TAF Required Documentation

Technology Assessment Form (TAF) Required Documentation

Below is the acceptable documentation for technology purchases at Yosemite Community College District. This is required at each renewal for all systems and software the district utilizes before a purchase is authorized.

Note:

• Only the highest level document is necessary
• Documentation must be dated within the last 12 months
• Only one approval is needed for each vendor/publisher each fiscal year
• Documents must be submitted to Information Security before or during the purchase process for approval

 

Decision Matrix

Data Classification	Acceptable Documentation
	HECVAT Lite	HECVAT Full	FedRAMP Authorized	ISO 27001	SOC 2 Type II
Level Red		X	X	X	X
Level Yellow: 100+ Records		X	X	X	X
Level Yellow: 1-99 Records	X	X	X	X	X
Level Green	N/A	N/A	N/A	N/A	N/A

 

Data Classifications

Data Classification Level	Information Example
Level Red	Employment records, student Records, and other information that could cause substantial harm to the District, its staff, or its students.
Level Yellow	Personally Identifiable Information (PII) beyond first and last name or other information that could cause significant harm to the District, its staff, or its students.
Level Green	Publicly available directory information or information that could cause little to no harm to the District, its staff, or its students.

 

Additional Information

Warning: These links navigate to an external site outside of Yosemite Community College District's control. Proceed with caution.

HECVAT Full/Lite - https://www.educause.edu/higher-education-community-vendor-assessment-toolkit

FedRAMP - https://www.fedramp.gov/

ISO 27001 - https://www.iso.org/standard/27001

SOC 2 Type II - https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2