Cloud vendors handling non-public UVA information generally must be reviewed.  If you are uncertain whether or not a review is required in your case, check out our purchaser FAQ [2].

The most important pieces of information you will need to know are as follows: the name of the service, the name of the vendor providing the service, and an email address for a specific point of contact with the vendor. 

An email will automatically be sent to the vendor contact email you provided.  Be sure to notify your contact with the vendor that they will be receiving an email from OneTrust prior to submitting the form.  This helps to keep the review on track.

Certainly!  Email it-compliance@virginia.edu [3] and we can resend the email. 

This is largely dependent on the vendor.  The IT Compliance team typically sends information requests back to the vendor within five business days of receiving the initial submission.  In general, vendors with more mature Information Security practices tend to go through the review process more quickly than vendors without established Information Security practices.

Yes, although the next steps for your review will be dependent on the data and context.  If the vendor you submitted is processing Highly Sensitive Data or has been designate as mission critical, then a sign off process may be necessary after the review (see the Vendor Security Review standard [4]).  Otherwise, if no further steps are required, you and the vendor will receive an email indicating the outcome of the review.

When you login to OneTrust, you should see any in progress or completed Self-Service Portal submissions at the bottom half of your screen (below the Vendor Onboarding Form launch button).

Feel free to send them the template below.  Just replace "[Vendor]" with the name of your vendor and send it off to your point of contact:

"I have been notified by our Information Security team that due to the data your service handles, a review is required by UVA policy. Our Information Security team has implemented a new process for conducting these reviews which allows for an easier and more secure means for transmitting documentation.

Requests for [Vendor]’s review will be sent from “UVA IT Compliance <noreply@m.onetrust.com [5]>” with the words “Assessment Assigned” in the subject line. The email will include information and instructions for completing the review.

UVA Information Security uses the Higher Education Cloud Vendor Assessment Tool (HECVAT) for reviews.  If you organization already maintains a completed copy of the HECVAT, then you only need to complete through the Documentation section – then hit the button that says “Submit” at the bottom right.  If you do not have an up to date HECVAT, then please complete the full form.

Please let me know if you are not the appropriate person to receive this request. Otherwise, thank you for your assistance in helping us to comply with the University’s Vendor Security Review Standard [4]."

Feel free to send them the template below.  Just replace "[Vendor]" with the name of your vendor and send it off to your point of contact:

"I have been notified by our Information Security team that it is time for our annual review of [Vendor]’s SOC 2 report or comparable information security document. Our Information Security team has implemented a new process for collecting and reviewing this report which allows for an easier and more secure means for transmitting documentation.

Requests for [Vendor]’s SOC 2 or comparable information security document will be sent from “UVA IT Compliance <noreply@m.onetrust.com [5]>” with the words “Assessment Assigned” in the subject line. The email will include information and instructions for completing the review.

To submit the SOC 2 type 2 report, you only need to complete questions 1.2 & 4.1 (with SOC 2 report upload) – then hit the button that says “Submit” at the bottom right.  If you do not have a SOC 2 type 2 or comparable documentation, please complete the full form.

Please let me know if you are no longer the appropriate person to receive this request. Otherwise, thank you for your assistance in helping us to comply with the University’s Vendor Security Review Standard [4]."