Every third party software system we use needs to answer the following questions.
Has your software application been load-tested?
Do you encrypt customer data in storage?
Do you encrypt customer data during transmission across network boundaries?
Do you have a group or individual assigned responsibility for information security?
Do technologies and services you offer adhere to Section 508 of the Rehabilitation Act and the Americans with Disabilities Act?
If employing web-based technology, does your application conform with Level AA accessibility standards set forth in WCAG 2.0?
Once these questions have been answered a formal security review of the software must be handled and will be initiated by IS&T. This should occur priort to any contract being signed.
Questions/comments should be directed to the director of IS&T.