NYSED RFP #24-026: Audit Management Solution Software

Questions regarding the request must be submitted via online form no later than the close of business 12/23/2025.

Bidders are requested to submit their bids electronically. The following documents, as detailed in the Submission section of this RFP, must be received via online form no later than January 13, 2026

The proposal must be received by the due date.

All unsuccessful bidders may request a debriefing within fifteen (15) calendar days of receiving notice

The protest must be filed within ten (10) business days of receipt of a debriefing or disqualification letter

Submission Documents labeled <name of bidder> Submission Documents RFP #24-026

Technical Proposal labeled <name of bidder> Technical Proposal RFP #24-026

M/WBE Documents labeled <name of bidder> M/WBE Documents #24-026

Bidders should submit subcontracting/supplier forms that meet or exceed NYSED’s participation goals for this procurement. All subcontracting/supplier forms must be submitted with the bid proposal.

bidders must complete and submit M/WBE 100: Utilization Plan, M/WBE 102: Notice of Intent to Participate and EEO 100: Staffing Plan.

Bidders should submit a request for a partial waiver (Form M/WBE 101) and document their Good Faith Efforts (Form M/WBE 105)

All payments to Minority and Women-Owned Business Enterprise subcontractor(s) must be reported to NYSED M/WBE Program Unit using M/WBE 103

Bidders should use the templates and instructions in Appendix R to submit the required DPA EXHIBIT

DPA EXHIBIT 1 - Contractor’s Data Privacy and Security Plan and DPA EXHIBIT 2 - Education Law §

The Subcontracting Form located in the Submission Documents must be updated annually and submitted to NYSED.

the bidder will submit, with their proposal, Staffing Plan (EEO 100).

Contractor shall submit all necessary M/WBE documents and/or forms as described above as part of their proposal in response to NYSED procurement.

Bidders must submit subcontracting forms that: 1) fully comply with the participation goals specified in the {'F - Document Acronym'}; OR

The proposal submitted in response to this RFP must include the following documents submitted via the online form in Microsoft Office

1. Submission Documents 2. Technical Proposal 3. Cost Proposal 4. M/WBE Package bearing signatures 5. Data Security and Privacy Plan

3 Year Detailed Budget (split by Licensing / Support and Maintenance) – with a Two (2)

2.) Subcontracting Form

3.) M/WBE Purchases Form

Full Participation-No Request for Waiver 1. M/WBE Cover Letter, Signatures Required 2. M/WBE

Bidders may submit a request for debriefing through the online form

The protest letter must be filed with the Contract Administration Unit via online form

NYSED recommends that vendors file the required Vendor Responsibility Questionnaire online via the New York State VendRep System.

although this form is not required as part of the bid submission, NYSED encourages bidders to include it in their bid submission to expedite contract execution if the bidder is awarded the contract.

although these forms are not required as part of the bid submissions, NYSED encourages bidders to include them in their bid submission

The selected bidder must file a properly completed Form ST-220-CA (with NYSED as the Contracting Agency) and Form ST-220-TD

NYSED encourages bidders to include them with their bid submissions to expedite contract execution if the bidder is awarded

1. Non-Collusion Certification

2. MacBride Certification

3. Certification-Omnibus Procurement Act of 1992

4. Certification Regarding Lobbying; Debarment and Suspension; and Drug-Free Workplace Requirements

5. Offerer Disclosure of Prior Non-Responsibility Determinations

6. NYSED Substitute Form W-9 (If bidder is not yet registered in the SFS centralized vendor file.)

7. Iran Divestment Act Certification

8. Sexual Harassment Policy Certification

9. Gender-Based Violence and the Workplace Certification

10. Certification Under Executive Order No. 16

1. M/WBE Cover Letter

2. M/WBE 100 Utilization Plan

3. M/WBE 102 Notice of Intent to Participate

4. EEO 100 Staffing Plan

5. M/WBE 101 Request for Waiver

6. M/WBE 105 Contractor’s Good Faith Efforts

Please send a signed, scanned copy to [email] with “Consultant Disclosure Form B” in the subject line

Name of Contractor: 2. Purpose of Contract: 3. Contract Term: Contract Start Date: Contract End Date:

Type(s) of Data that Contractor will be provided Access to or Disclosure of: Student Data

For what purpose is Student Data or APPR Data being used?

