No. Issue Further details Refer to 20. Jurisdiction Which country or jurisdiction is the vendor based in. Vendor 21. Which jurisdiction will the data reside? Vendor 22. Site security Does the vendor have a current independently compiled security audit of their site? Vendor 23. How often are security audits conducted and by whom? Vendor 24. Levels of Service Does the vendor provide a Service Level Agreement that sets targets for the services it offers? Vendor 25. Is there a documented and enforceable means of complaints resolution? Vendor 26. How does the vendor charge for its services? E.g. annual charge, numbers of students etc. Vendor 27. If the service level needs to be scaled up or down how is this to be accommodated in the cost of the service? System sponsor 28. Has the College secured future price protection for this service? System sponsor 29. Continuity of service Does the vendor have adequate documented arrangements for dealing with computer disasters and ensuring a continuity of service to College? Vendor 30. What would be the impact to College if the service was unavailable? System sponsor 31. Compatibility List any operating systems or versions that the vendor product cannot work on. Vendor 32. List any web browsers or versions that the vendor’s product cannot work on. A.6 Data issues This section deals with College data and the implications of its use. System sponsors will need to consider if the cloud solution justifies the risk of processing data offsite and the possible costs security audits. For sensitive data a College hosted system may offer cost savings in the long term. No. Issue Further details to 33. Data ownership and safety Will the system need data from core College systems such as Student Administration, Personnel or Research Support Systems? The permission of the relevant College data owner will be needed to use data of this type. Data owner(s) 34. Will the vendor allow other organizations access to the data stored on the cloud system? Vendor
35. Will the contract allow the vendor disclose any of the data to others without the College’s permission. Vendor 36. Are sub-contractors or vendors involved in the provision of the service? Vendor 37. Will the College retain ownership of the data? Vendor and system sponsor 38. How long will data reside on the system? Vendor 39. If the vendor ceases trading who would own the data? Vendor and system sponsor 40. Who controls access to the data within the vendor’s organization? Vendor 41. Data sensitivity Is the system dealing with information that must be kept confidential? Data Protection and other legislation apply to cloud computing services. Examples might include :- Names or contact details of College students or staff Academic grades Research data or results College financial information etc. System sponsor 42. What steps will the vendor take to safeguard sensitive information? Vendor 43. The vendor should supply current copies of their IT security policy and supporting documentation. Vendor. 44. How are backups of data secured by the vendor? Vendor 45. Data required What data will be required? Most vendors supply a list of the data fields they require. This should be given to the data owner. Vendor 46. Is data encryption required? What data encryption mechanism does the vendor provide? Vendor 47. How are users to be authenticated for the service? Does the cloud service support the Shibboleth / SAML 2.0 or ADFS protocol to facilitate connection to TCD's Federated Access authentication system? Vendor 48. Data Protection and other legislation How would the vendor address:- Persons who wish to view their data under Data Protection or other legislation? Persons who wish to or remove their data? Vendor 49. Transparency to service users How will those using the new service be made aware that their data is been processed off-site and possibly their data is being stored off-site?