Product Review Template

Confidential Page 1 1/30/2008 Insert Product Name Here Product Review Insert Requestor Here, Insert Requestor’s Department Here (Replace all blue wording with information relating to the product and change to black) Date submitted: 0/0/0 Incident tracking #: INCXXXX Product Overview This memo provides information from research conducted on Insert Product Name Here, Insert (very) Short Description Here. This information will be used to assess a potential product’s compatibility with the OUHSC campus technical infrastructure; identify possible risks associated with security; and identify potential cost efficiencies through coordinated licensing or existing shared technology services. The review process will enable the OU Health Sciences Center to maintain a resilient technical environment that meets the many security and compliance requirements of a diverse campus population. Business Purpose Insert a description of the business use case for purchasing/developing this product. Product Description and Scope Insert a complete listing of all features/components with detailed descriptions. Then elaborate on how this product and what features of it will be used in the OUHSC environment. Please complete the following to the best of your abilities. Some of the following sections may require assistance from a departmental Tier 1, the product’s vendor or HSC IT. When working with the vendor, try to contact someone in technical support. Technical support personnel will typically have better answers in these areas than the sales staff. To find the name of your departmental Tier 1, please check the Tier 1 Directory at http://it.ouhsc.edu/tier1/directory.cfm. Security Requirements Provide any information available about the types of data this product will contain, store or process. Is this data protected by law or regulation? What security features does this product provide? Specifically look for access controls (LDAP/directory services), authentication methodologies, and the use of encryption for data storage or transmission. Will this product require a security certificate? Network/Telecom Connectivity Insert here any information about how and why the product communicates across the OUHSC network (wired connection, wireless, telecom). What level of throughput is required by the product? How will the product utilize the network/telecom connection? Please provide network service and/or port information, if available. Database Connectivity/File Storage Insert here any information about how and why the product communicates with a database. Include the specific database platforms compatible with this product. What are the anticipated storage requirements for this product either in terms of database storage or file storage? Development Describe any application or web development that this product will require. Please describe all development, regardless of who is actually doing the development. Provide any available details regarding programming languages and/or development tools being used. User License Agreement Describe the license agreement and include the number of licenses included in this purchase. If this is an enterprise license, indicate that. Please note that the Terms and Conditions of any technology purchase must be approved by Purchasing and/or Legal prior to the purchase. Confidential Page 2 1/30/2008 Product Implementation Questions Please complete the following to the best of your abilities. Some of the following sections may require assistance from a departmental Tier 1, the product’s vendor or HSC IT. When working with the vendor, try to contact someone in technical support. Technical support personnel will typically have better answers in these areas than the sales staff. To find the name of your departmental Tier 1, please check the Tier 1 Directory at http://it.ouhsc.edu/tier1/directory.cfm. Answer the following questions “YES” or “NO”. If N/A is answered please give explanation. These questions will be used by HSC IT to determine if additional review is needed. Is this product currently being used in any OUHSC environment? If YES, for how long? Does/could the software/hardware support more than one application? Will the software/hardware be maintained or supported by a departmental Tier 1 or will support by HSC IT be required? If the hardware/software is classified as a tool, (compilers, debuggers, monitors, test tools), is this hardware/software used in a production environment? What operating system will this product use? Does this hardware/software require a modification or a recompilation of the operating system? (i.e. exits, system parameters, configuration files) Does this hardware/software have its own internal security or proprietary security features? Do the application activities that use this hardware/software require any administrator (Windows), root (UNIX) or authorized library (mainframe) access to implement or support their usage? Does the hardware/software provide a security control function for an application? (i.e. Input Control, Access Control, Processing Control, Output Control, Administrative/Change Control, Telecommunications Control) Will an application/infrastructure lose significant functionality if this hardware/software breaks? Does the product have specific availability requirements? Would compromise of the hardware/software result in unauthorized access to production programs or data? Does this hardware/software transmit data to/from non-OUHSC sites? Will this product need to be accessible from the Internet? Confidential Page 3 1/30/2008 Please return the completed Product Review form by attaching it to the e-mail message you received from OUHSC IT with the Incident INC# or send as an attachment to Servicedesk@OUHSC.EDU Potential Risks IT will summarize potential risks of this product on the OUHSC IT infrastructure, security and deployment. Recommendation and Controls This is a summary of Information Technology recommendations and controls to be considered before development, purchase or deployment of this product. Information Technology Review All Information Technology groups will review, identify potential impacts and make recommendations for deployment of this product. Department Representative Date Received Date Completed Infrastructure Services Application Services IT Service Desk Project Services Security Services Technology Sales