OFFER

The Purchasing Agency solicits offers for Services and/or goods described in this solicitation. All offers and responses received shall be treated as Offers to contract as defined in 9 NCAC 06A.0102(12).

EXECUTION

In compliance with this Request for Proposal (RFP), and subject to all the conditions herein, the undersigned offers and agrees to furnish any or all Services or goods upon which prices are offered, at the price(s) offered herein, within the time specified herein.

Failure to execute/sign offer prior to submittal shall render offer invalid. Late offers are not acceptable.

OFFEROR:

STREET ADDRESS: P.O. BOX: ZIP:

CITY, STATE & ZIP: TELEPHONE NUMBER: TOLL FREE TEL. NO

NAME & TITLE OF PERSON SIGNING: FAX NUMBER:

AUTHORIZED SIGNATURE: DATE: E-MAIL:

Offer valid for three hundred sixty (360) days from date of offer opening unless otherwise stated here: ____ days

ACCEPTANCE OF OFFER

If any or all parts of this offer are accepted, an authorized representative of Purchasing Agency Krystle Rice shall affix its signature hereto and any subsequent Request for Best and Final Offer, if issued. Acceptance shall create a contract having an order of precedence as follows: Best and Final Offers, if any, Special terms and conditions specific to this RFP, Agency terms and conditions, Specifications of the RFP, the Department of Information Technology Terms and Conditions, and the agreed portion of the awarded Vendor’s Offer. A copy of this acceptance will be forwarded to the awarded Vendor(s).

STATE OF NORTH CAROLINA REQUEST FOR PROPOSAL NO. 24-RQ150385-KR

North Carolina Department of Public Instruction

Division of Standards, Accountability, and Research

Contract Name:

College Readiness Assessments

Bid Opening Date: October 7, 2026

Refer ALL inquiries regarding this RFP to:

Krystle Rice procurement@dpi.nc.gov

Issue Date: September 4, 2026 Commodity Code:811620-Cloud-based software as a service Purchasing Agency: Department of Public Instruction

Requisition No. RQ150385 mailto:procurement@dpi.nc.gov

FOR DEPARTMENT OF PUBLIC INSTRUCTION USE ONLY

Offer accepted and contract awarded (Effective Date)

By:

Maurice Green, Superintendent of Public Instruction (Authorized representative of NC Department of Public Instruction), By:

Alexis Schauss, Chief Financial Officer of Public Instruction (Authorized representative of NC Department of Public Instruction)

Table of Contents

1.0 ANTICIPATED Procurement Schedule

2.0 Purpose of RFP

2.1 Introduction

2.2 Agency Background

2.3 SUMMARY OF PROBLEM Statement

2.4 Contract Term

2.5 Effective Date

2.6 Contract Type

3.0 RFP requirements and Specifications

3.1 General requirements and Specifications

3.2 Security Specifications

3.3 Enterprise Specifications

3.3.1 ARCHITECTURE DIAGRAMS

3.3.2 SOLUTION ROADMAP

3.3.3 IDENTITY AND ACCESS MANAGEMENT

3.3.4 INTEGRATION APPROACH

3.3.5 DISASTER RECOVERY AND BUSINESS CONTINUITY

3.3.6 DATA MIGRATION

3.3.7 Data Exchange

3.3.8 APPLICATION MANAGEMENT

3.3.9 ACCESSIBILITY

3.4 Technical Specifications

3.4.1 Assessment

3.4.1.2 Content Alignment

3.4.1.3 State-specific website

3.4.1.4 Configurations

3.4.1.5 Technology Readiness

3.4.1.6 Test registration system

3.4.2 Assessment Administration

3.4.3 Security

3.4.4 Access

3.4.5 Reporting and Analytics

3.4.6 Data Management

3.4.7 Service Level

3.4.8 User Experience

3.4.9 Quality Assurance

3.4.10 Project Management

3.4.11 Artificial Intelligence (AI)

3.4.12 Training

3.4.14 Change Management

3.4.19 Grade Eight Diagnostic Test

4.0 Cost of Vendor’s Offer

4.1 Offer Costs

4.2 Payment Schedule

5.0 Evaluation

5.1 Source Selection

5.2 Evaluation Criteria

5.3 Best and Final Offers (BAFO)

5.4 POSSESSION AND REVIEW

6.0 Vendor Information and Instructions

6.1 General Conditions of Offer

6.2 General Instructions for Vendor

6.3 Instructions for Offer Submission

7.0 Other Requirements and Special Terms

7.1 Vendor Utilization Of Workers Outside of U.S

7.2 Financial Statements

7.3 Financial Resources Assessment, Quality Assurance, Performance and Reliability

7.4 Vendor’s License or Support Agreements

7.5 Resellers

7.6 DISCLOSURE OF LITIGATION

7.7 CRIMINAL CONVICTION

7.8 Security and Background Checks

7.9 Assurances

7.10 Confidentiality of offers

7.11 Project Management

7.12 Meetings

7.13 Recycling and Source Reduction

7.14 Special Terms and Conditions

7.15 AGENCY Terms and Conditions

Attachment A: Definitions Attachment B: Department of Information Technology Terms and Conditions Attachment c: Description of Offeror Attachment d: Cost Form Attachment e: Vendor Certification Form Attachment F: Location of Workers Utilized by Vendor - Disclosure Statement Attachment G: References Attachment H: Financial Review Form

