00 AM – 5:00 PM PT, excluding University holidays and curtailment periods.
Cost	There are no direct costs associated with the standard service. Rush orders for vendor assessments may have a cost charged by our external vendor, Venminder. Rush order fees range from $250 to $1000 depending on the type of assessment.
Data Classification	This service is rated for P3, A2, and R2 data. Compliance: Users are responsible for ensuring data handled within this service complies with the Data and IT Resource Classification Standards.