Risk Management

Services relating to Information Security related policy exceptions, risk assessments, etc.

Services (2)

Vendor SPSA Requirement Determination

When Northwestern University engages a third-party service provider, the Information Security Office (ISO) is tasked with evaluating the service provider’s information security controls by conducting a Service Provider Security Assessment (SPSA).

Information Security Policy Exception Requests

The Information Security Policy Exception form for requesting an exception to a related Policy or Standard.