RIC ONE Vendor Management Risk Operations Center 2023-24 Annual Report

NEW YORK STATE REGIONAL INFORMATION CENTERS

RISK OPERATIONS CENTER (RIC ONE ROC) CENTRALIZED, STANDARDIZED, AND COST-EFFECTIVE

VENDOR MANAGEMENT FUNCTIONS REDUCE RISK

OPTIMIZE PERFORMANCE

DRIVE INNOVATION

DATA PROTECTION

PERFORMANCE

VALUE

RISK MANAGEMENT

RISK MANAGEMENT

RISK MANAGEMENT

NEW YORK STATE

REGIONAL INFORMATION CENTERS

RIC ONE VENDOR MANAGEMENT RISK OPERATIONS CENTER (ROC) 2023-2024 ANNUAL REPORT

NEW YORK STATE REGIONAL INFORMATION CENTERS

RISK OPERATIONS CENTER (RIC ONE ROC)

TABLE OF CONTENTS RIC ONE ROC OVERVIEW INFORMATION

PAGES 3-7

APPENDIX

PAGE 10

RIC ONE ROC OVERVIEW AND YEAR 1 FOCUS RIC ONE ROC PRODUCT SCOPE RIC ONE ROC FUNCTIONS, BENEFITS, AND PRODUCT SCOPE RIC ONE ROC DATA PRIVACY AGREEMENTS (DPAs) FUNCTION RIC ONE ROC DATA PROTECTION RISK MANAGEMENT FUNCTION RIC ONE ROC TEAM AND PARTNERS

INSERT

3 4 5 6 7 8

INSERT

NEW YORK STATE REGIONAL INFORMATION CENTERS

RISK OPERATIONS CENTER (RIC ONE ROC) VENDOR MANAGEMENT RISK OPERATIONS CENTER (RIC ONE ROC) OVERVIEW RIC One is designed to coordinate efforts between the twelve statewide Regional Information Centers (RICs). The centers work collaboratively as one to provide efficient and unified statewide technology leadership and innovative solutions. The RIC One Vendor Management Risk Operations Center (RIC One ROC) is implementing centralized, standardized, cost-effective, and sustainable processes to manage vendor risk. In Phase 1, during the 2023-2024 school year, the RIC One ROC focused on the protection of data. Specifically, the ROC focused on developing a structure that supports the efficient execution of Data Privacy Agreements. This page explains the RIC One ROC current and future functions. The functions are identified in the dark blue boxes. Important vendor management functions that are outside of the scope of the RIC One ROC are also identified in the light blue boxes. To learn more review the diagram below.

RIC ONE ROC FUNCTIONS

2023-2024 (YEAR 1) FOCUS

STRATEGIC SOURCING

SOLICITATION AND SELECTION PROCESSES 1

DATA PROTECTION FUNCTIONS $ $

PURCHASE AND PAYMENT PROCESSES

NIST CSF ALIGNMENT

DUE DILIGENCE DATA PROTECTION PROCESSES

CONTRACTS MANAGEMENT

MASTER SERVICE AGREEMENTS (MSAs) 1

YEAR 1 FOCUS

Strategic Sourcing and Procurement involves leveraging policies and processes to obtain technology and IT services in compliance with state laws and best practice. In the future, for priority vendors, the RIC ONE ROC plans to perform due diligence efforts to identify cybersecurity risks. (NIST CSF 2.0 GV.SC-06 Alignment)

DATA PRIVACY AGREEMENTS (DPAs)

Contract Management involves negotiating terms that address legal and regulatory requirements. Additionally, other terms are negotiated to mitigate risk. The RIC One ROC works with data privacy partners, such as NYSED, A4L’s Student Data Privacy Consortium, and the TEC Student Data Privacy Alliance, to maintain a centralized and standardized structure that supports the negotiation, execution, and management of data privacy agreements. (NIST CSF 2.0 GV.SC-05 Alignment)

RISK MANAGEMENT

DATA PROTECTION RISK MANAGEMENT

PERFORMANCE RISK MANAGEMENT

VALUE RISK MANAGEMENT

Risk Management involves implementing processes to minimize risks associated with third-party products and vendors.

The RIC One ROC is developing processes to influence vendors’ cybersecurity postures, the quality of products and services, and vendors’ plans for existing and new solutions. (NIST CSF 2.0 GV.SC Alignment) 1 There are other consortium and collaboration structures that the BOCES and RICs leverage to support the areas that are out of scope.

