Skip to content

Web Application Risk Assessment

As of May 2025 if you are requesting a new PUBAPPS or PRIVAPPS instance before the RC OPS Team will create the first VM for the group's hosting instance the group is required to submit a Risk Assessment. We are working on a more generalized RA for the entire infrastructure to streamline this process. Until then, all groups getting new hosting instances have to submit individual risk assessments. Note that this process must be started, but is not required to be completed before the group can proceed with purchasing a hosting instance (PA-Instance) and opening a support request to create the instance. Provide us with the RA number when you open a support ticket for the instance setup following the purchase form or the trial allocation request form submission.

Risk Assessment Submission

The UFIT Risk Assessment can be submitted by clicking on the Access the UF Integrated Risk Management System link on the UFIT Risk Assessment page.

Service Diagrams

Please use the appropriate service diagram for the RA submission:

PubApps

UFIT Research Computing PubApps Instance Diagram

PrivApps

UFIT Research Computing PrivApps Instance Diagram

Getting Help

If you need help with your Risk Assessment please contact Justin Richardson at UFIT Research Computing or submit a Support Request

Submitting a Risk Assessment

Below are the examples and screenshots of the critical parts of a risk assessment that need to be filled out correctly for the RA to be categorized quickly, so we could proceed with the setup of the web VM.

General Information

  • Submitter: your name
  • Project Name: PubApps instance for GROUP group
  • Project Owner: Group sponsor's name
  • Technical Resource: "Moskalenko, Oleksandr"

Critical Steps

The following three sections must be filled out correctly to allow for speedy RA classification.

Data Classification

  • Classify your data according to the UF Data Classification Guide

  • Select the data type

    • If the data is not regulated check the sensitive or open data type as appropriate or both.
    • If you use a regulated data type please check all relevant data type(s).

  • Note, if you select the 'Other' data type the classification will be delayed as the staff will contact you for a review of the data type(s).

Do not select the '[] Other' checkbox. This will delay the classification.

'Data Classification' section

Activity Types

Specify the project's activity type. For sensitive and open data the selection is likely to be 'Research'.

Activity Types

Uses and Disclosures

Specify the Uses and Disclosures of data. In most cases you will select 'No' in this list.

Uses and Disclosures

Submit the Risk Assessment and post the RA number into the RCSupport ticket opened for the setup of the hosting instance.