Please indicate where Student Data and/or APPR Data will be stored:

Contractor certifies that it will comply with the above described requirements, and require its Subcontractors to comply

Cost Proposal Excel workbook to be used for the cost evaluation

Contractor Reference Form For Vendor to provide list of references

The technical and cost proposal documents should be submitted in Microsoft Office. PDF files that are editable and Optical Character Recognition (OCR) searchable are acceptable.

Please do not submit the technical or cost proposal as a scanned PDF.

Submission documents requiring a signature must be signed using one of the methods listed below and may be submitted as a Microsoft Office, PDF, or JPG document.

A scanned PDF is acceptable for these documents.

handwritten signatures on faxed or scanned documents

e-signatures that have been authenticated by a third-party digital software, such as DocuSign and Adobe Sign

stored copies of the images of signatures that are placed on a document by copying and pasting or otherwise inserting them into the documents

a typed name, including a signature created by selecting a script or calligraphy font for the typed name of the person “signing”

the signer will sign beside or provide by email the following attestation: “I agree, and it is my intent, to sign this document by <describe the signature

please ensure that the RFP number and title listed on page 1 are accurately entered into the fields “Procurement No” and “Procurement Title/Name” on the online form.

Proposals should be prepared simply and economically, avoiding the use of elaborate promotional materials beyond those sufficient to provide

The completed Technical Proposal should be labeled [name of vendor] Technical Proposal – RFP #24-026 and needs to address

Please provide the information in the same order in which it is listed above, with a tabulated

The Bidder’s Technical Proposal (excluding attachments, work samples and project plan), should be limited to no more

should be limited to no more than 25 pages and should not include slide decks or other

Cost information must not be included in the Technical Proposal documents

The completed Cost Proposal spreadsheet should be labeled [name of vendor] Cost Proposal – RFP

Budgets must be submitted using whole dollar numbers

The original completed M/WBE Documents should be labeled <name of bidder> M/WBE Documents – RFP

an ACORD form is not acceptable proof of New York State workers’ compensation or disability benefits insurance coverage

Technical Proposal (70 points)

General Qualifications and Experience (30 points)

Project Approach, Licensing, Training and Support (20 points)

Technical Qualifications, Security and System Availability (20 Points)

Cost Proposal (30 points)

The Financial Criteria portion of the RFP will be scored based upon the grand total of

The Technical Evaluation is 70% (up to 70 points) of the final score

Technical Criteria (70 Points)

Financial Criteria (30 Points)

The financial portion of the proposal represents 30 points of the overall score

awards the highest score of 30 points to the budget that reflects the lowest overall cost

awarded to the vendor whose aggregate technical and cost score is the highest among all the proposals rated

awarded to the vendor in that group of highest aggregate scores whose budget component reflects the lowest overall cost

seeking proposals for a web-based, audit management system, with services provided through the cloud, that will accommodate 15 end users.

Eligible applicants are vendors with demonstrated experience in hosting and operating online audit management software in a statewide environment.

Vendors may propose to offer existing commercial-off-the-shelf (COTS) solutions that perform the functions defined below.

Subcontracting will be limited to thirty percent (30%) of the total contract budget.

Bidders are required to comply with NYSED’s Minority and Women-Owned Business Enterprises (M/WBE) participation goals for this RFP through one of three methods.

NYS Education Department hereby establishes an overall goal of 30% of the total contract amount for M/WBE participation

17% for Minority-Owned Business Enterprises (“MBE”) participation and 13% for Women-Owned Business Enterprises (“WBE”) participation

All bidders must document good faith efforts to provide meaningful participation by MWBEs as subcontractors or suppliers in the performance of this Contract.

All firms utilized must be certified with the NYS Division of Minority and Women Business Development before beginning any work on this contract.

Bidders will be required to certify and attest to their good faith efforts by completing NYSED’s Certification of Good Faith Efforts (Form M/WBE 105).

