14. Harvard must conduct appropriate due diligence to ensure that third parties that store or have access to Harvard confidential information are capable of properly protecting the information and must require such third parties to protect the information