Software and Online Services - Security and License Review
The North Dakota University System (NDUS) requires that all software be reviewed in accordance with NDUS Policy 840
Before software and online services can be purchased, installed or made available for use by NDSU students, faculty and staff, contract and license information must be reviewed for compliance with North Dakota laws, State Board of Higher Education policies and NDSU policies. This review must occur even if the platform or software is free. This review also needs to happen if there is hardware that is purchased that sends data to an online service.
The Office of the Vice President for Information Technology facilitates the Software and Online Services License Review process in collaboration with the North Dakota Attorney General's Office campus representative.
If you have questions or need assistance, please contact Wendy McCrory at wendy.mccrory@ndsu.edu, (701) 231-7093 or ndsu.itso@ndsu.edu.
Policies and Procedures
The contract and license review process is driven by the North Dakota Attorney General, State Board of Higher Education policy and NDSU policy.
- North Dakota Century Code § 32-12.2-15(5)
- N.D. State Board of Higher Education Policy 840: Contract Review
- NDSU Policy 712: Contract Review
Review Process
A minimum of 2 weeks is needed to review software and online services.
Process of Department Requesting New Software or Online Services
- Determine the laws, regulations, policies or contractual obligations that apply to the data that the software or online service will handle. See NDUS Procedure1203.7
- Work with your [Link for document 97435 is unavailable at this time] to complete the Software and Online Service Contract Review request form.
- Respond with additional information and clarification as requested by the chief information security officer, legal, or software licensing staff
- Facilitate communication with all parties to complete the purchase order.
- Collaborate with the vendor to amend the license or contract as recommend by the Attorney General's office if needed.
Process of the Office of the Vice President for Information Technology
- Review the license and contract in consideration of State Board of Higher Education Policy 840 and NDSU Policy 712
- Assess the level of risk associated with purchasing, installing and using the software or online service, and make a recommendation based on that risk assessment.
- Facilitate communication among parties, including:
- Consult with Attorney General's office if purchase is over $1,000 or issues with data privacy, confidentiality, or compliance with law or policy emerge during the review process.
- Record and track approved software and online services licenses and contracts, including amended language, for the university.