RFP #NG2610 - Peoplesoft AWS Managed Services ProviderCITY COLLEGES OF CHICAGO

REQUEST FOR PROPOSALS (RFP) #NG2610

PEOPLESOFT AWS MANAGED SERVICE PROVIDER

The District will only accept proposals electronically uploaded to the EUNA Procurement System (formerly Bonfire) at: https://ccc.bonfirehub.com/portal/?tab=openOpportunities City Colleges of Chicago will issue email alerts via EUNA for all published RFPs.

EUNA Vendor Support: access the EUNA Customer Hub Proposal Due Date: Proposals must be submitted in the CCC EUNA Procurement portal no later than 12:00 pm Central Time, Monday, November 2, 2026.

Pre-Proposal Conference: A pre-proposal conference is scheduled for Thursday, October 8, 2026, at 11:00 a.m. CT to discuss the Scope of Services and the Minority and Women Business Enterprise Contract Participation Plan (MBE/WBE).

MEETING LINK: https://cccedu.zoom.us/j/91031853753?pwd=Oo5FSKclaVetQSyINtaabsHSWRfXnn.1 Meeting ID: 910 3185 3753 Passcode: 260601 Questions: All questions regarding this solicitation should be submitted via the CCC EUNA Portal at: https://ccc.bonfirehub.com/portal/?tab=openOpportunities.

Questions Deadline: The deadline for submitting final questions via EUNA is Tuesday, October 13, 2026, by 12:00 pm Central Time.

Contents

BACKGROUND

City Colleges of Chicago (CCC) consists of seven (7) community colleges which are all located within the city limits of Chicago. In addition, there are five (5) satellite locations that are affiliated with the colleges. A seven- member board of trustees, who are appointed by the Mayor of Chicago, governs the system. The chief administrative officer of the system is the Chancellor, who is appointed by the Board of Trustees. Each college has its own President, who reports to the Chancellor, and its own administrative staff which is responsible for policy administration in the areas of human resources and staff development, finance, academic affairs, administrative services, and information technology. Each of these areas is headed by a Vice Chancellor that reports to the Chancellor.

INTENT TO SUBMIT

Vendors who intend to submit a proposal in response to this solicitation should indicate their intent to submit in the EUNA portal, https://ccc.bonfirehub.com/portal/?tab=openOpportunities , no later than Thursday, October 29, 2026, by 12:00 pm. If proposers fail to declare their intent, they must do so as part of their submission.

Link to: How do I submit my intent to bid?

BUSINESS GOALS AND OBJECTIVES

The City Colleges of Chicago (CCC) is soliciting proposals from Vendors (“Vendor”) qualified to provide Peoplesoft Amazon Web Services (AWS) Managed Services.

CCC's administrative operations are supported by a suite of PeopleSoft enterprise applications hosted on Amazon Web Services (AWS). These systems are mission-critical to CCC's human resources, payroll, financial management, and student services functions and support operations across all seven colleges and the District Office.

CCC's PeopleSoft environment includes the following application pillars:

1. PeopleSoft Human Capital Management (HCM) supporting core HR, payroll processing, time and labor, benefits administration, and position management

1. PeopleSoft Financials and Supply Chain Management (FSCM) supporting general ledger, accounts payable, accounts receivable, asset management, procurement, and contracts

1. PeopleSoft Campus Solutions (CS) supporting student admissions, records, financial aid, student financials, and campus community functions

1. PeopleSoft Interaction Hub (IH) providing unified portal and navigation experience across PeopleSoft application pillars

These applications are hosted in AWS and are supported by customizations, integrations, batch processes, and interfaces developed over the course of CCC's enterprise systems history. CCC's PeopleSoft environment represents a significant institutional investment and requires a mature, experienced managed services partner to ensure its continued stability, security, and operational effectiveness.

The selected Managed Services Provider (MSP) will be responsible for:

AWS Hosting: Managed hosting, platform maintenance, and infrastructure support Operations: Application operations and break/fix support Database Administration: Oracle Database administration Application Enhancements: Major and Minor enhancements Integrated security operations: Using a DevSecOps service model CCC seeks a partner with demonstrated experience managing complex, multi-pillar PeopleSoft environments in AWS at a scale and complexity consistent with a large, multi-campus public institution. The selected MSP must be capable of delivering reliable, secure, and continuously improving managed services that support CCC's academic calendar, administrative business cycles, and institutional mission.

CCC intends to award one thirty-six (36) month contract for the requested services with an additional two (2) one-year renewal options.

SCHEDULE

CCC anticipates the following schedule.

