35. Will the contract allow the vendor disclose Vendor any of the data to others without the College’s permission. 36. Are sub-contractors or vendors Vendor involved in the provision of the service? 37. Will the College retain ownership of the Vendor and system data? sponsor 38. How long will data reside on the system? Vendor 39. If the vendor ceases trading who would Vendor and system own the data? sponsor 40. Who controls access to the data within the Vendor vendor’s organization? 41. Data sensitivity Is the system dealing with information that System sponsor must be kept confidential? Data Protection and other legislation apply to cloud computing services. Examples might include :- Names or contact details of College students or staff Academic grades Research data or results College financial information etc. 42. What steps will the vendor take to Vendor safeguard sensitive information? 43. The vendor should supply current copies of Vendor. their IT security policy and supporting documentation. 44. How are backups of data secured by the Vendor vendor? 45. Data required What data will be required? Most vendors Vendor supply a list of the data fields they require. This should be given to the data owner. 46. Is data encryption required? What data Vendor encryption mechanism does the vendor provide? 47. How are users to be authenticated for the Vendor service? Does the cloud service support the Shibboleth / SAML 2.0 or ADFS protocol to facilitate connection to TCD's Federated Access authentication system? 48. Data Protection and How would the vendor address:- Vendor other legislation Persons who wish to view their data under Data Protection or other legislation? Persons who wish to or remove their data? 49. Transparency to How will those using the new service be service users made aware that their data is been processed off-site and possibly their data is being stored off-site?
35. Will the contract allow the vendor disclose any of the data to others without the College’s permission. Vendor 36. Are sub-contractors or vendors involved in the provision of the service? Vendor 37. Will the College retain ownership of the data? Vendor and system sponsor 38. How long will data reside on the system? Vendor 39. If the vendor ceases trading who would own the data? Vendor and system sponsor 40. Who controls access to the data within the vendor’s organization? Vendor 41. Data sensitivity Is the system dealing with information that must be kept confidential? Data Protection and other legislation apply to cloud computing services. Examples might include :- Names or contact details of College students or staff Academic grades Research data or results College financial information etc. System sponsor 42. What steps will the vendor take to safeguard sensitive information? Vendor 43. The vendor should supply current copies of their IT security policy and supporting documentation. Vendor. 44. How are backups of data secured by the vendor? Vendor 45. Data required What data will be required? Most vendors supply a list of the data fields they require. This should be given to the data owner. Vendor 46. Is data encryption required? What data encryption mechanism does the vendor provide? Vendor 47. How are users to be authenticated for the service? Does the cloud service support the Shibboleth / SAML 2.0 or ADFS protocol to facilitate connection to TCD's Federated Access authentication system? Vendor 48. Data Protection and other legislation How would the vendor address:- Persons who wish to view their data under Data Protection or other legislation? Persons who wish to or remove their data? Vendor 49. Transparency to service users How will those using the new service be made aware that their data is been processed off-site and possibly their data is being stored off-site?
Cloud%20Policy%202014%20Appendix%20A.docx