Buying Software and Cloud Computing

According to the UC Electronic Information Security policy (BFB IS-3), all systems that create, store, process, or transmit data internally at UCSF or externally through a supplier or other third party must be assessed for risk. This applies to all UCSF data, including but not limited to PHI, PII, PCI, RHI, FERPA and other restricted or sensitive data. UCSF prioritizes the highest-risk systems for a full security risk assessment.

If you are purchasing a software product or cloud service that creates, stores, processes, or transmits UCSF data, a full security risk assessment may be required.  

• Before placing your order in BearBuy, contact IT Security at [email protected] to determine whether a risk assessment is required.
• For more information on the risk assessment process, including how to request an assessment, what supporting documents are required, and what to expect during the process, visit the IT Security Risk Assessment page.

1. Accessing BearBuy

1. Login to your UCSF MyAccess account.
2. Click on the BearBuy link to open the application.
3. Note: You may need to click the Manage Favorites button in UCSF MyAccess to view the complete list of applications.
   

2. Navigating to the Software & Cloud Computing Form

1. In BearBuy, scroll to the bottom of the homepage to find the Software & Cloud Computing Form (in the Forms for Specific Purchases section).
   ​​​​​
2. Click on the form to open it.
   
3. The form opens in your browser window.
   ​​​

3. Completing the Software & Cloud Computing Form

Read the instructions on the left side of the form and enter all required information indicated with an asterisk (*) on the form

1. IT Security Risk Assessment: Contact IT Security at [email protected] to determine if a Risk Assessment is required. Complete and attach the Risk Assessment Completion Email (provided to you by IT Security) to your form in BearBuy before submitting the order. Otherwise, attach the Risk Assessment Intake Email Response from IT Security indicating that no assessment is required.
2. Supplier: Start typing the supplier name and select it from the list that appears. Otherwise, submit the appropriate Supplier Registration form to [email protected] to request to add the new supplier to BearBuy.
3. Fulfillment Address: This is the supplier's address where the order will be fulfilled. You may be able to select a different address if the Pencil icon appears. To add or update an address, email [email protected] for assistance.
4. Supplier Contact: Enter the name, phone number and email address of your supplier contact.
5. Department Information: Specify the Department Name and the department technical contact who will answer technical questions about the software purchase.
6. Software Information & Justification: Enter the start and end date for your software and a brief description of the software or service, including but not limited to (1) what it will be used for and (2) whether and what kind of UC data will be hosted, stored or accessed by the supplier. When using an established UC agreement, enter the contract information (title, reference, number, etc.).
7. Statement of Work: When purchasing services, establish a Statement of Work. Determine the payment structure based on completion of work, achievement of project milestones, or phases of work or provision of acceptable deliverables.
8. HIPAA: Select "Yes" only if the supplier will have access to Protected Health Information (PHI). Otherwise, select "No."
   1. Note: If UC PHI will be transmitted or stored outside the University's system, please initiate the IT Security Risk Assessment as early as possible so as to not delay the release of your PO.
9. FWFW: Select "FWFW" only if the supplier will provide services at a location owned or leased by UC. Otherwise, select "No."
10. License or Service Agreement: Indicate whether this transaction results from a current or prior License or Service Agreement with the supplier and if yes, provide the PO or Agreement number, if known.
11. Estimated Cost: Enter the total estimated dollar value of the software or service in the "Not-to-Exceed Price" field.
12. Commodity Code: Select a Commodity Code from the dropdown list, such as 00256-Software<$5,000/Cpy-52305. During checkout, you can override this value, see Accounting Guidance below.
13. Conflict of Interest: Select the radio button to agree to the statement; otherwise, contact your Department-Assigned Buyer prior to submitting the form if you believe the purchase may involve a conflict of interest.
14. Price Reasonableness & Source Selection: Only complete this section for federally funded purchases ≥ $10,000 (including tax and shipping) and/or non‐federally funded purchases ≥ $100,000 (excluding tax, but including shipping). For orders > $100,000, please contact your SCM Department-Assigned Buyer prior to submitting the form. If selecting Non-Formal Quotes, attach three (3) qualifying competitive quotes to the Attachments section at the bottom of the form. For details, read the Price Reasonableness and Source Selection FAQs.
15. Attachments: Attach any required or applicable documents, such as the IT Security Risk Assessment or Statement of Work. Note: External Attachments will be sent to the supplier along with the purchase order (PO) and remain viewable within BearBuy.
16. When finished, select the Add And Go To Cart button located at the top of the form (or select "Add to new Cart" from the dropdown). Note: To add multiple forms to your cart, select "Add To Cart and Return" from the dropdown.
    

4. Submitting your order

1. After adding the form(s) to your shopping cart, check/uncheck the Taxable box to indicate whether the line item is taxable. The taxability of software can vary. Software delivered through physical media (e.g., CD, thumb drive) is Taxable; software delivered electronically is NOT taxable.
2. When purchasing software for campus (business unit "SFCMP"), review the Accounting Guidance below to determine the appropriate Account. If necessary, click the Proceed to Checkout button at the top of your screen and enter the Account in the Accounting Codes section on your order.
3. Next, assign the cart to your department’s Requester to complete the checkout process and submit the requisition.
4. After the requisition is submitted, the order will route to your department’s Requisition Approver for approval (typically, for orders > $500).
5. Finally, the requisition will route to your SCM Department-Assigned Buyer to review/approve.
6. Once the requisition is fully approved, a purchase order (PO) and any External Attachments will be sent to the supplier.