68-SOCTT0926 - Addendum 02.pdf

UNIVERSITY OF NORTH CAROLINA SYSTEM OFFICE

BID ADDENDUM

FAILURE TO RETURN THIS BID ADDENDUM IN ACCORDANCE WITH

INSTRUCTIONS MAY SUBJECT YOUR BID TO REJECTION ON THE AFFECTED

ITEM(S)/SERVICES.

UNC System Office Bid Number: 68-SOCTT0926 Prospective Bidder:

Bid Opening Date/Time: October 14, 2026, at 10:00 a.m. EDT Addendum Number: 02 Addendum Date: October 7, 2026

The University of North Carolina issues this addendum to University of North Carolina RFP 68-SOCTT0926 to provide answers to properly submitted Vendor questions. The questions and responses are:

RFP Reference Section Question Answer

The rfp state that that the entire rfp response must be in one combined file. Yet a separate document that has confidential information marked and redacted is also requested. Please clarify that the redacted document should be a separate file from the submitted rfp response, so in this case, a second document is permitted.

The University requests that the entire RFP response, including any attachments, be combined into a single document. If a Vendor chooses to submit a redacted copy of the Vendor's response, the Vendor may submit the redacted copy as a separate document.

Section 6.3.2

Section 6.3.2 requires a Security Vendor Readiness Assessment Report (VRAR), but the RFP does not include the form or a link to it. Can the University confirm which VRAR template/version vendors should complete and submit?

Vendors are not required to complete or submit the State of NC Department of Information Technology’s VRAR template. The UNC System Office will prepare its own Vendor Risk Assessment Report after it reviews the vendor’s information and evidence, for internal use only. Section 6.3.2 is amended to require vendors to identify a security contact and secure access to the evidence needed for the University’s review.

Section 3.2 Security Specifications:

We request that the GovRAMP verification requirements under Section

3.2.2 be removed or revised to permit SOC 2 Type II compliance as an acceptable alternative. Our product undergoes an independent SOC 2 Type II audit annually, providing assurances that

Yes. Section 3.2.2 is amended, via Addendum 01 to remove the GovRAMP-related requirements. A current SOC 2 Type II report is an acceptable form of independent assurance evidence, assuming it contains no unresolved material exceptions and covers the services included in the proposal. A current FedRAMP authorization, HITRUST certification, or ISO 27001 certification is also acceptable. The evidence must cover the offered service, be current, and be satisfactory to the University’s review, including resolution or appropriate treatment of material findings. If the SOC 2 Type II report period has ended and a new report is in appropriate security, availability, integrity, and confidentiality controls have been designed and are operating effectively over a 12-month period. Requiring separate GovRAMP verification would impose a substantial, duplicative compliance burden that may unnecessarily limit competition among established technology providers. Would UNC System consider amending the RFP to accept a current SOC 2 Type II report in lieu of the GovRAMP status, Security Snapshot, and Progressing Snapshot requirements?

progress, the University requires the most recent SOC 2 Type II report along with an associated bridge letter from the current assessment firm.

3.2 Security

Specifications

We are extremely cautious in sharing information that contains our security safe measures for data including our SOC 2 Type II Report.

Would UNC System accept this information via a secured box link? Alternatively, would UNC System permit us to provide it following contract award rather than at the time of RFP submission?

Yes, a secure, access-controlled link is acceptable. The required security evidence may not be deferred until after contract award or contract execution when it is needed to complete the University’s security review. Vendors may provide the evidence during evaluation upon request through the secure method described above. The required security review and approval must be complete before contract execution, production use, or access to protected information.

Attachment H:

Financial Review Form

As a privately held company, our audited financial statements are not publicly available, and we are therefore unable to complete page 2 of Attachment H as requested. Would the University accept either a current Dun & Bradstreet report or a bank reference letter as sufficient evidence of a vendor’s financial stability?

If not, is UNC System willing to sign an NDA prior to the RFP submission deadline so that we may provide our audited financial statements in a protected manner?

Please disregard Attachment H and substitute the Certification of Financial Condition available at https://www.doa.nc.gov/pandc/onlineforms/pc-certification-financial-condition-92021-pdf/open in place of Attachment H.

1.0 Anticipated

Procurement Schedule

Can UNC System please provide the decision timeline for this RFP?

