PurposeÌý

ThisÌýstandardÌýestablishesÌýa consistent,Ìýrisk‑basedÌýprocess for evaluating, approving, and managing software that may introduce significant operational, security, privacy, compliance, or reputational risks to ¾Ã¾ÃÈÈ. It supports the university’s goals of protecting institutional data, ensuring responsible technology adoption, and enabling academic and administrative innovation.Ìý

ScopeÌý

This Standard applies to all:Ìý

  • University‑owned, leased, or managed devicesÌý
  • Cloud‑basedÌýandÌýon‑premisesÌýsoftware solutionsÌý
  • Academic, administrative, research, and auxiliary unitsÌý
  • Faculty, staff, contractors, student employees, and affiliates whoÌýprocureÌýor deploy software on behalf of ¾Ã¾ÃÈÈÌý

It covers:Ìý

  • New software acquisitionÌý
  • Renewal of existing softwareÌý
  • Third‑partyÌýintegrationsÌý
  • Free or freemium tools used with institutional dataÌý
  • Software that is currently blocked by the university due to industryÌýidentifiedÌýrisksÌý

DefinitionsÌý

Software With Significant Risk

Software is consideredÌýhigh‑riskÌýif it meets any of the following criteria:Ìý

  • HandlesÌýsensitive orÌýregulatedÌýdata (e.g., FERPA, HIPAA, GLBA, research data, personal information).Ìý
  • Integrates with enterprise systems or Single Sign-On (SSO).Ìý
  • Transfers university data to external parties.Ìý
  • Has access to large volumes of institutional or personal data.Ìý
  • ImpactsÌýcritical university operations (academic, financial, safety, or research systems).Ìý
  • IsÌýAIÌýor machine learningÌýtechnologiesÌýthat process institutionalÌýdata.Ìý

Exception

A documented, approved deviation from thisÌýstandardÌýwill beÌýgranted when compensating controls or business justification sufficientlyÌýreduceÌýrisk.Ìý

Ìý

Software Risk Management StandardsÌý

  • All software posing potential risk must undergo an assessment beforeÌýpurchase, renewal, or deployment. Assessments are managed byÌýInformation Security, with coordination fromÌýIT Operations,ÌýProcurement, andÌýBusiness Owners.Ìý
  • Depending on theÌýuse case, the following may beÌýrequired:Ìý
    • FormalÌýSecurity Risk Assessment (SRA);ÌýInformation Security reviews application security, data flows, authentication/authorization, encryption, incident response, vendor security posture, vulnerabilities, and system architecture.Ìý
    • Privacy/Data Protection Review:ÌýCompliance ManagersÌývalidatesÌýcompliance with FERPA, GDPR,ÌýPCI,Ìýstate privacy laws, contractual terms, data retention, and consent requirements.Ìý
    • Accessibility Review:ÌýCompliance ensures compliance with WCAG 2.1 AA and institutional accessibility policies.Ìý
    • IT Operations Review:ÌýInformation Technology willÌýdetermineÌýoperational maintainability, including:Ìý
      • Hosting/environment suitabilityÌý
      • Authentication RequirementsÌý
      • Data Location RequirementsÌý
      • Logging & Monitoring RequirementsÌý
      • Integration StandardÌý
      • APIs must use secure protocols and validated schemasÌý
      • Change Management CoordinationÌý
      • Disaster Recovery Expectations / Backup/restore expectationsÌý
      • System performance or bandwidth requirementsÌý
      • Patch management and update expectationsÌý
      • Supportability by existing IT teamsÌý
  • Risk decisions should align withÌýElon’s security and complianceÌýframeworks to ensure consistency and rigor.Ìý
  • The university reserves the right to rescind approval if new risksÌýemergeÌý(e.g., vendor breach, audit findings, or change in functionality).Ìý
  • Approved software may requireÌýannual or biennial reassessments, security review upon major feature changes, incident reporting obligations for vendors, patch/vulnerability managementÌýreview,Ìýor review ofÌýthird‑partyÌýattestations (SOC 2, ISO, penetration tests)Ìýbased on the data being used,Ìýtransmitted,Ìýor processed within the application.ÌýÌý
  • When a business need justifies use ofÌýhigher‑riskÌýsoftware, the business owner mustÌýdocumentÌýtheirÌýException Request.ÌýÌýInformationÌýin the request shouldÌýincludeÌýaÌýbusinessÌýjustification, risk acceptance rationale, dataÌýinvolvedÌýand the compensatingÌýcontrolsÌýnecessary to mitigate the risk. The controls may include restricted data use, limited user access, network segmentation, enhanced monitoring/logging,Ìýor vendor security auditÌýrequirements.Ìý
  • ÌýAllÌýapplication requests, risk reviews, exception requests and use decisions will be loggedÌýinÌýElon’s electronic ticketing system.ÌýÌý

Noncompliance with thisÌýstandard may result inÌýdenial of procurement, disabling integrations or SSO, removalÌýor blocking ofÌýsoftware from institutional networksÌýand/or escalation toÌýleadership.Ìý