The RFP and all attachments are available for download from the City Colleges of Chicago EUNA Portal, https://ccc.bonfirehub.com/portal/?tab=openOpportunities. Proposers are responsible for checking the EUNA Portal for required forms, templates, clarifications, and/or addenda.

This RFP is organized as follows:

Definitions For purposes of this RFP, the following definitions apply:

1. MSP — Managed Services Provider; the firm selected to deliver services under this RFP

1. CCC — City Colleges of Chicago, Community College District No. 508

1. PeopleSoft Environment — All in-scope PeopleSoft applications, configurations, customizations, integrations, and supporting infrastructure

1. AWS — Amazon Web Services; the cloud hosting platform on which CCC's PeopleSoft environment resides

1. OCI — Oracle Cloud Infrastructure; Oracle's cloud platform, planned for adoption as part of CCC's evolving technology strategy

1. DevSecOps — A service delivery model that integrates security practices into application operations, infrastructure management, and change delivery activities as a continuous, embedded function rather than a downstream or standalone discipline

1. Production Environment — The live PeopleSoft instance supporting active CCC operations

1. Non-Production Environments — Development, Test, QA, and UAT environments supporting change management, testing, and release activities

1. Incident — An unplanned interruption to or degradation of an in-scope service

1. Service Request — A standard, pre-approved operational request that does not require change management Change — A planned modification to the PeopleSoft environment or supporting infrastructure, subject to CCC's change management process

1. ServiceNow — CCC's enterprise IT service management (ITSM) platform used for incident management, service requests, and change management

1. JIRA — CCC's project and enhancement tracking platform

1. Entra ID — Microsoft Entra ID (formerly Azure Active Directory); CCC's identity and access management platform

The intent of this Request for Proposal (RFP) is to procure a qualified Managed Services Provider (MSP) to deliver reliable, secure, and cost-effective managed services for City Colleges of Chicago's (CCC) PeopleSoft enterprise applications hosted on Amazon Web Services (AWS).

From an enterprise systems perspective, CCC seeks to ensure the continued stability, availability, and operational effectiveness of its PeopleSoft environment through a managed services model that supports day-to-day operations, issue resolution, platform maintenance, Oracle Database administration, and defined enhancements. The selected MSP will partner with CCC to support mission-critical administrative systems that enable human resources, finance, and student services across the district.

This engagement is intended to establish a modern, security-first operating model that integrates application operations, infrastructure management, and security practices. CCC expects the MSP to operate under a DevSecOps service model, embedding security, compliance, and risk management practices throughout the lifecycle of support, enhancement, and change activities rather than treating security as a standalone or downstream function.

CCC TECHNICAL ENVIRONMENT OVERVIEW

This section provides Proposers with a high-level overview of CCC's current PeopleSoft technical environment to support accurate scoping, staffing, and pricing of proposed managed services. Proposers are expected to review this information carefully and reflect an understanding of CCC's environment complexity in their proposal responses.

Additional technical detail will be made available to shortlisted Proposers during the due diligence phase of the evaluation process under a Non-Disclosure Agreement (NDA).

5.1 - Institutional Context City Colleges of Chicago serves approximately 70,000 students annually across seven (7) colleges and the District Office. CCC's PeopleSoft environment supports human resources, payroll, finance, procurement, student administration, and financial aid functions across all locations. The scale, diversity, and year-round operational demands of the institution require a managed services partner capable of supporting a large, complex, and highly integrated enterprise environment.

5.2 - PeopleSoft Application Environment CCC's PeopleSoft environment includes four primary application pillars:

Human Capital Management (HCM) Supports core HR administration, payroll processing, time and labor, benefits administration, and position management for CCC faculty, staff, and administrators across all seven colleges and the district Office. Payroll processing represents a critical operational dependency with strict processing windows and regulatory obligations.

Financials and Supply Chain Management (FSCM) Supports general ledger, accounts payable, accounts receivable, asset management, procurement, contracts, and budget management. FSCM operations are tied to CCC's financial close cycles, Board of Trustees reporting requirements, and external audit obligations.

Campus Solutions (CS) Supports student admissions, campus community, student records, financial aid administration, student financials, and 3C communications. Campus Solutions operations are directly tied to CCC's academic calendar, enrollment periods, and federal and state financial aid compliance requirements.

Interaction Hub (IH) Provides CCC's unified portal and navigation experience across PeopleSoft application pillars, delivering Work Centers, dashboards, and role-based navigation for HCM, FSCM, and Campus Solutions users. The Interaction Hub is a production application component and is fully in scope for managed services support.

