Software Purchasing and Installation Policy (3.1-1)

Software Purchase and Installation Policy

The purpose of this document is to outline the software purchase and installation policy for SVSU computer equipment. Please read the entire article to understand various facets involved with making the right decision and getting the necessary support documentation for purchases.

SVSU Software Acceptable Use Clause

As stated in the University INTERNET, ELECTRONIC COMMUNICATIONS AND COMPUTING RESOURCES ACCEPTABLE USE POLICY (AUP), all employees of the University shall honor and follow copyright and license laws of computer software. This policy expands on the AUP to define proper procedures for software installation.

Information Technology Related Purchases Policy 

“All software, regardless of cost, must be purchased through a Purchase Requisition.  ITS department approval will happen through the Purchase Requisition routing process and does not need to be secured in advance of initiating the Purchase Requisition.   This method is required to ensure that the University is aware of all licensing and related tracking requirements. Procurement cards and Check Requisitions may not be used for any software purchase (excludes tablet and handheld software).  
… Information technology related purchases are still subject to the required departmental/vice president approvals specified in the separate Purchasing, Check Requisition and Procurement Card policies.”

Software Compliance is a MUST for SVSU.

Before you engage the purchasing process, you are required to have conversations as detailed below, and will be required to have the vendor provide additional details or documentation about their software/service.  Most vendors are aware or familiar with these software compliance/regulations. The additional documentation is required prior to issuing a purchase requisition or before installation of any software.

All software requests (including annual renewals) should answer the questions listed below, well in-advance of the procurement process (not weeks, but months in advance). Not having sufficient compliance documentation will only delay the procurement process or could lead to cancellation of the purchase request. 

You (the requester) will need to answer a few questions to determine what extra documentation must accompany your software purchase. Business Services, Office of Accessibility Resources and Accommodations, and Information Technology Services will provide guidance on these items. 

1. Have you discussed your software needs with IT Services (ITS)?
   • Contact ITS to find out if SVSU already has a contract or licenses that will meet your need.
   • The conversation may lead to other licensing nuances or considerations, or additional requirements not realized up front.
   • See Get ITS Involved Early!  in next section
      
2. Will the software require ITS server administration or single-sign-on capability?
   • Please contact ITS and discuss the overall needs for your project.
      
3. Will the software system require a Bid, RFP, or is it sole-sourced?
   • If yes, please contact Purchasing to acquire the proper paperwork and documentation necessary for purchasing the product(s).
   • If over $2,500 - you will be required to obtain 3 competitive quotes, or provide justification for a sole-source product.
   • If this is a new vendor, you must ensure they are listed as a Supplier in Unimarket prior to preparing a requisition.
      
4. Will any Grant or Federal Funds be used to fund the software?
   • If yes, contact Purchasing to have them run a Visual Compliance Report to check for disbarment as soon as the Vendor name is known.
      
5. Does the software involve any kind of financial transactions (i.e. credit card transactions or fund transfers, etc.)?
   • Please contact the Controller's Office to discuss the implications or requirements involved.
      
6. Does the software store or handle data in the cloud or on non-SVSU servers?
   • If yes, the vendor must provide a HECVAT - Higher Education Community Vendor Assessment Tool.
     • This document must be submitted to ITS for review by the Information Security Manager.
        
7. Does the data involve storing of any student data (grades, assignments, scores, etc..)?
   • If student data is involved, the vendor must have an acknowledgement about their processes to ensure FERPA compliance.
      
8. Is the software going to be accessed or used by students, or used by more than one individual?
   • If yes, the vendor must provide documentation regarding their software accessibility compliance.  You will need to request from the vendor to provide a VPAT - Voluntary Product Accessibility Template.
     • The VPAT must be submitted to and reviewed by the Accessibility Resource & Accommodations office.
       • If the software is deemed "not accessible" by the Accessibility Resources & Accommodations office, the requester will be required to find an alternate solution that is compliant, or will need to submit an ACCESSIBILITY STATEMENT OF RESPONSIBILITY (ASOR) that requires their signature, including their Dean/Chair/Supervisor/Director and Executive Vice-President or Provost signatures.
         • A plan of action must be provided and documented for potential accommodation needs.

