I have UC P2/3 data, what do I do?

How can a vendor be assessed for P2/P3 data in the absence of ISO resources?

Units can ensure that 3rd-party service providers meet campus data security requirements for handling P2/P3 data by taking the following actions during the contracting process:

• Include the UCOP Data Security & Privacy Appendix: This appendix is required for all UC contracts involving third-party access to protected data. Ensure it is included in the service provider contract without edits. This ensures baseline protection in the event of a data breach, including:
  • Service provider compliance with applicable laws (e.g., FERPA, HIPAA), regulations, and campus policy.
  • Requirements for a vendor information security plan and breach reporting process.
  • Adequate cyber-insurance to cover the cost of investigating and responding to a breach.

  Reference: UCOP Procurement Policies and Forms.

• Notify the Provider of MSSEI Obligations: Explicitly inform the service provider that by signing the Data Security & Privacy Appendix, they are obligated to abide by campus policy. This includes adherence to the Minimum Security Standard for Electronic Information (MSSEI) for the protection of UC P2/P3 data.

---

For more information on data sensitivity, see the Data and IT Resource Classification Standard.