CCC's PeopleSoft environment includes significant customizations, custom-developed components, third-party integrations, and batch processes. All customizations, interfaces, and integrations documented within CCC's environment are considered in scope for managed services.

5.3 - AWS Hosting Infrastructure and Oracle Database CCC's PeopleSoft applications are hosted on Amazon Web Services (AWS). The environment includes production and multiple non-production instances supporting development, testing, quality assurance, and user acceptance testing activities.

AWS services in use within CCC's PeopleSoft environment include, but are not limited to:

1. Amazon EC2 (application and web server compute)

1. Amazon RDS (database services)

1. Amazon S3 (storage)

1. AWS networking and security services

1. AWS monitoring and logging services

5.4 - Oracle Database on AWS CCC's PeopleSoft environment operates on Oracle Database hosted within its AWS infrastructure. The MSP must have demonstrated experience supporting Oracle Database deployments in AWS environments, including Oracle Database on Amazon EC2. Proposers must describe their Oracle Database on AWS architecture experience, including how they manage database availability, performance, patching, backup and recovery, and security within an AWS-hosted model. Experience with both EC2-hosted Oracle Database and Amazon RDS for Oracle is desirable.

5.5 - Network Connectivity CCC maintains secure network connectivity between its on-premises environment and its AWS-hosted PeopleSoft infrastructure. The MSP must be capable of supporting, managing, and troubleshooting both connectivity methods in use:

5.6 - AWS Direct Connect CCC utilizes AWS Direct Connect to provide dedicated, private network connectivity between CCC's on-premises infrastructure and its AWS environment. The MSP must demonstrate experience managing and supporting Direct Connect configurations and must be capable of diagnosing and resolving connectivity issues across this link in coordination with CCC's network team.

5.7 - VPN Connectivity CCC maintains VPN connectivity as a component of its network architecture supporting secure access to its AWS environment. The MSP must support VPN configuration, management, and troubleshooting as part of its infrastructure management responsibilities.

Proposers must describe their experience with AWS Direct Connect and VPN management in enterprise environments and identify the personnel responsible for network connectivity support within their proposed staffing model.

5.8 - Identity, Access, and Security Infrastructure CCC's identity and access management environment is built on Microsoft Entra ID (formerly Azure Active Directory). The MSP must be capable of supporting, configuring, and integrating with CCC's identity infrastructure as part of its managed services responsibilities.

5.9 - Microsoft Entra ID Integration The MSP must support integration between CCC's PeopleSoft environment and Microsoft Entra ID for identity and access management purposes. This includes supporting directory synchronization, user provisioning and deprovisioning, and role-based access control aligned to CCC's security policies.

5.10 - Single Sign-On (SSO) CCC requires SSO capability for PeopleSoft access. The MSP must be capable of configuring, supporting, and troubleshooting SSO integrations between PeopleSoft and CCC's Entra ID environment. Proposers must describe their experience implementing and managing SSO for PeopleSoft applications.

5.11 - Multi-Factor Authentication (MFA) MFA is required for access to CCC's PeopleSoft environment and supporting infrastructure. The MSP must support MFA configuration and enforcement across all in-scope systems and must ensure that MSP staff access to CCC's environment complies with CCC's MFA requirements at all times.

Proposers must describe their experience configuring and managing Entra ID integrations, SSO, and MFA in PeopleSoft environments.

5.12 - API Development and Integration Capability CCC requires the MSP to possess and maintain active API development and integration capability as part of its managed services delivery model. The MSP must be capable of supporting:

1. RESTful and SOAP API development and maintenance

1. PeopleSoft Integration Broker configuration and support

1. Integration development and troubleshooting across CCC's documented interface inventory

1. API-based integration with third-party systems, including Microsoft Entra ID and other institutional platforms

1. Documentation and version control of all APIs and integrations developed or maintained under this engagement

5.13 - Environment Structure

The MSP will be responsible for managing and supporting all in-scope environments. Environment refresh, cloning, and promotion activities are included within the scope of managed services.

5.14 - Integrations and Interfaces CCC's PeopleSoft environment maintains integrations and interfaces with a number of external and internal systems, including but not limited to third-party benefit administrators, state and federal reporting systems, Microsoft Entra ID, Salesforce CRM, and CCC-managed ancillary systems.

A detailed integration inventory will be made available to shortlisted Proposers under NDA. Proposers should assume a moderately complex integration landscape consistent with a large public higher education institution.

5.15 - IT Service Management and Project Management Platforms CCC operates defined service management and project management platforms that the MSP must align to and operate within. These platforms are not optional — the MSP is required to adopt and integrate with CCC's established tooling rather than introduce parallel or replacement systems.

