Version May 4, 2026

OFFER

The Purchasing Agency solicits offers for Services and/or goods described in this solicitation. All offers and responses received shall be treated as Offers to contract as defined in 9 NCAC 06A.0102(12).

EXECUTION

In compliance with this Request for Proposal (RFP), and subject to all the conditions herein, the undersigned offers and agrees to furnish any or all Services or goods upon which prices are offered, at the price(s) offered herein, within the time specified herein.

Failure to execute/sign offer prior to submittal shall render offer invalid. Late offers are not acceptable.

OFFEROR:

STREET ADDRESS: P.O. BOX: ZIP:

CITY, STATE & ZIP: TELEPHONE NUMBER: TOLL FREE TEL. NO

NAME & TITLE OF PERSON SIGNING: FAX NUMBER:

AUTHORIZED SIGNATURE: DATE: E-MAIL:

Offer valid for one hundred twenty (120) days from date of offer opening unless otherwise stated here: ____ days

ACCEPTANCE OF OFFER

If any or all parts of this offer are accepted, an authorized representative of the University of North Carolina shall affix its signature hereto and any subsequent Request for Best and Final Offer, if issued. Acceptance shall create a contract having an order of precedence as follows: Best and Final Offers, if any, Special terms and conditions specific to this RFP, Specifications of the RFP, the Department of Information Technology Terms and Conditions, and the agreed portion of the awarded Vendor’s Offer. A copy of this acceptance will be forwarded to the awarded Vendor(s).

FOR PURCHASING AGENCY USE ONLY

Offer accepted and contract awarded this date, , as indicated on attached certification, by (Authorized representative of the University of North Carolina).

STATE OF NORTH CAROLINA REQUEST FOR PROPOSAL NO.

UNIVERSITY OF NORTH CAROLINA

PBS NC

Bid Opening Date: June 25, 2026

Refer ALL inquiries regarding this RFP to:

Bob Myers rbmyers@northcarolina.edu 68-SOCC0626 Questions

Issue Date: June 4, 2026

Commodity Code: 83111507

Purchasing Agency: University of North Carolina

Requisition No.:

https://docs.google.com/forms/d/e/1FAIpQLSdPSotpHBUr2aAJcZuGfQGtIg3gdrbfIUNC4tcGr5y0T6_b7A/viewform?usp=header

Table of Contents

1.0 Anticipated Procurement Schedule

2.0 Purpose of RFP

2.1 Introduction

2.2 Agency Background

2.3 Summary of Problem Statement

2.4 Contract Term

2.5 Effective Date

2.6 Contract Type

3.0 RFP requirements and Specifications

3.1 General requirements and Specifications

3.2 Security Specifications

3.3 Enterprise Specifications

3.3.1 Architecture Diagrams

3.3.2 Solution Roadmap

3.3.3 Identity and Access Management

3.3.4 Integration Approach

3.3.5 Disaster Recovery and Busienss Continuity

3.3.6 Data Migration

3.3.7 Application Management

3.3.8 Accesibility

3.4 Business and Technical Requirements

3.5 Business and Technical Specifications

4.0 Cost of Vendor’s Offer

4.1 Offer Costs

4.2 Payment Schedule

5.0 Evaluation

5.1 Source Selection

5.2 Evaluation Criteria

5.3 Best and Final Offers (BAFO)

5.4 Possession and Review

6.0 Vendor Information and Instructions

6.1 General Conditions of Offer

6.2 General Instructions for Vendors

6.3 Instructions for Offer Submission

7.0 Other Requirements and Special Terms

7.1 Vendor Utilization Of Workers Outside of U.S

7.2 Financial Statements

7.3 Financial Resources Assessment, Quality Assurance, Performance and Reliability

7.4 Vendor’s License or Support Agreements

7.5 Resellers

7.6 Disclosure of Litigation

7.7 Criminal Conviction

7.8 Security and Background Checks

7.9 Assurances

7.10 Confidentiality of offers

7.11 Project Management

7.12 Meetings

7.13 Recycling and Source Reduction

7.14 Special Terms and Conditions

7.15 Agency Terms and Conditions

Attachment A: Definitions Attachment B: Department of Information Technology Terms and Conditions Attachment C: Description of Offeror Attachment D: Cost Form Attachment E: Vendor Certification Form Attachment F: Location of Workers Utilized by Vendor - Disclosure Statement Attachment G: References Attachment H: Financial Review Form

May 4, 2026

1.0 ANTICIPATED PROCUREMENT SCHEDULE

The Agency Procurement Agent will make every effort to adhere to the following schedule:

Action Responsibility Date

RFP Issued Agency 6/4/2026

Written Questions Deadline Potential Vendors 6/12/2026 at noon EDT

Agency’s Response to Written Questions/ RFP Addendum Issued

Agency 6/17/2026

Offer Opening Deadline Vendor(s) 6/25/2026 at 10:00 a.m. EDT

Contract Award Agency TBD

Protest Deadline Responding Vendors 15 days after award

2.0 PURPOSE OF RFP

2.1 INTRODUCTION

The purpose of this RFP is to solicit Offers for call agent staffing services. PBS North Carolina is requesting proposals for an external call center agency to provide call agent staffing for the organization Monday-Friday, 9:00am-5:00pm ET. The call center agency will be responsible for answering and fielding all phone calls as well as responding to voicemails to PBS North Carolina from its nearly 105,000 members and many more viewers that watch its free public broadcasting. The donations from the members of PBS North Carolina constitute the majority of the organization’s annual budget, necessitating the need for the highest level of customer service for these donors.

