Multi-factor Authentication Required for myVPN Starting July 22, 2024 - Learn More

CSP - IT Rep - Outsourcing and Service Provider Management

Outsourcing & Service Provider Management  

16. Security & Confidentiality Agreement

Is the Service Provider Security Checklist reviewed, and the Security and Confidentiality Agreement (SACA) signed (when required) before any Service Provider is granted access to UBC Electronic Information and Systems?

Why is this Essential?

The Service Provider Security Checklist support you in ensuring the minimum required controls for managing privacy/information security risk have been considered when engaging with a vendor.

Signed SACAs both set clear expectations with vendors on their responsibilities relating to UBC information and systems as well a transfer some legal responsibility in the event of a breach not caused by UBC.

Reference Links​
Information Security Standards – U9 Outsourcing and Service Provider Management
Service Provider Security Checklist
Security and Confidentiality Agreement


Service Providers must sign a Security and Confidentiality Agreement (SACA) prior to being granted access to Medium, High or Very High Risk Information. The Administrative Head of Unit of Unit may request the Office of the University Counsel to grant a waiver of the requirement for a SACA where the primary contract with the Service Provider contains equivalent privacy and security language. Doctors, lawyers, accountants, auditors, psychologists and other professionals who are bound by a duty of confidentiality do not need to sign a SACA.

What is Acceptable?

There is a process in place to ensure service providers are reviewed against the checklist, SACAs are signed and that there is knowledge or awareness in the IT support community.


17. Privacy Impact Assessment

Are Privacy Impact Assessments conducted on all projects handling personal information (Note: Guidance is available on when to conduct a PIA and exceptions for research projects)?

Why is this Essential?

Privacy and information security at UBC is a shared responsibility. A Privacy Impact Assessment (PIA) is a risk management and compliance review process used to identify and address potential information privacy and security issues, thus avoiding costly program, service, or process redesign and minimizing exposure to potential privacy breaches.

Furthermore, British Columbia’s Freedom of Information and Protection of Privacy Act (FIPPA) requires public bodies such as UBC to conduct a PIA for all new or substantially modified projects. For additional information, please refer: Privacy-impact-assessment

Reference Links​
Information Security Standards – U1 Security Classification of UBC Electronic Information
Information Security Standards – U9 Outsourcing and Service Provider Management
Information Security Standards – U11 Securing Internet of Things (IoT) Devices
Information Security Standards – M11 Development and Modification of Software Applications
Privacy Matters @UBC - Personal Information, How to protect personal information online
Privacy Matters @UBC – Privacy Impact Assessment



What is Acceptable?

The importance of assessing privacy/information security risk is part of the unit's culture. Staff are educated and encouraged to "prepare for" and "complete" Privacy Impact Assessments.

UBC Crest The official logo of the University of British Columbia. Urgent Message An exclamation mark in a speech bubble. Caret An arrowhead indicating direction. Arrow An arrow indicating direction. Arrow in Circle An arrow indicating direction. Arrow in Circle An arrow indicating direction. Chats Two speech clouds. Facebook The logo for the Facebook social media service. Information The letter 'i' in a circle. Instagram The logo for the Instagram social media service. Linkedin The logo for the LinkedIn social media service. Location Pin A map location pin. Mail An envelope. Menu Three horizontal lines indicating a menu. Minus A minus sign. Telephone An antique telephone. Plus A plus symbol indicating more or the ability to add. Search A magnifying glass. Twitter The logo for the Twitter social media service. Youtube The logo for the YouTube video sharing service. Bell Warning