Overview
SAIT and Student Affairs Procurement have partnered to clarify the technology acquisition process, and empower Student Affairs units with the knowledge needed to efficiently obtain the software tools and technology necessary for their staff to successfully serve the student population, while ensuring contractual protections for university, staff and student data.
Before Submitting an SA Technology Procurement Request
1. Review Existing Resources
Review both the Student Affairs Software Catalog and the IT Service Catalog first to try to identify an existing solution. The providers of the software and services listed in these catalogs have existing relationships with Student Affairs, UC Berkeley and/or the UC System. If an existing technology solution can meet at least 80% of your requirements, it should be the selected solution.
Ordering new computers or other hardware:
- Student Affairs staff may be eligible to receive funding from the Division of Student Affairs' New Device Program. Complete this form(link is external) to apply for a new device. For any questions, email Hollyann Larson (hollyann@berkeley.edu(link sends e-mail))
- For hardware purchases not eligible for the Student Affairs New Device Program, follow the instructions on the ITCS Computer Hardware Purchasing webpage.
2. Understand Delegated Authority
While it is possible to procure some technology solutions by using a blucard with an online service provider, or bypass this procurement process directly in Bearbuy, very few staff are authorized to do so. Please engage your Buyer prior to finalizing any transaction to include agreement terms that are compliant with UC policies, etc.
- Only those with delegated authority may initiate and sign supplier’s quotes or agree to their terms and conditions.
- No click-through agreements should be initiated by departments, even if the supplier says they are “free.”
- “Click-through,” “shrink-wrap” and similar supplier terms/agreements may constitute legally binding agreements, binding UC to their terms. Acceptance of such terms as written could expose the University to unacceptable and costly risks, including but not limited to being liable for using infringing software; being liable for third-party acts or omissions (i.e., a direct violation of a UC Standing Order(link is external)); HIPAA violations; possible mishandling of sensitive data; intellectual property concerns; and non-compliance with laws/regulations/policies of Federal, State, UC, funding agency entities.
- Such "click-through" agreements for software or services available on the Internet are likely not approved by UCOP or UC Berkeley legal and procurement departments; moreover, only authorized individuals can enter into agreements for UC. Therefore, please avoid clicking through on such agreements and instead please engage your Buyer before finalizing your transaction to include agreement terms that are compliant with UC policies, etc.
3. Confer with the SAIT Strategic Initiatives Director & Student Affairs Procurement
- The Strategic Initiatives Director (sait-sim@berkeley.edu(link sends e-mail)) can be a thought partner to offer guidance and best practices as you explore solutions to your business challenges, as well as connect you with campus resources and other division partners that may have a similar technology need.
- Student Affairs Procurement can help you determine if a formal bid would benefit your situation. Typically, software and services that have been formally bid have better pricing, less risky and contract terms, and are negotiated faster than contracts that have not been formally bid. This will help to ensure departments receive quality software as a service, competitive pricing, and suppliers who adhere to UC Regents’ policies.
- RSSP staff should confer with Ingrid Hunt (ijbhunt@berkeley.edu(link sends e-mail)), Technology Planner for RSSP, who will provide guidance and coordinate with the Strategic Initiatives Director and Student Affairs Procurement.
4. Document the business requirements
- What does the software/technology need to do? What problem is it being used to solve? What features are required? What vendors have been considered? Do any vendors present unique advantages or offerings? What is the approximate 1st year/implementation pricing? What are the annual costs?
- You may use this feature comparison template(link is external) to define requirements and compare vendor products.
5. Ask potential vendors Security/Privacy and Accessibility questions
Ask questions of potential vendors to see if they seem prepared to meet the Security/Privacy and Accessibility needs of the procurement process.
- Security/Privacy
- Ask potential vendors if they have completed a HECVAT(link is external) (Higher Education Community Vendor Assessment Toolkit). A vendor that has completed a HECVAT demonstrates attention to security and it is a good sign that they will be responsive during a vendor security assessment.
- If there is credit card data involved, ask potential vendors if they have a PCI DSS Attestation of Compliance from a Qualified Security Assessor (this is a third-party attestation, not a self-attestation).
- Ask potential vendors if they have a security plan they can share as part of a procurement process.
- Consider the business and/or data location of potential vendors. Vendors without a US presence can pose extra security risks and contractual challenges.
- Inquire with potential vendors and confirm that the data is not being used to generate income outside of the contracted services (data is not being sold or shared with third parties).
- Ask potential vendors if they support SSO/SAML2(link is external) and can integrate with CalNet (nice to have).
- Accessibility
- Ask potential vendors if their software meets the WCAG 2.0 level AA standards or if they have completed a VPAT.
- Ask potential vendors if they are willing to complete an Accessibility questionnaire(link is external) as part of a procurement process.
- Ask potential vendors if they are willing to participate in a hands-on accessibility review. Would they be willing to commit resources to address any major accessibility issues identified?
- Check with the Web Access team(link is external) for guidance and tips for identifying an accessible solution. You can contact them via email: webaccess@berkeley.edu(link sends e-mail)
FAQs
Can I just charge it on the department Blucard?
While it is possible to procure some technology solutions by using a blucard with an online service provider or bypass this procurement process directly in Bearbuy, very few staff are authorized to do so. Only those with delegated authority may initiate and sign supplier’s quotes or agree to their terms and conditions.
What about free services/accounts? Can I use those?
Only those with delegated authority may initiate and sign supplier’s quotes or agree to their terms and conditions.
- No click-through agreements should be initiated by departments, even if the supplier says they are “free.”
- “Click-through,” “shrink-wrap” and similar supplier terms/agreements may constitute legally binding, binding UC to their terms. Acceptance of such terms as written could expose the University to unacceptable and costly risks, including but not limited to being liable for using infringing software; being liable for third partythird-partyissions (i.e., a direct violation of a UC Standing Order(link is external)); HIPAA violations; possible mishandling of sensitive data; intellectual property concerns; and non-compliance with laws/regulations/policies of Federal, State, UC, funding agency entities.
- "Click-through" agreements for software or services available on the Internet are likely not approved by UCOP or UC Berkeley legal and procurement departments; moreover, only authorized individuals can enter into agreements for UC. Therefore, please avoid clicking-through on such agreements and instead please engage your Buyer prior to finalizing your transaction to include agreement terms that are compliant with UC policies, etc.
How long does it typically take to procure a solution?
Completion of any new deal with data terms and no formal bid typically takes 3 months of negotiation with the supplier. If the supplier is willing to accept UC’s agreement and standard terms without modification, the process can be completed much more quickly. If the Protection Level of the data is P1 or P2 and the supplier is willing to accept a purchase order instead of signing the supplier’s paperwork the process can also be completed more quickly.
How long does a Vendor Security Assessment take?
It is best to allow at least 30 days for a vendor security assessment. This can vary greatly depending on the number assessments in ISO’s queue, as well as the cooperation of the vendor, and the preparation of the requesting department’s Main Point of Contact. When all parties are well prepared and collaborative, a vendor security assessment can be completed quickly.