1.0 ANTICIPATED PROCUREMENT SCHEDULE

The Agency Procurement Agent will make every effort to adhere to the following schedule:

Action Responsibility Date

RFP Issued Agency September 4, 2026

Written Questions Deadline Potential Vendors September 14, 2026

Agency’s Response to Written Questions/ RFP Addendum Issued

Agency September 21, 2026

Offer Opening Deadline Vendor(s) October 7, 2026 Microsoft Teams meeting Join:

https://teams.microsoft.co m/meet/21744123997597 7?p=ujblUX23WJCxhPj5

KS

Meeting ID: 217 441 239 975 977 Passcode: uT6Zj6Nx

Need help? | System reference Dial in by phone +1 919-230- 4058,,326008272# United States, Cary Find a local number Phone conference ID:

326 008 272# For organizers: Meeting options | Reset dial-in

PIN

Offer Evaluation Agency TBD

Selection of Finalists Agency TBD

Oral Presentations and/or Product Demonstrations by Finalists (Optional)

Selected Vendors TBD

Negotiations with Finalists Agency designees and selected Vendor(s)

TBD

Best and Final Offers Deadline from Finalists

Selected Vendors TBD

Contract Award Agency TBD

Protest Deadline Responding Vendors 15 days after award https://teams.microsoft.com/meet/217441239975977?p=ujblUX23WJCxhPj5KS https://teams.microsoft.com/meet/217441239975977?p=ujblUX23WJCxhPj5KS https://teams.microsoft.com/meet/217441239975977?p=ujblUX23WJCxhPj5KS https://teams.microsoft.com/meet/217441239975977?p=ujblUX23WJCxhPj5KS https://aka.ms/JoinTeamsMeeting?omkt=en-US https://teams.microsoft.com/l/meetup-join/19%3ameeting_NjcyYzc3ZTMtMzM5Yy00NmZhLTliMjAtZGJhZmI3ZDY4NTQ2%40thread.v2/0?context=%7b%22Tid%22%3a%22849e9c61-f0bb-4d83-ba5f-4b5337664cf7%22%2c%22Oid%22%3a%222da16ef2-f053-47db-a486-79faf77bfd77%22%7d https://teams.microsoft.com/l/meetup-join/19%3ameeting_NjcyYzc3ZTMtMzM5Yy00NmZhLTliMjAtZGJhZmI3ZDY4NTQ2%40thread.v2/0?context=%7b%22Tid%22%3a%22849e9c61-f0bb-4d83-ba5f-4b5337664cf7%22%2c%22Oid%22%3a%222da16ef2-f053-47db-a486-79faf77bfd77%22%7d tel:+19192304058,,326008272 tel:+19192304058,,326008272 https://dialin.teams.cloud.microsoft/5349f5a5-3431-4360-9428-3c6876460abe?id=326008272 https://teams.microsoft.com/meetingOptions/?organizerId=2da16ef2-f053-47db-a486-79faf77bfd77&tenantId=849e9c61-f0bb-4d83-ba5f-4b5337664cf7&threadId=19_meeting_NjcyYzc3ZTMtMzM5Yy00NmZhLTliMjAtZGJhZmI3ZDY4NTQ2@thread.v2&messageId=0&language=en-US https://teams.microsoft.com/meetingOptions/?organizerId=2da16ef2-f053-47db-a486-79faf77bfd77&tenantId=849e9c61-f0bb-4d83-ba5f-4b5337664cf7&threadId=19_meeting_NjcyYzc3ZTMtMzM5Yy00NmZhLTliMjAtZGJhZmI3ZDY4NTQ2@thread.v2&messageId=0&language=en-US https://dialin.teams.cloud.microsoft/usp/pstnconferencing https://dialin.teams.cloud.microsoft/usp/pstnconferencing

2.0 PURPOSE OF RFP

2.1 INTRODUCTION

The purpose of this RFP is to solicit offers through a competitive bid process as required by North Carolina General Statutes (NCGS) for a nationally norm-referenced college admissions test for all students in the eleventh grade (§ 115C-174.11(c)(4)), a diagnostic test in the tenth grade that aligns to the nationally norm-referenced college admissions test (§ 115C‑174.22), and a diagnostic test in the eighth grade that aligns to the nationally norm referenced college admissions test adopted by the State Board through the competitive bid process pursuant to § 115C-174.22. The nationally normed test of college readiness contributes to school level achievement scores in the State’s accountability model (§ 115C-83.15(b)(2)e).

As such, the requirements and specifications set forth in this RFP contemplate the use of these scores to determine school-level performance grades as part of the State’s accountability model as well as individual student performance.

Proposals shall be submitted in accordance with the terms and conditions of this RFP and any addenda issued hereto.

2.2 AGENCY BACKGROUND

The North Carolina Department of Public Instruction (NCDPI) is charged with implementing the State's public-school laws for pre-kindergarten through 12th grade public schools at the direction of the State Board of Education and the Superintendent of Public Instruction.

The Offices of Accountability and Testing promote the academic achievement of all North Carolina public school students and assist stakeholders in understanding and gauging this achievement against state and national standards. The purpose of this mission is three-fold: the design and development of reliable and valid assessments, uniform implementation of and access to suitable assessment instruments for all students, and the provision of statistically accurate reports.