OUT OF SCOPE For example, Erie 1 BOCES/ WNYRIC and Capital Region BOCES manage contract consortiums. Additionally, BOCES and RICs have local practices that support procurement and MSA needs. The new RIC One ROC processes complement these existing BOCES structures.

-3-

NEW YORK STATE REGIONAL INFORMATION CENTERS

RISK OPERATIONS CENTER (RIC ONE ROC) RISK OPERATIONS CENTER (RIC ONE ROC) PRODUCT SCOPE This diagram includes information about product segmentation. The 2023-2024 pilot product scope and 2024-2025 anticipated product scope is defined. The rest of the information mirrors the diagram on Page 3. The new RIC One ROC processes complement existing BOCES collaborative contracts consortiums. Together, these centralized, standardized, cost-effective, and sustainable vendor management processes support NYS educational agencies in efficiently and effectively addressing priority vendor responsibilities.

RIC ONE ROC PRODUCT SCOPE

RIC ONE ROC FUNCTIONS

SOLICITATION AND SELECTION PROCESSES 1

STRATEGIC SOURCING

$ $

PURCHASE AND PAYMENT PROCESSES

RIC ONE ROC PRODUCT SCOPE DUE DILIGENCE PROCESSES

Strategic Sourcing and Procurement involves leveraging policies and processes to obtain technology and IT services in compliance with state laws and best practice. In the future, for priority vendors, the RIC ONE ROC plans to perform due diligence efforts to identify cybersecurity risks. (NIST CSF 2.0 GV.SC-06 Alignment) ‣ 2023-2024 Scope ‣ 2024-2025 Scope

CONTRACTS MANAGEMENT

None New 7710 potential financial management systems and student management systems.

DATA PRIVACY AGREEMENTS (DPAs)

MASTER SERVICE AGREEMENTS (MSAs) 1

Contract Management involves negotiating terms that address legal and regulatory requirements. Additionally, other terms are negotiated to mitigate risk. The RIC One ROC works with data privacy partners, such as NYSED, A4L’s Student Data Privacy Consortium, and the TEC Student Data Privacy Alliance, to maintain a centralized and standardized structure that supports the negotiation, execution, and management of data privacy agreements. (NIST CSF 2.0 GV.SC-05 Alignment) ‣ 2023-2024 Scope ‣ 2024-2025 Scope

RISK MANAGEMENT

Products, and the related vendors, selected by NYS pilot educational agencies.

Products, and the related vendors, with access to students’ personally identifiable information.

NIST CSF ALIGNMENT

PRODUCT SCOPE DECISION-MAKING ‣ Product segmentation, categorization, and tiering strategies are used to assist agencies in allocating the right resources to the right products. ‣ The ROC uses these strategies to inform resource allocation. ‣ The scope of products addressed varies based on Function. ‣ Example segmentation, categorization, and tiering criteria are highlighted below.

PRODUCT SCOPE KEY CRITERIA USE LEVEL DATA SENSITIVITY

DATA PROTECTION RISK MANAGEMENT

PERFORMANCE RISK MANAGEMENT

VALUE RISK MANAGEMENT

PRODUCT CRITICALITY

Risk Management involves implementing processes to minimize risks associated with third-party products and vendors. The RIC One ROC is developing processes to influence vendors’ cybersecurity postures, the quality of products and services, and vendors’ plans for existing and new solutions. (NIST CSF 2.0 GV.SC Alignment)

SERVICE DEPENDENCY

Data Protection Risk Management SchoolTool ‣ 2023-2024 Scope 2024-2025 Scope Tiering-informed products from the 793 Appendix C Section 7710. ‣

SWITCH COSTS

Performance Risk Management 2023-2025 Scope Value Risk Management 2023-2025 Scope

OUT OF SCOPE

7710 products to be determined based on Directors’ decision-making.

None

DATA REPORTING

1 There are other consortium and collaboration structures that the BOCES and RICs leverage to support the areas that are out of scope. For

example, Capital Region BOCES and Erie 1 BOCES manage contract consortiums.

