THIRD PARTY SECURITY ASSESSMENT
The Information Security Team can support your division, department or faculty to identify and mitigate risks associated with using third-party services and suppliers who process University data. Whether it’s a new or existing relationship, the results of an assessment will better prepare you to make the right decisions about how to manage your suppliers.
What we offer
The Third Party Security Assessment (TPSA) is a due diligence activity to gain a level of assurance with the overall security of our suppliers.
It can be treated as part of the procurement process or carried out with existing suppliers. It involves sending the supplier a list of security-related questions about their control environment, and uses the expertise of the Information Security Team to assess the responses.
Benefits for you
- Gain active assurance that suppliers are protecting your data.
- Reduce the risk of information security incidents.
- Make managers more aware of the supplier risks to your data.
- Standardised assessment methods ensure a consistent approach to measuring supplier risk.
- Compliance with legal and policy requirements.
- Enable informed decision making when selecting new suppliers.
How it works
The service is available to all parts of the collegiate university and typical engagements with suppliers are provided free of charge. Where a greater level of involvement is required (over half a day’s work) the service can be provided at our standard re-charge rate of £470 per day. The service includes:
- Assistance with determining the level of risk based on the nature and volume of the data involved.
- Assessing the security controls and contractual arrangements of the supplier to determine if they are fit for purpose.
- Providing advice, assistance and support when dealing with supplier queries and negotiations.
- Making recommendations to help you decide whether the supplier’s security is sufficiently mature.
What you need to do
If you are interested in this service, please send a completed version of the TPSA questionnaire to infosec@it.ox.ac.uk or contact us in advance if you have any queries.
