Purchasing Software

Learn more about the pre-approval process for technology accessed via a web browser, or vendor hosted cloud services and subscriptions. This includes e-learning platforms, online testing, assessments, proctoring, enterprise-wide solutions, and any student or public-facing technology. UB also has some university-wide licenses that are available for departments at no charge or for a nominal fee.

On this page:

Web-based Services and Software Solutions Pre-Purchase Compliance Process

Purchases of hosted solutions (over the internet) or software, whether installed or accessed from on-premise or in the cloud, can put sensitive university data at risk, may not meet the needs of the campus population with disabilities, may violate the university's Electronic and Information Technology (EIT) Accessibility Policy, or may require integration with enterprise level applications or university systems.

Hosted solutions and software applications installed on UB servers must be reviewed by experts in security, financial mangement, accessibility, and the Chief Information Office prior to the purchase occurring to ensure the applications are compatible with university policies, state and federal guidelines.

Process Goals

The goal of this process is to incorporate review and approval by the Office of Equity, Diversity and Inclusion (EDI), Financial Management and the Vice President Chief Information Office (VPCIO) prior to the purchase.   The end result of the review process is to provide a recommendation or approval regarding the purchase of the software, service or application.

Applies To

  • Web-based services (hosted software applications that are installed, hosted and accessed entirely over the internet).
  • Cloud computing offered via a cloud service or cloud provider
  • Server-based software requiring installation on UB servers
  • Any service or software accessed by students or the public via UB or third party webpages
  • Any software or service that collects payments or requires PCI compliance (credit card use)
  • Any software or service that contains or exchanges Personal Identifiers (PID) or HIPAA data
  • Any upgrade from current on-premise software to cloud based services or software
  • All enterprise based software or campus-wide software
  • All multi-year renewals not previously vetted through this process
  • Open source, freeware, shareware, and no-charge products.

Does Not Apply To

  • Hardware drivers only (such as printer drivers or utilities)
  • Individual or single department use desktop or web-based software (i.e. Adobe Suites)
  • UB licensed software available through the VPCIO office

Data Security Importance

Ensuring that UB data is secure is a vital part of our business operations. UB has different security requirements depending on the nature of the data or IT resources the supplier will handle. The greatest risk is associated with purchases requiring the use of Category 1 or Category 2 data per the Data Risk Classification Policy.

Not sure what category of data you intend to use?

Your IT Node Support Staff can assist in determining the type of data you intend to use. Find the IT support staff for your unit, department, or academic area.

What Is at Risk If You Skip the Pre-Purchase Process?

  • Students and the public with disabilities may not be able to access the required tool
  • Violation of UB Electronic and Information Technology (EIT) Accessibility Policy, Americans with Disabilities Act (ADA), Section 504 of the Rehabilitation Act of 1973, and the New York State Human Rights Law
  • Possible breach of personally identifiable, FERPA, and/or HIPAA information
  • Inability of central services to integrate product or provide adequate support
  • Possible violation of UB's rules for conducting financial transactions

Process Steps

Desktop Software

Contact an Expert

Nina Anders

Purchasing and Contract Services

Phone: 716-645-4575

Email: ninaande@buffalo.edu

Related Forms and Policies