缅北禁地 Technology Purchases
This process is now managed within the CSUBuy Procure-to-Pay system.
A user guide and step-by-step instructions will be available within the new system to support users throughout the process.
|
Technology Category
|
Category Examples |
|---|---|
|
Software Includes, but is not limited to: applications, non-Web software, and platform software. Includes license purchase, renewals or upgrades. |
|
|
Hardware A tangible device, equipment or physical component of Technology |
|
|
Web Anything on the web (including but not limited to examples) |
|
| Electronic Content |
|
| IT Services |
|
**This is not an exhaustive list of products/services considered Technology Purchases.
Requests received through the Technology Review Request are automatically received for Section 508 compliance (VPAT) review. Impact analysis is completed on the request and determines whether further action (e.g., partial or full VPAT review) is required.
What is a VPAT?
A Voluntary Product Accessibility Template (VPAT) is a supplier-generated statement that provides information on how a product or service conforms to the Section 508 Accessibility Standards for technology. In general, suppliers should generate a VPAT whenever they develop products or services that are determined to be technology and are to be used in the 缅北禁地 marketplace. In each VPAT, suppliers are expected to make specific statements in simple understandable language about how their product or service meets the requirements of the Section 508 Standards (section by section, and paragraph by paragraph).
If an technology product or service will be used in an academic setting, by more than one user, or by the general public, a VPAT is required to ensure the product/service is fully accessible, regardless of disability.
How to Obtain a VPAT
-
Contact the Supplier/Vendor
Many suppliers who work with Higher Ed and other government agencies already have VPATs or other Section 508 documentation available for download from their website. If you cannot locate a VPAT on their site, contact them directly to inquire. If they do not have a VPAT on file, see #3.
-
Check to see if a system wide contract is in place with the vendor or if a VPAT is on file through the Chancellor’s Office.
-
Ask the Supplier to complete a VPAT
Suppliers that do not have a VPAT should complete the VPAT 2.5 508 Template. The website has information specifically for suppliers regarding the CSU’s technology requirement and how to provide documentation about their product’s conformance with applicable accessibility standards.
VPAT Review Workflows
Resources
Requests received through the Technology Review Request are automatically reviewed for impact on campus information security. Impact analysis is completed on the request and determines whether further action (e.g. partial or full contract and/or product review) is required.
Why is an information security review required for campus Technology purchases?
The Campus IT environment is rapidly changing and the speed of cloud and non-IT department centric services adoption is increasing. As our campus deploys or identifies IT services we may want to use, we must ensure that those acquired services are appropriately assessed for managing the risks to the confidentiality, integrity and availability of sensitive institutional information and the PII of campus participants. Our campus has established a security assessment methodology and resources to review these services for privacy and security controls.
What is involved in the information security review?
As a campus member requesting to purchase an Technology-related product, you have been identified as a potential host or handler of 缅北禁地 protected level one or level two data (). If the product you are requesting will be hosting or handling our data, per the CSU Information Security Policy, you, the requestor, must "ensure that when critical or protected information is shared with third parties, it is either specifically permitted or required by law and that a written agreement is executed between the parties that addresses the applicable laws, regulations, and CSU/campus policies, standards, procedures, and security controls that must be implemented and followed to adequately protect the information asset".
The information security review performed by the campus information security office will assist you in performing a review of a vendor to ensure that they can provide the appropriate level of assurances and protections for data we share with them. This process may involve multiple question and answer sessions with a potential vendor, during which additional documentation and contract modifications may be requested. The expectation of the requestor is that they will remain an active participant in the communication process between the vendor and the campus information security office.
Once the information security review process is completed, we will provide a recommendation to proceed (with or without contract modifications) or a recommendation not to proceed (with a risk evaluation stating how this decision was reached). For reviews that are not recommended, where the requestor wishes to proceed with the purchase, the request must be escalated to the campus CIO (Chief Information Officer), in the ITS Department.
ISO Review
High-level step by step review ending in either (A) recommended or (B) not recommended.