68-SOCTT0926 - Addendum 01.pdf

UNIVERSITY OF NORTH CAROLINA SYSTEM OFFICE

BID ADDENDUM

UNC System Office Bid Number: 68-SOCTT0926 Prospective Bidder:

Bid Opening Date/Time: October 14, 2026, at 10:00 a.m. EDT Addendum Number: 01 Addendum Date: October 7, 2026

This addendum is issued pursuant to UNC System Office RFP 68-SOCTT0926 to reconcile RFP 68-SOCTT0926’s security language with UNC System Office’s current Third Party/Vendor Risk Management (TPRM) policy and procedures. The solicitation identifies the highest data classification as Restricted. Accordingly, the selected solution will undergo UNC System Office’s highest applicable vendor review path before contract execution, production access, or processing of protected information.

The University hereby supplants and replaces the GovRAMP-specific language in Section 3.2.2. The amended requirement is a UNC System Office risk-based review (see Appendix A), not a vendor obligation to hold GovRAMP status, provide a GovRAMP Security Snapshot/Matrix, or enroll in the GovRAMP Progressing program.

One of the following attestations/certifications are acceptable in lieu of GovRAMP: 1) a current SOC 2 Type II (or most recent, along with associated bridge letter covering the current period while a new report is in progress); 2) current FedRAMP authorization; 3) current HITRUST certification; or 4) current ISO 27001 certification. A vendor lacking current qualifying independent assurance evidence, or with material unresolved findings, may be asked to provide alternative evidence and may be eligible only for a documented conditional approval or risk acceptance process. Additionally, the University may request additional evidence based on the proposed service, material deficiencies in any reports, scope application, integration, data flow, and findings.

The University hereby makes the following changes to Request for Proposals 68-

SOCTT0926:

1. Replace Section 3.2.2(a)–(d) with the following:

“Vendor Security Review for Solutions Not Hosted on State Infrastructure. Because the Solution may process Restricted information, UNC System Office must complete its vendor risk review before contract execution, production use, or access to protected information. As required under the UNC System Third Party Risk Management Policy, the vendor shall provide secure access to a current SOC 2 Type II report, FedRAMP authorization, HITRUST certification, or ISO 27001 certification that covers the offered service(s), together with other security evidence reasonably requested for the review. The University may use an access-controlled Trust Hub or secure link for receipt of requested materials and may execute an appropriate NDA. The review will consider the scope, currency, applicable service, findings, data flow, integrations, access model, subcontractors, and other relevant risks. A vendor lacking current qualifying independent assurance evidence, or with material unresolved findings, may be asked to provide alternative evidence and may be eligible only for a documented conditional approval or risk acceptance process. The vendor may not begin protected data processing or receive production access until the required review, approval, data protection agreement and contract terms, and onboarding controls are complete, or a documented risk acceptance has been approved.”

2. Replace Section 6.3.2(c) with the following:

“Security evidence. The vendor shall identify a security contact and provide secure access to current independent assurance evidence and other information needed for the University’s vendor risk review. The University prepares a written Vendor Risk Assessment Report for internal use only. Vendors must identify any requested contractual exceptions in accordance with Section 6.2.3.”

3. Section 3.3.8

Replace the reference to “WCAG 2.1” with “WCAG 2.2 Level AA.”

Appendix A: Third Party Risk Management Policy Requirements for Restricted/Confidential Data Processing

Path 3. Advanced Review

An Advanced Review is used when Tier 3 (sensitive/restricted/confidential) data is stored, handled, transmitted, processed, or otherwise involved. It is also used when the service hosts critical systems or has privileged access. The proposer/vendor shall provide the following for review:

A current third-party independent assurance/attestation of one of the following types: SOC 2 Type 2, FedRAMP, HITRUST, or ISO 27001.

The independent assurance report is accepted when it meets the review standard used by Vendor Risk Management, including the absence of unresolved major findings that the review treats as blocking.

If the attestation has expired but had no major findings, and a new assessment is underway, a bridge letter along with the most current report is acceptable on the condition that the current report is provided and no material defects are noted, when the assessor finishes.

An external security monitoring platform score of 700 or higher at the time of assessment.

Additional conditions apply to specific data types:

Criminal justice information: a signed CJIS Security Addendum and evidence of compliance

Health information subject to HIPAA: a business associate agreement

Account data shared with the vendor: a current PCI DSS Attestation of Compliance

When the conditions are met, the written assessment records the vendor as approved. The report is stored in the secure vendor folder designated for that vendor, together with artifacts appropriate to store.

Path 3a: Alternate Acceptable Criteria Path

When the vendor lacks a current third-party attestation, or the report contains major findings, Vendor Risk Management may require a combination (two or more) of the following:

A third party internal and external vulnerability assessment performed within the past 45 days

Penetration test results from the past year

A written plan of action and milestones for major findings

Dataflow documentation

Information security policies, including incident response and business continuity

A BitSight score of 700 or higher, or the equivalent threshold if the monitoring platform changes

Note: The contract may require the vendor to complete a full third-party attestation within 365 days of signature. The written assessment then records a conditional approval and the noted exceptions.

All other information contained in the RFP and Addendum 01 thereto remains the same.

INSTRUCTIONS:

1. Return one properly executed copy of this addendum prior to the Bid Opening Date/

Time listed above.

2. Please make the following change(s) in the bid referenced above:

3. Check ONE of the following options:

Bid has not been submitted. Any changes resulting from this addendum are included in our bid.

Bid has already been submitted. No changes resulted from this addendum.

Bid has already been submitted. Changes resulting from this addendum are as follows.

Execute Addendum:

Bidder:_______________________________________________________________

Authorized Signature:________________________ Date:_____________________

Name and Title (Typed):_______________________________________________

BID ADDENDUM