The FCPS's Resource Evaluation process reviews technologies, services, and hardware for potential or continued inclusion in the FCPS ecosystem. FCPS uses industry standard evaluations such as the Confidentiality, Integrity, Availability (CIA) to assess the appropriate cybersecurity, privacy, accessibility, and compatibility requirements.  This process also aligns with compliance to federal, state, and local regulations. This page is designed both for FCPS staff and prospective/existing vendors, detailing the criteria for successful completion of the FCPS resource evaluation process.

To establish the relevant requirements above, it is first integral to understand the data classification of the information to be included in the system.  FCPS classifies data into four levels based on the highest level of sensitivity of the data stored in the platform.  FCPS uses this classification as the primary factor in determining the relevant policies, applicable laws, and required security controls.

FCPS Resource Evaluation Process

As FCPS applies a Risk-Based Approach to evaluating resources and vendors, Governance, Risk, and Compliance (GRC) and Technology Architecture and Assessment (TAA) will conduct an initial triage of vendors to determine the following: 

1. The data classification level of the data the vendor stores on behalf of FCPS.
2. Criticality of the service toward FCPS daily operations.
3. Student-Facing or Staff-Facing Only
4. Potential integrations to FCPS services and/or hardware connectivity requirements

If deemed necessary, the FCPS Resource Evaluation team(s) will request vendors complete a questionnaire with vendors providing as much relevant details as possible to facilitate the collaboration and guide the teams through their analysis.

Vendor Acceptance Questionnaire Submission Process

1. FCPS will communicate, through email, with vendors as needed to initiate and request their participation in this process.  The first vendor step involves vendors completing the VAQ in its entirety.
   1. Please note that FCPS can only accept Excel files for the vendor’s responses on the VAQ.
   2. FCPS does not accept unsolicited VAQ responses: each submission requires an FCPS Sponsor. .
2. Vendors must submit a completed response or notify FCPS of their intention to submit within 30-days of receipt to maintain their place in the evaluation process.
3. The Vendor Adoption Team will communicate, via email, confirmation upon receipt of the VAQ.
4. FCPS will only share FCPS analysis with FCPS personnel, and not vendors.
   1. FCPS staff must contact IT prior to sharing any Resource Evaluation analysis with vendors.

Governance, Risk, and Compliance (GRC) Assessment

Third Party Risk Management (TPRM) Process

After the triage analysis process, FCPS will perform the relevant cybersecurity review.  Aligned to the CISA principles and determining the overall risk to the enterprise. Afterwards, the Governance, Risk, and Compliance (GRC) Office will determine if an external independent review meets FCPS requirements or if the vendor must undergo further analysis. 

1. The following questions will primarily determine the process:
   1. What level of data does the vendor’s resource have access to from FCPS?
   2. What level of criticality does the resource represent for FCPS?
   3. Does the resource require FCPS IT integrations? 

GRC will reach out with any applicable and necessary next steps.