Pre-approved technology - Technology Acquisition Reviews (TAR)

Pre-approved technology does not require a TAR. Pre-approved technologies are low risk or have already completed Information Security and Accessible Technology Team reviews. The list is reviewed and updated frequently. To request an addition to the pre-approved list, please open a Service Request. Last update 9/16/2022.

Web applications, Digital content, and cloud services

Pre-approved campus standard cloud technology should be used where it provides equivalent functionality. Exception requests to use a non-standard cloud technology require a documented business reason why the campus-provided standard technology cannot be used, and should be documented in the TAR. The cloud computing services listed below have been pre-approved:

Hardware, equipment, and supplies

Hardware

• Cameras, video cameras, and accessories (does not include security, monitoring, or surveillance cameras) (refer to Confidential Data Policies/Practices and Guidelines)
• Digital voice recorders (refer to Confidential Data Policies/Practices and Guidelines)
• Displays
• DVD players/Blu-Ray players 
• Hard drives (refer to Confidential Data Policies/Practices and Guidelines)
• Label maker/ label printer – Brother
• Monitors – contact your local IT Provider for purchasing monitors, printers, and scanners for a pre-approved model that will meet your requirements. Monitors do not require a TAR.
• HP Printer models: contact your local IT Provider for purchasing monitors, printers, and scanners for a pre-approved model that will meet your requirements
• Scanners – contact your local IT Provider for purchasing monitors, printers, and scanners for a pre-approved model that will meet your requirements. Monitors do not require a TAR.
• Smart TVs - LG brand. These may not be connected to the SF State network. Installation of equipment purchased must be managed as part of a pre-approved project.
• Specialized scientific equipment that does not connect to or have the ability to connect to the campus network or wireless network, directly or indirectly via a computer
• Televisions without Wi-Fi, Internet, or network connections
• Xerox WorkCenter devices (Managed Print Program) – Printers used to print Level 1 or Level 2 data would still require a TAR

Equipment

• Adapters
• Docking Stations
• Headphones, headsets, and microphones
• Input devices (e.g. mice, trackballs, trackpads, Apple Pencils, barcode scanners, Microsoft Pens, and keyboards) *Exceptions* Any bluetooth device that will be used with a high-risk workstation requires a TAR. This includes wireless keyboards, speakers, and mice.
• Memory (RAM); Memory Cards
• Network equipment peripherals, such as cables, port adapters, and stand-alone power supplies (not network connected)
• Port replicators
• Portable power bricks or power banks, and portable chargers
• Sound cards
• Speakers
• Two-Factor (2FA) Tokens:
  • FEITIAN ePass A4B USB Security Key - Two Factor Authenticator - USB-A with FIDO U2F + FIDO2
  • FEITIAN ePass K40 USB Security Key - Two Factor Authenticator - USB-C with NFC, FIDO U2F + FIDO2
  • FEITIAN iePass K44 Dual-Connector iOS USB Security Key - Two Factor Authenticator - USB-C + Lightning - FIDO U2F + FIDO2 + MFi
• Uninterruptible Power Supplies (UPS)
• USB drives (Note: these are not approved for storing Level 1 and Level 2 data. Special encrypted flash drives are required, along with approved procedures for proper management. Reach out to  security@sfsu.edu for more guidance.)
• USB hubs
• Video cards

Supplies

• Batteries
• Cables
• Compact Disks and tapes (refer to Confidential Data Policies/Practices and Guidelines)

Tablets, laptops, and desktop computers – contact your Local IT Provider for a quote that will be for a pre-approved device