Kean University SOP 09 – Emergency Procurement
Table of Contents
- About
- Scope
- Definitions
- Roles & Responsibilities
- Procedure
- Post‑Facto Risk Assessment
- Records & Retention
- Metrics & KPIs
- Related Policies
About
This Standard Operating Procedure (SOP) defines the required steps for initiating, approving, executing, and documenting Emergency Procurements—acquisitions that must be completed urgently to maintain University operations, restore essential services, or mitigate critical risk.
Emergency procurement enables expedited action while preserving required cybersecurity, risk, accessibility, and compliance controls.
Scope
This SOP applies when all of the following conditions are met:
- An immediate need exists to prevent operational disruption, safety impact, or compliance failure
- Standard procurement timelines would cause unacceptable delay or harm
- The request is approved as an Emergency Procurement by Procurement and the CISO (or designee)
This SOP applies to information technology (IT), operational technology (OT), software, cloud services, professional services, and physical goods.
Definitions
- Emergency Procurement: Time‑sensitive acquisition required to restore or maintain essential operations.
- Post‑Facto Risk Assessment: Required risk review conducted after the emergency purchase.
- Justification Statement: Written explanation documenting emergency conditions and risk trade‑offs.
- Critical Service Disruption: Failure significantly impacting students, staff, safety, compliance, or operations.
Roles & Responsibilities
View roles
- Procurement Lead: Validates emergency status and coordinates expedited workflow.
- Business Owner: Provides justification and confirms urgency and impact.
- IT Security: Performs minimal security triage and applies temporary controls.
- Risk Manager: Conducts the Post‑Facto Risk Assessment and remediation planning.
- Finance: Confirms emergency funding availability.
- CISO: Approves emergency initiation and remediation requirements.
Procedure
1. Initiate Emergency Request
The Business Owner submits an Emergency Procurement request in Freshservice, including description of the emergency, operational impact, urgency, and proposed vendor or solution.
2. Validate Emergency Status
Procurement confirms emergency criteria and consults the CISO and Finance. If approved, the request is formally designated as an Emergency Procurement.
3. Minimum Documentation & Security Triage
Procurement collects any available vendor assurance documentation. IT Security performs a minimal review to ensure no prohibited risks exist and temporary mitigations are feasible.
4. Accelerated Contract Review
Procurement performs an expedited review of contract terms, security clauses, and data handling requirements. Legal review is included when feasible; exceptions are documented.
5. Approval & Execution
Procurement submits an Emergency Procurement Justification Statement to the CISO for final approval. Upon approval, the purchase is executed and temporary controls are applied.
Post‑Facto Risk Assessment
A full supplier risk assessment is required within 30 days of the emergency purchase. The Risk Manager assigns a risk tier and documents remediation actions.
Medium, High, and Critical‑risk suppliers must complete remediation approved by the CISO.
Records & Retention
Emergency requests, approvals, justification statements, temporary controls, post‑facto assessments, and remediation documentation must be retained for a minimum of seven (7) years.
Metrics & KPIs
- Number of Emergency Procurement requests per year
- Percentage completed with Post‑Facto Risk Assessment
- Time from initiation to service restoration
- Percentage requiring significant remediation
Related Policies
- KU SRM 01 – Supplier Risk Management Policy
- KU SRM 02 – Procurement Policy
- KU SEC 05 – Exception Management Policy
- KU SEC 10 – Policy Precedence & Governance
- KU IT 01 – Asset Management Policy
``