How does your organization handle software requests that have not made it to the approved list yet?

I just started a new Cyber Helpdesk position, separate from the IT Helpdesk within the same company, and was curious how other organizations handle software requests that have not been approved yet, especially if you are in a government contracting/D.O.D. organization. Do you reach out to the software vendors to find out where their servers are located, if outside your country? How they push updates, etc? How much detail and research does your Cyber team look into new software that …

cyber cybersecurity government helpdesk list organization organizations requests software