REQUEST FOR PROPOSALS (RFP) NC2615

IT General Controls and Cybersecurity Audit RFP

The District will only accept proposals electronically uploaded to the EUNA Procurement System (formerly

Bonfire) at: https://ccc.bonfirehub.com/portal/?tab=openOpportunities

City Colleges of Chicago will issue email alerts via EUNA for all published RFPs.

EUNA Vendor Support: access the EUNA Customer Hub

Proposal Due Date: Proposals must be submitted in the CCC EUNA Procurement portal no later than 12:00 p.m. Central Time, Friday, July 17, 2026.

Pre-Proposal Conference: A pre-proposal conference is scheduled for Tuesday, June 23, 2026, at 11:00 a.m. to discuss the Scope of Services and the Minority and Women Business Enterprise Contract Participation Plan

(MBE/WBE).

MEETING LINK:

https://cccedu.zoom.us/j/95110086913?pwd=otsvdOTPGILaPa8LasSTBBfubCoGKK.1&from=addon

Questions: All questions regarding this solicitation should be submitted via the CCC EUNA Portal at:

https://ccc.bonfirehub.com/portal/?tab=openOpportunities.

Questions Deadline: The deadline for submitting final questions via EUNA is Friday, June 26, 2026, by 12:00 p.m. Central Time.

https://ccc.bonfirehub.com/portal/?tab=openOpportunities https://customer.eunasolutions.com/public/s/ https://cccedu.zoom.us/j/95110086913?pwd=otsvdOTPGILaPa8LasSTBBfubCoGKK.1&from=addon

RFP #NC2615

IT General Controls & Cybersecurity Audit RFP

C I T Y C O L L E G E S O F C H I C A G O

Contents

1. BACKGROUND

2. INTENT TO SUBMIT

3. BUSINESS GOALS AND OBJECTIVES

4. SCHEDULE

5. SCOPE OF SERVICES

5.1. INTERROGATORIES

6. SPECIAL TERMS AND CONDITION

6.1. Insurance Requirements

6.2. Federal/State Funding

6.3. Participation by other Local Government Agencies

6.4. Payment

6.5. Termination

6.6. Indemnity

6.7. Non-Discrimination

7. SUBMITTAL REQUIREMENTS (Required Proposal Content)

7.1 Table of Contents

7.2 Cover Letter

7.3 Executive Summary

7.4 Response to the Scope of Services

7.5 Qualifications of the Proposer and References

7.6 Proposed Team Structure/Key Personnel

7.7 MBE/WBE Participation (Subcontracting or Teaming)

7.8 Joint Ventures

7.9 Fee/Cost Proposal

7.10 Financial Statements

7.11 Insurance Requirements

7.12 Legal Actions

7.13 CCC Ethics Orientation Contractors/Vendors

7.14 Disclosure

7.15 Debarment

7.16 Economic Disclosure Statement

7.17 IRS W-9 Form

7.18 Addenda

8. EVALUATION CRITERIA

8.1. Responsiveness of Proposal

8.2. Qualitative Criteria

8.3. Technical Evaluation

9. GENERAL INSTRUCTIONS

9.1. Time for Receiving Proposals

9.2. Communications and Inquiries

9.3. Pre-proposal Conference (if applicable)

9.4. Preparatory Cost

9.5. Contract Award

9.6. Contract Term

9.7. Conflicts

9.8. Withdrawal of Proposals

9.9. Ownership and Confidentiality

9.10. Addenda to this RFP

10. APPENDIX I – ADDENDA ACKNOWLEDGEMENT FORM

1 . B A C K G R O U N D

City Colleges of Chicago (CCC) consists of seven (7) community colleges which are all located within the city limits of Chicago. In addition, there are five (5) satellite locations that are affiliated with the colleges. A seven-member board of trustees, who are appointed by the Mayor of Chicago, governs the system. The chief administrative officer of the system is the Chancellor, who is appointed by the Board of Trustees. Each college has its own President, who reports to the Chancellor, and its own administrative staff which is responsible for policy administration in the areas of human resources and staff development, finance, academic affairs, administrative services and information technology. Each of these areas is headed by a Vice Chancellor that reports to the Chancellor.

2 . I N T E N T T O S U B M I T

Vendors who intend to submit a proposal in response to this solicitation should indicate their intent to submit in the EUNA portal, https://ccc.bonfirehub.com/portal/?tab=openOpportunities , no later than Wednesday, July 15, 2026, by 12:00 p.m. If proposers fail to declare their intent, they must do so as part of their submission.

Link to: How do I submit my intent to bid?

3 . B U S I N E S S G O A L S A N D O B J E C T I V E S

The City Colleges of Chicago (CCC) is soliciting proposals from Vendors (“Vendor”) qualified to provide services to be procured.

CCC intends to award one twelve (12) month or until completion contract for the requested services.

Through the provision of the services identified in this RFP, the selected proposer shall assist CCC in meeting the following business goals and objectives:

a. Strengthen the Reliability and Integrity of CCC’s Core Systems.

• Provide assurance that key IT general controls supporting critical systems are designed appropriately and operating effectively.

b. Improve Control Over Access to CCC’s Critical Systems and Data.

• Assess whether logical access controls appropriately restrict access to authorized users.

c. Reduce Risk from IT Change and Operational Processes.

https://cccedu.sharepoint.com/sites/FinanceOnboarding/Procurement/Procurement/Documents%20and%20Templates/How%20do%20I%20submit%20my%20intent%20to%20bid?