2.3 SUMMARY OF PROBLEM STATEMENT

Schools and students need the ability to determine if they are on track to be remediation-free at a community college or university. The NCDPI is seeking assessment tools that will allow students and schools to make that determination. The NCDPI seeks vendors who can provide (through a Software-as-a-Service solution) a nationally norm-referenced college admissions test to all students in the eleventh grade, a diagnostic test for students in the tenth grade that aligns to the nationally norm-referenced college admissions test to help assist with their community college or university readiness determination and a diagnostic test in the eighth grade that aligns to the nationally norm-referenced college admissions test.

For the purpose of this RFP, an assessment is defined as the tests (paper or online) and platform for operation, delivery and reporting.

2.4 CONTRACT TERM

A contract awarded pursuant to this RFP shall have an effective date as provided in the Notice of Award.

The term shall be five (5) year(s) and will expire upon the end of the contract term unless otherwise stated in the Notice of Award, or unless terminated earlier. The State retains the option to extend the Agreement for two (2) additional one (1) year periods at its sole discretion.

https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_115C/GS_115C-174.11.html https://www.ncleg.gov/EnactedLegislation/Statutes/PDF/BySection/Chapter_115C/GS_115C-174.22.pdf

2.5 EFFECTIVE DATE

This solicitation, including any Exhibits, or any resulting contract or amendment shall not become effective nor bind the State until the appropriate State purchasing authority/official or Agency official has signed the document(s), contract or amendment; the effective award date has been completed on the document(s), by the State purchasing official, and that date has arrived or passed. The State shall not be responsible for reimbursing the Vendor for goods provided nor Services rendered prior to the appropriate signatures and the arrival of the effective date of the Agreement. No contract shall be binding on the State until an encumbrance of funds has been made for payment of the sums due under the Agreement.

2.6 CONTRACT TYPE

Indefinite Quantity Agency Specific Contract – Pursuant to 9 NCAC 6B.0701, this solicitation will establish an indefinite quantity agency specific contract between a Vendor and the State. The quantity of Goods or Services that may be used by the State is undetermined. An estimated quantity based on history or other means may be used as a guide but shall not be a representation by the State of any anticipated purchase volume under any contract made pursuant to this solicitation.

The State reserves the right to make partial, progressive or multiple awards where it is advantageous to award separately by functional areas, where more than one supplier is needed to best meet the State’s overall needs.

3.0 RFP REQUIREMENTS AND SPECIFICATIONS

3.1 GENERAL REQUIREMENTS AND SPECIFICATIONS

3.1.1 REQUIREMENTS

Requirement means, as used herein, a function, feature, or performance that the System must provide. If the offer cannot meet the requirements, they will not be evaluated.

3.1.2 SPECIFICATIONS

Specification means, as used herein, a detailed description that documents the function and performance of a system or system component.

The apparent silence of the specifications as to any detail, or the apparent omission of detailed description concerning any point, shall be regarded as meaning that only the best commercial practice is to prevail and that only processes, configurations, materials and workmanship of the first quality may be used. Upon any notice of noncompliance provided by the State, Vendor shall supply proof of compliance with the specifications. Vendor must provide written notice of its intent to deliver alternate or substitute Services, products, goods or other Deliverables. Alternate or substitute Services, products, goods or Deliverables may be accepted or rejected in the sole discretion of the State; and any such alternates or substitutes must be accompanied by Vendor’s certification and evidence satisfactory to the State that the function, characteristics, performance and endurance will be equal or superior to the original Deliverables specified.

3.1.3 SITE AND SYSTEM PREPARATION

Vendors shall provide the Purchasing State Agency complete site requirement specifications for the Deliverables, if any. These specifications shall ensure that the Deliverables to be installed or implemented shall operate properly and efficiently within the site and system environment. Any alterations or modifications in site preparation, which are directly attributable to incomplete or erroneous specifications provided by the Vendor and which would involve additional expenses to the State, shall be made at the expense of the Vendor.

3.1.4 EQUIVALENT ITEMS

Whenever a material, article or piece of equipment is identified in the specification(s) by reference to a manufacturer’s or Vendor’s name, trade name, catalog number or similar identifier, it is intended to establish a standard for determining substantial conformity during evaluation, unless otherwise specifically stated as a brand specific requirement (no substitute items will be allowed). Any material, article or piece of equipment of other manufacturers or Vendors shall perform to the standard of the item named. Equivalent offers must be accompanied by sufficient descriptive literature and/or specifications to provide for detailed comparison.

3.1.5 ENTERPRISE LICENSING

In offering the best value to the State, Vendors are encouraged to leverage the State’s existing resources and license agreements, which can be viewed here:

https://it.nc.gov/resources/statewide-it-procurement/statewide-it-contracts

a) Identify components or products that are needed for your solution that may not be available with the State’s existing license agreement.

b) Identify and explain any components that are missing from the State’s existing license agreement.

c) If the Vendor can provide a more cost-effective licensing agreement, please explain in detail the agreement and how it would benefit the State.

3.2 SECURITY SPECIFICATIONS

3.2.1 SOLUTIONS HOSTED ON STATE INFRASTRUCTURE

RESERVED

3.2.2 SOLUTIONS NOT HOSTED ON STATE INFRASTRUCTURE

NCDPI has designated this solicitation to receive and securely manage data that is classified as:

X Restricted - Restricted data represents the highest risk to the State, State Agencies, and constituents if it is disclosed or compromised. This information is likely to be regulated by State or Federal law, and access to it is restricted to a limited audience (e.g., State and Federal Tax Information [FTI], Payment Card data, Protected Health Information [PHI], Criminal Justice Information [CJI], Social Security Administration provided information, etc.)