The intention is to review and make decisions within three weeks of the submission deadline.

https://www.doa.nc.gov/pandc/onlineforms/pc-certification-financial-condition-92021-pdf/open

Section 4.0 Cost of vendor’s Offer

Has UNC System identified a budget for this initiative, and if so, is it possible to share? Is there a price above which proposals would not be accepted?

There is no current overall budget for all transfer technology initiatives, but we are actively seeking funding from public and private sources to support a statewide transfer ecosystem.

Section 2.4 Contract Term

Would the University be open to vendors proposing alternative contract term lengths (e.g., three- or five-year terms) if a longer-term commitment would allow the vendor to offer more favorable pricing?

This RFP covers only a short period of time (one year of initial funding with the possibility of extending), but there is a long-term goal to support transfer students, so we ask for a response to this specific RFP's timeline and if there are longer-term implications for pricing and product, those would be welcomed.

6.3.2 OFFER

ORGANIZATION

If a Vendor utilizes a subcontractor as part of the bid, what attachments or other forms must be provided for the subcontractor with the Primary's bid package?

The University does not require specific forms for Vendors using subcontractors. Vendors are reminded of the provisions of Section 1(4) of the Department of Information Technology Terms and Conditions which reads: "The Vendor may subcontract the performance of required Services with Resources under the Agreement only with the prior written consent of the State contracting authority. Vendor shall provide the State with complete copies of any agreements made by and between Vendor and all subcontractors. The selected Vendor remains solely responsible for the performance of its subcontractors.

Subcontractors, if any, shall adhere to the same standards required of the selected Vendor and the Agreement. Any contracts made by the Vendor with a subcontractor shall include an affirmative statement that the State is an intended third party beneficiary of the Agreement; that the subcontractor has no agreement with the State; and that the State shall be indemnified by the Vendor for any claim presented by the subcontractor.

Notwithstanding any other term herein, Vendor shall timely exercise its contractual remedies against any non-performing subcontractor and, when appropriate, substitute another subcontractor."

6.3.2 OFFER

ORGANIZATION

Where within the organization described in section 6.3.2 would you like any required subcontractor forms to be included?

The University does not require specific forms for Vendors using subcontractors. Vendors are reminded of the provisions of Section 1(4) of the Department of Information Technology Terms and Conditions which reads: "The Vendor may subcontract the performance of required Services with Resources under the Agreement only with the prior written consent of the State contracting authority. Vendor shall provide the State with complete copies of any agreements made by and between Vendor and all subcontractors. The selected Vendor remains solely responsible for the performance of its subcontractors.

Subcontractors, if any, shall adhere to the same standards required of the selected Vendor and the Agreement. Any contracts made by the Vendor with a subcontractor shall include an affirmative statement that the State is an intended third party beneficiary of the Agreement; that the subcontractor has no agreement with the State; and that the State shall be indemnified by the Vendor for any claim presented by the subcontractor.

Notwithstanding any other term herein, Vendor shall timely exercise its contractual remedies against any non-performing subcontractor and, when appropriate, substitute another subcontractor."

Reference:

Section 3.4 item

Does UNC envision one statewide discovery and transfer-planning experience with institution-specific branding, separate institution-branded deployments, or both? Please identify who will supply and approve branding assets, navigation, institutional descriptions, and required disclosures. How should institutional attribution appear when information is delivered through external advising applications or AI assistants used by prospective and enrolled learners?

This remains an open question without having a defined plan and partner. All branding resources that are necessary will be available and there is a long history of the UNC System Office co-branding initiatives with our universities. The primary focus is on a set of tools that will serve transfer students and institutions--the best way to present that and create that is a key element of this

RFP.

Reference:

Sections 2.3 and

3.4 items 3 through 5;

Section 3.5 item

Please clarify whether the required student experience is limited to discovery, comparison, and transfer planning, or also includes application handoff, enrollment requests, course registration, or other transactions. What institution, program, course, and pathway information must be available for comparison during the initial contract term? Should the solution also support exploration of career goals and connect those goals to relevant programs, credentials, and learning pathways, or should this be proposed as an optional capability?

The more information housed in one place for students is usually the best option (streamlined approach for students). The primary focus of this project is transfer planning, as mentioned in the question, but if more uses could be included in a single tool, we imagine that could streamline processes for students, families, and institutions. We would hope that in transfer planning, identifying course transfer equivalencies and how those fit into degree programs at different institutions is key. Not just identifying how credits should transfer but how they transfer--how can they help students make progress towards a degree. There are a number of lists in section 2.3 identifying key items we want to see included in the proposals.

