PSU Software Request Form: Classification, Accessibility, Export

To complete the Penn State Software Request Form, open it through the GURU portal at guru.psu.edu/forms/software-agreement, answer the compliance questions about accessibility, data classification, hosting, FERPA, enterprise integrations, and AI, and submit it to Penn State Procurement along with the vendor’s software agreement and an accessibility review from Penn State’s Accessibility Team.1Penn State Procurement. Software Request Process The same process covers paid licenses, renewals, and no-cost software that still requires Penn State to accept terms.

Who Has to Use the Form

Any Penn State employee who wants to install, use, or renew software for university business goes through this process. It covers software installed on university-owned hardware and cloud tools used for institutional work. Free and open-source tools count too, as long as the vendor asks Penn State to agree to terms of service or a license.1Penn State Procurement. Software Request Process

The requirement traces back to University Policy AD95. If the software will handle information classified as High (Level 3) or Restricted (Level 4), the Office of Information Security has to grant an Authority to Operate before the software goes live.2Penn State Policies. AD95 Information Assurance and IT Security

What to Have Ready Before You Open the Form

Three things keep the request from stalling at the first review:

  • The vendor’s software agreement, meaning the terms of service or end user license agreement.
  • A completed accessibility review from Penn State’s Accessibility Team.
  • Answers to the data-classification and technical questions the form will ask.

Penn State Procurement publishes a checklist of the exact questions the form asks. Looking at it before you start lets you line up answers you’ll need help with, especially around data sensitivity and system integrations.3Penn State Procurement. Software Request Checklist

Questions the Form Will Ask

The form is built around compliance questions rather than a product description.3Penn State Procurement. Software Request Checklist

  • Accessibility review. Has Penn State’s Accessibility Team confirmed the software meets Policy AD69? This review has to be done before you submit.
  • Remote access outside the U.S. Will the software, its documentation, or its data be accessed by users outside the United States? A yes flags the request for export-control screening.
  • Data classification. Will the software handle data classified as High (Level 3) or Restricted (Level 4) under AD95? The form specifically notes that Personally Identifiable Information as defined in AD53 falls into the High category.
  • Hosting location. Is the software cloud-based or vendor-hosted, locally installed on Penn State hardware, or something else?
  • FERPA data. Will the software store, process, or manage any student education records protected under FERPA?
  • Enterprise system integration. Will data flow between this software and LionPATH, WorkLion, SIMBA, or Canvas?
  • AI functionality. Does the software include any artificial intelligence features? If so, Penn State’s AI Guidelines apply.

Classifying Your Data Correctly

Several questions on the form turn on how you classify the data the software will touch. Getting this wrong is one of the fastest ways to have a request sent back. AD95 defines four levels:2Penn State Policies. AD95 Information Assurance and IT Security

  • Restricted (Level 4). Data controlled by law, regulation, or contract, where unauthorized disclosure carries civil or criminal penalties. Payment card data governed by PCI-DSS and data subject to FISMA moderate or high standards sit here.
  • High (Level 3). Data whose exposure would cause significant social, financial, legal, or reputational harm. PII as defined in AD53 and HIPAA-protected health data fall into this level.
  • Moderate (Level 2). Data whose unauthorized disclosure would have adverse but not severe effects. Non-PII student records and personnel records are typical.
  • Low (Level 1). Minimal risk if exposed, such as publicly available information, published research, and preliminary research data.

If the software handles High or Restricted data, the Office of Information Security must grant an Authority to Operate before use. A provisional Authority to Operate is available while OIS review is in progress, but only if you inform OIS and certify that the data is properly secured in the meantime.2Penn State Policies. AD95 Information Assurance and IT Security

Getting the Accessibility Review Done

The accessibility approval is one of the three documents you must attach, so it isn’t something you can defer. Penn State’s Accessibility Team at accessibility@psu.edu runs the evaluation against Policy AD69.4Penn State Policies. AD69 Accessibility of Information and Communications Technology

If no accessible alternative exists from any vendor and the software doesn’t fully meet AD69, Penn State can still procure it, but only with an Equally Effective Alternate Access Plan (EEAAP) in place before the software enters an academic or business environment. Contact the team early. Waiting until the rest of your request is ready can add weeks if the product needs a detailed review or an EEAAP needs drafting.4Penn State Policies. AD69 Accessibility of Information and Communications Technology

How and Where to Submit

Where your submission goes depends on how the software will be paid for. In every case you attach the same three documents: the vendor’s software agreement, the completed Software Request Form, and the accessibility approval.1Penn State Procurement. Software Request Process

  • Purchase order. Create a Non-Catalog Purchase Requisition in ServiceNow and attach all three documents.
  • Purchasing card. Email the three documents to purchasesoftware@psu.edu.
  • No-cost software. Same email route: send all three documents to purchasesoftware@psu.edu.

If the software you need is already approved and available at no charge, you can browse and download it at softwarerequest.psu.edu instead. Faculty and staff shopping for paid software can use the IT Software tile in PSUbuy, which requires web-based training the first time you access it.5Penn State IT. Penn State IT Software – Available Tools and Downloads

Renewing Without Starting Over

Renewals use Penn State’s One-Time Delegation Approval. An initial approval is automatically valid for one year from the approval date. You can qualify for a two-year delegation if all of the following stay true:1Penn State Procurement. Software Request Process

  • The software does not involve High (Level 3) or Restricted (Level 4) data under AD95.
  • No AI functionality is used.
  • None of the original Software Request Form answers have changed, including the employee who received the one-time approval.
  • Your business area has maintained the original acknowledgments and contingencies in the delegation approval.

If any of those conditions stop holding, perhaps because the vendor added an AI feature in an update or you’ve started using the software with a higher data classification, you have to run the full request process again rather than renew under delegation.

Export Control Flag

The form asks about access outside the United States because federal export control laws, including ITAR, EAR, and OFAC regulations, can restrict the transfer of certain technology and data across borders. Penn State’s Office of Export Compliance handles the screening.6Research Support. Export Control

If your software involves proprietary technology, controlled data, or research with international collaborators, email the Office of Export Compliance at export@psu.edu before submitting the form. The office maintains an Item Classification Lookup tool to help determine whether your software or data falls under ITAR or EAR controls. Raising this early avoids an outcome where the request is approved internally but can’t legally be used the way you intended.