transferring data to vendors/outsourced services

["Witmer, Robert" <r.witmer () SNHU EDU>]

I am looking for a policy or "checklist" to be considered for vendor/third party data transfers.  The policy/checklist 
might include provisions for secure data transfer, the vendor's use of the information, vendor's data 
storage/protection of the information, etc.

Also, who (management, data owner, InfoSec, other, all) has the authority/responsibility to initiate, approve and 
implement data transfers to third-party vendors?

Thank you for your contribution.
Bob Witmer
r.witmer () snhu edu