Skip to main content

Technology & Digital Service Purchase Pre-Authorization Procedure

  

1. Purpose  

This procedure procedure outlines the step-by-step instructions Arkansas State University faculty and staff must follow when seeking security clearance to procure to procure technology and digital services. Completion of this procedure ensures that all relevant parties for the approval process can review the Pre-Authorization request without delay. This procedure serves as a pre-authorization for software purchase.  After the ticket is approved, you will still will still need to contact procurement to receive to receive approval and complete the purchase.  

2. Defining Public Data  

Public data in higher education refers to information that colleges, universities, and education agencies make openly available to promote transparency and informed decision‑making. This typically includes items such as enrollment figures, graduation and retention rates, accreditation status, degree programs, course catalogs, tuition and fee information, campus policies, and high‑level research outputs.    

Not all higher education data is public. Information that is considered private or protected includes, but is not limited to, individual student records, personal information about students, faculty, or staff, unpublished research data, internal financial or strategic planning documents, and data protected by laws such as FERPA.  Please see appendix B for additional for additional examples.  

3. Submission Requirements  

All Technology & Digital Service Purchase Pre-Authorization requests requests for resources that will access non-public data  must include sufficient security documentation. If the vendor is unable or unwilling to provide these required security documents, the request cannot be reviewed and may be rejected by IT Security.  Please ensure that all documentation is included in included in your submission.  

The following table outlines the necessary documents:  

Documentation Documentation   

Required for  

Substitutions Accepted?  

Voluntary Product Accessibility Template (VPAT)  

CPI Security to determine to determine accessibility.    

No substitutions substitutions are accepted. Exceptions may be granted on a case-by-case basis.    

Federal Risk and Authorization Management Program (FedRAMP)  

IT Security to determine to determine data security.    

Substitutions are accepted. A CSA-STARISO assessment 27001 certification or SOC 2 report can be submitted be submitted in lieu of this document.      

CloudInternational SecurityOrganization Alliancefor – Security, Trust, Assurance and RiskStandardization (CSA-STAR) ISO) - ISO 27001 (IT Security)

IT Security to determine to determine data security.  

  

Substitutions are accepted. A A FedRAMP Packet Packet or SOC 2 report can be submitted be submitted in lieu of this document.      

System and Organization Controls 2 (SOC 2) Report  

IT Security to determine to determine data security.  

  

Substitutions are accepted. A CSA-STARISO assessment or 27001 certification or FedRAMP Packet Packet can be submitted be submitted in lieu of this document.      

  

  

NOTE:  General staff should not sign an NDA to access NDA to access security documentation.  IT Security will not accept links to vendor trust centers in place of documentation. It is the responsibility of the requestor to to get the links and contact and contact lglasco@astate.edu to  to complete the NDA process process to receive these documents for upload.  

4. Pre-Authorization Request – Step by Step Guide  

This form can be found here: Technology & Digital Service Purchase Pre-Authorization

  • Section 0: Requestor Information  
    • This section requests basic user information such as your name, email address, and department.  
  • Section 1:  Technology and digital service service questions.  
    • Technology & Digital Service Classification:  
      • Software or application:  A program installed on a computer.  
      • Cloud Service:  A service hosted online and accessed through the internet.  
      • Data Processing Processing Tool:  A tool used to collect, analyze, manipulate, transform, or report data.  
      • Vendor or third-party Service:  A service provided by an external company.  
      • Artificial Intelligence (AI) Tool: Tool that uses machine learning, automation,  or predictive algorithms to generate content or analyze or analyze information.  
    • Will this Technology or Digital Resource access or host data that is not publicly available:  
      • This question requires the requestor to define the data being accessed.  Please see see “Defining Public Data” in this guide to help determine help determine how to answer this question. If you need additional need additional support, please contact contact security@astate.edu for assistance  for assistance classifying this data.  
    • The remaining questions in this section ask for basic Technology or Digital resource information such as user counts, name of resource, and for a detailed description of how it will be used.    
  • Section 2: Vendor or Manufacturer Questions.  
    • This section requests basic information about the vendor or manufacture manufacture such as their name, the name of your contact within the organization, the contacts email address and phone number.  
  • Section 3: Accessibility & Security Questions.  
    • This section is to confirm that you have gathered the relevant documentation for submission. If you have any questions about about this,  please see sections see sections 2 and 3 above.  If you need additional need additional support,  then please contact:  

                    1. security@astate.edu for assistance  for assistance with security security documentation.  

                    2. CPI-Security@astate.edu  for VPAT related questions.

  • Section 4: Documentation Upload.  
    • The final section The final section of the request process where you will upload all required documentation.    
5. Completing the Procurement Process  
  • Once approval has been received, contact procurement to verify to verify they have received the approved pre-authorization request and confirm the next steps.  
  • Please note that all current procurement processes remain processes remain in effect, including those for any purchases or contracts exceeding $20,000. Departments should contact procurement@astate.edu for further guidance on these purchases.  

  

Appendix A – Vendor Outreach Template  

Good morning / afternoon, Vendor,    

To move forward with procuring with procuring your solution, Arkansas State University requires accessibility and security documentation to be on file.  I’ll ll need your most recent copies of the following documents to to proceed:  

  • A Voluntary Product Accessibility Template (VPAT)

        And  

  • Federal Risk and Authorization Management Program (FedRAMP) Packet.    
    Or  
  • CloudInternational SecurityOrganization Alliancefor Standardization (ISO) - Security,ISO Trust, Assurance and Risk27001 (CSA-STAR)IT assessment. Security)
    Or  
  • System and Organization Controls 2 (SOC 2) Report.  
    Or  
  • Any auditor-validated, independently assessed report attesting to the security practices of the vendor or manufacturer of this resource.  

Thank you for your assistance your assistance with this matter matter and I look forward to procuring your to procuring your solution.  

Thanks,    

Your name here  

  

Appendix B B – Data Classification Examples  

Please note: This is not an exhaustive list.  

Data Type  

Classification  

Justification  

Export Controlled data  

Regulated  

ITAR, EAR  

Credit card cardholder data  

Regulated  

PCI  

Social Security Numbers  

Regulated  

PII  

Donor Financial Records  

Regulated  

GLBA  

Patient health records (identifiable)  

Regulated  

HIPAA  

Student records (non-directory)  

Confidential  

FERPA  

Class Schedules  

Confidential  

PII  

Transcripts  

Confidential  

FERPA  

Personally Identifiable Information Information   

Confidential  

  

Employee data (not including SSN)  

Confidential  

Employee privacy  

System security plans  

Internal  

Protective information  

Unpublished research results  

Internal  

Competitive and commercial potential  

Exams (question banks and answer keys)  

Internal  

Exam integrity  

ASU System Directory (students & staff)  

Public  

FERPA  

University regulations  

Public  

Intended for public use  

Course catalog  

Public  

Intended for public use  

Public web sites  

Public  

Intended for public use  

If you have any questions or need assistance, please contact the IT Support Services team at at itsupportservices@astate.edu.  

Back to top