5.16 - ServiceNow — Incident and Change Management CCC uses ServiceNow as its enterprise IT service management (ITSM) platform for incident management, service requests, and change management. The MSP must manage all incidents, service requests, and change records within CCC's ServiceNow instance. The MSP must be capable of operating within CCC's ServiceNow workflows, SLA tracking configurations, and reporting structures.

5.17 - CCC Change Control Process All changes to CCC's PeopleSoft environment and supporting infrastructure are subject to CCC's formal change control process, managed within ServiceNow. The MSP must comply with CCC's change control requirements, including change request submission, review, and approval workflows, testing attestation, and post-implementation review. Emergency change procedures are defined within CCC's change control process and must be followed for all unplanned changes to the production environment.

5.18 - Jira — Project Management CCC uses Jira for project and enhancement tracking. The MSP must utilize CCC's Jira instance for all project management, enhancement tracking, and sprint or release planning activities. Proposers must describe their experience working within customer-managed Jira environments.

5.19 - Operational Demand Patterns CCC's operational calendar creates predictable periods of elevated system demand that the MSP must plan for and support:

1. Payroll processing cycles — bi-weekly or as scheduled, with strict processing windows

1. Financial close cycles — monthly, quarterly, and annual close activities

1. Enrollment periods — fall, spring, and summer registration windows driving peak Campus Solutions activity

1. Financial aid disbursement cycles — tied to federal and state aid calendars

1. Board of Trustees reporting cycles — requiring financial data availability and system stability The MSP is expected to be proactive in identifying operational risks during these periods and must have documented procedures for heightened support during peak demand windows.

5.20 - Current State and Transition Context CCC currently receives managed services support from an incumbent provider. The selected MSP will be required to execute a structured transition from the incumbent, including knowledge transfer, documentation review, and operational handoff, without disruption to CCC's production environment or business operations.

5.21 - Strategic Technology Direction — Oracle Cloud Infrastructure CCC is currently planning the adoption of Oracle Cloud Infrastructure (OCI) as part of its long-term enterprise technology roadmap. While CCC's PeopleSoft environment currently operates on Oracle Database hosted within AWS, CCC anticipates that Oracle Cloud will become a component of its enterprise architecture during the initial contract term of the engagement resulting from this RFP.

Proposers should be aware of this planned direction and must describe their experience with and readiness to support Oracle Cloud environments in their proposal response. The MSP will be expected to support CCC through Oracle Cloud evaluation, planning, and transition activities as that initiative progresses, and must be capable of operating within a hybrid AWS and Oracle Cloud environment as CCC's architecture evolves.

This is not a current production requirement. Proposers will not be disqualified for limited Oracle Cloud experience. However, demonstrated Oracle Cloud capability will be viewed favorably during evaluation and will be scored as a desired qualification as described in Section VII.

SCOPE OF SERVICES

6.1 - Scope Of Services The scope of services under this RFP includes managed hosting, infrastructure support, application operations, break/fix support, Oracle Database administration, enhancement services, and integrated security operations for CCC's PeopleSoft environment hosted on AWS.

The MSP will be responsible for supporting PeopleSoft applications and related infrastructure across all in-scope environments, including production and non-production instances. Services under this engagement are expected to support CCC's operational needs while adhering to established governance, security, and change management practices and operating within a DevSecOps service model.

At a high level, the scope includes, but is not limited to:

1. AWS Hosting: Managed hosting, platform maintenance, and infrastructure support

1. Operations: Application operations and break/fix support

1. Database Administration: Oracle Database administration

1. Application Enhancements: Major and Minor enhancements

1. Integrated security operations: Using a DevSecOps service model

1. Operational reporting, service transparency, and compliance visibility

Customizations, integrations, batch processes, reports, and interfaces that are part of CCC's existing PeopleSoft environment are considered in scope.

CCC is actively planning the adoption of Oracle Cloud Infrastructure (OCI) as a component of its evolving enterprise technology strategy. The selected MSP must demonstrate awareness of Oracle Cloud capabilities as they relate to PeopleSoft operations and must be capable of supporting CCC's transition to and operation within an Oracle Cloud environment as that initiative matures.

6.1.1 - In-Scope Applications The MSP shall provide support for the following PeopleSoft applications and components:

PeopleSoft Human Capital Management (HCM) Including core HR, payroll, time and labor, benefits, security, interfaces, and reporting.

PeopleSoft Financials and Supply Chain Management (FSCM) Including General Ledger, Accounts Payable, Accounts Receivable, Asset Management, Procurement, and Contracts.

