Tech & Cloud Contract Management. A Small College Perspective

Transcription

1 Tech & Cloud Contract Management A Small College Perspective

2 The Problem: Vendors want to take NO responsibility Sales says You don t need the IT folks for this Even though you don t need the IT folks you DO need to move data between the new system and existing Systems Of Record The vendor went out of business!! What happened to our DATA!! Acme-Cloud.com just got breached! Now what do I do?

3 So What Do We Do? There are many solutions and the best one is the one that best fits your institutional culture This will be one small college s solution Later you ll hear a large land-grant university s solution

4 Lay of the Land at Siena College Siena is a small (3000 students) private, Catholic, liberal arts College Management is quite siloed, each Division operating independently Culture is fairly risk-averse (good for this purpose) There is a Risk-Officer, and a Contracts Administrator who is a trained lawyer

5 More Lay of the Land Although there is Policy that all technology purchasing be run through ITS (Information Technology Services), past practice had been to ignore that policy With more Cloud services popping up, the CIO (me) and the Contracts Admin decided things had to change.

6 Checklist! Technology Contracts Checklist Description Applicability Mitigating Factors Negotiable Privacy SAAS/Hosted/Contracted services Depends on Data Y Confidentiality SAAS/Hosted/Contracted services Depends on Data N Service Level Commitment SAAS/Hosted How critical is the service Shouldn't be Breach issues & Cyber-Liability Insurance SAAS/Hosted What's the risk Y General Liability All See standard contract Y Physical and Hosting security SAAS/Hosted What's the risk Y Compliance with Siena Policies SAAS/Hosted/Contracted services See standard contract Y Data Assurance (recovery & management) SAAS/Hosted Depends on Data N Accessibility Anything with web access Required N Venue All Not too big a deal Y Warranty ALL See standard contract Shouldn't be Indemnification All See standard contract Should be fair PCI Any service involving credit cards See standard contract N

7 Other things to think about What happens if the Vendor goes out of business? Do I want the data at the Vendor s location included in a Data Warehouse or other analytics collection? What are the consequences in terms of this contract if the Vendor has a data breach? If we have a data breach? What happens if our Internet connection goes down? What if theirs does?

8 Click-Thru Agreements! Solely with respect to students, applicants, and employees of Client using VENDOR s Services, the following paragraph of the section of the Terms of use entitled User Submitted Content hereby is revised to read as follows: You understand and agree that You are solely liable, and VENDOR shall not be liable under any circumstances, for any losses, liabilities, expenses, or damages of any kind suffered as a result of uploading, publishing, sharing, entering, transmitting, or displaying any Content or Data whatsoever (including, without limitation, the designation or authorization by You of persons or entities to receive, review, use, or have access to Your Content or Data), except to the extent such losses, liabilities, expenses or damages arise from the negligence or willful misconduct of VENDOR, its employees, subcontractors, agents or any other person or entity under VENDOR s direction and control. You, for and on behalf of Yourself and Your heirs, successors, assigns, and legal representatives, hereby forever release and discharge VENDOR (including, without limitation, its subsidiaries and affiliates), and their respective shareholders, directors, officers, members, managers, employees, representatives, contractors, and agents, and their respective heirs, successors, and assigns (each, a VENDOR Party and collectively, the VENDOR Parties"), from any and all liabilities, claims, damages, actions, and losses in any way related to or connected with (a) any error, omission, disclosure, display, transmission, loss, or use by one or more VENDOR Parties of or with respect to Your Personal Information, Content, or Data, except if arising from a VENDOR Party's negligence or willful misconduct Added Replaced even

9 How do we get people to think about these things? Or at least let us know that there is a deal in the offing?

10 Contract Management System The Contracts Office needed a system to track Contracts More than just tech related info needed to be provided by acquiring offices If IT built a system for the Contracts Office we could build in notification to IT when technology was involved

11 Built the System Using ProcessMaker First Section

12 Second Section Does the contract Involve Technology?

13 Next If the submitter checks the technology box, I get an to log into the system. If the submitter doesn t check the box, but the CA s assistant (who reviews all incoming contracts) thinks technology is involved anyway, I get an to log into the system. When I log in I can see the info that they ve put into the form and view or download the contract itself.

14 And then. Generally I will download and red-line the contract and send the red-lined version with comments to the CA. We then get on the phone and discuss it. The CA compiles all our concerns, makes her own red-lined copy and sends it to the vendor. They, then, usually, refuse to make any changes (not really, but getting more common)

15 Resources Sample language I keep on hand Data Security Cloud Compliance SLA (Service Level Agreement) Recovery of Data Warranty Scheduling of Maintenance/Upgrades Confidentiality Physical Hosting Vendor Liability Access to Data (API) Support Breach!

16 Places to look for Resources: NACUA Educause NACUBO Search for: vendor contract site:.edu

17 Conclusion We want to try and protect ourselves with contract language, so does the vendor Both of us want a deal so usually there is a happy medium to make a compromise When there isn t, it can be VERY hard to draw a line in the sand Sometimes we accept language we don t like in order to get a product or service We hope that if there is a problem the vendor finds it in their own best interest to make things right

18 Moral of many stories: It s better to get the right language into the contract than to expect the vendor to be nice later!