Utah Admin. Code R277-487-7 - Application to Third Parties
(1) A
third-party contractor shall protect student personally identifiable
information against unauthorized access and redisclosure, both physical and
digital.
(2) A third-party
contractor shall have policies in place that follow reasonably industry best
practices and adequately address the protection of student personally
identifiable information.
(3) A
third-party contractor shall develop and document an information security
program.
(4) A third-party contract
shall inform an LEA or the Superintendent of the precautions taken regarding
the maintenance and protection of student personally identifiable
information.
(5) For the purposes
of meeting the audit requirements of a contract subject to Subsection
53E-9-309(2)(e),
a third-party contractor may:
(a) provide an
LEA or the Superintendent a self-assessment of their compliance with the
contract and the effectiveness of the information security program described in
Subsection (3);
(b) provide
responses to a questionnaire provided by the LEA or Superintendent;
(c) provide a report of an
industry-recognized privacy and security audit, such as an SOC2 or SOC3;
or
(d) submit to an onsite audit,
if agreed upon by the third-party contract and the LEA or
Superintendent.
Notes
State regulations are updated quarterly; we currently have two versions available. Below is a comparison between our most recent version and the prior quarterly release. More comparison features will be added as we have more versions to compare.
No prior version found.