2.2 AGENCY BACKGROUND

PBS NC is North Carolina's only statewide public media network PBS NC’s 12 stations provide all 100 counties with four full time, unique broadcast program channels. PBS NC’s strategic priorities focus on service and engagement within our communities and developing an operating plan that promotes long-term sustainability.

2.3 SUMMARY OF PROBLEM STATEMENT

Call agents should be able to answer phone calls, log account changes with the PBS North Carolina CRM, take new donations, cancel donations, and provide answers to questions pertaining to either the mission or programming of PBS North Carolina or its streaming app, Passport. Call agents must be able to work out of Blackbaud’s Raisers Edge NXT, Blackbaud’s Luminate Online, and MVault, a PBS system used to manage Passport access.

External call center must maintain sufficient data-security measures for all call agents (in-person and/or remote) and must annually provide a current PCI DSS Attestation of Compliance for Service Providers, under PCI DSS v4.0(x) or the then-current version, covering the services proposed for PBS NC, including applicable telephony, call recording, CRM/ticketing, payment-processing, remote-agent, and subcontractor environments.

Additionally, if able, PBS North Carolina would like to know availability to provide 24-hour call agent staffing for a pledge line with the sole purpose of taking new donations, documenting requested premium gifts, and taking request notes to provide for the 9:00am-5:00pm call team for data entry.

Reporting on calls answered, calls missed, response rate per agent, tickets resolved, and other relevant metrics must be provided on a weekly basis, presented by daily results. Recordings of call agents, masking all PII, must be provided upon request to ensure quality control. The external call center must not store payment-card data, CVV/CVC, sensitive authentication data, or payment information in recordings, transcripts, voicemails, tickets, notes, or quality-assurance tools. The external call center shall not record any portion of conversations whereby PII or payment-card data is shared by PBS donors.

2.4 CONTRACT TERM

A contract awarded pursuant to this RFP shall have an effective date as provided in the Notice of Award.

The term shall be one (1) year, and will expire upon the anniversary date of the effective date unless otherwise stated in the Notice of Award, or unless terminated earlier. The State retains the option to extend the Agreement for two (2) two-year periods at its sole discretion.

2.5 EFFECTIVE DATE

This solicitation, including any Exhibits, or any resulting contract or amendment shall not become effective nor bind the State until the appropriate State purchasing authority/official or Agency official has signed the document(s), contract or amendment; the effective award date has been completed on the document(s), by the State purchasing official, and that date has arrived or passed. The State shall not be responsible for reimbursing the Vendor for goods provided nor Services rendered prior to the appropriate signatures and the arrival of the effective date of the Agreement. No contract shall be binding on the State until an encumbrance of funds has been made for payment of the sums due under the Agreement.

2.6 CONTRACT TYPE

Definite Quantity Contract - This request is for a close-ended contract between the awarded Vendor and the State to furnish a pre-determined quantity of a good or service during a specified period of time.

The State reserves the right to make partial, progressive or multiple awards where it is advantageous to award separately by items; where more than one supplier is needed to provide the contemplated specifications as to quantity, quality, delivery, service, geographical areas; or where other factors are deemed to be necessary or proper to the purchase in question.

3.0 RFP REQUIREMENTS AND SPECIFICATIONS

3.1 GENERAL REQUIREMENTS AND SPECIFICATIONS

3.1.1 REQUIREMENTS

Requirement means, as used herein, a function, feature, or performance that the System must provide. If the offer can not meet the requirements, they will not be evaluated.

3.1.2 SPECIFICATIONS

Specification means, as used herein, a detailed description that documents the function and performance of a system or system component.

The apparent silence of the specifications as to any detail, or the apparent omission of detailed description concerning any point, shall be regarded as meaning that only the best commercial practice is to prevail and that only processes, configurations, materials and workmanship of the first quality may be used. Upon any notice of noncompliance provided by the State, Vendor shall supply proof of compliance with the specifications. Vendor must provide written notice of its intent to deliver alternate or substitute Services, products, goods or other Deliverables. Alternate or substitute Services, products, goods or Deliverables may be accepted or rejected in the sole discretion of the State; and any such alternates or substitutes must be accompanied by Vendor’s certification and evidence satisfactory to the State that the function, characteristics, performance and endurance will be equal or superior to the original Deliverables specified.

3.1.3 SITE AND SYSTEM PREPARATION

Vendors shall provide the Purchasing State Agency complete site requirement specifications for the Deliverables, if any. These specifications shall ensure that the Deliverables to be installed or implemented shall operate properly and efficiently within the site and system environment. Any alterations or modification in site preparation, which are directly attributable to incomplete or erroneous specifications provided by the Vendor and which would involve additional expenses to the State, shall be made at the expense of the Vendor.

3.1.4 EQUIVALENT ITEMS

Whenever a material, article or piece of equipment is identified in the specification(s) by reference to a manufacturer’s or Vendor’s name, trade name, catalog number or similar identifier, it is intended to establish a standard for determining substantial conformity during evaluation, unless otherwise specifically stated as a brand specific requirement (no substitute items will be allowed). Any material, article or piece of equipment of other manufacturers or Vendors shall perform to the standard of the item named. Equivalent offers must be accompanied by sufficient descriptive literature and/or specifications to provide for detailed comparison.

