In the age of cloud subscriptions and digital classrooms, school districts and government entities are
increasingly reliant on software to operate efficiently. But with this reliance comes responsibility,
especially when it comes to tracking, managing, and reporting software inventory. Enter GASB 96, a
game-changer in how public institutions account for software subscriptions.
What is GASB 96?
GASB Statement No. 96, issued by the Governmental Accounting Standards Board, provides
guidance on how to account for Subscription-Based Information Technology Arrangements
(SBITAs). In simple terms, it treats software subscriptions like leases, requiring entities to recognize
both an intangible asset (the right to use the software) and a liability (the obligation to pay for it). This
means that every software subscription, whether it’s for a learning management system, productivity
suite, or cybersecurity tool, must be documented, valued, and reported. GASB 96 became effective
for fiscal years beginning after June 15, 2022, and applies to all reporting periods thereafter.
Beyond Compliance: Why Software Inventory is a Cybersecurity Imperative
While GASB 96 focuses on financial reporting, cataloging software also plays a critical role in
cybersecurity. Frameworks like NIST SP 800-53, NIST CSF, and CIS Controls all emphasize the
importance of maintaining a comprehensive software inventory.
For example:
- NIST SP 800-53 CM-8: Requires a documented inventory of all system components,
including software. - CIS Control 2.1: Calls for active management of software assets to prevent unauthorized
applications. - NIST CSF ID.AM-2: Highlights the need to inventory all software platforms and applications.
A well-maintained inventory helps ensure that only approved, secure, and up-to-date software is in
use—reducing the risk of vulnerabilities and data breaches.
Questions Every District Should Ask
To build a strong software inventory and approval process, consider:
- Is there a formal approval process for software?
- Is the process different for student-facing vs. staff-only applications?
- Does the curriculum department have input?
- Is purchasing involved in vetting software?
- Are privacy agreements required from vendors?
- What happens if a vendor (like Microsoft, Apple, Adobe, or Google) won’t sign?
- Is software periodically reviewed for continued approval?
These questions aren’t just about compliance, they’re about protecting student data, ensuring
instructional quality, and managing risk.
How to Get Started
You don’t need to overhaul your entire system overnight. Start small:
- Start today and build the list of active software as the initial purchases or renewals occur.
- Collect data points like software title, publisher, vendor, length of contract/service (i.e.,
annual, 3-year, monthly, etc.), purchase price, and intended audience (i.e., staff v. students,
administrative v. instructional). - Make sure to have a copy of the contract or software agreement! This can all be included in a software approval process, so work with your finance, curriculum, and risk management co-workers to develop a workflow that collects all of the required information and checks off everyone’s boxes.
- Use your resources: TCEA, Education Service Centers, consultants, and AI tools can help
streamline the process.
Accountability
Your annual financial audit will require that the Software-Based Information Technology Arrangements
(SBITAs) be submitted for review.
Reporting and cataloging software inventory isn’t just a compliance checkbox, it’s a strategic move
that supports financial transparency, cybersecurity resilience, and operational efficiency. Whether
you’re driven by GASB 96 or a desire to better protect your digital environment, the time to act is
now.
