Benefits of password managers, BitWarden license tiers and how to purchase BitWarden for a department.

For UH departments looking to purchase a password manager, ITS recommends BitWarden.

What is a password manager?

A password manager is a secure digital vault that stores credentials for various websites and services, eliminating the need to memorize passwords and thus allowing for strong (unique, long, and complex) passwords to be used for each service. 

Used typically through a browser extension or mobile app, a password manager can automatically fill your saved username and password directly into login screens for seamless access.

Many password managers also feature a built-in generator to instantly create strong, randomized passwords for new accounts or reset passwords.

Benefits of a password manager

1. Stop Password Reuse: Eliminates the "domino effect" where one hacked account grants access to all others.
2. Autofill Passwords: Saves hours of typing by instantly logging you into websites and apps on any device.
3. Universal Access: Syncs your vault across phones, laptops, and browsers so you’re never locked out.
4. Breach Alerts: Automatically notifies you if your credentials appear in a known data leak.
5. Zero-Knowledge Privacy: Ensures that only you have the key to your data—not even the service provider can see your passwords.

Benefits of a password manager

1. Stop Password Reuse: Eliminates the "domino effect" where one hacked account grants access to all others.
2. Autofill Passwords: Saves hours of typing by instantly logging you into websites and apps on any device.
3. Universal Access: Syncs your vault across phones, laptops, and browsers so you’re never locked out.
4. Breach Alerts: Automatically notifies you if your credentials appear in a known data leak.
5. Zero-Knowledge Privacy: Ensures that only you have the key to your data—not even the service provider can see your passwords.

BitWarden Password Manager

License Tiers

Premium (Personal)

• Best For: Individuals looking to upgrade their personal security.
• Integrated Authenticator: Stores and generates TOTP codes (2FA) directly within the app.
• Emergency Access: Designate a trusted contact to request vault access if you are incapacitated.
• File Attachments: Up to 1GB of encrypted storage for sensitive documents or ID scans.

Teams (Business)

• Best For: Small groups or departments needing to collaborate.
• Unlimited Collections: Create shared folders to distribute passwords among specific users.
• Event Logs: Track over 50 different user and administrative actions for audit trails.
• Directory Sync: Automate user onboarding by syncing with your existing employee directory.

Enterprise (Business)

• Best For: Organizations requiring total administrative control and compliance.
• ​​​​​​​Policy Enforcement: Force organization-wide security rules, such as mandatory 2FA or master password requirements.

 

Purchasing BitWarden Licenses

ITS recommends using the NASPO contract vehicle to purchase BitWarden licenses, but you should coordinate purchases with your fiscal administrator to ensure you are following proper UH procurement policies and practices:

• Licenses can be purchased under NASPO using SPO 23-08
  • For purchases up to $24,999.99 the agency is required to obtain a minimum of one (1) price quote from the list of contractors in the awarded category.
• Personnel conducting or participating in utilizing Price List Contract No. 23-08 is responsible for completing form SPO-010, Record of Procurement for purchases of $5,000 or more.
  • SPO-010 can be found here: https://spo.hawaii.gov/all-forms/
• Request OVPIT approval for IT procurement
  • This form is used to submit requests for approval IN ADVANCE of any IT procurement, inclusive of renewals, for $25,000 or more, OR (REGARDLESS OF AMOUNT) if the product or service to be procured requires integration with ANY ITS managed system (inclusive of ID management, enterprise systems and ITS developed and maintained localized applications. PLEASE NOTE that simple connectivity to ITS network or campus infrastructure is not considered integration in this context; the objective of identifying integration work is focused on managing impacts to ITS operated infrastructure and systems).  REF: EP8.200 III.B.4.f.
  • If integrating with ITS-managed systems (for example, if integrating BitWarden with UH SSO) a DGP will be required.
• OVPIT Shrink Wrap approval not required for BitWarden.
• Documents to be submitted to SAS
  • NASPO SPO 23-08 contract 
    • Quote must reference SP 23-08
  • SPO-010 if $5,000 or more
  • OVPIT approval for IT procurement (if above 25k or integrating with ITS)
  • DGP (if integrating with ITS)
  • Quote(s)