NYSED reserves the right to reject any bid for failure to document “good faith efforts” to comply with

Bidders should consider fulfilling the requirements of this contract through the participation of SDVOBs at a rate of 6%.

Vendor must provide an off-the-shelf Audit Management System, offered as a Software as a Service (SaaS), Cloud-based application.

The term of the contract is for three (3) years with an additional two (2) year option for renewal.

The Cloud-based application must be FEDRAMP-certified.

Vendor must implement the Audit Management System, which includes configuration and testing.

Vendor must conduct training and provide related materials (web-based training, reference manuals, knowledge base access, video tutorials, etc.)

Vendor must provide ongoing Support and Maintenance, including user issues, system upgrades, fixes, and enhancements.

The software system must include an offline feature, as our staff occasionally perform field audits in remote locations without internet access.

The Vendor’s proposed system must provide an integrated system of electronic working documents, scheduling, notifications to users, issue tracking

The Vendor’s proposed solution must automate the entire audit process, including but not limited to:

The Vendor’s proposed system must provide integration of audit planning activities including a centralized and built-in repository for audit planning

Web content as well as any deliverable such as documentation is to be WCAG 2.0 AA compliant

Training for the platform must be provided with the core licensing

Training must include web-based training, reference manuals, knowledge base access, and video tutorials

System must allow single sign-on

The underlying infrastructure of the platforms, such as servers, databases, networking (including traffic egress and ingress), and storage, must be included in the core licensing

All individual components of the core platform and ancillary services must be included within the quoted price

Vendor must provide manned telephone support via a toll-free number and web/email support during business hours (Eastern Time)

Vendor must identify the classifications of defects, their response and resolution times

Vendor must provide real-time disk replication to multiple data centers at geographically diverse locations

The platform must maintain a 99.9% uptime

The Vendor must provide the definition of uptime and how it is calculated

Vendor must provide performance report metrics, including uptime percentage and support requests, classifications, and response and resolution times

Vendor must maintain all components of the platforms and the underlying infrastructure

Vendor will make updates and upgrades available to NYSED at no additional cost

Scheduled maintenance must occur with at least two business days’ notice, at agreed-upon times, and inot during NYSED business hours

For unscheduled downtime, the Vendor must provide NYSED regular status reports, at least once per day or upon NYSED’s request

After unscheduled downtime issue is resolved, Vendor will provide NYSED with a root cause analysis and security logs

Vendor must document penalties for failing to meet uptimes, response, and resolution times

NYSED will own all rights, title and interest in all data provided and any data derived therefrom

Vendor shall not disclose, provide, or sell any NYSED data for any purpose other than fulfilling its obligations under the agreement

NYSED shall have the right, upon reasonable notice to Vendor, to audit, review, and copy all records collected by Vendor

Out-of-the-box audit features and reporting should be available

Where legal mandates for data retention apply, all agreements must establish terms for preservation, retention, filtering, and retrieval

Where legal mandates do not apply, the Vendor may not delete or remove NYSED data without express permission of NYSED

Backups should be performed every 24 hours

In the event of service failure, Vendor shall be able to restore the cloud software and data within 24 hours, with no more than 24 hours of data lost prior to failure

Solution provider shall back up NYSED data in an off-site hardened facility located within the Continental United States (CONUS)

Recovery procedures must be tested twice a year

Vendor shall reasonably cooperate with NYSED to document such transition plan no later than sixty (60) days prior to termination

Vendor shall assist NYSED in exporting and extracting the NYSED data, in a format usable without the use of the Vendor software

Vendor must provide a secure environment for NYSED data, and any hardware and software, including servers, network, and data components provided by Vendor

All applicable controls listed in the following Information Security policies and standards must be implemented

Vendor must be FEDRAMP-compliant

All data in transit and at rest must be encrypted, including backups

Vendor shall not access NYSED’s accounts or data except if required for daily operations by authorized personnel

NYSED data may not leave the Continental United States (CONUS)

Vendor must disclose to NYSED the identity of any third-party host of data

When storing data, commingling is prohibited

Vendor must provide policies documenting the physical and

Vendor must perform penetration testing using industry best practices on

The Contractor agrees to comply with Family Educational Rights and Privacy Act (FERPA) and New

all contracts with a third-party contractor that receives PII include a Data Privacy and Security Plan,