PeopleSoft Campus Solutions (CS) Including Campus Community, Recruiting and Admissions, Student Records, Financial Aid, Student Financials, and 3Cs.

PeopleSoft Interaction Hub (IH) Provides CCC's unified portal and navigation experience across PeopleSoft pillars, delivering Work Centers, dashboards, and role-based navigation for HCM, FSCM, and Campus Solutions users across the district.

All customizations, interfaces, batch processes, reports, and integrations documented within CCC's PeopleSoft environment are considered in scope.

Oracle Database Administration (DBA) Support The MSP shall provide full Oracle Database administration support for CCC's PeopleSoft environment hosted on AWS. DBA support is a core, non-optional component of the managed services scope and is not subject to separate scoping or pricing unless explicitly defined as an enhancement activity.

DBA support responsibilities include, but are not limited to:

· Oracle Database installation, configuration, and administration across all in-scope environments

· Database performance monitoring, tuning, and optimization

· Execution and validation of database backups and recovery procedures

· Oracle Database patching in coordination with PeopleSoft lifecycle requirements and CCC's change control process

· Capacity planning and storage management

· Schema management and database object maintenance

· Support for database-related incident diagnosis and resolution

· Coordination with AWS infrastructure services supporting Oracle Database workloads

· Audit and compliance support related to database access and activity

6.1.2 - DevSecOps Service Model Under the DevSecOps service model, the MSP is expected to:

1. Embed security considerations into support, enhancement, and deployment activities

1. Align deployment and change activities with secure coding and infrastructure standards

1. Support vulnerability identification, remediation, and audit readiness as part of normal operations

1. Coordinate security requirements across application, infrastructure, and integration layers

1. Maintain security controls aligned to FERPA, GLBA, and applicable Illinois data governance requirements

6.1.3 - Out-of-Scope Services Unless explicitly defined elsewhere in this RFP, the following are out of scope:

1. End-user training

1. Support for non-PeopleSoft systems

Detailed functional, technical, and security requirements associated with this Scope of Services are provided in subsequent sections of this document.

MINIMUM QUALIFICATIONS

7.1 - Overview Proposals submitted by firms that do not meet all Minimum Qualifications set forth in this section will be deemed non-responsive and will not be evaluated further. CCC reserves the right to request documentation or references to verify that stated qualifications are accurate and current.

Proposers must affirmatively confirm compliance with each Minimum Qualification in their proposal response and provide supporting evidence as specified.

7.2 - PeopleSoft Managed Services Experience

7.2.1 - Multi-Pillar PeopleSoft Experience The Proposer must demonstrate a minimum of five (5) years of experience providing managed services for PeopleSoft enterprise applications. Experience must include operational support for at least two (2) of the following PeopleSoft pillars:

· Human Capital Management (HCM)

· Financials and Supply Chain Management (FSCM)

· Campus Solutions (CS)

7.2.2 - Active Managed Services Engagements The Proposer must have a minimum of two (2) active managed services engagements for PeopleSoft at the time of proposal submission. References for these engagements must be provided and are subject to verification by CCC.

7.2.3 - Higher Education or Public Sector Experience The Proposer must demonstrate managed services experience with at least one (1) higher education institution or public sector organization of comparable scale and complexity to CCC.

7.2.4 - PeopleSoft Interaction Hub Experience The Proposer must demonstrate experience supporting PeopleSoft Interaction Hub in a managed services context, including portal configuration, Work Center and dashboard support, and navigation maintenance.

7.3 - Oracle Database and DBA Qualifications

7.3.1 - Oracle Database Administration Experience The Proposer must demonstrate a minimum of five (5) years of Oracle Database administration experience in support of PeopleSoft or comparable enterprise application environments. DBA experience must include performance tuning, patching, backup and recovery, and schema management.

7.3.2 - Oracle Database on AWS Experience The Proposer must demonstrate documented experience administering Oracle Database hosted in AWS environments, including EC2-hosted Oracle Database deployments. Proposers must identify the Oracle Database on AWS architecture supported in prior engagements.

7.3.3 - Oracle Certifications The Proposer must have at least one (1) staff member assigned to the CCC engagement who holds a current Oracle Database certification relevant to the version of Oracle Database in use within CCC's environment.

7.3.4 - Dedicated DBA Staffing The Proposer must include at minimum one (1) dedicated Oracle DBA in its proposed staffing model for the CCC engagement. The DBA role may not be fulfilled on a shared or as-needed basis. The named DBA must be identified as a key personnel role subject to the personnel substitution provisions of this RFP.

