Kean University SOP 06 – Contract Review & Security Requirements
Table of Contents
- About
- Scope
- Definitions
- Roles & Responsibilities
- Procedure
- Escalation & Approval
- Records & Retention
- Metrics & KPIs
- Related Policies
About
This Standard Operating Procedure (SOP) defines the required process for reviewing supplier contracts to ensure cybersecurity, data protection, accessibility, privacy, and compliance requirements are included before contract execution or renewal.
This SOP operationalizes requirements from the Procurement Policy and Supplier Risk Management Policy to ensure enforceable contractual controls are in place.
Scope
This SOP applies to all contracts, agreements, statements of work, licenses, or terms that:
- Involve information technology systems, software, or cloud services
- Grant access to University data, systems, or networks
- Create operational, compliance, or regulatory obligations
- Introduce cybersecurity, privacy, or accessibility risk
- Are funded by University, grant, or sponsored funds
This SOP applies to new contracts, renewals, amendments, and extensions.
Definitions
- Contract Review: Structured evaluation of contractual terms.
- Security Requirements: Mandatory cybersecurity and data‑protection clauses.
- Accessibility Requirements: Clauses enforcing WCAG 2.1 Level AA compliance.
- Right to Audit: Contractual authority to verify vendor controls.
- Data Protection Requirements: Obligations for encryption, retention, and destruction.
Roles & Responsibilities
View roles
- Procurement Lead: Coordinates contract review and ensures required clauses are included.
- IT Security: Reviews cybersecurity and data‑protection language.
- Risk Manager: Confirms contract alignment with supplier risk assessment.
- Accessibility Reviewer: Validates accessibility‑related clauses.
- Legal Counsel: Reviews enforceability, liability, and regulatory compliance.
- Chief Information Security Officer (CISO): Approves High and Critical‑risk contracts.
Procedure
1. Contract Intake
Procurement receives the draft contract and verifies supplier identity, scope alignment, and inclusion of all attachments.
2. Identify Required Clauses
Procurement determines applicable clauses, including cybersecurity, accessibility, data protection, breach notification, audit rights, and retention requirements.
3. Security & Privacy Review
IT Security reviews technical and cybersecurity provisions, including encryption, authentication, logging, and incident notification timelines.
4. Accessibility Review
Accessibility requirements are validated based on VPAT / Accessibility Conformance Report findings, including remediation timelines where gaps exist.
5. Risk Alignment & Legal Review
Risk Manager confirms contract terms align with assessed risk tier. Legal Counsel reviews enforceability, liability, and regulatory compliance.
6. Finalization
Procurement consolidates approved revisions, coordinates vendor acceptance, and ensures execution by authorized University signatories only.
Escalation & Approval
- Low / Medium Risk: Procurement and Risk approval
- High / Critical Risk: CISO approval required
- Additional conditions or compensating controls may be imposed
Records & Retention
Executed contracts, security reviews, accessibility findings, and approval records must be retained in approved repositories for a minimum of seven (7) years.
Metrics & KPIs
- Percentage of contracts containing required security clauses
- Average contract review cycle time
- Number of High‑risk contracts escalated to the CISO
- Contracts missing accessibility documentation
Related Policies
- KU SRM 01 – Supplier Risk Management Policy
- KU SRM 02 – Procurement Policy
- KU SEC 05 – Exception Management Policy
- KU SEC 10 – Policy Precedence & Governance
- KU IT 01 – Asset Management Policy
``