Any Cloud Service Provider (CSP) under consideration must have in place a baseline of data

protection security configurations implemented along with documentation that demonstrates annual

CSP must also, have a compliance process within their environment to ensure

Any documents, web-based information and applications, or programming delivered pursuant to this

conform to NYSED-WEBACC-001 as determined by quality assurance testing. Such quality assurance

Subcontracting will be limited to 30% of the total contract budget. Subcontracting is defined as non-

For vendors using subcontractors, a Vendor Responsibility Questionnaire and a NYSED vendor

If the vendor proposes to change subcontractors during the contract period, NYSED must be notified

Using this form, the vendor must also report to NYSED, on an annual basis, actual expenditures incurred for all

The contractor will maintain continuity of staff throughout the course of the contract. All changes in staff

The replacement staff with comparable skills will be provided at the

The contract resulting from this RFP will be for

with the option to extend for one

make every good faith effort to promote and assist the participation of certified Minority and Women-Owned Business Enterprises

shall contain a provision requiring that contractors and grantees accept electronic payments

The contractor must document its good faith efforts as set forth in 5 NYCRR 142.8.

The contractor will include the provisions of subdivision one of this section in every subcontract

Contractors or subcontractors shall comply with the requirements of any federal law concerning equal employment opportunity

Contractor shall agree, as a condition of entering into said contract, to be bound by the provisions of Article 15-A

NYSED may require a contractor to submit proof of an equal opportunity program after the proposal opening

contractors and/or subcontractors will be required to submit compliance reports relating to the contractor’s and/or subcontractor’s program

These goals should not be construed as rigid and inflexible quotas that must be met, but as targets reasonably attainable

Contractor shall ensure that enterprises have been identified (M/WBE 102) within the Utilization Plan, and the contractor shall attempt

the contractor shall, within the period of time specified, submit compliance reports documenting remedial actions taken and other information

contractor may file a written application with NYSED M/WBE Program Unit requesting a partial or total waiver (M/WBE 101) of such requirements

Whether the contractor has advertised in general circulation media, trade association publications and minority-focused and women-focused media

Whether there has been written notification to appropriate certified M/WBEs that appear in the Empire State Development website.

All M/WBE firms are required to be certified by Empire State Development (ESD). Online Certification can be found at the New York

Failure to comply with the requirements of Article 15-A as set forth under this procurement and in conjunction with the corresponding contract

the bidder should reference these materials in the technical proposal, identifying the document(s) and citing the appropriate section and page(s)

The proposal must communicate an understanding of the deliverables of the RFP, describe how the tasks are to be performed and identify

Bidders should specify all details and dates required to evaluate the technical proposal and should limit aspects of the project plan

No optional deliverables to be provided only at an additional cost should be included and will not be considered in the evaluation

Contractual terms, conditions and assumptions are inappropriate for inclusion in the proposal.

Any proprietary material considered confidential by the bidder will specifically be so identified, and the basis for such confidentiality

their business structure (ex. sole proprietor, corporation), company history, the number of years in business

lawsuits, pending litigation, bankruptcies, that have occurred either in the past ten years or are under current

Describe any contracts the bidder had with New York State within the past 5 years

Describe any similar contracts the bidder had with any company, state or federal agency within

The bidder should provide three references using the form available (see Reference Form

a narrative that illustrates that the bidder has read all requirements documented in the RFP

a description of the proposed project approach and work effort from initiation to deployment

Describe any unique capabilities on why your product may be superior to your competitors

a description of the licensing and maintenance structure for the proposed solution (please do not

a description of your training approach for end-users, what is the delivery method and what

Describe the standard technical support, warranty period and maintenance offered as part of

technical specifications for the software product including the system architecture both logical and physical

technical specifications for the Cloud provider architecture including infrastructure, platform, software, and presentation

details on security for infrastructure and customer-facing services, details on what security testing is performed

Please list your uptime percentage for the last 3 years and describe the reasons

a list of standards and frameworks utilized and certifications obtained for software, data

the Contractor should note throughout the technical proposal when Contractor resources and when subcontractor

the Contractor must also note in the technical proposal the name and business address of

Successful bidders may be subject to audit and should ensure that adequate controls are in place

The protest must be in writing and must contain specific factual and/or legal allegations

Before an award of $100,000 or greater can be made to a covered entity, the entity will be required to complete and submit a Vendor Responsibility Questionnaire.

