Software Internal Control Policy

Software Internal Control Policy

Purpose:  

This control is established to ensure Eastern Connecticut State University meets the standards for governing the use of approved and/or licensed software by State agencies, to maintain inventory control of software and to establish a uniform policy for the prevention of software copyright infringement.

Policy: 

1. The Budget Authority completes requisition to purchase software and sends requisition to purchasing. (During this process the end-user may consult with Analysis & Support Technician, CIT for technical assistance).
2. Purchasing forwards a copy of the requisition to the Analysis & Support Technician, CIT for analysis and approval.  CIT approves or modifies requisition, in consultation with end-user and returns to purchasing.  
3. Purchasing issues a purchase order, which indicates the software, will be shipped to CIT. 
4. The Analysis & Support Technician at CIT receives software package or authorization codes from the vendor and notifies the Budget Authority or end-user the product has arrived on campus.  The end-user coordinates installation with the Helpdesk or CIT. 
5. The Analysis & Support Technician at CIT provides control information and media to ITS Administrative Assistant for inventory purposes.  
6. The Administrative Assistant provides the Helpdesk with installation information for standalone applications.  For lab installs, the ITS Admin Assistant will provide an email with installation instructions. 
7. Helpdesk or lab technician provides inventory information to the ITS Admin Assistant to finalize the transaction.  
8. The ITS Admin Assistant maintains Critical Data Element and media for inventory control purposes. 

Critical Data Element:  

The software inventory will contain the following property control items. 

1. Assigned Identification Number: a numerical number assigned sequentially per fiscal year.  For example:  06-001.  06 fiscal year, 001 first entry of fiscal year. 
2. Title of Software:  
3. Description:  software name or functional application. 
4. Version: 
5. Manufacturer/Reseller: 
6. Software Serial/Registration Number(s) (if applicable)
7. Acquisition Type:  (leased, purchased, loan, gift) 
8. Acquisition Detail:  purchase order number, donation source or gift source) 
9. Initial Installation Date: 
10. Location and Identification Number of Computer:
11. Cost: 
12. Disposal:  Upgraded (list new serial number), transferred, sold or destroyed.  

Media Storage: 

All media and keys will be stored in a central ITS location and tied to the Critical Data Element inventory.  Combining the policy and Critical Data Element will ensure a closed process for software inventory.  ITS will maintain the Critical Data Element using QueTel's TraQ Software.  The media from the purchases will be stored in a lockable cabinet, inventoried in TraQ and a backup copy stored in a remote location.  Under no circumstances will access keys or media be removed from storage without an authorized Helpdesk work order.  Coordination will be required between CIT and the Critical Data Element administrator, the ITS Administrative Assistant.  

Administrative Procedures:  

The Chief Information Officer, working with Associate Vice President for Administration and Finance will be the responsible party for monitoring and establishing the software inventory.  The ITS Administrative Assistant working with CIT will establish and be responsible for the administration of the Critical Data Elements, physical security of software media and manuals.  Annually, a software inventory report will be produced and act as a basis for comparison with a physical inventory of the software library.  

All software purchased by the University will be registered to Eastern Connecticut State University, or the Connecticut State University System. Under no circumstances will an individual be named as licensee holder of any software bought, leased or owned by the State of Connecticut, or purchased with non-State funds for use by the State.  Personal software is software that is not licensed to the State of Connecticut or its subdivisions. Personal software may not be installed on any computer owned or leased by the State or the Federal Government or purchased with Federal Funds for use by the State, except in those specific instances covered in "License Agreements" found in Chapter 7 of the State of Connecticut Property Control Manual.  Any installation of personal software may compromise the integrity of the State's compliance with copyright laws and may expose the stand-alone computer or network file server to the introduction of computer viruses.  Faculty may purchase software for use on computers at the University through the ECSU Foundation.  Freeware, shareware, and software used at no cost to the University in the pursuit of the academic mission is covered under the Academic Freedom rules of the collective bargaining agreement.  If an individual faculty member wishes to download such software for use on a University-owned computer, they must determine the level of security risk associated with the product.  If assistance is required on the security classification of non-purchased software, individuals should contact the CIO via email.    For additional restrictions on software contact the University CIO.

This policy shall be incorporated into the University's technology plans and employee orientation program.

JRT:

12/12/08