• Evaluate controls over IT changes and operations to minimize disruption and unintended impacts.

d. Improve Leadership Visibility and Oversight of Cybersecurity Risk.

• Assess the effectiveness of cybersecurity governance, accountability, and oversight.

e. Integrate Cybersecurity Risks with CCC’s Broader Risk Environment.

• Evaluate how cybersecurity risks are identified, prioritized, and managed alongside other institutional risks.

f. Enhance CCC’s Ability to Respond to and Recover from Cyber Incidents.

• Assess preparedness to detect, respond to, and recover from cybersecurity incidents.

g. Validate That IT and Cybersecurity Controls Work in Practice.

• Confirm that key controls operate effectively through independent testing.

h. Provide Practical, Actionable Insights That Support Continuous Improvement.

• Deliver prioritized, achievable recommendations tailored to CCC’s operating environment.

i. Support Effective Accountability and Governance Oversight.

• Enable clear ownership, remediation tracking, and governance follow‑up.

4 . S C H E D U L E

CCC anticipates the following schedule.

Activity Estimated Date RFP posted to the procurement portal June 9, 2026 Pre-Proposal conference June 23, 2026 Proposer Questions Deadline June 26, 2026 CCC response to Proposer Questions– Tentative July 6, 2026 Intent to Submit Proposal July 15, 2026 Proposal Due Date July 17, 2026

5 . S C O P E O F S E R V I C E S

The RFP and all attachments are available for download from the City Colleges of Chicago EUNA Portal, https://ccc.bonfirehub.com/portal/?tab=openOpportunities. Proposers are responsible for checking the EUNA Portal for required forms, templates, clarifications, and/or addenda.

Current State/Point points

City Colleges of Chicago operates a complex and evolving information technology environment that supports academic, student, and administrative functions across a distributed, multi-college structure. As reliance on technology continues to expand and cybersecurity risks grow more dynamic, CCC seeks independent internal audit assurance over whether IT General Controls and cybersecurity governance, risk management, and resilience practices are appropriately designed and operating effectively. This need is driven by the importance of consistent control execution across systems, clear cybersecurity governance and risk integration, operational resilience, and governance-appropriate reporting. The objective of this engagement is to provide risk-based, standards-aligned assurance on the effectiveness of existing controls, informed by targeted technical validation, to support executive leadership and Board oversight consistent with, including but not limited to, the Global Internal Audit Standards.

The Office of Internal Audit has identified the need for an independent, risk-based internal audit assurance engagement to evaluate whether existing IT General Controls and cybersecurity governance and practices are appropriately designed, consistently operating, and effectively supporting CCC’s objectives.

Future State /Desired Outcomes

The desired future state for City Colleges of Chicago is a well-governed, risk-informed IT and cybersecurity environment in which key controls are clearly owned, consistently operating, and effectively supporting institutional objectives. Through this engagement, CCC seeks independent assurance that IT General Controls and cybersecurity practices are appropriately designed, operating as intended, and aligned with governance, enterprise risk management, and resilience expectations under the Global Internal Audit Standards. The outcome of the audit will be increased confidence for executive leadership and the Board regarding cybersecurity oversight, control effectiveness, and preparedness, supported by clear, actionable insights that strengthen accountability, risk prioritization, and informed decision-making without expanding scope into system redesign or certification efforts.

This engagement is assurance-focused, not advisory or consulting in nature. Respondents must align their methodology, testing, conclusions, and reporting to internal audit standards and practices.

Governing Frameworks

The following frameworks shall be used exclusively, as applicable, to structure testing and evaluation:

• Global Internal Audit Standards (GIAS) – Governing assurance framework

• COBIT 2019 – Evaluation of Information Technology General Controls

• NIST Cybersecurity Framework (CSF) – Cybersecurity governance, risk management, and resilience criteria

• PTES or NIST SP 800-115 – Penetration testing methodology alignment https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/

Scope of Services

The selected firm will conduct an internal audit that includes, at minimum, the following components:

A. Overall Assurance Governance (GIAS)

The selected firm shall:

• Perform risk-based audit planning aligned to CCC’s strategic, operational, and technology objectives.

• Apply internal audit assurance methodologies to evaluate both design and operating effectiveness of in-scope controls.

• Develop clear assurance conclusions supported by sufficient and appropriate audit evidence.

B. Information Technology General Controls (ITGC)

The audit shall evaluate ITGCs using COBIT 2019, limited to the following domains:

1. IT Governance – COBIT 2019 – EDM01, EDM03 & EDM05 o Roles, responsibilities, oversight, and decision-making structures o Alignment of IT governance to CCC objectives

2. Access Management – COBIT 2019 – DSS05 / APO13 o User provisioning and deprovisioning o Privileged access management o Logical access monitoring and review

3. Change Management – COBIT 2019 – BAI06 o Change approval and authorization o Testing and migration controls o Segregation of duties

4. IT Operations – COBIT 2019 – DSS01 o Backup and recovery processes o Job scheduling o Incident handling and escalation

5. Interface Controls – COBIT 2019 – DSS06 o High-risk system interfaces only

ITGC Area Primary COBIT Objective(s) Supporting (Limited Only)

IT Governance EDM01, EDM03, EDM05 APO12, APO13

Access Management DSS05 + APO13 DSS06 (SoD only)

IT Operations DSS01 DSS02, DSS04

Change Management BAI06 BAI07, DSS01

Interface Controls DSS06 DSS01

C. Cybersecurity Governance, Risk Management, and Resilience

Cybersecurity will be evaluated using the NIST Cybersecurity Framework (CSF) across the following areas:

