Third-Party Vendor Access Solution

Information Security
Security Operations and Services
Third-Party Vendor Access Solution

Third-Party Vendor Access Solution

Managing Third-Party SDSU Vendor Accounts

Third parties who access CSU information assets must be required to adhere to appropriate CSU and campus information security policies and standards. The CSU Information Security policy (ICSUAM 8040.00) provides direction and support for managing third party relationships and guidance for granting access to third parties.

As of October 31, 2020, SecureLink was decommissioned. To request third-party vendor access or make changes to existing vendor account access, please see below for further instructions.

New Vendor and New Firewall Requests		If a request is made for a new vendor account and vendor group, the SDSU Sponsor will create a ServiceNow ticket and provide the following information: SDSU Sponsor Name SDSU Sponsor Department New Vendor Representative: First Name, Last Name, Email Address, Phone, and Company, Access End Date of Vendor Account Firewall Requests: IP addresses, Port Numbers
Changes to Existing Vendor Representative Accounts and Vendor Groups		If a request is made for updates to existing vendor representatives, the SDSU Sponsor will create a ServiceNow ticket and provide the following information: SDSU Sponsor Name SDSU Sponsor Department Description of Changes Requested Existing Vendor Representative(s) to be deleted or New Vendor Representative to be added (provide first name, last name, email address, phone, and company, access end date of vendor account)
Changes to Firewall Rules to Existing Vendor Groups		If a request is made for updates to existing firewall rules, the SDSU Sponsor will create a ServiceNow ticket and provide the following information: SDSU Sponsor Name SDSU Sponsor Department Description of Changes Requested Existing firewall rules to be deleted or New firewall rules to add (provide IP addresses and ports)

Requesting Vendor Access

Vendor Access Solutions	Submit a ServiceNow ticket. Access should only be activated on an as-needed basis and disabled when not in use.

Information Security