Reference:

Sections 3.3.6 and 3.5 items 1, 2, and 5

What authoritative content will UNC and participating institutions provide for discovery and planning, including program descriptions, course descriptions, requirements, equivalencies, agreements, costs, delivery methods, and admissions information where applicable? Is there a centralized, normalized source, or must information

There are a number of centralized resources at the UNC System Office, but it is the idea of our office that the most accurate source of information would be the individual institutions. Solutions that integrate with existing campus degree audit, course catalog, and student information systems are of significant interest. Solutions should include how to connect various data systems (as mentioned in section 2.3--interconnected and interoperable data systems).

be collected from institution-maintained sources? Please distinguish vendor responsibilities for importing and normalizing existing content from responsibilities for creating missing content, and identify institutional approval, publication, update, and conflict-resolution responsibilities.

Reference:

Sections 2.1, 2.3, 2.4, and 3.3.2

What minimum institutional participation, content coverage, and functionality must be operational at initial launch and by the end of the first contract year? Will UNC accept staged implementation, beginning with selected institutions and validated content, followed by additional institutions, integrations, and service channels? Please identify required acceptance milestones, institutional readiness requirements, and how delays in institutional data access or approval will affect delivery expectations.

There is no minimum number of institutions required--the solution should work across institutions to show interoperability with thoughts of how to expand to additional universities and community colleges.

Reference:

Sections 3.3.2, 3.3.4, and 3.5 items 4, 9, and

May vendors propose a shared service architecture that supports the required web and mobile experience while also making approved discovery, equivalency, and transfer-planning functions available to authorized advising applications and AI assistants through documented APIs or standards such as the Model Context Protocol? Should such access be included in initial delivery, proposed as a separately priced pilot, or addressed in the solution roadmap?

Vendors may propose any solution that they feel addresses our primary areas of concern. That may be part of year 1 or included as part of a future roadmap.

Reference:

Sections 2.3, 3.3.3, and 3.5 item 15

Would UNC permit approved public institution, program, course, and equivalency information to be accessed without a student account, while requiring appropriate

If there is a way to allow students to create an account and identify how credits transfer prior to application (to assist with the decision-making process), this would be ideal.

identity, consent, and authorization for personalized academic records and actions? Please identify restrictions on transmitting public information or protected student information to external AI services, including requirements concerning retention, model training, and the applicable security boundary.

Reference:

Sections 3.4 item 4 and 3.5 items 1, 2, 9, and 15

For automated or AI-assisted guidance, what requirements should apply to source attribution, catalog year, effective dates, explanation of conditions, and identification of preliminary results? Which functions may support exploration automatically, and which require student confirmation or institutional review, particularly for credit petitions, credit awards, applications, and enrollment?

What handoff to institutional advisors or other authorized staff must be supported?

It would be highly functional to be able to incorporate any information in course catalogs detailing awarding of credit, applications, and enrollment. If there are limits to various "what if" scenarios due to campus rules/requirements, those are expected.

There should be the ability to explore as well as receive definitive answers regarding transferability and applicability of credit--this includes nuances and guarantees available in articulation agreements, admissions requirements, major requirements, and appropriate disclaimers as needed (ie, recognizing that credits would only transfer upon acceptance to the university/program)

Reference:

Sections 3.3.8 and 3.5 item 13

Which languages and translation approval processes are required for the student experience? Where an approved external advising application or AI assistant presents the solution’s information, how should accessibility, language support, institutional attribution, and testing responsibilities be divided between the vendor’s services and the external host? Please identify which requirements must be satisfied at launch and which may be addressed through phased delivery.

We ask all vendors to present solutions that are aligned with NC procurement guidelines.

Reference:

Sections 3.3.4, 3.3.6, and 3.5 items 5 and 14

What rights and obligations will govern reuse of normalized institutional content, approved transfer rules, and planning results across the statewide portal, institution-branded

If the question is what information must be retained after providing transfer options and course equivalency information, then the response is that it is anticipated that this is a dynamic solution, not requiring exports for record keeping, but would save sessions and information relevant to each user. No reporting back to the institution of identified equivalencies is necessary, as it is hoped this information will be pulled directly from the institution's experiences, and authorized advising services? Must these resources remain available through documented interfaces and export formats for continued institutional use or transition to another provider? Please distinguish rights in institution-supplied content from rights in vendor-developed software and services.

data systems and not created externally.