7.3.5 - Oracle Cloud Infrastructure Experience (Desired) Experience with Oracle Cloud Infrastructure (OCI) is a desired qualification. Proposers with Oracle Cloud experience should describe it in their proposal response. This is not a mandatory minimum qualification and will not be used as a pass/fail criterion. Oracle Cloud experience will be evaluated and scored as described in Section VII.

7.4 - Cloud Hosting and AWS Experience

7.4.1 - AWS Hosting Experience The Proposer must demonstrate documented experience managing enterprise application workloads hosted in AWS, including EC2, RDS, S3, and related services. PeopleSoft workloads hosted in AWS are strongly preferred.

7.4.2 - AWS Certification The Proposer must have staff assigned to the CCC engagement who hold current AWS certifications relevant to the scope of services, including at minimum one (1) AWS Certified Solutions Architect at the Associate level or above.

7.4.3 - AWS Advanced Tier Partner Status The Proposer must hold current AWS Advanced Tier Partner status within the AWS Partner Network (APN) at the time of proposal submission. AWS Advanced Tier Partner status demonstrates that the Proposer has met AWS’s requirements for technical expertise, customer success, and demonstrated delivery capability at scale. Proposers must provide evidence of current AWS Advanced Tier Partner designation, including the partner listing or official AWS partner credential documentation. Proposals from firms that do not hold AWS Advanced Tier Partner status or above will be deemed non-responsive.

7.4.4 - AWS Modernization Competency The Proposer must hold a current AWS Modernization Competency designation within the AWS Partner Network. The AWS Modernization Competency validates that the Proposer has demonstrated technical proficiency and proven customer success in helping organizations modernize their applications, infrastructure, and data on AWS. This competency is a mandatory qualification given CCC’s planned Oracle Cloud Infrastructure adoption and the expectation that the selected MSP will support CCC’s evolving hybrid cloud architecture. Proposers must provide evidence of current AWS Modernization Competency designation with their proposal submission.

7.4.5 - Oracle on AWS Competency The Proposer must hold a current Oracle on AWS Competency designation within the AWS Partner Network. The Oracle on AWS Competency validates that the Proposer has demonstrated technical depth and verified customer success in deploying, migrating, and managing Oracle workloads on AWS, including Oracle Database and Oracle applications. This designation is a mandatory qualification given that CCC’s PeopleSoft environment runs on Oracle Database hosted in AWS and that Oracle remains a core technology dependency across the engagement. Proposers must provide evidence of current Oracle on AWS Competency designation with their proposal submission.

7.5 - Security and DevSecOps Qualifications

7.5.1 - DevSecOps Operating Model The Proposer must demonstrate experience operating under a DevSecOps service model, with security practices integrated into application operations, change delivery, and infrastructure management. Proposers must describe their DevSecOps operating model and provide evidence of its application in prior engagements.

7.5.2 - SOC 2 Type II Certification The Proposer must hold a current SOC 2 Type II certification. A copy of the most recent SOC 2 Type II report must be submitted with the proposal or made available under a Non-Disclosure Agreement upon request.

7.5.3 - Security Incident Response The Proposer must have a documented security incident response capability and must describe how security incidents are identified, escalated, and remediated within their managed services delivery model.

7.6 - Staffing Qualifications

7.6.1 - Key Personnel The Proposer must identify key personnel proposed for the CCC engagement, including at minimum:

· Engagement or Account Manager

· PeopleSoft Technical Lead

· AWS Infrastructure Lead

· Oracle DBA Lead

· Security / DevSecOps Lead

Each key personnel role must be filled by a named individual with relevant qualifications described in the proposal. Substitution of key personnel after contract award requires prior written approval from CCC.

7.6.2 - PeopleSoft Technical Expertise Key technical staff assigned to the engagement must hold demonstrable expertise in PeopleSoft application support, including PeopleCode, Application Engine, Integration Broker, and the specific application pillars in scope.

7.7 - Compliance and Regulatory Qualifications

7.7.1 - Data Privacy and Regulatory Compliance The Proposer must demonstrate experience operating within regulatory compliance environments applicable to higher education institutions, including FERPA (Family Educational Rights and Privacy Act) and GLBA (Gramm-Leach-Bliley Act). Proposers must describe how compliance obligations are embedded in their managed services delivery model.

7.8 - Service Level Framework City Colleges of Chicago (CCC) requires the selected Managed Services Provider (MSP) to commit to defined Service Level Agreements (SLAs) by incident severity levels (High, Medium, Low) that ensure high availability, timely incident response, timely incident resolution, and consistent service performance across CCC's mission-critical enterprise environment.