Confidential - Includes information that is limited to a small audience with a need-to-know or legitimate business case (e.g., State employee personnel records, trade secrets, student records, sensitive public security information, etc.). If exposed to unauthorized parties, data from this category will cause high impact consequences such as regulatory fines, inability to recruit talent, loss of confidence, and/or damage to vendor relationships. This is not a complete list and is subject to legislative changes.

Internal - This is information typically used within the agency and not for public sharing.

Most documents are classified as Internal within the organization, and most State employees would have access. This type of data, if exposed to unauthorized parties, would have a very limited impact on an agency’s reputation, compliance requirements or ability to achieve strategic goals. Internally classified data does not contain direct identifiers. Often, the effects of the loss of data can be https://it.nc.gov/resources/statewide-it-procurement/statewide-it-contracts recognized in very subtle ways and may not lead to clear negative consequences causing confusion due to lack of context or minor reputational harm.

Public - Data that is open to public inspection according to state and federal law, or readily available through public sources.

Refer to the North Carolina Statewide Data Classification and Handling policy for more information regarding data classification. The policy is located at the following website:

https://it.nc.gov/document/statewide-data-classification-and-handling-policy.

To comply with the State’s Security Standards and Policies, State agencies are required to perform annual security/risk assessments on their information systems using NIST 800-53 controls.

This requirement additionally applies to all Vendor-provided, agency-managed Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) solutions which will handle data classified as Internal, Confidential, or Restricted.

(a) To comply with the State’s Security Standards and Policies, cloud products are required to comply with applicable FedRAMP or GovRAMP security requirements, including but not limited to, continuous monitoring, incident response, and data classification as outlined in GovRAMP documentation.

(b) To streamline and standardize this requirement the State has adopted GovRAMP which is a Risk and Authorization Management Program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. GovRAMP’s security verification model is based on NIST 800-53 Rev. 5 (or current).

(c) The required GovRAMP verified status will depend on the sensitivity of the data and processes supported by the solution as defined in the Statewide Data Classification and Handling Policy.

(d) For purposes of this solicitation, in accordance with the North Carolina Department of Information Technology Statewide Information Security Manual, a GovRAMP verified status of Restricted is required. At offer submission, if the protected system does not currently hold a validated GovRAMP status, the Vendor will be required to provide their GovRAMP Security Snapshot Score and upon request, the complete Snapshot Matrix. If awarded the contract, Vendor shall have an interim period from the effective date of the contract to achieve the verified GovRAMP status outlined above. The interim time periods for each data classification that requires a verified status are further described below. The Vendor shall provision access to the State to their continuous monitoring packages at a standard access level within fourteen (14) days of contract award, and seven (7) days of any subsequent GovRAMP status changes

a. Public - For third-party cloud services where the highest category of information to be processed is Public data, the Vendor must submit an updated score for the product annually throughout the contract duration that meets or exceeds the original score at time of contract award. Products with GovRAMP Core, Ready, Authorized or Provisionally Authorized statuses or FedRAMP Rev. 5 authorization also satisfy the security requirement.

b. Internal - For third-party cloud services where the highest category of information to be processed is Internal data, the Vendor must either achieve the status of GovRAMP Core prior to award, or agree to achieve GovRAMP Core status within an https://it.nc.gov/document/statewide-data-classification-and-handling-policy interim time period, no later than twelve (12) months from the effective date of the contract.

c. Confidential - For third-party cloud services where the highest category of information to be processed is Confidential data, the Vendor must either achieve a status of GovRAMP Ready, or agree to achieve GovRAMP Ready status no later than fifteen (15) months from the effective date of the contract.

d. Restricted - For third-party cloud services where the highest category of information to be processed is Restricted Data, the Vendor must either achieve a status of GovRAMP Authorized, or agree to achieve GovRAMP Authorized status no later than twenty-one (21) months from the effective date of the contract.

Upon contract award, Vendors who submitted a GovRAMP Security Snapshot Score will be required to enroll in the GovRAMP Progressing Snapshot program prior to any data being transferred, stored or processed. The Vendor must complete their first Progressing Snapshot within ninety (90) days of award, with the expectation that progress will be made on a quarterly basis and access to progress reports must be provisioned to the State. Products must maintain their participation in the Progressing Snapshot program and continued access to progress reports must be provisioned to the State until such time that they have achieved the minimum verified status outlined above. The State will review the Vendor’s progress on a quarterly basis and, in its sole discretion, may determine that the Vendor is not making satisfactory progress in the Progressing Snapshot program. Satisfactory progress shall be a material requirement of the contract.

(e) If the Vendor holds a FedRAMP Rev. 5 authorization at time of award, this authorization can be accepted in lieu of a GovRAMP authorization. Authorizations obtained via the FedRAMP 20x Pilot Program will not be permitted.

If the Vendor’s cloud product currently holds a FedRAMP Authorized designation, at the time of award, the State may require the Vendor to initiate and actively pursue, within thirty (30) days of award, the GovRAMP Fast Track Process, to achieve a GovRAMP Provisionally Authorized or Authorized status in order to satisfy Statewide continuous monitoring requirements.

(c) Additional Security Documentation. Prior to contract award, the State may in its discretion require the Vendor to provide additional security documentation, including but not limited to, vulnerability assessment reports and penetration test reports. The awarded Vendor shall provide additional security documentation upon request by the State during the term of the contract.

