Risk assessments look at three areas:

• Data security, which looks at the controls that are implemented to keep the data secure
• Data privacy and compliance, which looks at what data is collected and how that data is used, stored and deleted
• Contracts, which define and govern the rules around data handling practices

The University has obligations when we collect, use and store sensitive data. Some of these obligations come from internal policies, and others come from external policies and legislation like the Freedom of Information and Protection of Privacy Act (FIPPA), which is provincial legislation that the University must comply with.

Lack of details surrounding data handling practices may lead to sensitive information being exposed, manipulated or used for malicious purposes. If U of T were to expose sensitive data, there would be impacts for the University and the department(s) that allowed the exposure. Impacts would depend on the sensitivity and volume of the data exposed.

The University must be compliant with FIPPA legislation and the data that FIPPA protects. Noncompliance would have impacts, which could include financial penalties.

Examples of data and documentation needed for data security controls to be examined include, but are not limited to the following:

• Certifications, such as PCI certification for handling financial and payment-based information or an ISO-27001 certification for information management systems
• Documentation that details how security controls are applied, such as a Higher Education Community Vendor Assessment Toolkit (HECVAT) or Consensus Assessments Initiative Questionnaire (CAIQ)
• Audit reports, such as SOC2 type 2 reports that verify that controls are in place and are working as intended
• Vulnerability scan and penetration test reports

Risk assessments should be conducted in the following cases:

• When new applications, systems, platforms or hardware (solutions) are procured or implemented
• When significant change to functionality takes place within an already assessed solution. This is dependent on the solution, but examples are:
  • New plugins for a WordPress site
  • Integrations to existing environments
• When the data collection, usage or storage is changed
• On a routine basis – depending on the type of solution, new assessments should be done periodically to ensure that controls are still in place
  • Every two or three years can be used as a rough timeline, assuming there are no changes to functionality or data collection/usage

Note that updated security documentation from vendor-managed systems should be requested and reviewed annually.

Assessments are meant to be confidential (level 3 data) because they may deal with confidential information and vulnerabilities/weaknesses in solutions that contain sensitive data. Access to assessments should be restricted to those who need to know, such as stakeholders.

Assessments are the property of both the requesting department and Information Security. They are sometimes shared by other University departments on an as-needed basis. Assessments with issues that cross risk thresholds may be escalated within Information Security. Senior management, including the chief information security officer, may be alerted as needed.

Usually, each risk assessment takes anywhere between six to eight weeks (about two months) after providing all documents.

The turnaround time is not time specific and changes depending on current workload.

Assessments take time. Bigger and more complicated solutions will require more time to complete and document.

Typically, when the assessment is complete, a finalized assessment document will be emailed to the requester and the tracking ticket will be closed.

We use a risk matrix that consists of likelihood (the chance that an event will occur) and impact (what happens when that event does occur). Each potential issue is measured by these two factors and rated on a scale. Higher level risks are prioritized for resolution.

For more details, review the risk matrix in the risk register template.

The unit/requestor for the risk assessment is responsible for mitigating the identified risks. If any risk is left untreated, the risk should be continuously tracked and monitored in the unit’s risk register.

Divisions, departments or groups may have their own staff who can assess risks and implement measures to reduce exposure. If internal resources are not available, the Information Security team is available to help.