3.1.5 ENTERPRISE LICENSING

a) Reserved.

3.2 SECURITY SPECIFICATIONS

3.2.1 SOLUTIONS HOSTED ON STATE INFRASTRUCTURE

Reserved.

3.2.2 SOLUTIONS NOT HOSTED ON STATE INFRASTRUCTURE

The Agency (named on page one (1)) has designated this solicitation to receive and securely manage data that is classified as:

Agency has selected:

Restricted - Restricted data represents the highest risk to the State, State Agencies, and constituents if it is disclosed or compromised. This information is likely to be regulated by State or Federal law, and access to it is restricted to a limited audience (e.g., State and Federal Tax Information [FTI], Payment Card data, Protected Health Information [PHI], Criminal Justice Information [CJI], Social Security Administration provided information, etc.)

Confidential - Includes information that is limited to a small audience with a need-to-know or legitimate business case (e.g., State employee personnel records, trade secrets, student records, sensitive public security information, etc.). If exposed to unauthorized parties, data from this category will cause high impact consequences such as regulatory fines, inability to recruit talent, loss of confidence, and/or damage to vendor relationships. This is not a complete list and is subject to legislative changes.

Internal - This is information typically used within the agency and not for public sharing. Most documents are classified as Internal within the organization, and most State employees would have access. This type of data, if exposed to unauthorized parties, would have a very limited impact on an agency’s reputation, compliance requirements or ability to achieve strategic goals.

Internally classified data does not contain direct identifiers. Often, the effects of the loss of data can be recognized in very subtle ways and may not lead to clear negative consequences causing confusion due to lack of context or minor reputational harm.

Public - Data that is open to public inspection according to state and federal law, or readily available through public sources.

Refer to the North Carolina Statewide Data Classification and Handling policy for more information regarding data classification. The policy is located at the following website:

https://it.nc.gov/document/statewide-data-classification-and-handling-policy.

To comply with the State’s Security Standards and Policies, State agencies are required to perform annual security/risk assessments on their information systems using NIST 800-53 controls.

This requirement additionally applies to all Vendor-provided, agency-managed Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) solutions which will handle data classified as Internal, Confidential, or Restricted.

(a) To comply with the State’s Security Standards and Policies, cloud products are required to comply with applicable FedRAMP or GovRAMP security requirements, including but not limited to, continuous monitoring, incident response, and data classification as outlined in GovRAMP documentation.

(b) To streamline and standardize this requirement the State has adopted GovRAMP which is a Risk and Authorization Management Program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. GovRAMP’s security verification model is based on NIST 800-53 Rev. 5 (or current).

(c) Additional Security Documentation. Prior to contract award, the State may in its discretion require the Vendor to provide additional security documentation, including but not limited to, vulnerability assessment reports and penetration test reports. The awarded Vendor shall provide additional security documentation upon request by the State during the term of the contract.

Refer to: https://it.nc.gov/documents/statewide-glossary-information-technology-terms for descriptions of the Application Criticality categories.

Refer to: http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf for descriptions of NIST system confidentiality, integrity, and availability categories.

3.3 ENTERPRISE SPECIFICATIONS

3.3.1 ARCHITECTURE DIAGRAMS

The two diagrams are Network Architecture and Technology Stack. The State utilizes architectural diagrams to better understand the design and technologies of a proposed solution. Details on these diagrams can be found at the following link: https://it.nc.gov/resources/statewide-it-procurement/vendor-engagement-resources#Tab-Architecture-1192

The provision of these two diagrams is a requirement at offer submission. If they are not supplied at that time, the Vendor’s offer will be considered non-responsive and will not be evaluated.

There may be additional architectural diagrams requested of the vendor after contract award. This will be communicated to the vendor by the agency as needed during the project.

3.3.2 SOLUTION ROADMAP

https://it.nc.gov/document/statewide-data-classification-and-handling-policy https://it.nc.gov/documents/statewide-glossary-information-technology-terms http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf https://it.nc.gov/resources/statewide-it-procurement/vendor-engagement-resources#Tab-Architecture-1192 https://it.nc.gov/resources/statewide-it-procurement/vendor-engagement-resources#Tab-Architecture-1192

3.3.3 IDENTITY AND ACCESS MANAGEMENT

Reserved.

3.3.4 INTEGRATION APPROACH

Describe proposed solution capabilities to interoperate with other solutions. Identify the standards supported, integrations platforms, adaptors, APIs, and the like.

3.3.5 DISASTER RECOVERY AND BUSINESS CONTINUITY

Describe the proposed solution capabilities related to the following areas:

Disaster Recovery Plan (DRP) – describe how proposed solution supports Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO) metrics.

System Backup – describe backup plan capabilities.

Disaster Recovery Testing – describe the frequency and test procedures for end-to-end disaster recovery testing. Business Continuity Plan (BCP) – describe capabilities proposed solution can provide in support of agency’s continuity of operations and incident responses.

3.3.6 DATA MIGRATION

Describe approaches available for data conversion and/or data migration to load current data into proposed solution.

3.3.7 APPLICATION MANAGEMENT

Describe how the proposed solution monitors and reports the metrics on system performance.

Describe how the proposed solution manages user administration.

Describe the audit capabilities of proposed solution related to management of the application.