Refer to: https://it.nc.gov/documents/statewide-glossary-information-technology-terms for descriptions of the Application Criticality categories.

Refer to: http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf for descriptions of NIST system confidentiality, integrity, and availability categories.

3.3 ENTERPRISE SPECIFICATIONS

Agencies and vendors should refer to the Vendor Resources Page for information on North Carolina Information Technology enterprise services, security policies and practices, architectural requirements, and enterprise contracts. The Vendor Resources Page can be found at the following link: https://it.nc.gov/vendor-engagement-resources. This site provides vendors with statewide information and links referenced throughout the RFP document. Agencies may request additional information.

https://it.nc.gov/documents/statewide-glossary-information-technology-terms http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf https://it.nc.gov/vendor-engagement-resources

3.3.1 ARCHITECTURE DIAGRAMS

The two diagrams are Network Architecture and Technology Stack. The State utilizes architectural diagrams to better understand the design and technologies of a proposed solution. Details on these diagrams can be found at the following link: https://it.nc.gov/resources/statewide-it-procurement/vendor-engagement-resources#Tab-Architecture-1192

The provision of these two diagrams is a requirement at offer submission. If they are not supplied at that time, the Vendor’s offer will be considered non-responsive and will not be evaluated.

There may be additional architectural diagrams requested of the vendor after contract award. This will be communicated to the vendor by the agency as needed during the project.

3.3.2 SOLUTION ROADMAP

A Solution Roadmap defines the vision and strategic elements of the solution. The Solution Roadmap is a plan of action for how a Solution will evolve over time. The minimum content should include:

• Vision for the solution

• High-level functionality expected for each solution release into production environment

• High-level timeline

• Description of how customer feedback is collected and incorporated into solution enhancements

Describe the solution roadmap for your product. Include content on release strategies for functionality, roadmap for technical architecture, and how scalability of solution is planned.

3.3.3 IDENTITY AND ACCESS MANAGEMENT

Describe how the proposed solution can integrate with NCDPI’s Identity and Access Management (IAM) Service. Here is a brief description of the integration methodology using NCEdCloud.

3.3.3.1 Provisioning.

Authorized user is expected to have an account in a system to login and use that system. The NCEdCloud IAM Service supports two methods of implementing automated lifecycle management of accounts for both provisioning and de-provisioning.

3.3.3.1.1 Provisioning via SAML

The first method for target application account provisioning is via SAML. This method requires the target system to use a SAML Service Provider (SP), and it must support the on-demand creation (auto- provisioning) of user accounts via this method. Not all systems that provide SP capability may support this method.

3.3.3.1.2 Provisioning via Data Synchronization

The second method for target application account provisioning is via data synchronization. One component of the NCEdCloud IAM service is Identity Automation’s DSS product. Using DSS adapters, the IAM service will communicate directly with the target system in order to provision accounts. This process occurs in near real-time as user accounts are created and updated in the Central Directory. Depending on the integration path for SSO/RSO, this provisioning process may include synchronization of user credentials.

3.3.3.2 Authentication

The NCEdCloud IAM Service will support three methods of implementing a simplified authentication service for end users accessing target application systems. The term “simplified https://it.nc.gov/resources/statewide-it-procurement/vendor-engagement-resources#Tab-Architecture-1192 https://it.nc.gov/resources/statewide-it-procurement/vendor-engagement-resources#Tab-Architecture-1192 authentication” refers to the concept that users won’t have to keep track of multiple credentials when accessing the different target systems. From the end user perspective, this could be either an SSO or an RSO experience, depending on the method used to provide the authentication integration.

The term single logout is the counter solution to SSO. For example, if you log in to five applications via SSO, you could log out of all sessions with a single logout link. The NCEdCloud IAM service will provide a single logout capability for SAML-enabled target systems but cannot enforce its implementation by all target systems. So, if an end-user clicks on the single logout option of an application, it would log them out of all sessions that were accessed using SAML.

Unfortunately, only closing the browser application itself can guarantee that all sessions are absolutely ended.

3.3.3.2.1 SAML Authentication

The first (and preferred) method for target system authentication integration is via SAML.

This method requires the target system to use a SAML Service Provider (SP). Once integrated, the login page for every target system using SAML will be the NCEdCloud IAM login page (branded to illustrate the use of the NCEdCloud Username and Password). The first application accessed will require the user to authenticate (via the IAM Service Login), however, each subsequent SAML-enabled application the user accesses will provide an SSO experience (no additional login required).

3.3.3.2.2 Native Authentication

The second method for target system authentication would be native authentication.

With this method the user will access the target system and will login with credentials that have been synchronized to that system (See 1.2. Provisioning via Data Synchronization). In this case, the application is storing the user account credentials locally, thus it is using native authentication. This method will provide an RSO experience because the credentials used will be the same credentials as the NCEdCloud.

3.3.3.2.3 LDAP Authentication

The third method for target system authentication integration is via LDAP. This method requires the target system to support an option to use LDAP for authentication as an alternative to local/native authentication. The NCEdCloud IAM Service will provide a load balanced, fault tolerant LDAP endpoint for target systems for authentication. This method will provide an RSO experience because the credentials used will be the same credentials as the NCEdCloud.

3.3.4 INTEGRATION APPROACH

Describe proposed solution capabilities to interoperate with other solutions. Identify the standards supported, integrations platforms, adaptors, APIs, and the like.

