Administrative Regulations Home
Software Acquisition
Private Space Designation and Use
Work Breaks
Web Content Management
Video
Vehicle Usage
Vacation
Travel Procedures
Travel Card
Trademarks and Photographs
Tobacco Use
Tax Sheltered Annuity Program
Surveillance Cameras
Substantive Change Procedure (SACSCOC)
Student Per-Term Credit Hour Limits
Student Employment: Federal Work-Study
Student Dress Code
Student Complaints
Student Attendance and Class Participation
Social Media Guidelines
Sick Leave Pool Administrative Guidelines
Sick Leave
Assistance Animals - Service Animals
Annual Security and Fire Safety Report
Scholastic Probation or Suspension
Scholastic Integrity
Safety Manual
Responsibilities of Student Organization Advisors
Research Security Program Framework
Access to Educational Records of Deceased Students
Records Retention Schedules and Management Training
Recording of Class Lectures by Students
Quiet Hours and No Loitering
Purchasing
Procurement Card (P-Card)
Printing Guidelines
Payment of Medical Care Costs for Student Athletes
Parking and Traffic Regulations
Outside Employment
Excused Absences for Students Called To Active Military Service
Blinn Announcement (Mass Email) Guidelines
Building Access Key and Card Regulation
Institutional Scholarships/Pell Grant Award Coordination
Information Resources Acceptable Use, Security and Copyright Infringement
Incivility Protocol
Hiring Manager’s Guide For Faculty and Staff
Graduation
General Educational Development Test Administration
Flexible Work Schedules
Financial Support for Student Organizations
Final Course Grade Appeal
Faculty Workload, Teaching Load, and Office Hours
Faculty Professional Development
Unearned Tuition Assistance Funds
Facility Naming Rights
Externally Funded Grants and Contracts
Expulsion of Students from Class
Expressive Activities on Campus by Students and Employees
Employee Progressive Discipline
Employee Performance Evaluations
Assistance Animals - Emotional Support Animals
Cell Phone Allowances
Emergency Response Plan
Employee Book Voucher
Emergency Procedures Manual
Athletic Department Drug Testing
Drug and Alcohol Prevention Program (DAAPP)
Disposal of Property
Display Screen Guidelines
Discretionary Time
Direct Deposit, Payroll
Capital Asset Guidelines
Campus Security Authorities
Campus Carry
Information Systems and Services
Information Systems and Information Integrity
Information Systems and Communications Protection
Information Systems Supply Chain Risk Management
Information Systems Security Planning
Administrative Organization Plan - Councils and Committees
Information Systems Security Assessment and Authorization
Information Systems Risk Assessment
Prohibited Technologies and Covered Applications
Information Systems Media Protection
Information Systems Maintenance
Information Systems Security Program
Information Resources Acceptable Use, Security and Copyright Infringement
Information Systems Incident Response
Information Systems Identification and Authentication
Information Access Control
Photo Identification (ID) Card
Faculty Credentialing Procedures
Blinn Alert Notification
Student Code of Conduct
Approved Vendors for Apparel and Promotional Items
Alternate Work Location
Admission Requirements and Registration Eligibility
Web Accessibility
Board Policy/Administrative Regulations Development and Approval
Quarantine Leave for Certain Law Enforcement and EMS Personnel
Outdoor Intramural Spaces Guidelines
Name, Image, and Likeness
Indoor Tabling Guidelines
Hazing Prevention
Credit by Examination, Prior Learning Assessment, Awarding Credit
Additional Education During Term of Employment
Post Accident Drug and Alcohol Testing
Personal Leave
Prohibition Against Inducements, Commission and High-Pressure Recruitment Tactics for Service Members
Continuity of Operations Plans
Employee Complaints
Community Users of the Blinn College Library
College District Closures
College District Brand Guidelines
College Catalog Policy
Information Systems Physical and Environmental Protection
Information Systems Personnel Security
Information Systems Contingency Planning
Information Systems Configuration Management
Information Systems Awareness and Training
Information Systems Audit and Accountability
Awarding Incomplete Grades
Athletic Awards Criteria
Assessment of Instructional Programs and Courses
Board Policy CS - Information Systems