Reference:

Sections 2.3, 3.3.4, and 3.5 items 1, 2, 6, and 14

Does UNC require program applicability determinations and petitions for transfer credit or advanced standing to be processed within each institution’s existing systems, or will UNC consider a shared service that models applicability and manages submission, routing, review, and approval of credit petitions across participating institutions? Could this service use institution-approved rules and program requirements, with decisions retained under the receiving institution’s authority, as an alternative or complement to existing degree audit and petition systems? Where institutions have different systems or lack such capabilities, will adoption of the selected workflow be mandatory, voluntary, or determined institution by institution?

The UNC System does not view an entirely new system, built and operated outside of existing software, as an ideal way to solve the transfer planning and applicability problem. Reviews of proposals will consider the additional effort that will be placed on institutions to participate in a new system.

Reference:

Sections 2.3 and

3.5 items 10, 11, and 15

When a prospective transfer student has received an offer of admission or a preliminary transfer credit evaluation, may an authenticated academic record obtained directly from the sending institution through an approved electronic exchange satisfy the receiving institution’s official transcript requirement and support final credit evaluation and posting, without separate paper or PDF receipt, sorting, and ingestion? Please identify requirements for source

There currently is a unified digital transcript in production for the entire public postsecondary and K12 systems, which could theoretically feed digital transcripts. That is not completed and the launch date is unknown. It is best for proposals to consider best practices for support transcript migration to student information systems.

authentication, completeness, final grades or degree confirmation, reconciliation with the prior offer or evaluation, and circumstances in which a separate transcript would still be required.

Reference:

Sections 2.3, 3.4 items 3 through 5, and 3.5 items 3, 9, and 14

Is the required planning population limited to students transferring among participating postsecondary institutions, or should it also include high school students, including dual-enrollment students, and learners at vocational or technical institutions pursuing career pathways, 2+2 pathways, or other agreements with four-year partners? Should these learners access the student-facing portal through institutional single sign-on where available, with an alternative access method for those without a participating institutional account?

Beyond guidance, agreement transparency, and transferability and applicability checking, should the experience connect learners to institutional registration systems for courses that fulfill outstanding academic plan requirements? Please clarify whether the scope includes registration links only, authenticated handoff with relevant course or plan context, or direct registration transactions, and whether registration status must be returned to update the learner’s plan.

It is recommended to provide solutions that can access college credit earned in a variety of settings. If dual enrolled high school students earn credits at community college, those should be available. Any credits that can be included in student information systems should be accessible.

Reference:

Sections 3.3.4 and 3.5 items 2, 4, 9, and 14

Does UNC envision transfer guidance being available only through a dedicated portal, or should vendors also propose embeddable widgets or components that augment existing institutional catalog, program, course, and admissions pages? Such

Without identifying a specific solution with specific functionalities, it is difficult to reject or embrace different ideas. In theory, it seems as though one central location for information would be helpful for many students (as they are choosing between institutions) but having the ability to house the solution on individual websites also seems important (if a student only has one institution in mind). We will consider all ideas about organizing and presenting this information, with the focus being on simplifying the student experience.

components could help prospective learners check transferability and program applicability, understand the source and certainty of a result, and continue into planning or advising while browsing institutional content.

Would UNC consider a reusable integration approach that connects these existing pages and platforms to shared transfer and planning services, reducing the need for institutions to duplicate content or replace their current websites? Please clarify whether this capability should be included in the initial scope or offered as an option, and identify responsibilities for deployment across large institutional websites, branding, accessibility, content updates, and communication of preliminary versus institution-approved results.

Section 3.5 Business and Technical Specifications

In which systems are the requirements for these credentials maintained? Are they stored in institutional degree audit systems or in separate databases or tools?

Please identify the systems used.

They are housed in existing degree audit systems.

Section 3.5 Business and Technical Specifications

In which systems do participating institutions maintain student academic records, course equivalencies, and transfer-credit information? Please identify the student information systems and any other relevant systems used.

Across 74 public institutions (58 community colleges and 16 universities), there are a variety of systems used. Between them all, there are instances of Colleague, Banner, and PeopleSoft.

