Requestor Name
Requestor Email
Requestor Department
Requestor Division 

Product Name
Vendor Name
Product Website
Vendor Rep. Name
Vendor Rep. Email
How the Product will be used
Product Category
Purchase Amount
Funding Source
Type of License (monthly, annual, multiyear)
Renewability

Generalized or jargon-filled terms are examples of what not to do.

Data Classification Level [pdf] (Level 1, 2 or 3). NOTE: For cloud-based level 1 and level 2 software, a current security document [pdf] is required.

Will the supplier access any academic records?  If yes, describe the purpose
Will the supplier access any medical records?  If yes, describe the purpose
Will the supplier access any financial transactions? If yes, describe the purpose
Is the software cloud-based or hosted on premises?
If the software is cloud-based, please identify the data center locations
Does the software support SAML2 Single Sign-on?
Does the software have AI features or AI components?

How will the technology be used at SJSU: academic/curricular, employment/administrative or campus operations/services

Who will use the technology (non-public, public, web based), the anticipated user groups (faculty, students, staff, multiple) and number of users.

A completed Accessibility Conformance Report / VPAT and/or accessibility statement from the vendor. This is required for all submissions except a few exceptions. 

VPAT stands for Voluntary Product Accessibility Template. It is a standardized document used by software, hardware, and technology vendors to describe how their product conforms to accessibility requirements, including Section 508 of the U.S. Rehabilitation Act.

CSU follows the U.S. government's Section 508 guidance, and recommends that vendors complete the VPAT edition that includes the Revised Section 508 standards. The most recent version of the VPAT® can be downloaded from the ITI website.

ACR stands for Accessibility Conformance Report. An ACR is the completed accessibility report that results when a vendor fills out a VPAT for a specific product or service.

The ACR provides detailed information about the product's accessibility conformance and is typically reviewed as part of the TRIA/CUSBUY accessibility evaluation process.

The terms are often used interchangeably, but they are not the same:

VPAT = The blank template used to evaluate and document accessibility.

ACR = The completed report generated from the VPAT that describes a specific product's accessibility conformance.

An ACR helps procurement and accessibility reviewers understand how well a product meets accessibility requirements and identify any known accessibility barriers. Reviewing an ACR supports informed purchasing decisions and helps ensure that products acquired by the institution are accessible to users with disabilities.

SOC2 Type 2 - System and Organization Controls Type 2

HECVAT - Higher Education Community Vendor Assessment Toolkit

ISO - Information Security Office

SSO - Single Sign On

MFA - Multi Factor Authentication

You should submit a TRIA (Technology Request for Information Accessibility) when: (1) Your request will not be paid with state funds, and (2) Your request will not be submitted through CSUBuy.

If your request is paid with state funds and/or will be entered into CSUBuy, a TRIA submission is no longer required.

Instead, complete the appropriate request form based on the type of purchase:

Software Purchases: Submit an IT Software Request.

Hardware Purchases: Submit an IT Hardware Request.

Vendor-Provided Services: Submit a Goods and Services Request for (1) Professional services, (2) Vendor-conducted surveys, (3) Maintenance agreements, (4) Other vendor-provided services

Software:  IT Software Request

Hardware:  IT Hardware Request

Services, surveys, or vendor maintenance:  Goods and Services Request

Non-state-funded purchases not submitted through CSUBuy: TRIA

If you are unsure which form applies to your purchase, consult your procurement or TRIA team before submitting your request.

For any question, you can always fill in “Don’t Know” or “Not Sure.” After you submit the form, the TRIA team will contact you for any clarification needed.

It is OK to submit the TRIA when you do not have the VPAT and/or the required security document yet, though it might slow down the process.

If you have a multi-year agreement, you may be able to use the quick approval route.  Please open the TRIA form and answer the first set of questions to confirm you meet the criteria to proceed to requisition. (An active, executed multi-year agreement requires TRIA only in the first year. An exception is if there are added modules or if the use of the tool fundamentally changes and therefore can impact accessibility or security risk.)

Yes, since the use case (purpose and users) might be different for each purchase. 

Yes.

Yes.

A self-service dashboard for requesters with status updates is in development. In the meantime, please reach out to @TRIA Review Mailbox for status update.

Primary users are any SJSU personnel who wish to purchase technology-related products or want to use freeware in the SJSU environment.  Stakeholders are IT personnel and IT management that review and approve the request.

Any feedback is greatly appreciated. Please send them to TRIA Review Mailbox.

Refer to the Information Classification cheat sheet [pdf]. Please review it in order to appropriately classify the application.

Anything classified as Level 2 and above requires a security document. While multiple documents are viable, we prefer the HECVAT 4 as it contains AI and Privacy related information. For more information, please refer to the Required Documentation for TRIA Security Review for Cloud Hosted Purchases Document [pdf].

Please notify the Information Security team. We can work with you to review mitigations on SJSU’s side. In the future, we highly discourage working with vendors that conduct this behavior.

Yes, an AI risk assessment must be completed, to check for AI and privacy-related concerns. Please contact the Information Security team.

This must be completed by the software vendor. Please contact the vendor to receive this documentation

We only review the first year of the multiyear, and do brief checkups throughout the life of the contract.