Vendors must provide their New York State Vendor Identification Number when enrolling.

a Vendor Responsibility Questionnaire and a NYSED vendor responsibility review are required for a subcontractor where: the subcontractor is known at the time of the contract award; the subcontractor is not an entity that is exempt from reporting by OSC; and the subcontract will equal or exceed $100,000 over the life of the contract.

Bidders must acknowledge their method of filing their questionnaire by checking the appropriate box on the Response Sheet for Bids (5. Submission Documents).

An Offerer/bidder is restricted from making contacts from the earliest notice of the solicitation through final award and approval of the Procurement Contract by NYSED

State contractors will be required to disclose, by employment category, the number of persons employed to provide services under a contract for consulting services

State agencies must include in the Procurement Record submitted to OSC for new consultant contracts, the State Consultant Services Contractor’s Planned Employment from Contract Start Date Through the End of the Contract Term (Form A).

the legislation mandates that the annual employment reports are to be submitted by the contractor to the contracting agency, to OSC and to the Department of Civil Service.

State Consultant Services Contractor’s Annual Employment Report (Form B) is to be used to report the information for all procurement contracts above $15,000.

All bidders must comply with Public Officer’s Law Section 73 (4)(a), as follows:

Any payee/vendor/organization receiving Federal and/or State payments from NYSED must complete the NYSED Substitute Form W-9

NYSED must obtain one of the following forms before a contract can be approved:

Tax Law § 5-a requires contractors awarded State contracts for commodities or services valued at more than $100,000 over the full term

Vendors who are unable to complete or abide by these assurances should not respond to this request.

The CONTRACTOR shall perform all services to the satisfaction of the STATE. The CONTRACTOR shall provide services and meet

the CONTRACTOR shall take full responsibility for the acts and omissions of its subcontractors. Nothing in the subcontract

The CONTRACTOR shall meet the audit requirements specified by the STATE.

certifies and warrants that all wood products to be used under this contract award will be in accordance with

the prime Contractor will indicate and certify in the submitted bid proposal that the subcontractor has been informed

the Contractor either (a) has no business operations in Northern Ireland, or (b) shall take lawful steps

The Contractor has made reasonable efforts to encourage the participation of New York State Business Enterprises as suppliers

The Contractor has complied with the Federal Equal Opportunity Act of 1972 (P.L. 92-261), as amended

will comply with New York State Education Department IT Policy NYSED-WEBACC- 001, Web Accessibility Policy

all data, including any backups, metadata, or derivative data created, processed, stored, or transmitted under this Agreement

Contractor shall ensure that all subcontractors, cloud providers, and other third parties engaged in the handling or storage

No fees shall be charged by the Contractor for training provided under this agreement

Funds provided pursuant to this Agreement shall not be used for any partisan political activity or for activities

Contractor agrees to maintain the confidentiality and security of Confidential Information in accordance with applicable New York, federal and local laws

Contractor has no property, licensing, or ownership rights or claims to Confidential Information Accessed by or Disclosed to Contractor

Contractor shall adopt and maintain reasonable safeguards to protect the security, confidentiality, and integrity of Confidential Information in a manner that complies with General Business Law section 899-bb

Contractor may be required to undergo an audit of its privacy and security safeguards, measures, and controls, or in lieu of performing an audit

Access to or Disclosure of Confidential Information shall only be provided to Contractor’s employees and Subcontractors who need to know the Confidential Information

Contractor must ensure that each Subcontractor performing Services where the Subcontractor will have Access to and/or receive Disclosed Confidential Information is contractually bound by a written agreement

Contractor is prohibited from retaining Disclosed Confidential Information or continuing to Access Confidential Information, including any copy, summary or extract of Confidential Information

upon expiration or termination of this Contract, Contractor shall transfer Confidential Information to NYSED in a format agreed to by the Parties

