CESS Approval Essentials and How-to-Guide

Determining if a Purchase or Project Needs CESS Approval

If either of the two following criteria applies to an IT project or single purchase, CESS approval is required regardless of cost.

• Any IT purchase which may process, store, or transmit Sensitive Data or Restricted Data or grant 3rd parties access to Sensitive Data or Restricted Data such as cloud storage of FERPA records (see Data Classification and Protection Standard).
  • Desktops, Scanners, Smartphones, Servers, or Network Routers that process, store or transmit data classified as Sensitive Data or Restricted Data WILL require a CESS.
  • Processing, storing or transmitting any Sensitive or Restricted Data on a physical or virtual device (i.e., cloud) outside of direct control or possession of UGA WILL require CESS approval.
• Any technology which does not fully meet UGA orUSG standards or policies especially:
  • Non-standard wireless (see Wireless Network Standard).
  • Non-compliance with network security policies (see Minimum Security Standards) and/or
  • Undue bandwidth consumption (see High Bandwidth Consumption Policy ) OR
  • Places an undue performance burden on UGA IT resources (see Acceptable Use of Computers Policy )

CESS approval is required for all new IT projects with an accumulative cost of $10,000 or more, regardless of funding source. CESS review is based on the total cost of a project; not by individual requisitions.

If CESS approval is required, DO NOT submit a purchase requisition in UGAmart until the CESS is approved and assigned a CESS number. CESS requests must be submitted in UGAmart, and CESS approval MUST be obtained prior to the submission of any requisition related to the project. All purchase requisitions related to the project must reference the CESS approval number, or they may be rejected by Procurement. If rejected, the Requisition will have to be resubmitted citing the CESS approval number.

**NEW** If you are unsure if your purchase or project requires CESS Approval and additional documents, please see the CESS Approval Workflow. You can also view the PowerPoint presentation for the CESS course taught quarterly through Training and Development.

CESS Approval Processing Time

• Once a CESS request form is submitted by the unit CESS Coordinator in UGAmart, the review process may take 7-10 business days before CESS approval, and potentially longer if security concerns need to be addressed by the unit and EITS to satisfactorily mitigate any high risk factors identified.

• IT projects with a total project cost of $500K or more will also require approval from the Office of Information Technology Services at the Board of Regents. Fill out the Board of Regents Approval Form and attach to the CESS form in UGAmart. In addition, if the total project cost exceeds one million dollars, fill out the Board of Regents Business Case Template and attach to the CESS form in UGAmart. For assistance with filling out the Business Case Template, please see the Business Case Guide. Approval from the BOR generally takes an additional 10-15 business days, so please plan accordingly.

• Supporting Documentation – Attaching any available documents related to the CESS request (quotes, project plan with costs by fiscal year, architecture, timing, data requirements, etc.) will greatly reduce the chance of delay in the approval process.

Entering a CESS Request in UGAmart

• Log into UGAmart using your MyID and password
• UGAmart Home Page - under the UGA Internal Stores & Forms section to the left, click CESS Approval Form.

Completing the CESS Form

• Fill in the “Individual Responsible for CESS Resource and Location” section, and select the appropriate “Approving Unit Coordinator Group”.
• Fill out all sections of the CESS form, and provide as much detail as possible
• If you answered “Yes” to any of the Security Questions, fill out and attach the CESS Security Evaluation Form.
  • Fill out, save and close the CESS Security Evaluation Form
  • Go back to the CESS Approval Form, and attach the CESS Security Evaluation Form (lower right corner)
• Attach any project documents or quotes available
• When all fields are completed and all documents have been attached, click the drop-down menu beside “Available Actions” at the top right of the CESS Approval Form, select Add to New Cart and click Go.

Finalizing the CESS Requisition for Submission and Approval

• When the new requisition cart opens, enter a Cart Name and a Cart Description
• Next, click Proceed to Final Review located near the top right
• If the Requisition doesn’t auto-fill, enter the “Shipping” and “Billing” information
• Click Edit in the Accounting Codes section, enter the Account Number and Detail Object code, and then click “Save”
• At the top middle of the page within the yellow text box, click the blue Final Review link
• At the top right of the page, click Submit for Approval (routes to the departmental unit CESS coordinator for approval) – Do NOT click “Assign Cart”.

CESS Approval

• The CESS Approver steps are identical to approving a purchase requisition. If you are not familiar with the approval process, you may view this video tutorial for instructions. http://library.sciquest.com/training-videos#play-94173495
• Each department on campus has, or should assign, one or more unit coordinators who review CESS requests. Please be advised that a CESS request cannot be submitted and approved by the same person. When approved at the departmental level, the CESS is electronically routed to EITS and the Office of the VPIT.

CESS Approval Status and Approval Number

• To check the approval status of a CESS request, click on the PR Approvals tab at the top left of the CESS Requisition.
• When the CESS request has been approved by all review levels, an email notification will be sent to the Shopper who created the cart with the approval number (if the Shopper’s profile email notification is set)
• The CESS Approval Number must be specified on EVERY purchase requisition against the CESS project (example below)

Any questions regarding the CESS approval process should be directed to Jennifer Dobbs (cess-eits@uga.edu ) in Enterprise Information Technology Services.

 5 year plan

Revised: 1/3/2019