. . . "Security protection measure requirements and responsibilities should be clearly outlined in contracts, service-level agreements and memorandums of understanding with external contractors, vendors, service providers and other entities that are entrusted with College information assets." . .