-4-

NEW YORK STATE REGIONAL INFORMATION CENTERS

RISK OPERATIONS CENTER (RIC ONE ROC) VENDOR MANAGEMENT RISK OPERATIONS CENTER (RIC ONE ROC) BENEFITS RIC ONE ROC EXPECTED BENEFITS

RIC ONE ROC FUNCTIONS

STRATEGIC SOURCING

PURPOSE MINIMIZE VENDOR-RELATED SECURITY DATA RISK During Strategic Sourcing (which involves vendor evaluation and selection processes), procedures are used to review vendors’ cybersecurity postures in order to inform decision-making regarding tool adoption.

DUE DILIGENCE DATA PROTECTION PROCESSES due diligence before RICs adopt a new product standard

CONTRACTS MANAGEMENT DATA PRIVACY AGREEMENTS (DPAs) a centralized, standardized, costeffective, and sustainable DPA structure

RISK MANAGEMENT DATA PROTECTION RISK MANAGEMENT

VALUE RISK MANAGEMENT

processes to manage vendor risks

DUE DILIGENCE RELATED TO NEW STUDENT AND FINANCIAL MANAGEMENT SYSTEMS

PURPOSE INCREASE DPA ACCESS, QUALITY, & STANDARDIZATION This Function includes processes to streamline DPA negotiation work.

Standardized language, a centralized negotiation team, and piggybacking functionality is used to support the execution of DPAs. School districts and BOCES can leverage the structure.

CENTRALIZED NEGOTIATION TEAM

STANDARD TERMS

PIGGYBACKING TERMS AND WORK FLOW

This function only addresses DPA needs. Educational Agencies will continue to negotiate or accept the standard terms defined in a Master Service Agreement.

DPAs THAT PROTECT STUDENT DATA FOR A BROAD SCOPE OF PRODUCTS

PRODUCTS ARE TIERED TO SUPPORT RESOURCE ALLOCATION Tiering drives resource allocation related to Risk Management. Data sensitivity, service criticality, service dependency, participation levels, and switch costs are examples of criteria that impact tiering.

TIER 1 VENDORS

TIER 2 VENDORS

TOP PRIORITY

PERFORMANCE RISK MANAGEMENT

Y1/Y2 PRODUCT SCOPE

PURPOSE

MEDIUM PRIORITY

TIER 3 VENDORS

LOW PRIORITY

MINIMIZE VENDOR-RELATED SECURITY DATA RISK

This Function includes processes that are used to influence vendors’ cybersecurity postures, the quality of products and services, and vendors’ plans for existing and new solutions.

DATA PROTECTION VENDORS’ CYBERSECURITY POSTURE PRODUCT PERFORMANCE QUALITY OF PRODUCTS PRODUCT VALUE VENDORS’ PRODUCT ROADMAPS

-5-

MONITORING AND MANAGING PRIORITY RIC-SUPPORTED PRODUCTS

NEW YORK STATE REGIONAL INFORMATION CENTERS

RISK OPERATIONS CENTER (RIC ONE ROC) RISK OPERATIONS CENTER (RIC ONE ROC) DPA STRUCTURE OVERVIEW RIC ONE ROC DATA PRIVACY AGREEMENTS (DPAs) FUNCTION The RIC One ROC manages centralized, standardized, cost-effective, and sustainable processes to minimize vendor risk. One of the primary RIC One ROC roles is to streamline processes associated with contractual needs related to the protection of student data. In partnership with NYSED, the RICs are working with multi-state and national data privacy and security alliances invested in the K-12 vendor ecosystem to support the negotiation of data privacy agreements (DPAs). This page provides details about the RIC One ROC’s function that supports the execution of Data Privacy Agreements.

PARTNERS CENTRALIZING, STANDARDIZING, AND STREAMLINING DPA PROCESSES At the national level, NYSED maintains an Access 4 Learning (A4L) Community membership. A4L manages an alliance that focuses on initiatives to support student privacy called the Student Data Privacy Consortium (SDPC). Through NYSED’s membership, NYSED, school districts, and BOCES are able to leverage A4L SDPC’s National Data Privacy Agreement (NDPA). At the multi-state level, the RICs maintain a TEC Student Data Privacy Alliance (TEC SDPA) membership. Through this membership, districts and BOCES can piggyback on existing agreements and request new agreements that leverage the NDPA. TEC and the ROC work together to support the negotiation of NYS terms.