SLAs apply to all in-scope PeopleSoft applications, AWS infrastructure components, Oracle Database, network connectivity, and supporting services identified in this RFP. The MSP's SLA framework must align with CCC's DevSecOps service model requirement, integrating operational and security obligations into day-to-day service delivery.

SLA performance will be measured using CCC's ServiceNow ITSM platform as the system of record for incident tracking, response time measurement, and resolution documentation. Vendors must confirm their ability to operate within ServiceNow for all SLA tracking and reporting purposes.

7.9 - System Availability — Uptime The MSP must commit to a minimum 99.99% system availability for all production PeopleSoft environments, measured on a monthly calendar basis.

7.9.1 - Uptime Defined System availability is defined as the percentage of time within a calendar month during which the production PeopleSoft environment is accessible and functional for CCC users, excluding approved planned maintenance windows. 99.99% availability equates to no more than approximately 4.3 minutes of unplanned downtime per month and no more than 52 minutes per calendar year.

7.9.2 - Downtime Defined Downtime is defined as any period during which the production PeopleSoft environment is unavailable or so severely degraded as to be non-functional for the majority of users. Downtime caused by MSP-managed infrastructure, configuration, deployment activity, or operational error will be counted against availability targets without exception.

7.9.3 - Measurement Availability will be measured continuously using MSP-managed monitoring tools integrated with CCC's AWS environment. Availability data must be accessible to CCC on demand and included in monthly SLA performance reports. CCC's ServiceNow records will serve as the authoritative source for outage duration in the event of disputes.

7.9.4 - Planned Maintenance Planned maintenance windows must be scheduled in advance, approved through CCC's change control process in ServiceNow, and communicated to CCC stakeholders a minimum of five (5) business days prior to execution. Maintenance windows must be scheduled during periods of lowest operational impact and may not occur during payroll processing cycles, financial close periods, or active enrollment windows without explicit written approval from CCC.

7.10 - Incident Priority Definitions and Response Times CCC defines response time as the period between incident creation in ServiceNow and the MSP's initiation of active, documented investigation. Ticket acknowledgment alone does not constitute a response. Response time begins at the moment an incident is logged in ServiceNow, regardless of the logging method.

The following priority tiers and response time targets are mandatory minimums.

Priority 1 — Critical Production system unavailable or so severely degraded as to be non-functional. Widespread impact to students, faculty, staff, or administrators. Includes payroll processing failures, financial close system unavailability, Campus Solutions outages during active enrollment, and any condition triggering compliance or regulatory risk.

Priority 2 — High Significant functionality unavailable or severely degraded. No reasonable workaround exists. Material impact to one or more major business functions or a substantial number of users. Includes integration failures affecting critical data flows and batch process failures during business-critical cycles.

Priority 3 — Medium Partial functionality unavailable. A reasonable workaround exists. Limited impact to users or departments. No immediate risk to business operations or compliance obligations.

Priority 4 — Low / Service Request Minor issues with minimal operational impact. Standard pre-approved service requests. Informational inquiries. Configuration questions with no system impact.

7.11 - Security Incident Response SLAs Given CCC's DevSecOps service model requirement, security incidents are treated as a distinct incident category with dedicated response obligations. A security incident is defined as any confirmed or suspected event involving unauthorized access, data exposure, vulnerability exploitation, malware, or any condition posing a risk to the confidentiality, integrity, or availability of CCC's data or systems.

The MSP must maintain a documented security incident response plan aligned to CCC's environment and must conduct at minimum one (1) tabletop security incident exercise with CCC annually.

7.12 - Change Management SLA Obligations All changes to CCC's environment are subject to CCC's change control process managed in ServiceNow. The MSP must meet the following change management commitments:

1. All non-emergency changes must be submitted in ServiceNow a minimum of five (5) business days prior to the planned implementation date

1. Emergency changes must be submitted in ServiceNow prior to implementation and retroactively documented within two (2) hours of completion

1. Change success rate must meet or exceed 95% on a rolling quarterly basis

1. Failed changes resulting in a Priority 1 or Priority 2 incident require a post-incident review and root cause analysis submitted within three (3) business days

7.13 - SLA Reporting The MSP must provide monthly SLA performance reports delivered to CCC's designated contract manager within five (5) business days following the close of each calendar month. Reports must be generated from ServiceNow data and must include, at minimum:

1. Monthly and year-to-date system availability against the 99.99% target

1. Incident volume by priority tier

1. Response time and resolution performance against targets by priority tier

1. Change success rate and security incident summary

1. Open items and aging incidents

1. Root cause summaries for all Priority 1 incidents

1. Trend analysis and identified improvement actions Reports must be formatted for executive and governance review and must be auditable.

