• UC Davis
• IET Home

ORMP: FacilitiesLink

Sponsor

The Office of Resource Management and Planning (ORMP)

To View Entire Submission

ORMP: FacilitiesLink (Draft)

Feedback Received to Date (10-04-2007)

Workgroup Observations and Comments

The web-enabled user interface seems well-designed and user-friendly, and the vendor has agreed to the campus Data Security Terms. The off-site data storage and backup design should reduce the burden on campus resources. The system's use at UCSD, UCSC, UCM, and UCOP is certainly a plus, and suggests the system has the potential for even wider use and perhaps system-wide integration. FacilitiesLink represents a much-needed step forward toward centralizing many data elements that now appear in unconnected, disparate systems. This aspect can be best leveraged if there is a corresponding process to map existing and intended interfaces with other systems, and clearly document how stakeholders at the unit level might access the application for their needs.

Considerations and Areas Needing Clarification and/or Future Action

1. Additional information is requested by IET regarding the issue of authentication, and the potential use of Distauth, CAS, and UC Trust. In particular, reviewers noted the reference to Kerberos authentication was accompanied by instructions to select a password different than the Kerberos password for campus computing accounts. Many users may, for the sake of convenience, disregard this suggestion and use their campus computing password, and there are questions about whether this creates an opportunity for password theft and the compromise of systems unrelated to FacilitiesLink.
2. This application seems to have been developed and is now supported by a very small company with a limited number of developers. Is there a mechanism to protect the campus if the company encounters financial challenges or other difficulties, including going out of business? Is the source code held in escrow?
3. Since this is an "ASP" that is run remotely by the vendor, what provisions are in place to establish ownership of the (campus) data - and recovery of this data from the company if necessary?
4. Although the sponsoring unit for FacilitiesLink is ORMP, no information was provided about one-time or ongoing costs - critical data points requested by the proposed policy for other systems.
5. The technical specifications for the web interface protocol(s) should be identified and reviewed for security vulnerabilities.
6. It was unclear from the information submitted how FacilitiesLink is or will be interfaced with other systems (departmental and "central campus"). Of particular importance is clear documentation identifying which (if any) data elements for which Facilities Link is intended to server as the official "system of record."
7. Relative to point 6 above, there was interest from some reviewers in knowing more about the business rules embedded in FacilitiesLink, and whether there was the capacity (or interest from the sponsor) in allowing academic and administrative units to embed their own business rules in the system.
8. Point #7 above reflects a significant level of interest in knowing more about the extent to which FacilitiesLink might be available for individual unit use, beyond its utility for the ORMP unit. To this point, it is suggested that ORMP consider establishing an Advisory Workgroup to collect and organize input from users about future development and functionality for FacilitiesLink.

Additional Note

Technical Leads Greg Loge (Biological Sciences) and Chip Mrizek (Graduate School of Management) assisted in this review and have offered their assistance to ORMP in addressing the issues raised above and in working to ensure campus-wide acceptance and success of this application.