Get ITS Involved Early!

1. Does a Software Solution Already Exist?
   • Before engaging the procurement process, or installation of software begins, it would benefit the initiator of the request to first inquire whether a software package is already licensed on campus (such as those made available in the Windows Software Center or Jamf Pro for Macs), or whether a reasonable alternative exists. Check standard software list.
2. Submit a New Software Install Request ticket.
3. Document purpose or business case for the software to be acquired.
   • Provide a list of any / all alternatives to the software being requested.  Including written documentation on why the alternative software would not be a workable solution (even if your choice is free).
4. Determine scope of licenses needed (individual, dept/lab, site).
   • When considering software to be used on university-owned equipment, it is imperative to understand license requirements.  A review of the vendor’s license agreement (EULA) and any other terms and conditions must be performed. It is important to consider the scope or potential use of the software – is it for individual, department, classroom/lab, or campus-wide use?
     • Individual or Named licenses require the purchase of a single license for every computer/user where the software is installed.
     • Site licenses are a flat rate typically based on a scale of the total number of computers on the network or FTE numbers.
     • Lab packs are priced in groups based on computers within a single lab, such as 5, 10, or 15 computers.
     • Concurrent licenses require the purchase of a enough licenses based on estimates of how many users are actually using the software at any one time, and generally are accompanied by license manager software.
5. Does the software require ITS to configure or automate access?
   • What computers will the software be installed upon?
   • Identify who will need access, and who must not have access?
   • There are times where licensing may require additional restrictions and could require ITS time/involvement to configure or automate access to applications. 
6. Determine cost of software license(s) and funding sources (account numbers).
   • Typically, individual and/or department software needs are funded by the requesting department. Depending on the scope or potential use of the software going outside the department, it is possible other cost-sharing will come in to play. Be sure to discuss with your department/college, ITS, and Sponsored Programs, if grant-related.
   • If the cost is over $500, do you have at least 3 vendors to send an RFP?
7. Determine date needed by (plan well in advance of need!).
   • Remember to factor in time for the vetting process to determine regulatory compliance, legal agreement and review of terms & conditions, time to purchase and acquire, and any programming or system administration efforts to deploy.

Software Requests for SVSU Computer Labs and Podiums

Lab Software Requests will be outlined in a separate document, but still require the same level of compliance vetting outlined above and throughout this document.  Refer to the online procedure posted at:  Article - Software for Computer Labs 

SVSU Purchased Software Installed on Personally-Owned Computer

Software purchased by SVSU, for university employee devices, shall not be installed on personally-owned computers – except for site-licensed software that is managed or controlled by an automated process that grants use based on user authentication (i.e. Microsoft Office 365 and Adobe Creative Cloud).  While some software may allow an install on a work device and a home device, there is no way for the university to guarantee 1) they cannot be run at the same time, or 2) the removal of software from personal devices; and therefore it is not allowed to be installed on home computers.
 

Personally Purchased Software Installed on University-Owned Computers

SVSU will not allow personally-owned or personally purchased software to be installed on university computers. If a piece of software is required for the employee to conduct their university business, it should be purchased through the proper channels to ensure the license fully complies with all university legal requirements.
 

ITS Software License Management

• ITS will retain the installation media of all software purchased by the University.
• In cases where Library staff do installations of database access software, the Library will retain an installation copy of the media and will make a backup copy for ITS’ files.
• ITS will install all software purchased by the University.
• All software installed on University owned systems must be accounted for through some form of proof of purchase and copies of EULA .
• ITS will perform periodic audits to ensure software compliance. Proof of purchase and copies of EULA agreements are required pieces of evidence towards compliance.
• ITS will perform a migration of software and data from one University owned computer to a replacement unit owned by the University.  This may occur when a unit either becomes non-repairable or through periodic replacement plans.
• It is the responsibility of the employee to ensure they have the appropriate and legal software/data on their system backed up to either their M:\drive, OneDrive, or alternate media (DVD/CD/USB flashdrive).