1. Govern (Cyber Governance) o Accountability, oversight, and reporting o Policies and governance structures

2. Identify (Cyber Risk Management) o Risk identification, assessment, and prioritization o Integration with enterprise risk management processes

3. Protect o Key preventive cybersecurity controls o Control design and operational effectiveness

4. Detect o Monitoring and alerting capabilities o Effectiveness of detection mechanisms

5. Respond o Incident response readiness o Plans, roles, and execution capability

6. Recover o Backup, disaster recovery, and resilience preparedness o Recovery testing evidence

All NIST Cybersecurity Framework (CSF) 2.0 functions and categories are considered within scope for purposes of assessing cybersecurity governance, risk management, and resilience. However, testing depth will be risk-based and focused on governance, control effectiveness, and key cybersecurity control domains, rather than a comprehensive maturity assessment of all categories.

D. Alignment to GIAS Cybersecurity Topical Requirement

The engagement must explicitly address the Cybersecurity Topical Requirement under GIAS, including assessment of:

• Governance and leadership accountability

• Integration of cybersecurity with enterprise risk management

• Policy adequacy and operational effectiveness

• Cyber resilience and preparedness

• Continuous improvement and lessons learned

E. Penetration Testing (Supporting Assurance Only)

Penetration testing shall be performed as a supporting assurance activity, not a standalone security consulting engagement.

Scope includes:

• External perimeter testing

• Limited internal or assumed-breach validation

• Application testing for one to two critical systems

Penetration testing must align with PTES or NIST SP 800-115 methodologies.

Deliverables

The selected firm will provide:

1. Audit Workplan

• A risk-based audit workplan for CCC Office of Internal Audit approval prior to fieldwork

• Clearly defined audit objectives, risks, controls, and testing procedures

• Alignment to GIAS, COBIT 2019, NIST CSF, and the Cybersecurity Topical Requirement

• Defined milestones, timelines, and dependencies

2. Fieldwork Documentation

• Complete audit working papers supporting design and operating effectiveness conclusions

• Documentation of testing procedures, evidence obtained, sampling, and results

• Penetration testing documentation integrated with internal audit assurance work

• Audit documentation maintained in accordance with internal audit quality standards and retained for CCC review

3. Draft Internal Audit Report

• Draft report provided for management and Internal Audit review, including:

o Executive summary with preliminary assurance conclusions o Scope and methodology o Risk-ranked findings aligned to applicable frameworks o Summarized penetration testing results o Draft management action plans

4. Final Internal Audit Report

• Final integrated report incorporating agreed-upon management responses

• Clear internal audit assurance conclusions written in GIAS-appropriate language

• Suitable for Board reporting

• No certification, maturity scoring, or regulatory compliance opinions

5. Status Reporting

• Periodic status updates throughout the engagement

• Timely escalation of significant issues identified during fieldwork

Scope and Cost Control Expectations

To maintain scope discipline and budget control:

• Framework usage is limited to those specified in this RFP

• Depth of testing shall be risk-based

• The engagement is for internal use only

Vendor Qualifications

Must Have:

• Demonstrated experience performing internal audit assurance engagements in accordance with the Global Internal Audit Standards (GIAS).

• Proven ability to evaluate design and operating effectiveness of controls and issue internal audit assurance conclusions.

• Substantive experience auditing IT General Controls (ITGC) using COBIT 2019 or a comparable control framework.

• Experience assessing cybersecurity governance, risk management, and resilience using the NIST Cybersecurity Framework (CSF).

• Ability to apply or align engagements to the Cybersecurity Topical Requirement under the Global Internal Audit Standards.

• Demonstrated understanding of governance, risk integration, and resilience assessment within an internal audit context.

• Prior experience performing IT and/or cybersecurity internal audits within higher education environments, preferably large, complex, multi‑college institutions.

• Familiarity with common risks, governance structures, and resource constraints in public higher education.

• Experience performing penetration testing aligned to PTES or NIST SP 800‑115 in support of internal audit or assurance engagements.

• Ability to integrate penetration testing results into an internal audit assurance report, rather than delivering standalone technical reports.

• Engagement personnel with appropriate professional experience in internal audit, IT auditing, and cybersecurity.

• Ability to maintain independence and objectivity consistent with internal audit standards.

• No conflicts of interest that would impair performance of an internal audit assurance engagement.

Nice to Have:

• Experience working with Illinois public sector entities, including community colleges or higher education systems.

• Familiarity with Illinois governance, procurement, and oversight expectations.

• Experience auditing distributed or decentralized IT environments, including shared services and institution‑level systems.

• Experience with ERP systems, student information systems, or cloud‑hosted platforms commonly used in higher education.

• Relevant professional certifications such as CIA, CISA, CISSP, or equivalent credentials held by key engagement personnel.

• Demonstrated use of a risk‑based audit approach that prioritizes high‑risk areas while maintaining scope and cost discipline.

