External Information Systems

External Information Systems A. Each agency must establish and maintain an inventory of all known service providers approved to access SOM assets or approved to process, store, or transmit SOM data. 1. The inventory includes classification(s), and the designated enterprise contract(s) for each service provider. 2. Classification consideration may include one or more characteristics, such as data sensitivity, data volume, availability requirements, applicable regulations, inherent risk, and mitigated risk. 3. Review and update the inventory annually, or when significant enterprise changes occur that could impact this safeguard. B. Each agency must ensure service provider contracts include appropriate security requirements. More details about security requirements for cloud and offsite hosting services are included in the Enterprise Cloud and Offsite Hosting Security Policy on the ITS website. C. Each agency must control sensitive information that is posted or processed on publicly accessible systems.