How to Request a Review

All third-party vendors with access to UVA data should be reviewed; this includes both cloud vendors and consultants. However, according to the University Data Protection Standards 3.0, only vendors handling sensitive, highly sensitive, or mission critical data must be reviewed by UVA IT Compliance before the product or service is purchased and/or used.

An email will automatically be sent to the vendor contact email you provided.  Be sure to notify your contact with the vendor that they will be receiving an email from OneTrust prior to submitting the form.  This helps to keep the review on track.

Certainly!  Email [email protected] and we can resend the email. 

This is largely dependent on the vendor.  The IT Compliance team typically sends information requests back to the vendor within five business days of receiving the initial submission.  In general, vendors with more mature Information Security practices tend to go through the review process more quickly than vendors without established Information Security practices.

Yes, although the next steps for your review will be dependent on the data and context.  If the vendor you submitted is processing Highly Sensitive Data or has been designate as mission critical, then a sign off process may be necessary after the review (see the Vendor Security Review standard).  Otherwise, if no further steps are required, you will receive an email indicating the outcome of the review.

When you login to OneTrust, you should see any in progress or completed Self-Service Portal submissions at the bottom half of your screen (below the tiles available for launch).

Feel free to send them the template below.  Just replace "[Vendor]" with the name of your vendor and send it off to your point of contact:

"I have been notified by our Information Security team a review of your service and environment is required by UVA policy. Our Information Security team has a process for conducting these reviews which allows for an easier and more secure means for transmitting documentation.

Requests for [Vendor]’s review will be sent from “UVA IT Compliance <[email protected]>” with the words “Assessment Assigned” in the subject line. The email will include information and instructions for completing the review.

Please let me know if you are not the appropriate person to receive this request. Otherwise, thank you for your assistance in helping us to comply with the University’s Vendor Security Review Standard."