5.1. INTERROGATORIES

1. Reasonableness of Overall Price

A. Provide a detailed fee breakdown, including:

I. Labor hours by role (partner, manager, staff)

II. Hourly rates by role

III. Total hours allocated to each major workstream:

Overall Assurance (Global Internal Audit Standards)

ITGC (COBIT – Governance, Access, Change, Operations, Interfaces)

Cybersecurity (NIST) & GIAS – Topical Requirement

Penetration Testing

Reporting and deliverables

B. Describe the key assumptions underlying your pricing, including:

II. Number of systems, applications, or processes to be tested

III. Level of stakeholder engagement required

IV. Availability of client documentation

C. Explain how your pricing aligns with a risk-based audit approach, including:

I. Allocation of effort to governance vs. control testing

II. Use of sampling and scoping techniques

D. Identify any potential scope drivers that may increase cost, including:

I. Expansion into full NIST or COBIT maturity assessments

II. Additional testing beyond ITGC/control effectiveness

E. Confirm that your proposed pricing:

I. ☐ Includes all deliverables described in your proposal

II. ☐ Does not assume additional advisory, consulting, or transformation services

2. MBE/WBE Compliance

If subcontracting, provide:

A. Describe how MBE/WBE firms will be actively engaged, including:

I. Roles and responsibilities

II. Participation in audit execution vs. administrative functions

B. Provide documentation of compliance with:

I. Illinois or local MBE/WBE participation requirements

C. Confirm:

I. ☐ Participation is substantive and aligned with audit deliverables

II. ☐ Not limited to pass-through or administrative roles

3. Understanding of Scope and Assurance Objectives [NC10.1]

A. Describe your understanding of the engagement scope, including:

I. ITGC domains (Governance, Access, Change, Operations, Interfaces)

II. Cybersecurity governance (NIST CSF Govern function)

III. Risk-based and control-focused testing approach

B. Explain how your approach aligns with internal audit assurance objectives, including:

I. Evaluation of design effectiveness

II. Evaluation of operating effectiveness

III. Evidence-based audit conclusions

C. Describe how you will maintain separation between:

I. Governance (strategy/oversight)

II. Control execution (operations/testing)

D. Explain how your approach avoids scope expansion into:

I. Full NIST CSF maturity assessment

II. Full COBIT maturity or process optimization

III. Cybersecurity consulting or transformation

E. Confirm:

I. ☐ Engagement is structured as an assurance engagement (not consulting)

II. ☐ Scope is aligned to GIAS standards and risk-based auditing

4. Audit Approach and Methodology

A. Describe your audit methodology, including:

I. Risk assessment and scoping

II. Control identification and mapping

III. Testing procedures

B. Provide your COBIT mapping, including how you will apply:

I. DSS01 (IT Operations)

II. DSS05 & APO13 (Access management)

III. DSS06 (Interface controls)

IV. BAI06 (Change management)

V. EDM01, EDM03, EDM05 (governance oversight)

C. Describe your NIST CSF application, including:

I. Coverage of all CSF functions

II. Risk-tiered testing approach (e.g., governance vs. control testing vs. limited validation)

D. Explain your testing approach, including:

I. Sampling methodology

II. Evidence collection and validation

III. Handling of exceptions and control deficiencies

E. Provide examples of audit procedures for each ITGC area, including:

I. Access provisioning and review

II. Change approval and migration

III. Operations monitoring

IV. Interface reconciliations

V. Roles and responsibilities and alignment of IT governance to CCC objectives

5. Deliverables and Reporting Quality

A. Provide a list of deliverables, including:

I. Detailed findings report

II. Executive summary

III. Control testing results

IV. Risk ratings and prioritization

B. Provide sample deliverables or report excerpts, demonstrating:

I. Clarity and conciseness

II. Risk-based language

III. Actionable recommendations

C. Describe how findings will be structured, including:

I. Condition

II. Criteria (COBIT / NIST / policy)

III. Cause

IV. Risk / impact

V. Recommendation

D. Explain how reporting will be tailored for:

I. Executive leadership

II. Board

E. Confirm:

I. ☐ Reports will be concise, risk-focused, and board-ready

II. ☐ Deliverables will support GIAS / QAIP expectations

6. Project Management and Timeline

A. Provide a detailed project plan, including:

I. Key phases (planning, fieldwork, reporting)

II. Milestones and deliverable dates

III. Dependency assumptions

B. Describe project governance, including:

I. Project manager responsibilities

II. Communication cadence (status updates, meetings)

III. Escalation procedures

C. Describe how you will manage scope and timeline risks, including:

I. Changes in scope

II. Delays in documentation or stakeholder availability

D. Provide staffing model, including:

I. Roles and responsibilities

II. Experience level of assigned team members

E. Confirm:

I. ☐ Timeline is achievable within proposed resource allocation

II. ☐ Project plan aligns with audit scope and deliverables

6 . S P E C I A L T E R M S A N D C O N D I T I O N

6.1. Insurance Requirements

The Proposer shall procure and maintain at all times, at Proposers own expense, until final acceptance of the Work covered by this Agreement, and if required to return during the warranty period, the types of insurance specified below, with insurance companies authorized to do business in the State of Illinois covering all operations under this Agreement, whether performed by the Proposer or by subcontractors.

The kinds and amounts of insurance required are as follows:

1. Worker's Compensation and Occupational Disease Insurance. Workers Compensation and Occupational Disease Insurance, in accordance with the laws of the State of Illinois, or any other applicable jurisdiction, covering all employees who are to provide a service under this contract.

Employer’s liability coverage with limits of not less than $1,000,000.00 each accident or illness shall be included.

2. Commercial Liability Insurance (Primary and Umbrella). Commercial Liability Insurance or equivalent with limits of not less than $5,000,000.00 per occurrence, combined single limit, for bodily injury, personal injury, and property damage liability. Products/completed operations, explosion, collapse, underground, independent contractors, broad form property damage and contractual liability coverages are to be included. City Colleges of Chicago is to be named as an additional insured without recourse or right of contribution for any liability arising from this work.

