Higher ed has a new tool for screening cloud service providers

As colleges and universities mull what operations to move to the cloud, the higher education technology consortium Internet2 is testing how vendors and higher education institutions respond to the Cloud Scorecard, a vendor assessment tool in the works since 2019.

The nonprofit released the scorecard, which universities can use for free as part of their procurement process for cloud-based service vendors, and a directory where higher education leaders can browse completed questionnaires, in November. That was a “soft launch,” Sean O’Brien, a director at Internet2, told EdScoop, with broad outreach beginning this week. So far, 26 vendors have submitted scorecards, designed to provide a broad assessment of what a cloud services provider can offer in areas such as accessibility, security and data management.

The coronavirus pandemic prompted higher education, like many other industries, to shift further toward cloud-based services. The goal of Internet2’s scorecard is to make it easier for institutions to screen cloud services providers for their specific needs, while also considering federal student privacy guidelines, O’Brien said.

“One of the design principles we went into with the cloud scorecard … was really to try to leverage existing standards, existing questions, existing methodologies, and bundle them up in a way that makes sense for higher ed versus creating something new,” he said.

Many of the updates after the November release are related to documentation, describing scorecard development and its goals, O’Brien said. One of the aspects members needed information on was how the scorecard differed from a similar tool offered by the higher education information technology organization Educause, called the Higher Education Community Vendor Assessment Toolkit. Whether a vendor filled out the HECVAT is a question on the Cloud Scorecard.

“The HECVAT really goes deep in terms of looking at specific security controls, specific assessments that people or certifications that people may have achieved — we’re trying to go [for] more of a high-level sort of overview document in many different areas, so security, accessibility, contract language, identity and access management integration,” O’Brien said.

Internet2’s Net+ program will oversee the scorecard and directory, assessing how many institutions use the database and how many vendors submit scorecards. A working group of Internet2 members will help implement changes, O’Brien said. The group plans to expand the Cloud Scorecard website to allow institutions to complete searches based on certain categories, he added, but that depends on interest.

“I think we’re fairly confident that the questionnaire is valuable but we want to see whether more than that is sustainable or not,” O’Brien said.