3.3.5 DISASTER RECOVERY AND BUSINESS CONTINUITY

Describe the proposed solution capabilities related to the following areas:

3.3.5.1 Define the solution’s Service Level Objective (SLO) and Service Level Agreement (SLA)

3.3.5.2 Disaster Recovery Plan (DRP)

Describe how proposed solution supports Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO) metrics.

3.3.5.3 System Backup

Describe backup plan capabilities.

3.3.5.4 Disaster Recovery Testing

Describe the frequency and test procedures for end-to-end disaster recovery testing.

Business Continuity Plan (BCP) – describe capabilities proposed solution can provide in support of agency’s continuity of operations and incident responses.

3.3.5.5 Describe how the proposed solution ensures resilient continuous operation.

3.3.5.6 Describe the strategies employed to protect active and backup data from malicious software.

3.3.5.7 Describe the capabilities for automated rollback to know-good states, include front facing application, data tier, and infrastructure.

3.3.6 DATA MIGRATION

Describe approaches available for data conversion and/or data migration to load current data into proposed solution.

3.3.7 DATA EXCHANGE

3.3.7.1 Describe approaches available for data exchange and ingestion into the proposed solution.

3.3.7.2 Describe the methods available for data exchange from the proposed solution to the State.

3.3.8 APPLICATION MANAGEMENT

3.3.8.1 Describe how the proposed solution monitors and reports the metrics on system performance.

3.3.8.2 Describe how the proposed solution manages user administration.

3.3.8.3 Describe the audit capabilities of proposed solution related to management of the application.

3.3.9 ACCESSIBILITY

3.3.9.1 Describe how the proposed solution ensures that the digital platforms and paper materials related to each assessment comply with industry accessibility standards and the ADA title II rule.

Include an Accessible Conformance Report (ACR) using the most current version of the Voluntary Product Accessibility Template (VPAT).

Provide product documentation that demonstrates how the proposed solution is both digitally accessible and accessible via paper format. If not fully accessible, provide the roadmap with timeline for remediation.

Standards include:

• W3C Web Accessibility Initiative - Web Content Accessibility Guidelines (WCAG) 2.1 AA or better: https://www.w3.org/TR/WCAG21/

• Section 508: https://www.section508.gov/

• Voluntary Product Accessibility Template (VPAT®):

https://www.itic.org/policy/accessibility/vpat

3.3.9.2 For the assessment in this proposal, describe how the proposed solution is inherently designed to provide access for all students across digital and paper test formats; specifically, accommodations for students with disabilities (including, but not limited to, individuals who have visual, auditory, motor, or cognitive impairments) and supports for English learners.

https://www.federalregister.gov/documents/2024/04/24/2024-07758/nondiscrimination-on-the-basis-of-disability-accessibility-of-web-information-and-services-of-state https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.w3.org%2FTR%2FWCAG21%2F&data=05%7C02%7Cstarr.christen%40nc.gov%7C3737b44528934d4e45f508dc3a2fddad%7C7a7681dcb9d0449a85c3ecc26cd7ed19%7C0%7C0%7C638449224463390497%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=e02p3b8aB5KB1xe2s6LB3ksZyRtoo09MCHTXDzO5E6Q%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.section508.gov%2F&data=05%7C02%7Cstarr.christen%40nc.gov%7C3737b44528934d4e45f508dc3a2fddad%7C7a7681dcb9d0449a85c3ecc26cd7ed19%7C0%7C0%7C638449224463398992%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=pzgUTV7chyDcngdl6SvQJ3tAIz7RLJvSY02jf8A4SRg%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.itic.org%2Fpolicy%2Faccessibility%2Fvpat&data=05%7C02%7Cstarr.christen%40nc.gov%7C3737b44528934d4e45f508dc3a2fddad%7C7a7681dcb9d0449a85c3ecc26cd7ed19%7C0%7C0%7C638449224463405831%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=5PxuYxDYvzebQ0oJ4qLv%2BXmBS25YhqJa3ms9L3r8c8c%3D&reserved=0

ENTERPRISE, SERVICES, AND STANDARDS

Vendors should refer to the Vendor Resources Page for information on North Carolina Department of Information Technology regarding architecture, security, strategy, data, digital, identity and access management and other general information on doing business with state IT process.

The Vendor Resources Page found at the following link: https://it.nc.gov/vendor-engagement-resources. This site provides vendors with statewide information and links referenced throughout the RFP document. Agencies may request additional information.

3.4 TECHNICAL SPECIFICATIONS

3.4.1 Assessment

3.4.1.1 Platform

3.4.1.1.1 Describe how your solution’s online testing delivery platform is compatible and meets industry technology standards.

3.4.1.1.2 Describe your solution’s technology-readiness certification process (i.e. how does the solution validate that schools or districts have the required technology to conduct the assessments?).

3.4.1.1.3 Provide an overview of the solution’s technology guidelines to include: an introductory section describing the navigation and structure of the secure web-based application, technical specifications for the system, help desk information, system troubleshooting and contingency plans, optimal network bandwidth requirements for the testing sites, resources required to properly utilize the system, accessibility features and accommodations, and guidelines for the use of one-to-one device scenarios, computer labs, or bring-your-own student devices.

3.4.1.2 Content Alignment

Describe how your solution provides purpose and benefit of the proposed college admissions test and the other proposed assessments. Include in the description how the assessments’ content aligns to expectations of student success in post-secondary education settings. Include evidence of validity and reliability of the proposed assessment for measuring college-readiness.