3. Automobile Liability Insurance. When any motor vehicles are used in connection with work to be performed, the Contractor shall provide Automobile Liability Insurance with limits of not less than $1,000,000.00 per occurrence combined single limit, for bodily injury and property damage. The City Colleges of Chicago is to be named as an additional insured.

4. Cyber Liability. A Cyber and Privacy Policy shall be maintained with limits of not less than $5,000,000.00 to address liability for a data breach which may result in the compromise of personal data pertaining to District Trustees, Employees, Students, Administrators, Staff, Visitors and Guests.

The Policy shall cover a variety of expenses associated with data breaches, including, but not limited to:

notification costs, credit monitoring, costs to defend claims by state regulators, fines and penalties, and loss resulting from identity theft.

5. Fidelity, EPLI and Professional Liability (E&O). Professional liability insurance covering errors, omissions or negligent acts must be maintained with limits of not less than $5,000,000.00. Coverage must include contractual liability. When policies are renewed or replaced, the policy retroactive date must coincide with, or precede, start of work on this Agreement. A claims-made policy, which is not renewed or replaced, must have an extended reporting period of two (2) years.

The Contractor will furnish City Colleges of Chicago original Certificates of Insurance evidencing the required coverage to be in force on the date of this contract, and Renewal Certificates of Insurance, or such similar evidence, if the coverage has an expiration or renewal date occurring during the term of this contract. The Contractor shall submit evidence of insurance prior to contract award. The failure of City Colleges of Chicago to obtain such evidence from Proposer before permitting Proposer to commence work shall not be deemed to be a waiver by City Colleges of Chicago, and the Proposer shall remain under continuing obligation to maintain the insurance coverage.

The insurance herein specified shall be carried until all work required to be performed under the terms of the Agreement is satisfactorily completed and formally accepted. Failure to carry or keep such insurance in force may constitute a violation of the Agreement, and City Colleges of Chicago maintains the right to stop work until proper evidence of insurance is provided.

The insurance shall provide for 60 days prior written notice to be given to City Colleges of Chicago Procurement and Business Services Department in the event coverage is substantially changed, canceled, or non-renewed.

The Proposer shall require all subcontractors to carry the insurance required herein, or Proposer may provide the coverage for any or all subcontractors, and, if so, the evidence of insurance submitted shall so stipulate.

Any and all deductibles on referenced insurance coverage shall be borne by Proposers.

Proposer expressly understands and agrees that any insurance coverage and limits furnished by Proposer shall in no way limit the Proposer’s liabilities and responsibilities specified within the contract documents or by law.

The Proposer and each subcontractor agree that insurer shall waive their rights of subrogation against City Colleges of Chicago.

The Proposer expressly understands and agrees that any insurance maintained by City Colleges of Chicago shall apply in excess of and not contribute with insurance provided by the Proposer under the contract.

If the Proposer, or its subcontractors desire additional coverage, higher limits of liability, or other modifications for its own protection, the Proposer and each of its subcontractors, shall be responsible for the acquisition and cost of such additional protection.

City Colleges of Chicago maintains the right to modify, delete, alter or change these requirements.

6.2. Federal/State Funding

If funding for the Deliverables in this Subgrant Agreement derive from federal funding sources, then the terms set forth in this Addendum/Section shall apply and are hereby incorporated into the Subgrant Agreement. For purposes of this section, references to the “CCC” mean Chicago City Colleges and all its offices. References to “Entity” refers to “Subgrantee/Subgrantee”. References to “Contract” or “Agreement” refers to this Subgrant Agreement.

1. Compliance with Federal Law, Regulations, and Executive Orders. Entity will comply with all applicable federal statutes, regulations, executive orders, and other federal requirements in carrying out any project supported by federal funds. The Entity recognizes that federal laws, regulations, policies, and administrative practices may be modified from time to time and those modifications may affect project implementation. The Entity agrees that the most recent federal requirements will apply to the project.

2. Debarment and Suspension. Entity is not presently debarred, suspended, proposed, for debarment, declared ineligible or voluntarily excluded form covered transactions by any federal Agency or agency;

b) within a three-year period preceding this Agreement have not been convicted of or had a civil judgment rendered against it for commission of fraud or a criminal offense in connection with obtaining, attempting to obtain or performing a public (federal, state or local) transaction or contract under a public transaction, violation of federal or state antitrust statutes or commission of embezzlement, theft, forgery, bribery, falsification or destruction of records making false statements receiving stolen property; c) are not presently indicted for or otherwise criminally or civilly charged by a governmental entity (federal, state, or local) with commission of any of the offences enumerated in subsection (b), above; d) have not within a three-year period preceding this Agreement had one or more public transactions (federal, state, or local) terminated for cause or default.

3. Lobbying and Political Activities. In signing this Agreement, Entity certifies, to the best of his or her knowledge and belief, that:

a. No federal appropriated funds have been paid or will be paid, by or on behalf of the undersigned, to any person influencing or attempting to influence an officer or employee of an agency, a Member of Congress, an officer or employee of Congress, or an employee of a Member of Congress in connection with awarding any federal contract, the making of any federal grant, the making federal loan, the entering into any cooperative agreement, and the extension, continuation, renewal, amendment, or modification of any federal contract, grant, loan, or cooperative agreement.

b. If any funds other than federal appropriated funds have been paid or will be paid to any person for influencing or attempting to influence an officer or employee of any agency, a Member of Congress relating to this federal contract, grant, loan, or cooperative agreement, the undersigned shall complete and submit Standard Form-LLL, “Disclosure Form to Report Lobbying”, in accordance with its instructions.

c. The undersigned shall require that the language of the foregoing two subsections be included in the award documents for all subcontracts at all tiers and that all subcontractors shall certify and disclose accordingly.

