University IT

Where will the link in the emails take me?

They will bring you to a Fusion site starting with https://unvofrochestermc-fusion.my.site.com/RCFusionCommunityPortal/login

Who are the emails coming from?

Each contact listed for the application will receive a notification email related to the assessments and findings, which will be sent from either the Risk and Compliance contact or Fusion Setup1 forcepartneradmin@fusionrm.com. Please note “[EXT]” will be in the subject line.

What are the options when I go to this page?

Exceptions: If you have any assigned exceptions. Ex: No encryption on a device you own/manage.

Findings: This is where you will locate any findings 120 days after the close of Risk Assessment review. These will only be High or Critical findings.

Questionnaires: Assigned Risk Assessments based on a location or application.

How long do I have to complete a questionnaire?

The email you receive will have a due date. The questionnaire will also have the due date at the top of the form.

What if multiple people are assigned to one application?

You will all receive an email. At the top of the questionnaire, it will list who else has access to complete the questionnaire.

Can I edit the answers to the questionnaire?

Yes, up until the due date, you can edit any of the provided answers.

Will I need to complete this every year?

Yes, however, your answers will carry forward from year to year unless there is a change in the question.

What are the Findings?

Findings are what Fusion calls Risks. The critical and high findings will be published 120 days after the due date of the questionnaires. Email notifications will be sent out.

How often do I have to update Findings?

Updates to the findings will be required quarterly until an exception is filed, compensating controls to reduce the risk level, or mitigated.

Who should I reach out to for general or technical questions?

infosecriskandcomp@urmc.rochester.edu