Administrative Regulations Home Software Acquisition Private Space Designation and Use Work Breaks Web Content Management Video Vehicle Usage Vacation Travel Procedures Travel Card Trademarks and Photographs Tobacco Use Tax Sheltered Annuity Program Surveillance Cameras Substantive Change Procedure (SACSCOC) Student Per-Term Credit Hour Limits Student Employment: Federal Work-Study Student Dress Code Student Complaints Student Attendance and Class Participation Social Media Guidelines Sick Leave Pool Administrative Guidelines Sick Leave Assistance Animals - Service Animals Annual Security and Fire Safety Report Scholastic Probation or Suspension Scholastic Integrity Safety Manual Responsibilities of Student Organization Advisors Research Security Program Framework Access to Educational Records of Deceased Students Records Retention Schedules and Management Training Recording of Class Lectures by Students Quiet Hours and No Loitering Purchasing Procurement Card (P-Card) Printing Guidelines Payment of Medical Care Costs for Student Athletes Parking and Traffic Regulations Outside Employment Excused Absences for Students Called To Active Military Service Blinn Announcement (Mass Email) Guidelines Building Access Key and Card Regulation Institutional Scholarships/Pell Grant Award Coordination Information Resources Acceptable Use, Security and Copyright Infringement Incivility Protocol Hiring Manager’s Guide For Faculty and Staff Graduation General Educational Development Test Administration Flexible Work Schedules Financial Support for Student Organizations Final Course Grade Appeal Faculty Workload, Teaching Load, and Office Hours Faculty Professional Development Unearned Tuition Assistance Funds Facility Naming Rights Externally Funded Grants and Contracts Expulsion of Students from Class Expressive Activities on Campus by Students and Employees Employee Progressive Discipline Employee Performance Evaluations Assistance Animals - Emotional Support Animals Cell Phone Allowances Emergency Response Plan Employee Book Voucher Emergency Procedures Manual Athletic Department Drug Testing Drug and Alcohol Prevention Program (DAAPP) Disposal of Property Display Screen Guidelines Discretionary Time Direct Deposit, Payroll Capital Asset Guidelines Campus Security Authorities Campus Carry Information Systems and Services Information Systems and Information Integrity Information Systems and Communications Protection Information Systems Supply Chain Risk Management Information Systems Security Planning Administrative Organization Plan - Councils and Committees Information Systems Security Assessment and Authorization Information Systems Risk Assessment Prohibited Technologies and Covered Applications Information Systems Media Protection Information Systems Maintenance Information Systems Security Program Information Resources Acceptable Use, Security and Copyright Infringement Information Systems Incident Response Information Systems Identification and Authentication Information Access Control Photo Identification (ID) Card Faculty Credentialing Procedures Blinn Alert Notification Student Code of Conduct Approved Vendors for Apparel and Promotional Items Alternate Work Location Admission Requirements and Registration Eligibility Web Accessibility Board Policy/Administrative Regulations Development and Approval Quarantine Leave for Certain Law Enforcement and EMS Personnel Outdoor Intramural Spaces Guidelines Name, Image, and Likeness Indoor Tabling Guidelines Hazing Prevention Credit by Examination, Prior Learning Assessment, Awarding Credit Additional Education During Term of Employment Post Accident Drug and Alcohol Testing Personal Leave Prohibition Against Inducements, Commission and High-Pressure Recruitment Tactics for Service Members Continuity of Operations Plans Employee Complaints Community Users of the Blinn College Library College District Closures College District Brand Guidelines College Catalog Policy Information Systems Physical and Environmental Protection Information Systems Personnel Security Information Systems Contingency Planning Information Systems Configuration Management Information Systems Awareness and Training Information Systems Audit and Accountability Awarding Incomplete Grades Athletic Awards Criteria Assessment of Instructional Programs and Courses Board Policy CS - Information Systems

Software Acquisition

SUBJECT: Software Acquisition
EFFECTIVE DATE: March 23, 2026
BOARD POLICY REFERENCE: CS, CR, CT
RESPONSIBLE DEPARTMENT: Academic Technology Services / Purchasing / Office of General Counsel

PURPOSE

Establish a standardized, secure, and compliant process for the evaluation, procurement, approval, implementation, and lifecycle management of all software used by the Blinn College District (“College District”). This Regulation ensures alignment with College District purchasing requirements and Information Security Administrative Regulations that govern data protection, system integrity, cybersecurity controls, and acceptable use.

SCOPE

This Regulation applies to all College District employees, contractors, vendors, and organizational units involved in the acquisition, installation, or use of software, including but not limited to:

On premises software systems
Cloud hosted or Software as a Service (SaaS) solutions
Subscription based or licensed locally installed software
Desktop, mobile, or web-based applications
Any system requiring authentication, network connectivity, or handling protected College District data

No software may be acquired, installed, or used on College District information systems without full compliance with this Regulation.

