Integrated Risk Management (IRM)

Risk Requests and Assessments

As part of UF’s IRM program, UFIT staff facilitate risk assessments on new and existing technologies. 

The assessment process provides a structured evaluation of cybersecurity risks for software, hardware, and cloud services. The process focuses on essential security and privacy protections for your data considering the use of technology. 
These assessments are performed on a wide variety on information systems, including: 

• Hardware, software and network connections
• Renewals, migrations, upgrades and enhancements of a pre-existing system or environment; and,
• New and existing tools, cloud services and applications

Once you've identified a new, unassessed technology you want to work with, you can fill out the Risk Request form to begin your assessment, and your Information Security Manager will manage the rest of the process for you. 

Commodity Approval

IRM reviews all purchase requisitions with IT commodity codes and is done in parallel with the risk assessment process. This process is further outlined on UF Procurement's departmental webpage. IRM will check the Fast Path Solutions list for the product being purchased. If the product appears on FPS, then no request is needed if using in accordance with the FPS guidelines. If there is previous purchase order or risk assessment request associated with the purchase, IRM will confirm the request number and approve the requisition.

If there is no request or FPS listing, IRM will ask that request be submitted before the requisition is approved.

When necessary, IRM will confirm with appropriate service owners that purchases align with the IT Rationalization Standard.

Fast Path Solutions

Fast Path Solutions is a comprehensive list of pre-assessed software and computing environments. Products on FPS can be searched for by name or by category.

If you are working with non-restricted data, you may use FPS without additional review by UF administrative, compliance or risk management offices.

UF Data Guide

Not all data classifications are created equal, so it can get very complex to appropriately classify data. The UF Data Guide will help you understand your data type within UF’s data classification guidelines and can also be used to find approved software and computing infrastructure for use with various data types.