3. Framing the SaaS Environment
Eric D’Souza – HUIT PMO
Panelists
Peter Katz – Office of the General Counsel
Rick Kellan – Risk Management and Audit Services
Sandy Silk – IT Security
Chris Gambon – Strategic Procurement
Ellen Gulachenski – HUIT PMO / Vendor Management Office
3
4. The Business Case
I am an administrator
I have a specific business need
I found a small SaaS-based application, and I have a click-through
agreement in front of me on my screen.
Should I click “agree?”
4
5. Legal Questions
1) Am I authorized to sign or click through an online license agreement on
behalf of the University?
2) How important is the service I am acquiring? Should I be signing a
boilerplate license for an important service?
3) Is there an existing negotiated University contract for the service?
5
6. Risk Management Questions
4) What type of data is it? Is it Level 3 or above?
5) Do we need to control vendor access to or use of the data?
6) Can Harvard recover the data if we exit the agreement or if the vendor goes
out of business?
6
7. 7) What is the potential harm if data gets corrupted, deleted, or exposed?
8) Who is going to manage access to the system and remove access when
people leave?
9) If I leave, can Harvard still use the service and the data?
IT Security Questions
7
8. Vendor Performance Questions
10) Is the service defined concretely enough in the click-through agreement
(e.g., customer support)?
11) What aspects of the service will be used to measure quality
(e.g., availability)?
12) What recourse do you have if there is an issue with delivery or quality?
8
9. Vendor Management Life Cycle
Vendor
Management
Life Cycle
Service Sourcing Strategy
1. Define Service Sourcing Strategy and
align to organizational strategy
Procurement
2. Vendor evaluation and selection
3. Contract negotiations
Vendor Performance Management
4. Contract management & administration
5. Vendor relationship management
6. Risk management (financial, operational and compliance)
7. Service, license, and deployment management
10. Key Questions - Summary
1) Am I authorized to sign or click through an online license agreement on behalf of the University?
2) How important is the service I am acquiring? Should I be signing a boilerplate license for an
important service?
3) Is there an existing negotiated University contract for the service?
4) What type of data is it? Is it level 3 or above?
5) Do we need to control vendor access to or use of the data?
6) Can Harvard recover the data, either if we exit the agreement or if the vendor goes out of
business?
7) What is the potential harm if data gets corrupted, deleted, or exposed?
8) Who is going to manage access to the system and remove access when people leave?
9) If I leave, can Harvard still use the service and the data?
10) Is the service defined concretely enough in the click-through agreement?
11) What aspects of the service will be used to measure quality?
12) What recourse do you have if there is an issue with delivery or quality?
10
11. The Business Case - Revisited
Should I click “agree?”
Has the discussion today impacted the way you will approach
answering this question?
11
12. Helpful Resources
General IT Questions or Assistance: ithelp@harvard.edu
Vendor Security Risk Assessment Requests: itsec-ec@harvard.edu
General Security Guidance: http://security.harvard.edu
Sourcing or Contract Questions christopher_gambon@harvard.edu
HUIT VMO Questions or Contact: huitvm@harvard.edu
Cloud Service Providers: http://rmas.fad.harvard.edu/cloud-service-providers
Harvard Cloud and DevOps: http://cloud.huit.harvard.edu/
Cloud Connect Event – Fri., Feb. 19: cloud.huit.harvard.edu/event/cloud-connect
12