This certification is a material representation of fact upon which reliance was placed when this transaction was made or entered into. Submission of this certification is a prerequisite for making or entering into this transaction imposed by section 1352, title 31, U.S. Code. Any person who fails to file the required certification shall be subject to a civil penalty of not less than $10,000 and not more than $100,000 for each such failure.

The Entity certifies or affirms the truthfulness and accuracy of each statement of its certification and disclosure, if any. In addition, the Entity understands and agrees that the provisions of 31 U.S.C. Chap.

38, Administrative Remedies for False Claims and Statements, apply to this certification and disclosure, if any.

4. DHS Seal, Logo, and Flags. Entity shall not use the DHS seal(s), logos, crests, or reproductions of flags or likenesses of DHS agency officials without specific FEMA preapproval.

5. Records Retention. Entity shall maintain for three (3) years from the date of submission of the final expenditure report, adequate books, all financial records and, supporting documents, statistical records, and all other records pertinent to the Subaward, adequate to comply with 2 C.F.R. § 200.333, unless a different retention period is specified in 2 C.F.R. § 200.333. If any litigation, claim or audit related to the purchases contemplated herein is started before the expiration of the retention period, the records must be retained until all litigation, claims or audit exceptions involving the records have been resolved and final action taken.

6. No Obligation by Federal Government. The Federal Government is not a party to this Agreement and is not subject to any obligations or liabilities to the non-Federal entity, Entity, or any other party pertaining to any matter resulting from the Agreement.

7. Program Fraud and False or Fraudulent Statements or Related Acts. Entity acknowledges that 31 U.S.C.

Chap. 38 (Administrative Remedies for False Claims and Statements) applies to the Entity’s actions pertaining to this Agreement.

6.3. Participation by other Local Government Agencies

Other local government agencies (“Local Government Agencies”) may be eligible to purchase Services pursuant to the terms and conditions of this Contract if such agencies are authorized, by law or their governing bodies, to execute such purchases, and if such authorization is allowed by the City Colleges of Chicago’s District Director of Business & Procurement Services, and if such purchases have no significant net adverse effect on the City Colleges of Chicago and result in no observed diminished ability on the Bidder to provide the Services to the City Colleges of Chicago or user departments pursuant to such purchases. Local Government Agencies shall include without limitation: City of Chicago, Chicago Park District, Chicago Public Schools, Chicago Transit Authority, Chicago Housing Authority, Chicago Board of Elections, Metropolitan Pier & Exposition Authority (McCormick Place, Navy Pier), and the Municipal Courts. All purchases and payment transactions shall be made directly between the Bidder and the requesting Local Government Agency; City Colleges of Chicago shall not be responsible for payment of any amounts owed by any Local Government Agency to Bidder. The City Colleges of Chicago assumes no authority, liability or obligation on behalf of any Local Government Authority.

6.4. Payment

The selected proposer will not be entitled to demand or receive payment under this Agreement until all of the stipulations, provisions and conditions set forth in the Agreement have been complied with. Invoice(s) should be transmitted to the Accounts Payable Department via e-mail (preferred method) to accountpayableservices@ccc.edu or in duplicate hard copy to CCC, Accounts Payable Department, 3901 S. State Street, Chicago, IL 60609. CCC offers expedited payment terms to its suppliers for accepting electronic payments, as follows:

Net 15 days or less - CCC utilizes an electronic payment method leveraging unique and secure card-less payment accounts which allows for placement of funds for approved payment transactions on a Visa Single Use Account (“SUA”) administered through U.S. Bank via the Payment Plus program.

Net 45 days - CCC also utilizes Automatic Clearing House (“ACH”) as a method to pay suppliers. This requires completion of a form indicating Bank routing and account number information authorizing CCC to deposit funds into your Bank account.

Net 60 days – CCC will issue traditional checks to suppliers unable to accept one of the preferred electronic methods.

6.5. Termination

1. Termination for Convenience. This contract can be terminated upon ten (10) days written notice by

City Colleges of Chicago on the grounds of Proposer’s violation of any terms and conditions of the Contract, procedures or guidelines or inadequacy of Proposer’s performance or if there is no further need for the requirements. In the event that no funds or insufficient funds are appropriated and budgeted in any fiscal period of the City Colleges of Chicago for payments to be made under this agreement, then the City Colleges of Chicago will notify the contractor of such occurrence and this agreement shall terminate on the earliest of the last day of the fiscal period for which sufficient appropriation was made or whenever the funds appropriated for payment under this Agreement are exhausted. No payments will be made or due to the contractor under this contract beyond those amounts appropriated and budgeted by the City Colleges of Chicago to fund payment under this contract.

City Colleges of Chicago may terminate this Contract, or any portion of the Services to be performed under it, at any time for convenience by a notice in writing from CCC to the Proposer when the Contract may be deemed no longer in the best interest of CCC.

