Submit Request for Review

Breadcrumb

To submit a Request for Review of ICT, the CU Requestor gathers all necessary accessibility and security information for the ICT review team to perform an initial evaluation and, if needed, conduct a complete accessibility or security review.

The sections below guide the CU Requestor through completing the ICT Review Process.

To start the review process, the CU Requestor must complete the Digital Technology Compliance Review Request (Form A).

You will receive an email confirmation of your submission with an assigned ticket number. The email will contain information regarding whether your requisition can move forward or needs further accessibility and security review. The classification of the impact will determine the depth of the accessibility and security reviews necessary and the additional information that will be needed to complete the review.

For high-impact security determinations, the ICT review team will need the ICT Security Review (Form B) to be completed. Please see the Security Information section for more information.
For high-impact accessibility determinations, the ICT review team will need the ICT Accessibility Review (Form C) to be completed. Please see the Accessibility Information section for more information.
For low-impact determinations, the CU Requestor can move forward with the requisition following the instructions provided in the email notifications.

For high-impact security requisitions, either the CU Requestor or the Supplier (based on where the data will be stored) must complete the ICT Security Review (Form B).

If this product/service/application is installed on campus, the CU Requestor must complete the ICT Security Review (Form B).
If this product/service/application is hosted by a 3rd party, the Supplier must complete the ICT Security Review (Form B). CU Requestor should notify the supplier to complete this form as soon as possible, providing them with the review ticket number that was provided on submission of the Digital Technology Compliance Review Request (Form A). The CU Requestor will receive an email notification when the completed form has been received by the ICT review team.

When the ICT Security Review (Form B) has been received by the ICT review team, a high-impact security review of the product of service will be conducted. The high-impact security review of the product or service involves a thorough investigation which may include:

Identification and classification of University data
Verification of IT security standards and validation of compliance to those standards
Vulnerability scans if the technology is to be hosted on any CU asset
The completion of a Service Continuity Plan based on the data involved and impact the service provides to the University
Collection and review of additional information from the supplier including, but not limited to, SOC I or II/SSAE 16 audits, ROCs, alternative internal audits, application scans, vulnerability scans, or an IT Security Audit performed by the CU Boulder Security Office

Additional steps may be requested of both the CU Requestor and Supplier, if the requisition is to be part of a CU Boulder provided IT Service.

For high-impact accessibility requisitions, the Supplier will need to complete the ICT Accessibility Review (Form C).

The CU Requestor should instruct the supplier to complete this form, providing them with the review ticket number that was provided on submission of the Digital Technology Compliance Review Request (Form A).

The Supplier will also need to provide a VPAT, a WCAG checklist, or equivalent documentation ensuring compliance as part of this form. If the product or service is only partially compliant, the Supplier may also need to provide an ICT Accessibility Roadmap and suggested interim workarounds while remediation is in progress.

The ICT accessibility review team will need all necessary forms and information from the Supplier before the full review can be conducted.

When the ICT Accessibility Review (Form C) has been received by the ICT accessibility review team, a high-impact accessibility review of the product of service will be conducted. The high-impact accessibility review of the product or service involves a thorough investigation which may include:

External testing by the supplier
Internal testing by the Digital Accessibility Office
Preparation of an accessibility plan by the department while remediation is in progress

Based on the results of the accessibility review, the Purchasing Service Center (PSC) may need to propose or negotiate accessibility compliance contract language with the supplier. The ICT review team will notify the CU Requestor once the review has been completed and if the process can move forward or more needs to be done.

Submit Request for Review

Breadcrumb

ICT Review Process Overview

Help & Feedback

Search

Other ways to search:

Submit Request for Review

Breadcrumb

ICT Review Process Overview

Help & Feedback