3.4.1.3 State-specific website

Describe how your solution creates and manages a North Carolina-specific website dedicated only to district and school test coordinators.

3.4.1.4 Configurations

Describe how your solution allows for configuration of tests and/or assessments by means of limiting/hiding features, questions, or content (generally termed “non-test” or “demographic information”) or resources related to the solution.

3.4.1.5 Technology Readiness

3.4.1.5.1 When schools are unable to meet the solution’s technology requirements, describe the alternate options provided to schools including a paper test administration.

3.4.1.6 Test registration system

Describe how your solution, enables testing staff at the school, district, regional, and state level to effectively manage organizational and testing related data including site information, students, users, test administration details, etc. Explain the tools, features and support resources available to help users efficiently perform testing administrative tasks, maintain accurate data, manage access and permissions, monitor testing activities and support successful test administration.

3.4.2 Assessment Administration

3.4.2.1 Student Registration

3.4.2.1.1 Describe how the proposed solution registers students.

3.4.2.1.2 Describe how the proposed solution collects basic student information and what information is collected.

3.4.2.1.3 Describe assessment safeguards or test administration processes that are available to validate student identity.

3.4.2.2 Testing Mode

The Grade 11 test scores are used in the State’s accountability reporting. Therefore, it is necessary that all eligible students [as defined by statute G.S. § 115C-174.11(4)] are provided with a testing opportunity. Describe your solution’s ability to make assessments available to all North Carolina public schools online. Also include a detailed description of accessibility supports and accommodations that are available to students to support access beyond the standard assessment (i.e. paper test, screen reader etc.).

3.4.2.3 Proctoring

Describe proctoring formats and guidelines related to all assessments in this proposal.

3.4.2.4 Testing Windows

Describe how your solution establishes testing windows (as defined by NCDPI) that ensure the State fulfills the legislated requirement of administering the assessments to all eligible students either online or in a paper format.

3.4.2.4.1. For each test format, describe the number of available testing windows for standard and accommodated test administrations.

3.4.2.4.2 Describe how the solution provides a state-specific and state-approved test material ordering window.

3.4.2.4.3 For all provided assessments, describe the number of state-specific test material ordering platform(s) available.

3.4.2.4.4 Describe how the solution allows the State to select testing windows.

3.4.2.4.5 Describe how schools can utilize all available testing windows at their discretion.

3.4.2.5 Unforeseen Event

An unforeseen event or emergency (as determined by NCDPI in its discretion) delays school from opening on time, results in closing school for the day, or otherwise affects the planned test administration on the regularly scheduled administration opportunities.

In the event a district or school experiences an unforeseen event, describe whether your solution provides a consistent and equitable testing solution to complete testing. Also include in the description the processes for amending testing windows to accomplish this https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_115C/GS_115C-174.11.html purpose. Describe examples of how this has been addressed in previous implementations.

Also include a description of the solution’s assessment failover process and procedures for unforeseen outages.

3.4.2.5.1 Paper Test Administrations

3.4.2.5.1.2 Describe the process for paper test administrations in the event of an unforeseen event.

3.4.2.5.1.3 Describe how schools are notified of additional testing opportunities and describe the process for ordering test materials.

3.4.2.5.2 Online Test Administrations

3.4.2.5.2.1 Describe the solution’s process for online test administrations in the event of an unforeseen event.

3.4.2.5.2.2 Describe how schools are notified of additional testing opportunities and describe the process for ordering test materials.

3.4.2.6 Double testing

Describe the process to protect assessment integrity by ensuring that a student who takes an online test does not take a paper test or vice versa.

When a student inadvertently tests multiple times, describe your proposed steps to ensure only one score will be reported to colleges or universities and that the State will only be charged for one test per student.

3.4.2.7 Retesting opportunity

Describe the process for State-level approval of retake opportunities, including but not limited to how the solution will remedy a situation when a student is interrupted during an online administration and retakes the assessment on a different day.

3.4.2.8 Materials delivery and return

Describe how paper materials are delivered to the school at least seven (7) days before the test administration date. Describe how pre-scheduled pick-ups may be facilitated for all tests that require materials to be returned to the Vendor.

3.4.2.9 Homebound Testing

Describe how the solution will support testing of homebound students. In North Carolina, students who receive hospital and homebound services participate in all State-required test administrations. For accountability purposes, the test results of a hospital- or homebound-student must be included in the accountability results at the student’s base school. Describe how assessment integrity will be maintained and materials will be secured in these testing environments.

3.4.2.10 Home School Testing

Describe how the solution facilitates testing within NC public schools for home school students per N.C.G.S. § 115C-565.1(a). Describe the mechanism in place to prevent home school students from being added to or included in the State-contract test administration, data and reporting.

3.4.3 Security

3.4.3.1 Student-level personally identifiable information

Describe how the solution secures and purges student-level personally identifiable information based on the State’s data and privacy requirements to include the following:

student-level personally identifiable information, non-demographic test information, and/or survey questions collected from, but not limited to: student answer documents, testing platforms, test information sites (score report portals, student portals/websites, etc.), or student responses to any State-approved surveys.

3.4.3.2 Security Breach

Describe how the solution will address security breaches, as defined in N.C.G.S. § 75-61.

3.4.3.3 Significant Security Incident (GS 143B-1320)

Describe how the solution will address significant cybersecurity security incidents as described in N.C.G.S. § 143B-1320.

