7.8.2.3 LIMITED PROCESS TO SEEK AUTHORIZATION FOR PURCHASE OF HIGHER RISK SOFTWARE WITH A PROCARD

A. Classification as Higher Risk Software

Software is classified as “Higher Risk Software”” if the software or its use involves any of the following factors: 

1. Any processing, access, storage, transmission, or hosting of Confidential or Controlled Data as defined in the Information Resources Use and Security Policy, including but not limited to data protected by FERPA, HIPAA, or applicable state or federal privacy laws.

2. Unsupervised interaction with students, or any use that presents a reasonably foreseeable risk to student welfare, safety, or privacy;

3. Interaction with minors;

4. Safety, health, or medical matters;

5. Risk to University property;

6. Unfettered access to the University network;

7. Solicitation on campus;

8. Providing any intellectual property of University, or any other aspects related to copyright or publication rights, or related to the University;

9. Modifications to University property;

10. Use of University property by another entity;

11. Required use of the service by students;

12. Processing, collection, or storage of University funds (ex: payment processer or reseller);

13. The vendor is an entity or individual based in, owned by a country designated as a foreign adversary under applicable federal or state law, or is otherwise subject to restrictions under U.S. export control laws, OFAC sanctions, or the U.S. Treasury Department's Specially Designated Nationals (SDN) List;

14. Providing the vendor with use of any University trademarks, logos or related marks; 

15. Any Heightened Scrutiny Artificial Intelligence System as defined by defined by Texas Government Code § 2054.003(6-a).

16. Any vendor service or software product identified as presenting an unacceptable or unmitigated risk by the University's ISO through its Vendor and Application Security Assessment process;

17. Any other aspect, feature, or service that, in the reasonable judgment of the Cardholder, ISO, or Commercial Card Office, presents a significant risk to the University, its data, its personnel, its students, or the University community.

B. Higher Risk Software Requires Approval

Higher Risk Software must not be secured through a Clickwrap Agreement unless approved through the process set forth in Section 7.8.2.3(C). Higher Risk Software that is not approved for purchase using a ProCard must be secured through either a purchase order or a negotiated agreement approved by the Business Contracts Office.

C. Process and Responsibilities for Purchasing Higher Risk Software with a ProCard

To purchase Higher Risk Software with a ProCard, the following procedure must be followed:

1. ISO Approval. The Cardholder must submit a requestto and obtain written approval from the University’s Chief Information Security Officer or his/her Office (the “ISO”). The ISO may request whatever materials and information that the ISO deems pertinent to the approval request, including confirmation that purchase of the requested Higher Risk Software must not commit the University to autorenewal beyond 12 months absent prior approval in compliance with Section 7.8.2.1(F).

2. CIO and CFO Approval. 

   1. If the Higher Risk Software is being requested for the first time at the University or is being requested for a substantially different use case than previously approved, the ISO will evaluate the request and, if recommending approval, will forward the request with a recommendation to (i) an approved delegate of the University’s Vice President for Technology and Chief Information Officer (CIO); and (ii) an approved delegate of the University’s Senior Vice President and Chief Financial Officer (CFO). CIO and CFO delegates must both approve the purchase of Higher Risk Software.

   2. If the requested Higher Risk Software has been previously approved by CIO and CFO delegates, and if the ISO determines in his/her discretion that the requested Higher Risk Software use case is substantially similar to the previously approved request, then no further approval is required.

Part 7. Purchasing - Table of Contents