NATIONAL ALLIANCE

MULTI-STATE ALLIANCE

A4L STUDENT DATA PRIVACY CONSORTIUM (SDPC)

TEC STUDENT DATA PRIVACY ALLIANCE (SDPA)

STANDARD NATIONAL TERMS

NEW YORK STATE ALLIANCE

DATA PRIVACY AND SECURITY OFFICE

RIC ONE ROC AND RIC ONE REGIONAL DPA TEAMS

STANDARDIZED NYS TERMS, A NEGOTIATION TEAM, AND PIGGYBACKING LANGUAGE

STATES WORKING TOGETHER TO PROTECT DATA USING STANDARDIZED LANGUAGE AND COMMON PROCEDURES

PROCESS FOR A NYS LEA TO PIGGYBACK ON AN EXISTING DPA OR INITIATE A NEW AGREEMENT The RIC ROC DPA management structure and a strategic field implementation plan was developed to support the state in leveraging the NDPA in a responsible manner. To complement the standard national terms, state-specific terms were developed by NYSED leaders/ attorneys, TEC attorneys, BOCES attorneys, RIC cybersecurity specialists, and RIC leaders. Contract managers and attorneys support the negotiation of DPAs using this common language. Once an educational agency executes an agreement negotiated by the centralized team, other agencies can piggyback on that DPA. In addition to supporting the efficient execution of DPAs, this new structure is used to support school districts, BOCES, RICs, and NYSED in holding vendors accountable, as common terms are negotiated into these agreements. This will be particularly valuable as NYSED and BOCES/RICs engage with vendors regarding breaches and security vulnerabilities. It is important to note that the approach will not address all field challenges. There are vendors unwilling to agree to the required terms. The diagram below illustrates the processes local educational agencies (LEAs) can use to access these DPAs. The top option is the process for piggybacking. Below the piggybacking option is the process to follow if there isn’t an existing agreement in place.

LOCATE AN EXISTING DPA

PIGGYBACK ON AN EXISTING DPA

REVIEW SUPPLEMENTAL INFORMATION

REQUEST A DPA

FOLLOWING NEGOTIATIONS, SIGN A DPA

REVIEW SUPPLEMENTAL INFORMATION

Piggyback on a Agreement Using the Exhibit E A4L SDPC Registry Functionality.

Or, Sign an Originating LEA DPA.

Enter MSA duration information and review the posted Ed Law 2-d Supplemental Information.

Search for an Existing Alliance DPA (TEC Negotiated Agreement with NYS Terms). As Necessary, Submit a New DPA Request.

1 This process only addresses DPA needs. Educational Agencies also need to negotiate or accept the standard terms defined in a Master Service Agreement.

-6-

NEW YORK STATE REGIONAL INFORMATION CENTERS

RISK OPERATIONS CENTER (RIC ONE ROC) RISK OPERATIONS CENTER (RIC ONE ROC) DATA PROTECTION MONITORING OVERVIEW RIC ONE ROC DATA PROTECTION RISK MANAGEMENT FUNCTION The RIC One ROC is implementing centralized, standardized, cost-effective, and sustainable processes to manage vendor risk.

One of the primary RIC One ROC roles will be to monitor and influence vendors’ data security controls. This will be done through functions that assist the centers in understanding, prioritizing, responding to, and monitoring risks over the course of the relationship. Vendor tiering will be used to prioritize products that are managed through these structures. Please be aware that this function is not yet developed and the high-level vision and plan documented on this page is expected to be refined.

RIC ONE ROC TIERING LEVELS AND CRITERIA USED TO SUPPORT PRODUCT PRIORITIZATION Tiering drives resource allocation related to Risk Management. Tiering levels and criteria are illustrated below.

TIERING LEVELS

TIERING CRITERIA

TIER 1 VENDORS TOP PRIORITY

USE LEVEL

SERVICE DEPENDENCY

TIER 2 VENDORS MEDIUM PRIORITY

DATA SENSITIVITY

SWITCH COSTS

TIER 3 VENDORS LOW PRIORITY

PRODUCT CRITICALITY

DATA REPORTING

HIGH USE BY NYS ED AGENCIES

PROTECTED OR SENSITIVE DATA

SERVICE DISRUPTION IMPACT

NO OR FEW VIABLE ALTERNATIVES

HIGH MIGRATION RESOURCE NEEDS

USED TO SUPPORT NYSED REPORTING

RIC ONE ROC PROCESSES TO MONITOR AND INFLUENCE VENDORS' DATA SECURITY CONTROLS The ROC will engage with vendors to support proactive planning regarding critical data security controls and to verify vendors are complying with priority contractual obligations.