2. Termination for Default. Subject to Section 10(a) herein, this Agreement may also be terminated for default. Each of the following shall constitute an event of default by Consultant (“Default”).

a. Any material misrepresentation, whether in the inducement or in the performance, made by the Consultant to the Institution; and

b. A breach of a representation or warranty contained in this Agreement; and

c. The insolvency, bankruptcy or committing of any act of bankruptcy or insolvency, or making an assignment for the benefit of creditors; and

d. Failure to comply with or perform any material provision of this Agreement; and

e. Failure or refusal to provide enough properly skilled personnel, adequate supervision, or adequate materials and equipment of the proper quality to perform the Services;

f. Causing, by any action or omission, the stoppage, delay of, or interference with, the work of any other Consultant or subconsultant.

If a court of competent jurisdiction rules that termination of this Agreement by the Institution for default of Consultant was wrongful, then the termination shall be deemed to have been a termination for convenience

3. Curable and Incurable Defaults. Time-sensitive defaults (e.g., failure to meet deadlines) are not curable unless the Institution, in its sole and absolute discretion, extends the deadline. Such extension, however, does not relieve Consultant of liability for any damages the Institution may suffer. Consultant shall cure any default that is not time-sensitive with ten (10) calendar days after Consultant is given notice of the default.

4. Remedies. In addition to any other remedies contained herein, the Institution may invoke any or all of the following remedies for a Default:

a. Complete the Services at Consultant’s expense, either directly or through the use of contractors and subcontractors; or

b. Receive a refund or withhold all or any portion of the Fee; or

c. Demand specific performance, an injunction or any other appropriate equitable remedy; or

d. Terminate this Agreement.

5. Right to Offset. All costs incurred by the Institution due to: (i) termination of this Agreement for default; or (ii) Consultant’s performance of the Services; or (iii) Institution’s exercise of any of the remedies available herein, may be offset by: (i) any credits due to or overpayments made by the Institution; or (ii) any payments due to Consultant for Services completed. If such amount offset is insufficient to cover those excess costs, Consultant shall be liable for and promptly remit to the Institution the balance upon written demand. This right to offset is in addition to and not a limitation on any other remedies available to the Institution.

No remedy hereunder is exclusive of any other remedy, but each remedy shall be cumulative and in addition to any other remedies at law, in equity or by statute existing now or hereafter. No delay or omission to exercise any right or power accruing upon any Default shall impair any such right or power nor shall it be construed to be a waiver of any Default or acquiescence therein, and every such right and power may be exercised periodically and as often as may be deemed expedient. If the Institution considers it to be in the Institutions best interest, it may choose not to declare a default or terminate the Agreement. The parties acknowledge that this provision is solely for the benefit of the Institution and that if the Institution permits Consultant to continue providing Services despite one or more events of default, the Consultant is in no way relieved of any of its duties and obligations under the Agreement and the Institution does not waive or relinquish any of its rights.

6. Additional Provisions. The parties further agree the following provisions:

a. Cooperation with Successors. If this Agreement expires or is terminated for any reason, Consultant shall use its best efforts to assure an orderly transition to Institution and to the successor consultant, if any. Consultant must make an orderly demobilization of its own operations, provide the Services uninterrupted until the effective day of such termination or expiration, and otherwise comply with the reasonable requests and requirements of the Institution in connection with the termination or expiration.

6.6. Indemnity

Notwithstanding any other terms and conditions, including any obligations regarding insurance coverage, Vendor agrees to defend, indemnify, save and hold harmless fully the Board of Trustees of Community

College District No. 508, its colleges, satellite campus’, officers, employees, agents, students, volunteers and contractors against any and all claims, suits or judgments, costs or expenses, including attorney’s reasonable fees, (collectively (“Loss”)) in connection with this Agreement. This indemnification obligation does not extend to that portion of a Loss caused by Institution’s negligence, as determined by a court of competent jurisdiction in a final, non-appealable judicial order. The firm must acknowledge in their submission their willingness to indemnify City Colleges of Chicago.

The requirements listed below are mandatory for protecting the interests of the City Colleges of Chicago.

1. The successful Proposer shall indemnify and hold CCC harmless from all providers’ performance or failure of performance under the resulting contract.

2. The successful Proposer shall keep CCC free and clear from all liens asserted by any person or firm for any reason arising out of the furnishing of services or materials by or to the provider.

3. The action of the successful Proposer with third parties is not binding upon CCC.

Minimum Wage

Effective December 11, 2014, City Colleges of Chicago (CCC) adopted Mayoral Executive Order 2014-1 which provides for a fair and adequate Minimum Wage to be paid to employees of CCC contractors and subcontractors performing work on CCC contracts. A copy of the Order may be downloaded from the Chicago City Clerk's website at:

https://www.chicago.gov/city/en/depts/bacp/supp_info/minimumwageinformation.html#:~:text=Starting %20July%201%2C%202024%20the,with%204%20or%20more%20workers.

The selected Proposers must comply with Mayoral Executive Order 2014-1 and any applicable regulations issued by the Vice Chancellor of Business and Procurement Services. The minimum wage in Chicago (for city contracts) is posted to the City’s website:

https://www.chicago.gov/city/en/depts/bacp/supp_info/minimumwageinformation.html

The Minimum Wage must be paid to:

a. All employees regularly performing work on CCC property or at a CCC jobsite.

b. All employees whose regular work entails performing a service for CCC under a CCC contract.