7.14 - Service Credits The contract resulting from this RFP will include a service credit framework applicable when the MSP fails to meet defined SLA commitments. Proposers must describe their proposed service credit structure in Volume III, including credit tiers, calculation methodology, credit caps, and exclusions.

Service credit structures that include material exclusions, caps that limit accountability, or calculation methods that obscure performance deficiencies will reflect negatively in scoring.

7.15 - Continuous Improvement CCC expects SLA performance data to drive continuous service improvement. The MSP must conduct a formal quarterly business review (QBR) with CCC that includes SLA trend analysis, root cause patterns, improvement initiatives underway, and forward-looking risk identification. QBR outputs must be documented and tracked in Jira.

7.16 - Monthly Status Report In addition to the SLA performance reports defined in Section VI.F, the MSP must deliver a comprehensive Monthly Status Report to CCC’s designated contract manager and IT leadership. The Monthly Status Report is distinct from SLA reporting and is intended to provide CCC with a complete operational picture of the engagement, including forward-looking risk identification, project activity, and staffing status.

Monthly Status Reports must be delivered within five (5) business days following the close of each calendar month. Reports must be formatted for executive and IT leadership review, must be auditable, and must be delivered as a structured document suitable for distribution to CCC’s senior stakeholders. All project and enhancement tracking data referenced in the Monthly Status Report must be sourced from CCC’s Jira instance, and all incident and change data must be sourced from CCC’s ServiceNow instance.

The Monthly Status Report must include, at minimum, the following sections:

1. Executive Summary A brief narrative summary of the overall health of the engagement during the reporting period, including an overall status indicator (green, yellow, or red), a summary of significant events, and any items requiring CCC leadership attention or decision. The executive summary must be written for non-technical senior leadership and must not exceed two pages.

2. Environment Health and Availability A summary of PeopleSoft environment health and availability during the reporting period, including:

1. Production environment availability percentage against the 99.99% target

1. Summary of any unplanned outages, including duration, root cause, and resolution

1. Status of non-production environments and any environment-related issues

1. AWS infrastructure health summary including compute, storage, database, and network connectivity status

1. Oracle Database health summary including performance, storage utilization, and any identified database-level issues

3. Incident and Service Request Summary A summary of all incidents and service requests managed during the reporting period, sourced from ServiceNow, including:

1. Total incident volume by priority tier (P1, P2, P3, P4) and comparison to prior month

1. SLA response time and resolution performance by priority tier against defined targets

1. Root cause summaries for all Priority 1 incidents and any repeat Priority 2 incidents

1. Total service request volume and completion rate

1. Open and aging incidents with current status and projected resolution dates

1. Security incident summary, including any vulnerabilities identified, remediated, or in progress

4. Change Management Summary A summary of all change management activity during the reporting period, sourced from ServiceNow, including:

1. Total changes implemented during the reporting period by change type (standard, normal, emergency)

1. Change success rate against the 95% quarterly target, with rolling quarterly view

1. Failed or backed-out changes with root cause and corrective action

1. Emergency changes implemented and post-implementation review status

1. Planned changes scheduled for the upcoming month with anticipated impact assessment

5. Enhancement and Project Activity A summary of all enhancement and project activity during the reporting period, sourced from Jira, including:

1. Status of all active enhancements and projects, including percent complete, milestones achieved, and current schedule position

1. Enhancements or projects completed during the reporting period

1. Enhancements or projects initiated during the reporting period

1. Any schedule variances, scope changes, or budget impacts with explanation and corrective action

1. Enhancement hours consumed against allocated or contracted levels during the reporting period

6. Risk Register A current risk register identifying all known risks to environment stability, service delivery, or engagement performance, including:

1. Risk description, probability, and potential impact

1. Risk owner and current mitigation status

1. New risks identified during the reporting period

1. Risks closed or downgraded during the reporting period with rationale

1. Upcoming operational calendar items representing elevated risk (enrollment periods, financial close, payroll cycles) and the MSP’s heightened support plan

7. Staffing and Resource Status A summary of the MSP’s staffing status for the CCC engagement, including:

1. Current staffing roster for the engagement with role and assignment status

1. Any key personnel changes, departures, or proposed substitutions during the reporting period, including status of CCC approval where required

1. Certification renewals completed or due within the next 90 days, including AWS, Oracle, and SOC 2 Type II

1. Training or capability development activities underway or planned for engagement…