3.3.8 ACCESSIBILITY

Describe how the proposed solution complies with industry accessibility standards.

Provide product documentation that demonstrates how the proposed solution is digitally accessible or if not fully accessible, provide the roadmap with timeline for remediation.

Standards include:

• State of North Carolina Digital Accessibility & Usability Standard

• W3C Web Accessibility Initiative - Web Content Accessibility Guidelines (WCAG) 2.1:

https://www.w3.org/TR/WCAG21/

• Section 508: https://www.section508.gov/

• Voluntary Product Accessibility Template (VPAT®):

https://www.itic.org/policy/accessibility/vpat

ENTERPRISE, SERVICES, AND STANDARDS

Vendors should refer to the Vendor Resources Page for information on North Carolina Department of Information Technology regarding architecture, security, strategy, data, digital, identity and access management and other general information on doing business with state IT process.

The Vendor Resources Page found at the following link: https://it.nc.gov/vendor-engagement-resources. This site provides vendors with statewide information and links referenced throughout the RFP document. Agencies may request additional information.

https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fit.nc.gov%2Fdocuments%2Fdigital-accessibility-usability-standard%2Fopen&data=05%7C02%7Candrea.pacyna%40nc.gov%7C6ff711c554904ca4fefe08dea07c8d50%7C7a7681dcb9d0449a85c3ecc26cd7ed19%7C0%7C0%7C639124653982102920%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=HoeiBL%2FHUIvvm3mFXH37dt6au5cZMhXaQn2%2FRa7cq3k%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fit.nc.gov%2Fdocuments%2Fdigital-accessibility-usability-standard%2Fopen&data=05%7C02%7Candrea.pacyna%40nc.gov%7C6ff711c554904ca4fefe08dea07c8d50%7C7a7681dcb9d0449a85c3ecc26cd7ed19%7C0%7C0%7C639124653982129428%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=oeGml%2FBan%2FQSTWo8MqssmpzMBvwzpHSpw6av66p4rIA%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.w3.org%2FTR%2FWCAG21%2F&data=05%7C02%7Cstarr.christen%40nc.gov%7C3737b44528934d4e45f508dc3a2fddad%7C7a7681dcb9d0449a85c3ecc26cd7ed19%7C0%7C0%7C638449224463390497%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=e02p3b8aB5KB1xe2s6LB3ksZyRtoo09MCHTXDzO5E6Q%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.section508.gov%2F&data=05%7C02%7Cstarr.christen%40nc.gov%7C3737b44528934d4e45f508dc3a2fddad%7C7a7681dcb9d0449a85c3ecc26cd7ed19%7C0%7C0%7C638449224463398992%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=pzgUTV7chyDcngdl6SvQJ3tAIz7RLJvSY02jf8A4SRg%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.itic.org%2Fpolicy%2Faccessibility%2Fvpat&data=05%7C02%7Cstarr.christen%40nc.gov%7C3737b44528934d4e45f508dc3a2fddad%7C7a7681dcb9d0449a85c3ecc26cd7ed19%7C0%7C0%7C638449224463405831%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=5PxuYxDYvzebQ0oJ4qLv%2BXmBS25YhqJa3ms9L3r8c8c%3D&reserved=0 https://it.nc.gov/vendor-engagement-resources https://it.nc.gov/vendor-engagement-resources

3.4 BUSINESS AND TECHNICAL REQUIREMENTS

3.4.1 PBS North Carolina is seeking an external call center agency to provide call agent staffing for the organization Monday-Friday, 9:00am-5:00pm ET. The call center agency will be responsible for answering and fielding all phone calls as well as responding to voicemails to PBS North Carolina from its nearly 105,000 members and many more viewers that watch its free public broadcasting.

Call agents must be able to work out of Blackbaud’s Raisers Edge NXT, Blackbaud’s Luminate Online, and MVault, a PBS system used to manage Passport access.

All call agents must be able to provide the following functions within the systems:

• Account changes such as changes to name, preferred salutation, physical mailing address, email address(es), phone number(s), and communication preferences

• Documenting premium gifts needed

• Cancellation of recurring donations

• Processing of new donations, including if a donor would like a new card or bank account on file, upgrade their donation, or downgrade their donation

• Passport Status look up

• Passport Award

• Passport Membership extensions

• Data entry from pledge line

• Documentation of all changes with action logs and notes within the systems

• Receipting

Additionally, call agents should be able to provide answers to questions pertaining to either the mission or programming of PBS North Carolina or its streaming app, Passport.

The external call center must maintain sufficient data-security measures for all call agents and must annually provide a current PCI DSS Attestation of Compliance for Service Providers, under PCI DSS v4.0.1 or the then-current version, covering the services proposed for PBS NC, including applicable telephony, call recording, CRM/ticketing, payment-processing, remote-agent, and subcontractor environments. PBS North Carolina will need one point of contact as the account representative that will meet with PBS North Carolina Development management twice a month to discuss current metrics and any relevant organizational or programming updates for PBS North Carolina for call center agents. Reporting on calls answered, calls missed, response rate per agent, tickets resolved, and other relevant metrics must be provided on a weekly basis, presented by daily results. Recordings of call agents, masking all donor PII, must be provided upon request to ensure quality control. The external call center must not store payment-card data, CVV/CVC, sensitive authentication data, or payment information in recordings, transcripts, voicemails, tickets, notes, or quality-assurance tools.

