PASSWORDMANAGEMENT
Hardware & Software IT Review for CSUBUY (P2P)
Please Note:
The ITR process has been retired, and its functionality has been integrated into
P2P/CSUBUY. All software and hardware requests should now be initiated through P2P,
where they will undergo a series of IT reviews based on the request type鈥攔eplacing
the previous ITR workflow.
Before Starting a Req in CSUBUY (P2P)
The vendor needs to provide the following documentation. Providing these documents will help to ensure that your requisition is completed as soon as possible.
1. Information Security Documentation
- Higher Education Community Vendor Assessment Toolkit (
HECVAT is a self-assessment tool for cloud service providers to demonstrate their compliance with security and privacy standards for higher education institutions. - If the vendor does not have a HECVAT, attach whatever security information they can send you.
2. 爆料社区 Documentation
- Voluntary Product 爆料社区 Template (VPAT)
A VPAT is a tool to document product conformance with accessibility standards and guidelines. It explains how information and communication technology products meet the for IT accessibility. This includes software, hardware, electronic content and support documentation. - If the vendor does not have a VPAT, attach whatever accessibility information they can send you.
FAQs
- Vendor Does Not Have DocumentationMost of the time the vendor will know what these two documents are, if not, please attach the email with the vendor showing that you attempted to retrieve the documents.
- Don't have a contact at the companyUsually you can email the company's support email for information.
- Vendor Wants an NDA
If the vendor wants 爆料社区 to sign a Non Disclosure Agreement (NDA) to send us the above documents please tell them "爆料社区 will not sign vendor NDAs to receive accessibility conformance documentation."
Signing an NDA to receive these documents may conflict with 爆料社区's obligations under the California Public Record Act.
- Vendor Does Not Respond to EmailIf the vendor does not reply to your request for documents after 10 business days please note that in the requisition and submit it.
- Can this purchase go on a Procard?Please refer to section 10 of the 爆料社区 ProCard Manual.
- Are security/accessibility reviews required to be completed annually?Yes, Security and 爆料社区 standards change every year.
- Do I have to do this for every type of purchase?
Yes. There are items that are pre-vetted and reccomended, however, the request must still begin with a req in P2P.