IT Procurement Compliance and Security Form

IT Procurement Compliance and Security Form

The IT Procurement Compliance and Security (IT-PCS) form is required before acquiring or purchasing many IT products or services at UMB.

Submitting the form helps ensure proposed software, hardware, or services meet university requirements for security, privacy, accessibility, compatibility, and compliance.

What is the IT-PCS form?

The IT-PCS form allows the requesting department to share key details about a proposed IT product or service so it can be reviewed by the appropriate campus teams prior to purchase or implementation.

Reviews may involve one or more of the following groups, depending on the nature of the request:

• School or unit IT department
• CITS Security & Compliance
• Web Accessibility Team
•  Strategic Sourcing and Acquisition Services (SSAS), when contracts or agreements are involved

 Which purchases require an IT-PCS form?

• All software purchases, regardless of cost
• Free or open‑source software used to store, process, analyze, or access UMB data
  (e.g., Python, R, research or analysis tools)
• Cloud-based or third-party hosted IT services
• Website or application development services
• Networking equipment
• Desktops, laptops, tablets, cellphones, or other devices that contain data
• External hard drives and other storage devices

**If the software will be used for research, clinical work, instruction, administration, or data analysis, an IT‑PCS form is generally required.

**If you’re unsure whether an IT‑PCS form is required, submit the form. Requests that do not require review will be routed accordingly.

Which purchases do not require an IT-PCS form?

• Computer peripherals (e.g., monitors, docking stations, mice, keyboards, cables, adapters)
• Computer Parts (e.g., RAM, GPUs, CPUs)
• Non-networked audio/video equipment
• Software purchased via CITS Software Licensing Center
• Common, locally installed utility software used only for general productivity 
  (e.g., web browsers, PDF readers, file compression tools, terminal/SSH clients, basic text editors)
• Internal add‑on packages or modules to already‑approved software
  (e.g., R packages installed within R/RStudio)

**This does not include third‑party add‑ins, extensions, or plugins that require accepting separate license or use agreements.

How do I complete the IT-PCS form?

The requesting department will need to gather information about the IT product/service and answer questions using the online IT-PCS form. Once submitted, the proposed IT purchase will be reviewed. Once the review is completed and approved, the requestor will be notified.

What happens once the IT-PCS form is approved?

Once the IT-PCS is approved, the department may proceed with the purchase through the appropriate purchasing process (e.g. PCard purchase or Requisition).

• For PCard Purchases, the department is required to retain a copy of the approved IT-PCS form with their PCard records for each applicable IT purchase. A PDF of the approved form should be uploaded into Quantum with the expense report for all applicable PCard IT purchases. 
• For “Free” software/hardware, Any contracts, license agreements, or other use agreements for the “free” software/hardware also require review by SSAS.
• Note that any contracts, license agreements, or other agreements for the purchase or acquisition require review by SSAS by emailing the documents to SSAS-CONTRACT-REVIEW@UMARYLAND.EDU.

How Often Do I Need to Submit the IT-PCS Form?

One submission is required for each department or use case of an IT product or service. Renewals and recurring payments do not require a new submission.

After the initial submission, the system will automatically send periodic reminders to revalidate your original submission and confirm whether the product or service is still in use at UMB. These reminders do not require new form submission. If there are changes, such as additional features, expanded scope, or new modules, the original IT-PCS submission should be updated to ensure it reflects the current state of the product or service.

Exceptions:

If the product or service is being expanded, or if new features or modules are being purchased, you must update your original IT-PCS form submission. This allows the review teams to re-evaluate the purchase for compliance, security, and operational impact. Such updates may be required outside of the regular review cycle.

• One submission per product/service: No need to re-enter the form for each renewal or payment cycle unless there are significant changes.
• Automated reminders: You will receive periodic notifications to review and confirm continued use.
• Update required for expansion: If you add new or remove existing features, modules, or expand the scope of the product/service, edit your existing submission for a new review.

When in doubt, ask CITS Security and Compliance or SSAS