Service Provider Security Acknowledgment. Vendor shall provide a written acknowledgment, incorporated into the Agreement, that Vendor is responsible for the security of account data, cardholder data, and sensitive authentication data that Vendor possesses or otherwise stores, processes, or transmits on behalf of PBS NC, or to the extent Vendor could affect the security of PBS NC cardholder data, sensitive authentication data, or cardholder data environment.

Telephone Payment and Recording Controls. Vendor shall describe the end-to-end payment-card handling process for all donor payments, including agent scripts, call routing, IVR or payment-application use, CRM entry, call recording, voicemail handling, ticketing, and quality-assurance review. Vendor shall use technical controls such as secure IVR or payment capture, pause-and-resume recording, DTMF masking or suppression, tokenization, secure payment links, or equivalent controls to prevent payment-card data from being exposed to or retained in non-payment systems, and shall provide evidence of the effectiveness of these controls upon request.

Compliance Monitoring and Reporting. Vendor shall provide updated PCI DSS compliance evidence at least annually and within ten (10) business days after PBS NC written request. Vendor shall notify PBS NC within five (5) business days of any material change in PCI DSS compliance status, lapse or expiration of an AOC, material change in PCI DSS scope, failure of a required PCI DSS control, change in payment-card processing flow, or change in any subcontractor that stores, processes, transmits, or could affect payment-card data. Vendor failure to maintain applicable PCI DSS compliance or to provide required evidence shall constitute a material breach of the Agreement.

PCI DSS Responsibility Matrix. Vendor shall provide and maintain a PCI DSS v4.0.1 or then-current responsibility matrix identifying each applicable PCI DSS requirement and sub-requirement and stating whether it is Vendor responsibility, PBS NC responsibility, or a shared responsibility. For shared responsibilities, Vendor shall describe the specific actions required of each party, the relevant systems or processes, and the evidence available to demonstrate compliance. Vendor shall update the responsibility matrix within thirty (30) calendar days of any material change to services, systems, subcontractors, compliance status, or payment-card handling processes.

Subcontractors and Nested Service Providers. Vendor shall not add or materially change subcontractors, affiliates, platforms, cloud providers, payment processors, IVR providers, call-recording providers, workforce-management tools, ticketing systems, or other third parties that store, process, transmit, access, or could affect PBS NC donor data or payment-card data without prior written notice to PBS NC and any required approval under the Agreement. Vendor shall ensure approved subcontractors are contractually bound to security, confidentiality, incident-response, audit, and PCI DSS obligations at least as protective as those imposed on Vendor. Vendor remains fully responsible for subcontractor performance and compliance.

Payment-Card and Donor-Data Incident Response. Vendor shall notify PBS NC without undue delay and no later than twenty-four (24) hours after discovering any suspected or confirmed unauthorized access to, disclosure of, compromise of, loss of, or inability to account for PBS NC donor data, account data, cardholder data, sensitive authentication data, payment systems, call recordings, voicemails, CRM records, or systems that could affect the security of such data. Vendor shall immediately contain the incident, preserve relevant logs and evidence, cooperate with PBS NC and its designated representatives, support payment-brand and acquirer requirements, and provide information reasonably necessary for PBS NC to meet legal, contractual, regulatory, and PCI DSS obligations. Vendor shall not make public statements regarding the incident without PBS NC prior written approval except as required by law.

Access Control and Security Audit Evidence. Vendor shall use unique user IDs, least-privilege access, strong authentication, multi-factor authentication where supported or required, secure password and session controls, timely removal of access upon role change or separation, and periodic access reviews for all personnel accessing PBS NC systems, donor data, payment systems, call recordings, or related tools. Upon reasonable request, Vendor shall provide documentation sufficient to verify compliance with security, privacy, and PCI DSS obligations, including policies, training records, access-review records, vulnerability-management summaries, penetration-test executive summaries, incident-response test results, PCI DSS evidence, AOCs, responsibility matrices, and relevant subcontractor attestations.

Additionally, PBS North Carolina would like to know availability to provide 24-hour call agent staffing for a pledge line with the sole purpose of taking new donations, documenting requested premium gifts, and taking request notes to provide for the 9:00am-5:00pm call team for data entry.

All responses to this RFP must include the following:

• Organization or company background

• Organization or company officers, account manager responsible for the PBS North Carolina account, other team members on PBS North Carolina account, and call agents on PBS North Carolina account

• Description of services offered, including services that PBS North Carolina may benefit from

• Average call center results for similarly sized clients

• Relevant public media experience

• Pricing for set up and services

• Current PCI DSS Attestation of Compliance under PCI DSS 4.0 for Service Providers, with scope covering the services proposed for PBS NC, plus any supporting responsibility matrix or scope summary needed to identify vendor, PBS NC, and shared responsibilities.

• Years of experience operating as a PCI compliant call center

• Description of compliance governance structure including internal or external audit function, ongoing PCI DSS compliance monitoring, role-based initial and annual PCI DSS training for call agents, and procedures for documenting, testing, and remediating PCI DSS control gaps.

• Description of masking, pause-resume recording, and no-storage capabilities for agents handling PII, payment-card data, CVV/CVC, sensitive authentication data, call transcripts, voicemails, tickets, notes, and quality-assurance tools.

