The State of North Dakota and StateRAMP

Why Third-Party Risk?

The State of North Dakota has a moral responsibility to protect citizen data.  Citizens are asked to provide sensitive information to receive various state-administered services.  They cannot go elsewhere to receive supplemental nutrition assistance, fishing license, mental health, or a driver’s license – just a small sample of the various critical and quality of life services North Dakota residents depend on to “Be Legendary”.  NDIT defends citizen data by proactively minimizing risk on the state network, along with cloud systems and applications used to administer services.  One way to do this is to partner with StateRAMP.

What is North Dakota’s Third-Party Risk Management Program?

North Dakota’s Third-Party Risk Management (TPRM) Program ensures potential risks are identified, evaluated, and mitigated when associated with third-party vendors.  TPRM focuses on due diligence activities which provides reasonable assurance that ND citizen data is safeguarded.  The breadth and depth of an assessment is dependent on the type of data a vendor will store and/or transmit based on NDIT’s Data Classification Policy.

StateRAMP is a strategic partner for the State of North Dakota, as vendors who are authorized by StateRAMP are fast-tracked through the NDIT TPRM assessment process.  With StateRAMP, North Dakota’s third-party cloud IT providers ensure:

• Government’s published cybersecurity policies and met and maintained.
• Data is stored and processed in a secure environment.
• A standardized approach to assessing and verifying security controls by an independent, third-party security assessor organization (3PAO).

Additionally, StateRAMP provides continuous monitoring of vendors, which allows our staff to focus on other priorities to reduce risk to our state’s citizens.The key outcomes of TPRM are: 

• Understand security concerns when selecting a vendor. 
• Safeguard data to foster an environment of citizen trust. 
• Mitigate undue risks and costs associated with third-party breaches. 
• Compliance with legal, privacy, policies, and standards requirements. 
• Ensure Business Continuity by verifying third-party vendors have effective contingency plans. 
• Partner with vendors as cybersecurity is a shared responsibility.