A Technology Security and Compliance Review is required before purchasing, subscribing to, renewing, implementing, or engaging any software, cloud service, application, technology platform, or technology-related professional service that will access, store, process, transmit, manage, integrate with, support, or otherwise interact with University information, University accounts, University-owned devices, University networks, or University technology systems. For a list of purchases requiring a review please check the FAQ below.
The review evaluates information security, regulatory and policy compliance, privacy, accessibility, operational risk, and technical considerations to help ensure the technology can be used safely and appropriately within the University environment.
This assessment must be completed and approved before loading information or contract documents into the UA Contract Portal for Contract Management. A pdf of the approved review will be required.
For assistance with answering questions or navigating this assessment, contact Compliance, Ethics and Regulatory Affairs.
InfoTechnology Security & Compliance Review Required for P-Card Purchases
Effective October 1, 2026, all purchases for software including application subscriptions, cloud and hosting services, AI (Artificial Intelligence), or data analysis tools will require an approved Technology Security and Compliance Review assessment. This applies to P‑Card purchases, reimbursable expenses, and any other payment methods.
Note: The form will not be required for asset purchases for example (stock images, font libraries, etc.)
A grace period will be in effect for all purchases made between July 13, 2026 and September 30, 2026, during which the form will not be required, but is highly encouraged. All purchases made on or after October 1, 2026, require an approved Technology Security and Compliance Review assessment to be attached with Concur documentation before transactions can be approved.
Approved Technology Security & Compliance Review assessments are valid for one year. For ongoing or monthly subscription payments, the approved form must be attached to each P‑Card reconciliation, reimbursement, or Concur invoice.
To support this process, a streamlined “p-card purchase” option will be available in the Technology Security and Compliance Review Portal, designed to be shorter and faster than the existing contract and purchase order review form.
Compliance Software Contract FAQ
What purchases require a review?
A review is generally required for the purchase of:
- Software applications, software licenses, and software subscriptions.
- Cloud and Software-as-a-Service (SaaS) solutions.
- Mobile applications used for University business.
- Artificial intelligence (AI) tools and services.
- Technology platforms that collect, store, process, or share University data.
- Technology products that integrate with University systems such as identity management, learning management systems, student information systems, HR systems, financial systems, email, or cloud storage services.
- Managed services or professional services that require access to University systems, University data, University devices, or University networks.
- Consulting, implementation, configuration, development, hosting, support, monitoring, or maintenance services related to University software, hardware, or technology infrastructure.
A review is not required solely for the purchase of:
- Research databases licensed or acquired by University libraries.
- Electronic journals, periodicals, or subscription-based scholarly content.
- Electronic textbooks or digital course materials.
- Conference registrations, workshops, certifications, subscriptions for professional development, memberships to professional organizations, or other professional development opportunities.
- Books, publications, or educational content that do not provide software functionality or access to University systems.
If a purchase includes both content and software functionality, or if there is uncertainty about whether a review is required, the purchase should be submitted for review before proceeding.
What documentation do I need?
All requests need to have a copy of the contract uploaded to the portal. If you have a Certificate of Insurance or any other supporting documents this will help expedite the approval process.
Can I fill this out on behalf of someone else?
Yes! You will need to note this on the submission for that you are acting a a proxy for another person on campus and identify them as well.
What about purchases for training and professional development?
Purchases for training, conferences, certifications, memberships, and other professional development opportunities that do not include the purchase, licensing, or use of software are not considered technology purchases and do not require the Technology Security and Compliance Review assessment.