• Current security protocols for all call agents (remote and onsite), including access control, authentication, endpoint protection, clean-desk standards, acceptable use, incident notification, breach escalation, evidence preservation, and donor-data or payment-card incident response procedures.

• If employing remote call agents, describe endpoint-security, authentication, network-security, device-management, local-storage, clean-desk, call-privacy, and monitoring controls for remote work.

• Documented PCI DSS shared responsibility matrix identifying vendor, PBS NC, and shared responsibilities, including evidence available to support each responsibility.

• Description of pre-employment background check standards for call agents

• Description of role-based onboarding and annual training requirements for all call agents, including PCI DSS responsibilities, donor confidentiality, prohibited storage of payment-card data, secure authentication, social engineering, phishing, incident reporting, call-recording procedures, clean-desk expectations, and remote-work security controls.

• Description of agent termination and access revocation standards and timelines

• Current liability insurance information, including cyber liability, technology errors and omissions, and privacy/security incident coverage applicable to donor data, payment-card data, call-center systems, subcontractors, breach response, notification, forensic investigation, and regulatory or payment-brand assessments where insurable.

• Disaster recovery or business continuity plan addressing recovery time objectives, recovery point objectives, telephony continuity, CRM or payment-system outages, remote-work disruptions, staffing shortages, pledge-drive surge coverage, incident-response coordination, and outage communication to PBS NC.

• Complete inventory of all subcontractors, affiliates, platforms, and nested service providers involved in call handling, donor information, payment-card data, telephony, call recording, CRM/ticketing, cloud hosting, support, or security monitoring, including each party’s role and whether it affects PCI DSS scope.

• References from similarly sized clients

• Other onboarding requirements

3.5 BUSINESS AND TECHNICAL SPECIFICATIONS

4.0 COST OF VENDOR’S OFFER

4.1 OFFER COSTS

The Vendor must list, itemize, and describe any applicable offer costs in ATTACHMENT D:

COST FORM.

4.2 PAYMENT SCHEDULE

The Vendor shall propose its itemized payment schedule based on the content of its offer. All payments must be based upon acceptance of one or more Deliverables.

5.0 EVALUATION

5.1 SOURCE SELECTION

A trade-off/ranking method of source selection will be utilized in this procurement to allow the State to award this RFP to the Vendor providing the Best Value and recognizing that Best Value may result in award other than the lowest price or highest technically qualified offer. By using this method, the overall ranking may be adjusted up or down when considered with or traded-off against other non-price factors.

a) Evaluation Process Explanation. State Agency employees will review all offers. All offers will be initially classified as being responsive or non-responsive. If an offer is found non-responsive, it will not be considered further. All responsive offers will be evaluated based on stated evaluation criteria. Any references in an answer to another location in the RFP materials or Offer shall have specific page numbers and sections stated in the reference.

b) To be eligible for consideration, Vendor’s offer must substantially conform to the intent of all specifications. Compliance with the intent of all specifications will be determined by the State.

Offers that do not meet the full intent of all specifications listed in this RFP may be deemed deficient. Further, a serious deficiency in the offer to any one (1) factor may be grounds for rejection regardless of overall score.

c) The evaluation committee may request clarifications, an interview with or presentation from any or all Vendors as allowed by 9 NCAC 06B.0307. However, the State may refuse to accept, in full or partially, the response to a clarification request given by any Vendor. Vendors are cautioned that the evaluators are not required to request clarifications; therefore, all offers should be complete and reflect the most favorable terms. Vendors should be prepared to send qualified personnel to RTP, North Carolina, to discuss technical and contractual aspects of the offer.

d) Vendors are advised that the State is not obligated to ask for, or accept after the closing date for receipt of offer, data that is essential for a complete and thorough evaluation of the offer.

5.2 EVALUATION CRITERIA

Evaluation shall include best value, as the term is defined in N.C.G.S. § 143-135.9(a)(1), compliance with information technology project management policies as defined by N.C.G.S. §143B-1340, compliance with information technology security standards and policies, substantial conformity with the specifications, and other conditions set forth in the solicitation. The following Evaluation Criteria are:

• Cost Efficiency

• Services Offered, both requested and additional

• Prior and Current Team Metrics; Security, Privacy, and PCI DSS Compliance, including demonstrated ability to protect PBS NC donor and payment-card data, maintain PCI DSS service-provider compliance, prevent payment-card data from being stored in call recordings or non-payment systems, manage subcontractors, support audits, and respond effectively to suspected or confirmed security incidents.

• Experience in working with public media entities

• Preference to a North Carolina based call center or North Carolina based call agents

• Quality of References

5.3 BEST AND FINAL OFFERS (BAFO)

The State may establish a competitive range based upon evaluations of offers, and request BAFOs from the Vendor(s) within this range; e.g. “Finalist Vendor(s)”. If negotiations or subsequent offers are solicited, the Vendor(s) shall provide BAFO(s) in response. Failure to deliver a BAFO when requested shall disqualify the non-responsive Vendor from further consideration. The State will evaluate BAFO(s), oral presentations, and product demonstrations as part of the Vendors’ respective offers to determine the final rankings.

5.4 POSSESSION AND REVIEW

During the evaluation period and prior to award, possession of the bids and accompanying information is limited to personnel of the issuing agency, and to the committee responsible for participating in the evaluation. Vendors who attempt to gain this privileged information, or to influence the evaluation process (i.e. assist in evaluation) will be in violation of purchasing rules and their offer will not be further evaluated or considered.

