Risks and Considerations of Cloud Services
APPROVED SERVICES
This table indicates which data categories (Published, Controlled, and Confidential) are allowed on a selection of common IT services.
Published Data -----> Generally Low Risk
Controlled Data -----> Generally Presents a Moderate Risk
Confidential Data -----> Can be High to Very High Risk Depending on the Type of Data and the Compliance Framework it Falls Under
For more information on data classification, please see UT's Data Classification Standard.
The cloud services below have color coded checkboxes below to help you know which types of university data is authorized to be used.
| Cloud Services |
Published
|
Controlled
|
Confidential
|
HIPAA1 |
FERPA
|
SSNs
|
PCI2 |
ITAR6 |
IRB
|
|---|---|---|---|---|---|---|---|---|---|
Cloud Collaboration Services |
|||||||||
Slack (slack.com)3 |
|||||||||
Microsoft 365 Platform (e.g, OneDrive, Sharepoint, Teams, Forms)4 |
|||||||||
Zoom |
|||||||||
Cloud Document Services |
|||||||||
Apple iCloud (icloud.com)5 |
|||||||||
Docusign (docusign.utexas.edu) |
|||||||||
Smartsheet |
|||||||||
Cloud Email Services |
|||||||||
Apple iCloud (icloud.com)5 |
|||||||||
Email: UT Outlook 365 4 |
|||||||||
Cloud Infrastructure Services (IaaS) |
|||||||||
Cloud Infrastructure: Amazon (AWS)9 |
|||||||||
Cloud Infrastructure: Google GCP9 |
|||||||||
Cloud Storage Services |
|||||||||
Apple iCloud (icloud.com)5 |
|||||||||
DropBox (www.dropbox.com)5 |
|||||||||
Microsoft 365 Platform (e.g, OneDrive, Sharepoint, Teams, Forms)4 |
|||||||||
Cloud Survey Services |
|||||||||
Microsoft 365 Platform (e.g, OneDrive, Sharepoint, Teams, Forms) 4 |
|||||||||
Cloud Web Hosting Services |
|||||||||
Content Management: UT Drupal Kit - Managed, Pantheon Web Hosting (Drupal, WordPress, etc.) |
|||||||||
Cloud Workflow Platforms |
|||||||||
Salesforce |
|||||||||
AI Services |
|||||||||
OpenAI ChatGPT (free)7 |
|||||||||
OpenAI ChatGPT Teams7 |
|||||||||
OpenAI ChatGPT Enterprise7 |
|||||||||
Microsoft Copilot (free)7 |
|||||||||
Microsoft Copilot for M365 (paid)7 |
|||||||||
Microsoft Azure OpenAI API7 |
|||||||||
Google Gemini7 |
|||||||||
Notes on Cloud Services |
|||||||||
|
1 HIPAA data has special regulatory requirements; read this for more info. |
|||||||||
|
2 Payment Card Industry (PCI) data has special regulatory requirements; read this for more info. |
|||||||||
|
3 No enterprise contract currently; each department must go through the Contracts Office for their own contract with a FERPA agreement. |
|||||||||
|
4 Authorized usage is limited to Microsoft services provided under the ITS-managed vendor contract to remain compliant. Any use of the standard consumer-grade offerings of these products is not approved. Emailing FERPA protected information via O365 is not acceptable and such correspondence should be limited to Canvas or other university approved services to ensure compliance with https://provost.utexas.edu/the-office/academic-affairs/canvas-adoption-policy/. HIPAA protected information may only be emailed via O365 if the data is encrypted in transit and only decrypted by the intended recipient. |
|||||||||
|
5 As there is no university contract in place for this vendor, no usage involving protected or restricted university data |
|||||||||
|
6 It may be possible to store ITAR protected data if properly encrypted prior to being uploaded, but faculty should |
|||||||||
|
7 AI products must have an active university contract in place and have a vendor security assessment completed to be considered compliant with state requirements if confidential university data is to be involved. Please see the Acceptable Use of AI Tools for more details. For ChatGPT-specific services, approved usage only applies to the dedicated UT instances of ChatGPT Enterprise covered by UT Austin contracts. For the Microsoft-specific services, approved usage only applies to the dedicated UT instances covered by UT System contracts. If you aren't sure if your use case is covered please contact ISO (security@utexas.edu). For information on obtaining Microsoft CoPilot for M365 licenses, please email: microsoft365@utexas.edu. |
|||||||||
|
8 Authorized storage of FERPA protected data is limited to the Google Drive service of the UTmail offering. Emailing FERPA protected information via UTmail is not acceptable and such correspondence should be limited to Canvas or other university approved services to ensure compliance with https://provost.utexas.edu/the-office/academic-affairs/canvas-adoption-policy/. |
|||||||||
|
9 Authorized usage of Google GCP or AWS is limited to services provided under the ITS-managed vendor contract to remain compliant. Any use of the standard consumer-grade offerings of these products is not approved. Also, depending on the associated university data for certain cloud infrastructure it may be necessary to implement additional security monitoring. Please consult with the Information Security Officer to determine if monitoring is needed and to understand how we can assist you. |
|||||||||
|
10 Canvas Conversations/Inbox are not approved for FERPA protected communications since copies of the message are forwarded to email addresses that are often not in a protected university service and thereby not encrypted. |
|||||||||
Local Services
For comparison purposes, select services run by ITS and offered to campus are listed below with the types of data that are approved for use with each. Use of locally hosted services is encouraged over cloud services when possible. This table is not intended to be a comprehensive list of all ITS offered services.
| Local Services Matrix |
Published
|
Controlled
|
Confidential
|
HIPAA1 |
FERPA
|
SSNs
|
PCI2 |
ITAR
|
IRB
|
|---|---|---|---|---|---|---|---|---|---|
| 3 | |||||||||
File Storage: Austin Disk |
3 | ||||||||
UT Backup (e.g., Code42/Crashplan) - see above - The cloud option is the only available option. |
|||||||||
Virtual Servers (UT VMG) |
3 | ||||||||
REDCap (instance maintained by VP Research) |
|||||||||
REDCap (instance maintained by Dell Medical School) |
|||||||||
On Premise GitHub |
3 | ||||||||
Notes on Local Services |
|||||||||
|
1 HIPAA data has special regulatory requirements; read this for more info. |
|||||||||
|
2 Payment Card Industry (PCI) data has special regulatory requirements; read this for more info. |
|||||||||
|
3 It may be possible to store ITAR protected data if properly encrypted prior to being uploaded, but faculty should |
|||||||||
Departments evaluating the purchase and/or use of a cloud service not covered on this page with any Confidential university data must request a security review of that service by sending a written description of the proposed implementation to the Information Security Office. During service selection, departments should inform vendors that security testing (either performed by the Information Security Office or a qualified third party to the vendor) is mandatory for the university purchasing process.
If, for any purpose, a non-approved cloud service is used with any Confidential university data, an Exception Process must be initiated that includes reporting the non-compliance to the Information Security Office, along with a plan for risk assessment and management. (See Security Exception Report) Non-compliance with these standards may result in revocation of system or network access, notification of supervisors, and reporting to the Office of Internal Audit.
University of Texas at Austin employees are required to comply with institutional rules and regulations, applicable UT System rules and regulations, state laws and regulations, and federal laws and regulations.
The policies and practices listed here inform the system hardening procedures described in this document and with which you should be familiar. (This is not an all-inclusive list of policies and procedures that affect information technology resources.)