Contractor will ensure all Confidential Information is securely destroyed in a manner that does not allow it to be retrieved or retrievable, read, or reconstructed

Redaction and obfuscation are specifically excluded as a means of data destruction

Upon request by NYSED, Contractor may be required to provide NYSED with a written certification of secure destruction of Confidential Information held by the Contractor

Contractor shall promptly notify NYSED of any Breach of Confidential Information, regardless of whether the Contractor or a Subcontractor suffered the Breach

must include a description of the Breach that identifies the date of the incident; the date of discovery; the types of Confidential Information affected

Contractor shall pay for or promptly reimburse NYSED the full cost of NYSED’s notification to Parents, Eligible Students, teachers, and/or principals

NYSED will be reimbursed by Contractor within 30 days of a demand for payment under this section

Contractor and its Subcontractors will cooperate with NYSED, and law enforcement where necessary, in any investigations into a Breach

Contractor shall comply with the provisions of the New York State Information Security Breach and Notification Act (General Business Law Section 899-aa; State Technology

Contractor shall be liable for the costs associated with such breach if caused by Contractor’s negligent or willful acts or omissions

The foregoing data privacy provisions of shall survive any termination of this Agreement and shall continue for as long as Contractor or its Subcontractors retain Access

Contractor certifies that it has met the disclosure requirements of State Finance Law §139-k

Contractor certifies that it has not knowingly and willfully violated the prohibitions against impermissible contacts

no governmental entity has made a finding of nonresponsibility regarding the Contractor in the previous four years

no governmental entity or other governmental agency has terminated or withheld a procurement contract with the Contractor

Contractor certifies that it is in compliance with NYS Public Officers Law, including but not limited to

The initial planned employment report must be submitted at the time of approval of this Agreement

The annual employment report on Form B is due by May 15th of each year

Contractor will maintain continuity of the consultant team staff throughout the course of the contract

the Contractor must complete the following or provide a plan that materially addresses its requirements

Outline how you will implement the data privacy requirements of this Contract

specifying the administrative, operational, and technical safeguards and practices that you have in place

Address the training received by your employees and any Subcontractors engaged in the provision of services

Outline how you will ensure that your employees and any Subcontractors are bound by written agreement

Specify how you will manage any data privacy and security incidents that implicate Information

Describe your activities upon the expiration of the Contract as they relate to

your secure destruction practices and how you will certify to NYSED that all Access

Describe your use of Generative AI, if any, to fulfill your obligations under the Contract

what are your procedures for maintaining the confidentiality of NYSED data provided to you

please explain how the generative AI is trained, without the inclusion of NYSED data

please explain your procedures for clients and customers to report AI bias and hallucinations

please explain your procedures for correcting hallucinations

please explain how you mitigate AI bias

describe any plans to incorporate generative AI into the provision of service pursuant to the Contract

describe what cloud services (i.e. AWS; Azure; Google) and how you plan to maintain the confidentiality, integrity, and availability

Provide an overview of the Cloud Service Provider’s (CSP) Disaster Recovery (DR) Process

Provide an overview of the Cloud Service Provider’s (CSP) Access Control Policy

If no, describe any plans to use cloud services to fulfill your obligations under this Contract

A Student’s Personally Identifiable Information (“Student PII”) cannot be sold or released for any Commercial or Marketing purpose

encryption, firewalls and password protection must be in place when Student PII is stored or transferred

NYSED contracts with vendors that receive Student PII will address statutory and regulatory data privacy and security requirements

Contractor agrees that it will not utilize Subcontractors without a written contract that requires the Subcontractors to adhere

the confidentiality and data security obligations under this DPA will survive the expiration or termination of this Contract

Securely transfer Disclosed Student Data and/or APPR Data to NYSED, or at NYSED’s option and written discretion

Securely destroy Disclosed Student Data and APPR Data

Contractor further agrees to facilitate such corrections within 21 days of receiving NYSED’s written request

Contractor agrees that Student Data and APPR Data will be encrypted while in motion and at rest