Loading...

Risks and Considerations of Cloud Services

Approved Services

This table indicates which data categories are allowed on a selection of common IT services.

Cloud Collaboration Services
Published
Controlled
Confidential
HIPAA1
FERPA
SSNs
PCI2
ITAR
IRB
Cisco Spark/Webex Teams $Approved for Public Data $Approved for Controlled Data $Approved for Confidential Data $Approved for Confidential Data       $Approved for Confidential Data
Instant Messaging: Skype for Business $Approved for Public Data $Approved for Controlled Data $Approved for Confidential Data $Approved for Confidential Data       $Approved for Confidential Data
Slack3 (slack.com) $Approved for Public Data $Approved for Controlled Data   $Approved for Confidential Data        
Teams $Approved for Public Data $Approved for Controlled Data $Approved for Confidential Data $Approved for Confidential Data       $Approved for Confidential Data
Zoom $Approved for Public Data $Approved for Controlled Data   $Approved for Confidential Data        
Spacer
Cloud Document Services
Apple iCloud $Approved for Public Data                
Google Docs for Education (utmail.utexas.edu) $Approved for Public Data $Approved for Controlled Data   $Approved for Confidential Data        
Docusign (docusign.utexas.edu) $Approved for Public Data $Approved for Controlled Data $Approved for Confidential Data $Approved for Confidential Data $Approved for Confidential Data     $Approved for Confidential Data
Smartsheet $Approved for Public Data $Approved for Controlled Data   $Approved for Confidential Data        
Spacer
Cloud Email Services
Apple iCloud $Approved for Public Data                
Email: UTmail $Approved for Public Data $Approved for Controlled Data   $Approved for Confidential Data        
Email: UT Office365 $Approved for Public Data $Approved for Controlled Data $Approved for Confidential Data $Approved for Confidential Data        
Spacer
Cloud Infrastructure Services (IaaS)
Cloud Infrastructure: Amazon (AWS)4, MS Azure4 $Approved for Public Data $Approved for Controlled Data $Approved for Confidential Data $Approved for Confidential Data $Approved for Confidential Data $Approved for Confidential Data   $Approved for Confidential Data
Spacer
Cloud Storage Services
Apple iCloud $Approved for Public Data                
Box (utexas.box.com) $Approved for Public Data $Approved for Controlled Data $Approved for Confidential Data $Approved for Confidential Data $Approved for Confidential Data $Approved for Confidential Data $Approved for Confidential Data $Approved for Confidential Data $Approved for Confidential Data
DropBox5 (www.dropbox.com) $Approved for Public Data                
Google Drive for Education (utmail.utexas.edu) $Approved for Public Data $Approved for Controlled Data   $Approved for Confidential Data        
Microsoft OneDrive $Approved for Public Data $Approved for Controlled Data $Approved for Confidential Data $Approved for Confidential Data $Approved for Confidential Data $Approved for Confidential Data $Approved for Confidential Data $Approved for Confidential Data $Approved for Confidential Data
Spacer
Cloud Survey Services
Survey Tool: Qualtrics (utexas.qualtrics.com) $Approved for Public Data $Approved for Controlled Data $Approved for Confidential Data $Approved for Confidential Data       $Approved for Confidential Data
Spacer
Cloud Web Hosting Services
Content Management: UT Quicksites, CMS Hosting Platform (Drupal, WordPress, etc.) $Approved for Public Data $Approved for Controlled Data              
Spacer
Notes on Cloud Services
1 HIPAA data has special regulatory requirements; read this for more info.
2 Payment Card Industry (PCI) data has special regulatory requirements; read this for more info.
3 No enterprise contact currently; each department must go through the Contracts Office for their own contract with a FERPA agreement.
4 All uses MUST be managed by ITS to be compliant. Also, depending on the associated university data it may be
necessary to implement security monitoring. Please consult with the Information Security Officer to determine if
monitoring is needed and to understand how we can assist you.
5 As there is no university contract in place for DropBox, no usage involving protected or restricted university data
is permitted. Use of Dropbox with Confidential data is a violation of Section 2 of the IRUSP.
 
 

Local Services

For comparison purposes, select services run by ITS and offered to campus are listed below with the types of data that are approved for use with each. Use of locally hosted services is encouraged over cloud services when possible. This table is not intended to be a comprehensive list of all ITS offered services.
Local Service
Published
Controlled
Confidential
HIPAA1
FERPA
SSNs
PCI2
ITAR
IRB
Database Hosting: ITS-Supported MySQL, SQLServer, Oracle $Approved for Public Data $Approved for Controlled Data   $Approved for Confidential Data $Approved for Confidential Data $Approved for Confidential Data   $Approved for Confidential Data
File Storage: Austin Disk $Approved for Public Data $Approved for Controlled Data   $Approved for Confidential Data $Approved for Confidential Data $Approved for Confidential Data 3 $Approved for Confidential Data
UTBackup(On Premise and Cloud) $Approved for Public Data $Approved for Controlled Data $Approved for Confidential Data $Approved for Confidential Data $Approved for Confidential Data $Approved for Confidential Data   $Approved for Confidential Data
Virtual Servers (UT VMG) $Approved for Public Data $Approved for Controlled Data 4$Approved for Confidential Data $Approved for Confidential Data $Approved for Confidential Data $Approved for Confidential Data 3 $Approved for Confidential Data
Spacer
Notes on Local Services
1 HIPAA data has special regulatory requirements; read this for more info.
2 Payment Card Industry (PCI) data has special regulatory requirements; read this for more info.
3 It may be possible to store ITAR protected data if properly encrypted prior to being uploaded, but faculty should
consult with the Information Security Office to determine if there are any other issues or concerns.
4 The high-performance storage (Tier H a.k.a Hitachi) option is recommended for HIPAA use as encryption is
standard. If users elect Tier 1 or Tier 2 storage (Compellent) instead they will need to verify that encryption
is enabled throughout the life of the HIPAA-covered asset on UT-VMG.

Security Review for New Services

Departments evaluating the purchase and/or use of a cloud service not covered on this page with any Confidential university data must request a security review of that service by sending a written description of the proposed implementation to the Information Security Office. During service selection, departments should inform vendors that security testing (either performed by the Information Security Office or a qualified third party to the vendor) is mandatory for the university purchasing process.

Non-Compliance and Exceptions

If, for any purpose, a non-approved cloud service is used with any Confidential university data, an Exception Process must be initiated that includes reporting the non-compliance to the Information Security Office, along with a plan for risk assessment and management. (See Security Exception Report) Non-compliance with these standards may result in revocation of system or network access, notification of supervisors, and reporting to the Office of Internal Audit.

University of Texas at Austin employees are required to comply with institutional rules and regulations, applicable UT System rules and regulations, state laws and regulations, and federal laws and regulations.

Related UT Austin Policies

The policies and practices listed here inform the system hardening procedures described in this document and with which you should be familiar. (This is not an all-inclusive list of policies and procedures that affect information technology resources.)