Risk Management and Compliance (RMC)

1. The first step in determining whether a risk assessment is needed is to identify the data classification. Guidelines are as follows:
   • Understand the level of risk associated with the data (level of sensitivity, value, and criticality) by referencing policies UWSA 1031 and UW-504.
   • Institutional data classification is determined by Data Stewards.
   • The Office of Compliance – HIPAA Privacy office determines the presence of PHI.
   • Research data is classified by the researcher as outlined in the Data Stewardship, Access and Retention Policy UW-4032.
2. Public and Internal data generally do not need a risk assessment.
3. When using Sensitive or Restricted information (SSN, PHI, FERPA, CUI etc.) AND
   • Before implementing new technologies (e.g., Public Cloud, Secure Storage) 
   • When onboarding new vendors         
   • When a significant change occurs (See “Assistance defining significant change”) 
   • As part of periodic routine reassessment 
4. To meet regulatory requirements (e.g., HIPAA, CMMC, NSPM-33, Select Agent)
5. To comply with UW Policy or other industry frameworks 
6. After a security incident or breach 
7. When collecting credit card information (PCI DSS)

If you are unsure whether a risk assessment is needed, submit an intake form in OneTrust for review. 

The Risk Management & Compliance (RMC) Team would suggest you follow these best practices for data security: RMC – Security Implementation Best Practices (CIS-Based Guidelines)

• Providing supporting materials upfront, including SOC 2, CAIQ, HECVAT, and relevant architectural or data flow diagrams, as part of your risk assessment request, can greatly expedite the review.
• Other examples of helpful supporting materials may include: privacy documentation, AI security documentation, vulnerability assessments, penetration test results, etc.
• Is the service provider willing to sign a contractual agreement to share responsibilities to protect University data (e.g., BAA, DUA, SLA)?
• The risk assessment process requires input from your team to reach completion. Lack of documentation or vendor responsiveness can lead to delays and a potential increase in overall assessed risk.

• Complete the OneTrust intake form.
• If you have questions, please contact rmc-cybersecurity@cio.wisc.edu.

Security and regulatory frameworks are leveraged when assessing risk. They include, but are not limited to:

• National Institute of Standards and Technology (NIST)
• Center for Internet Security (CIS)
• Open Web Application Security Project (OWASP) Top 10 / Top 10 for Large Language Model (LLM)
• Payment Card Industry Data Security Standard (PCI DSS)
• Health Insurance Portability and Accountability Act (HIPAA / Office of Compliance)
• Cloud Security Alliance (CSA) – Consensus Assessments Initiative Questionnaire (CAIQ)
• Tailored security controls relevant to the specific service or compliance requirements (e.g., CMMC, NSPM-33, GDPR)

• Data Classification – related policies: UW-504, UWSA-1031
• Regulatory requirements (FERPA, HIPAA, NSPM-33, etc.)
• Privacy concerns, consent, and data disclosure and transparency
• Business criticality and impact
• Scope of data
• Stakeholder expectations
• Volume of data records
• Phase of the project

• Office of Cybersecurity – Leads the effort
• Campus Partner (Faculty, Staff, Local-IT) – Support/Collaborate
• Privacy and Security Coordinators/Officers (HIPAA) – Support/Collaborate – Clarify the classification of Protected Health Information (PHI) and advise on privacy considerations
• Data, Academic Planning & Institutional Research (DAPIR) – Clarify the classification of non-PHI data
• Office of Legal Affairs (OLA) – Additional privacy evaluations and review of non-disclosure agreements (NDAs)
• Risk Executive or Delegate – Informed/Signatory

• 1-3 months depending on the complexity and scope of the assessment, response time of the vendor, and the resources available from your team.
• High demand for risk assessment work may delay the start of your project. These estimates apply once your risk assessment has been assigned to a risk analyst.

• Formal documentation will be developed to capture the overall risk, which may include a Risk Report, Memo, Addendum, email, or other official artifacts.
• Official documentation is distributed to key stakeholders, including the Risk Assessment Team, Cybersecurity Leadership, the HIPAA Security and Privacy Officer (HIPAA), and the designated Risk Executive.
• The overall risk rating determines whether the formal documentation is shared for informational purposes or submitted for signature:
  • Inconsequential to Moderate – Email Risk Executive for informational purposes; signature not necessary.
  • Moderate-High to Critical – Schedule a formal Risk Executive Meeting (optional); signature through DocuSign is required by the Risk Executive.

• The Requestor is responsible for acknowledging identified risks, which are tracked in the OneTrust Risk Register, and taking proactive steps toward their resolution.
• Risk Owners are responsible for managing their assigned OneTrust risks and ensuring they remain current, enabling accurate and timely reporting to Risk Executives.

Risk Assessment Process is described below on the RMC webpage