A significant cybersecurity incident is determined by the following factors:

1. Incidents that meet thresholds identified by the Department jointly with the Department of Public Safety that involve information:

a. That is not releasable to the public and that is restricted or highly restricted according to Statewide Data Classification and Handling Policy; or

b. That involves the exfiltration, modification, deletion, or unauthorized access, or lack of availability to information or systems within certain parameters to include (i) a specific threshold of number of records or users affected as defined in G.S. 75-65 or

(ii) any additional data types with required security controls.

2. Incidents that involve information that is not recoverable or cannot be recovered within defined timelines required to meet operational commitments defined jointly by the State agency and the Department or can be recovered only through additional measures and has a high or medium functional impact to the mission of an agency.

3.4.3.4 Cybersecurity Incidents

Describe how the solution will address a cybersecurity incident as defined in Attachment A:

Definitions, Paragraph 2.

3.4.4 Access

3.4.4.1 User Roles

3.4.4.1.1 Describe role-based security and permissions at the State, District, and Local School level, including the ability to create and manage user-defined roles and assign permissions based on user responsibilities and levels of access.

3.4.4.2 Describe in detail the role-based access controls for reporting (and how it aligns with the information provided in response to the Reporting and Analytics section below).

3.4.5 Reporting and Analytics

3.4.5.1 Student Identification Number

Describe how Vendor’s proposed solution will ensure student test records (answer documents, printed score reports, and online test records) are identified with the State-assigned unique student identification number. Also describe how the Vendor’s solution allows schools to resolve incorrect State assigned IDs.

3.4.5.2 Analytics

Describe what types of diagnostic feedback and method of delivery are available to students, districts, and schools for the assessments in this proposal.

3.4.5.3 Reports

3.4.5.3.1 Describe the solution’s procedures, in collaboration with the NCDPI, to give districts and schools the opportunity to reconcile discrepancies in the collected student information system before the release of reports.

3.4.5.3.2 Describe how the solution ensures that all students are accounted for and with the correct information, specifically during testing, post-testing, and prior to consolidation of scores.

3.4.5.3.3 Describe how the solution collaborates with the NCDPI on final review and approval of the score files for all assessments prior to acceptance by the State. Also include in the description the solution’s available file formats.

3.4.5.3.4 Describe how the solution provides test results to schools and districts on a rolling timeline.

3.4.5.3.5 Describe how the student score results are reported in a user-friendly format.

3.4.5.3.6 Describe the solution’s ability to provide individual student reports including the ability to configure report content and format based on State requirements and approval. Identify what information is included, and how the unique state-assigned student identification number is incorporated into the report.

3.4.5.3.7 Describe the solution’s ability to provide digital, dashboard-level aggregated student performance data to the State, districts, and schools.

3.4.5.3.8 Describe the solution’s ability to include the name of the State-parent organization (district for schools within a district or state for charter schools), state school code, and regional accountability office staff members’ names on all operational reports including missing materials lists, call logs from the Help Desk, technology readiness reports, and testing irregularity reports or investigation reports and files needing reconciliation of student data or scores.

3.4.5.3.9 Describe the solution’s ability to provide information to the State, upon request, for user changes and actions made within the application, to include time stamp and user information, for investigative and troubleshooting purposes.

3.4.6 Data Management

3.4.6.1 Describe the various scenarios for how the proposed solution validates data in real-time throughout all points of entry, including manual screen entry and bulk file upload.

3.4.6.2 Describe how data integrity is maintained.

3.4.6.3 Describe how data quality is ensured, and master data is managed and updated in the Vendor’s proposed solution.

3.4.6.4 Describe how the proposed solution handles scenarios like duplicate student IDs and a single ID for multiple students.

Also, elaborate on how data validation and other safeguards are used to mitigate student ID issues.

3.4.6.5 Explain how the proposed solution will prevent unauthorized changes to data.

3.4.6.6 Describe the data retention and archival process.

3.4.6.7 Describe how the proposed solution aggregates data for statewide reporting and analytic purposes.

3.4.6.8 Describe the solution’s default backup and restore capabilities, including how data is backed up, protected and restored across multiple locations while maintaining operational independence and ensuring integrity and consistency of State’s data. Describe the controls, settings, features and configuration options available to NCDPI for managing backup and restore processes including any capabilities related to backup frequency, retention, recovery, monitoring and data validation.

3.4.7 Service Level

3.4.7.1 Describe the proposed solution’s Service Level Agreement (SLA), detailing how the architecture delivers 99.9% availability.

Describe the Service Level Objectives and corresponding Service Level Credits.

3.4.7.2 Describe how the proposed solution scales without impacting performance.

3.4.7.3 Describe how the proposed solution monitors performance, including information specific to monitoring the usability of the solution’s features and functions with reasonable response times to ensure availability and responsiveness.

Explain how this information aligns with the way the proposed solution scales without impacting performance and data processing model and how it manages load and latency during non-peak and peak-usage times.

3.4.7.4 Describe the proposed solution’s process for role-based alerts of outage and performance degradations to ensure appropriate notification across all user classes.

3.4.7.5 Describe the proposed solution’s system management processes, frequency of server patches, version or patch management process, and how those processes do not compromise 99.9% availability.

Describe the solution’s general server or systems management, operating system, and security level version or patch application, and solution version or patch application.

Describe how the solution…