The Minimum Wage is not required to be paid to employees whose work is performed in general support of contractors’ operations, does not directly relate to the services provided to CCC under the contract, and is included in the contract price as overhead, unless that employee's regularly assigned work location is on CCC property or at a CCC jobsite. It is also not required to be paid by employers that are 501(c)(3) not-for-profits.

https://www.chicago.gov/city/en/depts/bacp/supp_info/minimumwageinformation.html#:%7E:text=Starting%20July%201%2C%202024%20the,with%204%20or%20more%20workers https://www.chicago.gov/city/en/depts/bacp/supp_info/minimumwageinformation.html#:%7E:text=Starting%20July%201%2C%202024%20the,with%204%20or%20more%20workers https://www.chicago.gov/city/en/depts/bacp/supp_info/minimumwageinformation.html

Except as further described, the Minimum Wage is also not required to be paid to categories of the Illinois Minimum Wage Law, 820 ILCS 105/1 et seq., in force as of the date of this Contract or as amended.

Nevertheless, the Minimum Wage is required to be paid to those workers described in subsections 4(a)(2)(A) and 4(a)(2)(B) of the Illinois Minimum Wage Law.

Additionally, the Minimum Wage is not required to be paid to employees subject to a collective bargaining agreement that provides for different wages than those required by Mayoral Executive Order 2014-1, if that collective bargaining agreement was in force prior to December 11, 2014, or if that collective bargaining agreement clearly and specifically waives the requirements of the order.

If the payment of a prevailing wage is required and the prevailing wage is higher than the Minimum Wage, then the Contractor must pay the prevailing wage.

Prevailing Wage

As required by the Illinois Revised Statutes, Chapter 48, Sections 39s-1 -39s-11, Prevailing Wage Act, as amended, requires that all wages paid to laborers, workers or mechanics performing work under this contract be in accordance with the general prevailing hourly rate of wages for persons engaged in the construction of public works in this locality as determined by the Department of Labor of the State of Illinois. The Contractor and its subcontractors shall provide all labor compliance data via CCC’s electronic monitoring system, LCPTracker at https://fortifyv2.lcptracker.net/ Payroll information and labor hours shall be submitted weekly in the system. Failure to properly and timely record certified payroll data in LCPTracker will delay vendor payments.

6.7. Non-Discrimination

A Contractor, in performing under this Agreement, shall not discriminate against any worker, employee or applicant, or any member of the public, because of race, creed, color, sex, age or national origin, nor otherwise commit an unfair employment practice.

This article will be incorporated by Contractor in all agreements entered into with supplier of materials or services, Contractors and Subcontractors and all labor organizations, furnishing skilled, unskilled and craft union skilled labor, or who may perform any such labor or services in connection with this contract.

Attention is called to Executive Order 11246 issued September 24, 1965, 3 CFR p. 567, 1966; The Civil Rights Act of 1964, Pub. L. 88-352, July 2, 1964, 78 Stat. 241 et sub; to the

State Acts approved July 28, 1961, Ill. Rev. Stat. 1967, CH. 38, Secs. 13-3 to 13-4 inclusive; July 8, 1933, Ill. Rev. Stat. 1967, CH. 29, Secs. 17 to 24 inclusive: July 21, 1961, Ill. Rev. Stat. 1967, CH. 48, Secs. 851 to 866 inclusive, and July 26, 1967, Ill. Rev. Stat. 1967, CH. 48, Secs. 881 to 887 inclusive, and an ordinance https://fortifyv2.lcptracker.net/ passed by the City Council of the City of Chicago, August 21, 1945, page 3877 to the Journal of the Proceeding.

When requested to demonstrate compliance, the Contractor and Subcontractors will furnish such reports and information as requested by the Chicago Commission on Human Relations.

7 . S U B M I T T A L R E Q U I R E M E N T S ( R e q u i r e d P r o p o s a l C o n t e n t )

Proposers will be required to submit proposals in two formats:

a. Full PDF response, excluding excel files;

b. Each response section (submittal requirement) separately into EUNA (formerly Bonfire).

7.1 Table of Contents

To provide uniformity and to facilitate comparison of proposals, CCC is requesting that all proposals include a table of contents. CCC reserves the right to waive minor variances or irregularities.

7.2 Cover Letter

Please limit this to one page. The cover letter must contain the following information on company letterhead:

a. Proposer’s commitment to provide the required services at the proposed price and schedule, indicating that the offer is valid for one hundred-eighty (180) days from proposal deadline due date.

b. Contact Person’s Name, Title and contract information (for this RFP);

c. Acknowledgement that it has read and understands this RFP’s Terms and Conditions;

d. Signatures by a principal and if applicable, a joint venture partner (wet ink signature(s)).

7.3 Executive Summary

Please limit this section to 2 pages. The Executive Summary shall include the following sections:

a. Brief project overview;

b. Key team members and Partners (subcontractors and/or partners) and respective project alignment;

c. Brief statement of the proposed team’s strengths.

7.4 Response to the Scope of Services

This section must provide a detailed response to the Scope of Services Section of this RFP in pdf format. This section should also include a response to the interrogatories in pdf format.

7.5 Qualifications of the Proposer and References

Firms must meet the following requirements:

a. Proposer has been in business for a total of at least two (2) full calendar years.

b. Proposer must be registered with the Office of the Illinois Secretary of State with a status of Good Standing. Please use this link https://apps.ilsos.gov/corporatellc for status. If not available at the time of submittal, NOTE that proposers must be registered with the Office of the Illinois Secretary of State to receive an award.

c. Proposers shall remain in Good Standing while doing business with City Colleges of Chicago.

Proposers responding to this request must have experience providing the services defined in the Scope of Services Section of this RFP and submit the following as evidence:

a. Proposer must include a description of the organization’s background as follows:

a. Legal Name;

b. Assumed Names if any;

c. Legal form (e.g. sole proprietor, partnership,…