After award of contract the complete bid file will be available to any interested persons with the exception of trade secrets, test information or similar proprietary information as provided by statute and rule. Any proprietary or confidential information, which conforms to exclusions from public records as provided by N.C.G.S. §132-1.2 must be clearly marked as such in the offer when submitted.

6.0 VENDOR INFORMATION AND INSTRUCTIONS

6.1 GENERAL CONDITIONS OF OFFER

6.1.1 VENDOR RESPONSIBILITY

It shall be the Vendor’s responsibility to read this entire document, review all enclosures and attachments, and comply with all specifications, requirements and the State’s intent as specified herein. If a Vendor discovers an inconsistency, error or omission in this solicitation, the Vendor should request a clarification from the State’s contact person.

The Vendor will be responsible for investigating and recommending the most effective and efficient solution. Consideration shall be given to the stability of the proposed configuration and the future direction of technology, confirming to the best of its ability that the recommended approach is not short lived. Several approaches may exist for hardware configurations, other products and any software. The Vendor must provide a justification for their proposed hardware, product and software solution(s) along with costs thereof. Vendors are encouraged to present explanations of benefits and merits of their proposed solutions together with any accompanying Services, maintenance, warranties, value added Services or other criteria identified herein.

6.1.2 RIGHTS RESERVED

While the State has every intention to award a contract as a result of this RFP, issuance of the RFP in no way constitutes a commitment by the State of North Carolina, or the procuring Agency, to award a contract. Upon determining that any of the following would be in its best interests, the State may:

a) waive any formality;

b) amend the solicitation;

c) cancel or terminate this RFP;

d) reject any or all offers received in response to this RFP;

e) waive any undesirable, inconsequential, or inconsistent provisions of this RFP;

f) if the response to this solicitation demonstrate a lack of competition, negotiate directly with one or more Vendors;

g) not award, or if awarded, terminate any contract if the State determines adequate State funds are not available; or

h) if all offers are found non-responsive, determine whether Waiver of Competition criteria may be satisfied, and if so, negotiate with one or more known sources of supply.

6.1.3 SOLICITATION AMENDMENTS OR REVISIONS

Any and all amendments or revisions to this document shall be made by written addendum from the Agency Procurement Office. If either a unit price or extended price is obviously in error and the other is obviously correct, the incorrect price will be disregarded.

6.1.4 ORAL EXPLANATIONS

The State will not be bound by oral explanations or instructions given at any time during the bidding process or after award. Vendor contact regarding this RFP with anyone other than the State’s contact person may be grounds for rejection of said Vendor’s offer. Agency contact regarding this RFP with any Vendor may be grounds for cancellation of this RFP.

6.1.5 E-PROCUREMENT

This is NOT an E-Procurement solicitation. See ATTACHMENT B, paragraph #38 of the attached North Carolina Department of Information Technology Terms and Conditions.

6.1.6 ELECTRONIC VENDOR PORTAL (EVP)

The State has implemented the electronic Vendor Portal (eVP) that allow the public to retrieve award notices and information on the Internet at https://evp.nc.gov. https://www.ips.state.nc.us/ips/ Results may be found by searching by Solicitation Number or agency name. This information may not be available for several weeks dependent upon the complexity of the acquisition and the length of time to complete the evaluation process.

6.1.7 PROTEST PROCEDURES

When a Vendor wants to protest a Contract awarded by the UNC System Office for information technology goods and services OR a contract valued at less than $500,000, the University and Vendor shall comply with the following:

1. The Vendor shall submit a written request for a protest meeting to the System Office within 30 calendar days from the date of the Contract award. The Vendor's request shall contain reasons why it has a concern with the award and any supporting documentation. If the request does not contain this information, or if the System Office determines that the protest is meritless so that a meeting would serve no purpose, then the System Office may, within 10 calendar days from the date of receipt of the request, respond in writing to the Vendor and refuse the protest meeting request.

2. If the protest meeting is granted, the System Office shall schedule the meeting within 30 calendar days after receipt of the request, unless mutually agreed otherwise. Within 10 calendar days from the date of the protest meeting, the System Office shall respond to the Vendor in writing with the executive officer's decision and appeal rights under Article 4 of G.S. 150B.

6.2 GENERAL INSTRUCTIONS FOR VENDORS

6.2.1 SITE VISIT OR PRE-OFFER CONFERENCE

Reserved.

https://evp.nc.gov/ https://www.ips.state.nc.us/ips/

6.2.2 QUESTIONS CONCERNING THE RFP

All inquiries regarding the solicitation specifications or requirements are to be addressed to the contact person listed on Page One of this solicitation via 68-SOCC0626 Questions.. Vendor contact regarding this Solicitation with anyone other than the contact person listed on Page One of this Solicitation may be grounds for rejection of said Vendor’s offer.

Written questions concerning this Solicitation will be received until June 12, 2026, at noon Eastern Daylight Time.

6.2.3 ADDENDUM TO RFP

If a pre-offer conference is held or written questions are received prior to the submission date, an addendum comprising questions submitted and responses to such questions, or any additional terms deemed necessary by the State shall become an Addendum to this RFP and provided via the State’s Ariba Sourcing Tool. Vendors’ questions posed orally at any pre-offer conference must be reduced to writing by the Vendor and provided to the Purchasing Officer as directed by said Officer. Oral answers are not binding on the State.

