This procedure seeks to ensure that third-party information systems or system components that access, process, store or transmit UO data are appropriately managed to protect the confidentiality, integrity and availability of the data. The procedure outlines the steps for conducting assessment of these systems prior to acquisition or renewal by UO units.