Technology related contract and product review
As part of UAB’s contract review process, UAB IT is responsible for reviewing any University contract that includes an IT or technology related component prior to contract execution. We review security protocols in the system or solution as well as identify IT resources needed for the purchase, such as single sign-on, installation, etc.
Get Started
1. Confirm your data type
Complete the data classification worksheet and review the requirements for public, sensitive and restricted data.
If you need access to HR data, please contact HR Information Systems before submitting a ticket to UAB IT at
2. Gather your documentation
Review the required documents below for your data classification.
3. IT request
Fill out the product/contract review form to send your request to IT.
4. Final Submission
Once the contract has been approved by IT, submit your contract through UABs Contract Management System for legal review. (Note: You will need your ServiceNow RITM number (EX. RITM01000000) to submit the contract.)
Required Documents for a Product/Contract Review
NOTE: If a vendor requests an NDA, we recommend this process, which typically takes less time:
- Ask the vendor to sign a CDA.
- Once the vendor returns the CDA, process it as you would a regular contract needing an official signature by submitting to the Contract Management System.
- Once you have both the vendor’s signature and the official UAB signature, please send the CDA document to the vendor and ask the vendor to send over documents. If they refuse and send you to a security portal, please send us a link to the portal.
-
Public Data
Public Data
- Contract/Invoice
- Use Case Form
-
Sensitive Data
Sensitive Data
- Contract/Invoice
- Use Case Form
- One of the documents listed below:
-
- HECVAT lite (Preferred)
- SSAE16 SOC2
- ISO 27001
- CSA CAIQ
- HSIS RA
- Data Steward Approval will be collected by Governance.
Note: The documents must be less than one calendar year old.
-
Restricted Data
Restricted Data
- Contract/Invoice
- Use Case Form
- One of the documents listed below.
- HECVAT full (Preferred)
- SSAE16 SOC2
- ISO 27001
- CSA CAIQ
- HSIS RA
- Data Steward Approval will be collected by Governance.
Note: The documents must be less than one calendar year old.
Estimated Turnaround Time
Turnaround time is determined by the type of data that will be stored or used in any IT-Related contract and all required documentation has been provided. Our Enterprise Information Security Office will review contracts with data identified as Sensitive and Restricted. Below are the estimated turnaround times:
- Public Data should be 1-2 business days
- Sensitive Date should be 1-7 business days.
- Restricted Data – NO SLA
*Reviewed by UAB Health System Information Services.