Critical updated information may be included in these Addenda. It is important that all Vendors bidding on this RFP periodically check the State’s Sourcing Tool for all Addenda that may be issued prior to the offer opening date.

6.2.4 COSTS RELATED TO OFFER SUBMISSION

Costs for developing and delivering responses to this RFP and any subsequent presentations of the offer as requested by the State are entirely the responsibility of the Vendor. The State is not liable for any expense incurred by the Vendors in the preparation and presentation of their offers.

All materials submitted in response to this RFP become the property of the State and are to be appended to any formal documentation, which would further define or expand any contractual relationship between the State and the Vendor resulting from this RFP process.

6.2.5 VENDOR ERRATA AND EXCEPTIONS

Any errata or exceptions to the State’s requirements and specifications may be presented on a separate page labeled “Exceptions to Requirements and Specifications”. Include references to the corresponding requirements and specifications of the Solicitation. Any deviations shall be explained in detail. The Vendor shall not construe this paragraph as inviting deviation or implying that any deviation will be acceptable. Offers of alternative or non-equivalent goods or services may be rejected if not found substantially conforming; and if offered, must be supported by independent documentary verification that the offer substantially conforms to the specified goods or services specification. If a vendor materially deviates from RFP requirements or specifications, its offer may be determined to be non-responsive by the State.

Offers conditioned upon acceptance of Vendor Errata or Exceptions may be determined to be non-responsive by the State.

6.2.6 ALTERNATE OFFERS

The Vendor may submit alternate offers for various levels of service(s) or products meeting specifications. Alternate offers must specifically identify the RFP specifications and advantage(s) addressed by the alternate offer. Any alternate offers must be clearly marked with the legend as shown herein. Each offer must be for a specific set of Services or products and offer at specific pricing. If a Vendor chooses to respond with various service or product offerings, each must be an offer with a different price and a separate RFP offer. Vendors may also provide multiple offers for https://docs.google.com/forms/d/e/1FAIpQLSdPSotpHBUr2aAJcZuGfQGtIg3gdrbfIUNC4tcGr5y0T6_b7A/viewform?usp=header software or systems coupled with support and maintenance options, provided, however, all offers must satisfy the specifications.

Alternate offers must be submitted in a separate document and clearly marked “Alternate Offer for ‘name of Vendor’” and numbered sequentially with the first offer if separate offers are submitted.

6.2.7 MODIFICATIONS TO OFFER

An offer may not be unilaterally modified by the Vendor.

6.2.8 BASIS FOR REJECTION

Pursuant to 9 NCAC 06B.0401, the State reserves the right to reject any and all offers, in whole or in part; by deeming the offer unsatisfactory as to quality or quantity, delivery, price or service offered;

non-compliance with the specifications or intent of this solicitation; lack of competitiveness; error(s) in specifications or indications that revision would be advantageous to the State; cancellation or other changes in the intended project, or other determination that the proposed specification is no longer needed; limitation or lack of available funds; circumstances that prevent determination of the best offer; or any other determination that rejection would be in the best interest of the State.

6.2.9 NON-RESPONSIVE OFFERS

Vendor offers will be deemed non-responsive by the State and will be rejected without further consideration or evaluation if statements such as the following are included:

• “This offer does not constitute a binding offer”,

• “This offer will be valid only if this offer is selected as a finalist or in the competitive range”,

• “The Vendor does not commit or bind itself to any terms and conditions by this submission”,

• “This document and all associated documents are non-binding and shall be used for discussion purposes only”,

• “This offer will not be binding on either party until incorporated in a definitive agreement signed by authorized representatives of both parties”, or

• A statement of similar intent

6.2.10 VENDOR REGISTRATION WITH THE SECRETARY OF STATE

Vendors do not have to be registered with the NC Secretary of State to submit an offer; however, in order to receive an award/contract with the State, they must be registered. Registration can be completed at the following website: https://www.sosnc.gov/Guides/launching_a_business

6.2.11 VENDOR REGISTRATION AND SOLICITATION NOTIFICATION SYSTEM

The NC electronic Vendor Portal (eVP) allows Vendors to electronically register with the State to receive electronic notification of current procurement opportunities for goods and Services available at the following website: https://evp.nc.gov.

This RFP is available electronically on the electronic Vendor Portal (eVP) at the following website:

https://evp.nc.gov.

6.3 INSTRUCTIONS FOR OFFER SUBMISSION

6.3.1 GENERAL INSTRUCTIONS FOR OFFER

Vendors are strongly encouraged to adhere to the following general instructions in order to bring clarity and order to the offer and subsequent evaluation process:

a) Organize the offer in the exact order in which the specifications are presented in the RFP. The

Execution page of this RFP must be placed at the front of the Proposal. Each page should be numbered. The offer should contain a table of contents, which cross-references the RFP specification and the specific page of the response in the Vendor's offer.

https://www.sosnc.gov/Guides/launching_a_business https://evp.nc.gov./ https://evp.nc.gov./

b) Provide complete and comprehensive responses with a corresponding emphasis on being concise and clear. Elaborate offers in the form of brochures or other presentations beyond that necessary to present a complete and effective offer are not desired.

c) Clearly state your understanding of the problem(s) presented by this RFP including your proposed solution’s ability to meet the specifications, including capabilities, features, and limitations, as described herein, and…