Software Application Approval Process

Overview

Numerous software applications are available to help us perform our daily tasks. It is essential to consult the correct documentation and policies when complying with our information security requirements.

• Please read this policy first! The Acceptable Use Policy is the overarching policy that outlines the expectations for Thrive Team Members and the use of Thrive Technology.

• Traditional software: If the software you are requesting is not an artificial intelligence tool, follow this Software Application Approval SOP to request a new software package that is not already included in our tenant.

• Artificial Intelligence: If you are requesting a new AI tool, please review and follow the Artificial Intelligence Policy and the Artificial Intelligence Standard Operating Procedure.

• External Software Collaboration: Refer to the Technology Vendor Management Policy if you are attempting to collaborate with companies outside of Thrive and use their software.

Terminology

If there is a budgetary impact to adding any application, approval is required from the department VP or department head before proceeding.

New Application Evaluation

When a new application is requested, please submit a ticket to ithelp@thrivepet.com with a detailed description of the application/software, including its purpose.

Obtain Approval

1. The Service Desk or the Azure Team will assess the new software and determine whether its purpose is the same as any other application currently used in Thrive. Additional departments may need to be consulted for input.

2. If a different application other than one of our approved work applications is requested:

   1. Verify the requested application provides a service not offered in the current application database.

   2. If the requested application is unique in design, the Information Security Team will review its request for permissions.

      • Many apps ask for elevated permissions and must be reviewed.  Some examples of elevated permissions are (this is not a complete list):

        • Have full access to all files the user can access

        • Maintain access to data you have given it access to

        • Read and write access to user email

        • Have full access to the user's email

        • Have full access to the user calendar

        • Read and Write to user mailbox settings

        • Read and Write access to user mail

3. Determine the risk of permissions vs reward based on all factors, including application and company reputation.

4. If approval is granted, continue to Onboard the Application.

Onboard the Application

To onboard the new application, follow the approval process outlined in Section 5 of the Technology Vendor Management Policy, including approval from the Information Security, Procurement, and Legal departments.

No new application will be onboarded without these approvals.

Existing Application

These applications have already been vetted and approved, or they have been integrated with Azure.

No approval is necessary unless a licensing cost is involved.

Examples of approved applications include Adobe Suite and Calendly.

Compliance with Other Policies and Procedures

The review, approval, and exercise of authority under this procedure must comply with all applicable Thrive policies and procedures, including, without limitation:

• Acceptable Use Policy

• Information Security Policy

• Technology Vendor Management Policy

• Artificial Intelligence (AI) Policy

• Artificial Intelligence (AI) Standard Operating Procedure 

Amendment and Revision History

We are committed to continuously reviewing and updating our policies and procedures. The Company, therefore, reserves the right to amend, alter, or terminate this policy/procedure at any time and for any reason, subject to applicable law. When material changes are made, Thrive will post the changes on our internal website and provide Team Members with subsequent notice consistent with local laws or regulations.