RIC ONE ROC PERFORMS VENDOR OUTREACH BASED ON TIERING

RIC ONE ROC REVIEWS AND ASSESSES INFORMATION GATHERED

RIC ONE ROC USES ONGOING BREACH MONITORING SERVICES & STRUCTURES

NIST CSF 2.0 ALIGNMENT These RIC One Data Protection Risk Management Processes align with the NIST CSF 1.1 and 2.0 Supply Chain Category.

Currently, NIST CSF 1.1 is the Standard for Data Privacy and Security for NYS Education Agencies. Below are example controls aligned with this RIC One ROC function from the 2.0 framework.

CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT GV.SC CYBERSECURITY SUPPLY CHAIN RISK MANAGEMENT PROGRAM, STRATEGY, OBJECTIVES, POLICIES, AND PROCESSES GV.SC-01 AARE ESTABLISHED AND AGREED TO BY ORGANIZATIONAL STAKEHOLDERS GV.SC-04 SUPPLIERS ARE KNOWN AND PRIORITIZED BY CRITICALITY GV.SC-07

THE RISKS POSED BY A SUPPLIER, THEIR PRODUCTS AND SERVICES, AND OTHER THIRD PARTIES ARE UNDERSTOOD, RECORDED, PRIORITIZED, ASSESSED, RESPONDED TO, AND MONITORED OVER THE COURSE OF THE RELATIONSHIP

-7-

NEW YORK STATE REGIONAL INFORMATION CENTERS

RISK OPERATIONS CENTER (RIC ONE ROC) 2023-2024 RIC ONE ROC TEAM RIC DIRECTORS Chantal Corbin Central New York RIC ccorbin@cnyric.org

Mike Doughty Northeastern RIC michael.doughty@neric.org

Tom Guillon South Central RIC tguillon@btboces.org

Heather Mahoney Mohawk RIC hmahoney@moric.org

DATA PRIVACY AND SECURITY FIELD SUPPORT Brittany Rizzo Mohawk RIC brizzo@moric.org

Ashleen Speen South Central RIC aspeen@btboces.org

Monica Statile Northeastern RIC monica.statile@neric.org

Ryan Mahoney Mohawk RIC rmahoney@moric.org

Phil Sage South Central RIC psage@btboces.org

Chris Grieco Mohawk RIC cgrieco@moric.org

Kelly Twitchell South Central RIC ktwitche@btboces.org

Kristine Kipers Mohawk RIC kkipers@moboces.org

KellyRose Yaeger Northeastern RIC kellyrose.yaeger@neric.org

CYBERSECURITY SPECIALISTS Don Harple Northeastern RIC don.harple@neric.org APPLICATIONS SPECIALISTS Lori DeForest Central New York RIC ldeforest@cnyric.org PROJECT COMPLIANCE AND GUIDANCE Joe Bufano Central New York RIC jbufano@ocmboces.org PROJECT MANAGEMENT

2023-2024 ROC CONTRIBUTORS David Pellow Mohawk RIC dpellow@moboces.org

Chrissy Choi South Central RIC cchoi@btboces.org

Kathleen Moorhead ROC Consultant patonconsultingllc@gmail.com

RIC ONE ROC PILOT PARTNER RIC ONE AND BOCES/RIC COLLABORATIVES Directors of the Regional Information Centers

Regional Implementation Teams for the DPAs Structures

BOCES Contracts Consortiums

RIC One Communications Collaborative

RIC ONE ROC PARTNER AGENCIES, ALLIANCES, AND CONSORTIUMS NYS EDUCATION DEPARTMENT

DATA PRIVACY AND SECURITY OFFICE Louise DeCandia Joseph Krummel Senior Chief Privacy Attorney Officer

NATIONAL CONSORTIUM

MULTI-STATE ALLIANCE

Steve Smith Interim A4L Leadership

Ramah Hawley Felicia Vasudevan TEC SDPA Attorney Murphy, Hesse, Director

A4L STUDENT DATA PRIVACY CONSORTIUM

-8-

Lisa Waters SDPC Registry Programmer

TEC STUDENT DATA PRIVACY ALLIANCE

Toomey & Lehane, LLP.