Harvard University Information Security | HARVARD.EDU

Contract language

V2. Written contracts including appropriate university riders must be executed with all vendors/other third parties who collect, process, host, or store information classified as Level 3 and above.

Written university contracts are strongly recommended for vendors/other third parties who collect, process, host, or store non-sensitive, non-public university data (i.e., Level 2).

See also: Level 2, Level 3, Level 4, 13, Vendors, Level 3, Level 4

How to Comply

Ensure approved contract language

Contracts covering the use of Level 3 or 4 confidential information must include confidentiality language approved by the Office of the General Counsel. The Personal Data Protection contract rider is acceptable to append to an existing contract and may be found at the OGC website.

Vendor contracts

Use the University Contract Rider to ensure vendor protection for confidential information. Refer to the Office of the General Counsel Model Documents for examples of approved consulting agreement, software agreement, and credit card merchant agreements. For complex or unusual agreements which may not be appropriately addressed through existing...

Information Security Policy

Harvard University

Contract language

How to Comply

Ensure approved contract language

Vendor contracts

a5521c6de467d1f1f57b952884f5e43e