All third-party service providers and cloud-based vendors handling (store, process, or transmit) sensitive or confidential institutional data must have the following security controls to meet Drexel ...