Compliance Reviews for Software and Related Services
Before purchasing or renewing software, cloud services or other technology, FOA departments must complete the Data and Technology Assessment Form to signify adherence to the applicable UC requirements for security and compliance, including:
- Vendor Risk Assessment with completed Department Response
- Digital Accessibility Review
- Bulk Data Transfer Review
The FOA VRA Team conducts the review to identify potential accessibility and data risks before a purchase is made and to ensure the appropriate documentation is included with your procurement requisition.
While the FOA VRA Team coordinates the review process, each department is ultimately responsible for selecting software that meets federal digital accessibility requirements and can contact the campus Digital Accessibility Lead for related inquiries.
Complete the Data and Technology Assessment Form
How do I prepare for requesting a form?
Review the FOA VRA for New & Renewal Purchases for awareness and adherence to the associated requirements.
Who needs to complete the form?
Complete the form if you are:
- Purchasing new software license, contract (PO/PA)*, vendor professional services, or cloud-based service
- Renewing an existing software license, contract (PO/PA), vendor professional services, or cloud-based service
*Purchase Order (PO), Purchase Agreement (PA)
What to expect
Step 1. Submit the form
Complete the FOA Data and Technology Assessment Form with information about your software purchase or renewal.
Step 2. FOA VRA Team reviews your form
The FOA VRA Team reviews the information provided for accuracy and determines if any additional actions are necessary before routing the form to the Technical UISL.
Step 3. Attach the completed form to the Requisition
Once all required signatures and reviews are complete, you will receive the signed form to your Inbox. Attach the completed form to your requisition.
- Digital Accessibility Review
Federal law requires digital tools used by public institutions to be accessible to people with disabilities. As part of the review process, the FOA VRA Team evaluates software based on how widely it will be used and whether additional accessibility review is needed.
Software used by large numbers of people may require a more detailed review (Tier 1 = 1000+ users). Please allow one to two weeks or longer for these requests.
Learn more: Accessible Software Procurement Guide, Digital Accessibility Resources
- Bulk Data Transfer Review
Some software purchases require additional review because they store, transfer or provide access to university data. If your request involves large datasets, sensitive personal information or foreign vendors or collaborators, additional review may be required to comply with federal regulations.
The FOA VRA Team will help determine whether this review applies to your request.
Learn more: DOJ Bulk Data Transfer Guidance
Frequently Asked Questions
- Why does FOA have its own form?
- The campus procurement process does not collect all the information needed to complete FOA’s accessibility and data reviews. The FOA form helps ensure required reviews are completed before your requisition is submitted.
- Does every software purchase receive the same review?
- No. The level of review depends on the business purpose of the product or service, the number of users, data classification, and the potential level of risk.
- I’m renewing software we’ve used for years. Do I still need to complete the form?
- Yes. Renewals require review because accessibility standards, security requirements and software features may have changed since the original purchase.
- Who is responsible for ensuring software is accessible?
- Departments are responsible for selecting software that complies with federal digital accessibility requirements and can work with the campus Digital Accessibility Manager to review and verify vendor status. The FOA VRA Team provides guidance and coordinates the review process to help identify potential issues before the purchase is finalized.
- If it is determined that a Digital Accessibility review by the campus Accessibility Lead is necessary, how long could that take?
- Reviews can take upwards of two to three weeks. A ServiceNow ticket will be created to track the status and any updates on the review process.