DEFINITIONS

Software: Any application, system, platform, cloud service, or executable code used to support instructional, administrative, operational, or technical functions.
Information System Owner (ISOw): The employee responsible for the functional area and business purpose supported by the software.
Academic Technology Services (ATS): The department responsible for infrastructure, information security, system integrations, and technical support.
TX-RAMP: Texas Risk and Authorization Management Program governing security standards for cloud computing services.

4. REGULATION

4.1 Initiation of Request

Departments must identify the operational needs for new or replacement software.
A Software Acquisition Intake Form shall be completed and must include:
1. Description of functional need
2. User groups and estimated user count
3. Data elements stored, processed, or transmitted
4. Hosting model (on premise, SaaS, cloud, hybrid)
5. Integration requirements
6. Accessibility/ADA documentation such as VPAT
The completed Intake Form must be submitted to the department head and ATS.

4.2 Information Security Review

ATS shall complete a security assessment prior to any procurement activity.

4.2.1 Risk Assessment (RA-01)

Evaluate data classification and applicable compliance requirements.
Assess confidentiality, integrity, and availability impacts.
Document risks and required mitigations.

4.2.2 TX-RAMP Applicability

All cloud systems must undergo TX-RAMP Level 1 or Level 2 review unless exempt.
A TX-RAMP Questionnaire must be completed in coordination with the Information Security Officer before acquiring a cloud system.

4.2.3 Information Security Program Compliance (PM-01)

Verify administrative, physical, and technical safeguards.
Verify defined security roles, responsibilities, and oversight.

4.2.4 System & Information Integrity (SI-01)

Review vendor vulnerability management, flaw remediation, monitoring, and alerting.
Verify patch management processes.

4.2.5 Acceptable Use & Data Protection Compliance

Ensure compliance with the Information Resources Acceptable Use, Security, and Copyright Infringement Regulation.
Confirm data is encrypted at rest and in transit.
Confirm acceptable retention, backup, and disposal practices.

4.3 ADA / Accessibility Requirements

Software must comply with ADA and accessibility standards.

4.4 Procurement Requirements

4.4.1 Budget Authorization

All software purchases must follow the College District budget and financial processes.
Departments must confirm available budget funds.

4.4.2 Purchase Requisition

After ATS approval, the requestor must submit a Banner Purchase Requisition.
Required attachments:
1. ATS Security Review outcome
2. Vendor quote
3. TX-RAMP documentation
4. Accessibility documentation
5. Legal agreements or contracts
All purchases must be processed through Banner Purchasing, an Academic Technology or Purchasing P-card.
Unauthorized or direct pay purchases are prohibited.

4.4.3 Purchasing Review

Verify compliance with procurement law, state cooperative contracts (DIR, TIPS), and internal purchasing regulations.

4.5 Legal Review

All agreements, licenses, EULAs, terms of service, data-processing addenda, or related contractual documents must be reviewed by the Legal Department.
Legal review must be completed prior to issuing a purchase order or approving software use.
No employee may accept vendor terms on behalf of the College District without authorized approval.

4.6 Implementation

ATS or Administrative Computing coordinates installation, configuration, and security hardening.
Access must follow least-privilege principles and Personnel Security controls.
Information System Owners must ensure the creation and maintenance of documentation, training materials, and operational procedures.

4.7 Ongoing Monitoring & Lifecycle Management

4.7.1 Continuous Monitoring (CA-07)

Systems must be monitored in accordance with College District cybersecurity monitoring practices.
Security incidents or anomalies must be reported through established procedures.

4.7.2 Annual and Renewal Review

Prior to renewal, ATS and ISOw must review the system’s continued compliance and security posture.
Renewals follow the same approval process as initial acquisitions.

4.7.3 System Retirement / Decommissioning

Decommissioning must be coordinated with ATS.
Data and media must be sanitized following MP-01, MP-06, and College District retention schedules.
Accounts, licenses, and integrations must be disabled or removed.

ROLES AND RESPONSIBILITIES

Requesting Department

Identify need and complete required documentation
Ensure funding availability
Maintain operational oversight

Academic Technology Services

Conduct security and compliance review
Assess integration, compatibility, and infrastructure impact
Support implementation and lifecycle management

Purchasing

Validate procurement method and requisition
Issue purchase orders

Legal Department

Review legal and contractual documents
Ensure regulatory and contractual compliance

Information System Owners

Maintain compliance with security controls
Support monitoring, audits, and incident response

COMPLIANCE AND ENFORCEMENT

Failure to comply with this Regulation may result in:

Removal or disabling of unauthorized software
Suspension of system or network access
Administrative corrective action
Mandatory reporting to supervisory or regulatory authorities

All software must comply with applicable state and federal laws, College District Board Policy, and Administrative Regulations.