Working with Vendors and External Services

Vendor contracts

V1. Written contracts and appropriate riders must be executed with all vendors and other third parties who have access to Harvard non-public systems.

Contract language

V2. Written contracts including appropriate university riders must be executed with all vendors/other third parties who collect, process, host, or store information classified as Level 3 and above.   ...

Read more about Contract language

Level 4 vendors

V3: The security design, policies, and procedures of vendors and other third parties who will collect, process, host or store Level 4 information or manage Harvard critical systems must be reviewed by a University Information Security Officer. Find out more about Vendor Reviews.

Read more about Level 4 vendors