Numerous degree audit software are supported, but we do not maintain a centralized list. Part of this process will be the catalog the different software utilized and how to read in the key information.

Section 3.5 Business and Technical Specifications

Are these data maintained centrally or separately by each institution? To what extent are data structures and formats standardized across participating institutions?

The key transfer information is housed at each institution.

Section 3.5 Business and Technical

Will the UNC System Office centrally manage implementation and

A final decision has not been made, but the vision is to have a statewide transfer ecosystem, which would require some centralized coordination along with connecting with individual

Specifications coordination, or will each participating institution manage its own integration activities? Please clarify the anticipated division of responsibilities.

institutions to manage integration.

6.2.3 Vendor

Errata and Exceptions

Would UNC System allow a vendor, in lieu of submitting a detailed redline or list of exceptions with its proposal, to include a letter proposing that the parties negotiate mutually acceptable contract terms if the vendor is selected for award and before the contract is executed?

No. Vendors must identify each requested exception and provide the required detailed redline and/or exception list with their proposal, as required by Section 6.2.3. A general letter proposing later negotiation does not identify the requested changes and will not substitute for the required submission. The University may negotiate with the selected vendor; however, that possibility does not waive the RFP requirement or constitute acceptance of unidentified exceptions.

Section 3.2.2, Security Specifications (page 7)

Section 3.2.2 establishes a GovRAMP verified status requirement and, at subsection (e), provides that a FedRAMP Rev. 5 authorization may be accepted in lieu of GovRAMP.

(a) Does the University intend to apply the GovRAMP requirement as stated, or will the University evaluate a Vendor's security posture against equivalent state-level authorization programs in its discretion?

(b) Will the University accept a current TX-RAMP certification, SOC 2 Type II, and ISO27001 certification, either in lieu of GovRAMP or as evidence of security maturity during the interim period described in Section 3.2.2(d)

Addendum 02 will not require GovRAMP, so an equivalency determination among state authorization programs is not necessary. As noted above, a current SOC 2 Type II report or ISO 27001 certification is acceptable independent assurance evidence for the University’s review. A current FedRAMP authorization or HITRUST certification is also acceptable. A TX- RAMP certification may be submitted as supplemental information, but TX-RAMP alone is not an automatic substitute for the recognized independent assurance evidence or for the University’s risk review.

Attachment G, References (page 42)

Attachment G, References (page 42) - requires three references of customers utilizing the proposed solution "fully implemented in a setting similar to this solicitation's scope of work." Statewide credit transfer technology is an emerging product category, and the number of fully implemented deployments available

Agreed that this is an emerging technology solution and in early stages of implementation and adoption. Please provide references that speak to the vendor's solutions in the areas relevant to this proposal. If there is no currently-existing solution, references speaking to the ability to create such a solution is sufficient. If a solution does currently exist but is in early stages of adoption, references speaking to the experience of the existing solution's integration will be particularly helpful.

addressing the full scope in the vendor community is limited.

(a) Will the University accept a reference where the solution is deployed and operational in a non-production environment

— for example, a completed pilot or proof of concept — provided the Vendor clearly identifies the deployment stage?

(b) Alternatively, will the University accept fewer than three references where a Vendor provides at least two implementations that align and address this solicitation's full scope in institution type, sector, and functionality?

(c) For purposes of evaluating references under Attachment G and Section 5.2 criterion 7, how will the University assess a reference implementation that addresses only a portion of the functionality described in Section 2.3, as compared with one addressing the full scope?

Attachment D (Cost Form)

Attachment D (Cost Form) -the page is blank in the issued RFP. Will the University provide a cost form template or should the Vendor provide their pricing in their own format? (§4.1)

Vendors should provide pricing in their own formats.

Attachment H

Attachment H is to be submitted as an Excel file.

Where can we obtain the Excel file? (§7.2)

Please disregard Attachment H and substitute the Certification of Financial Condition available at https://www.doa.nc.gov/pandc/onlineforms/pc-certification-financial-condition-92021-pdf/open in place of Attachment H.

Section 3.3.8 - Accessibility

Section 3.3.8 - Accessibility – this section references Web Content Accessibility Guidelines 2.1, while Section

3.5 Question 13 specifies

Web Content Accessibility Guidelines 2.2. Can you confirm the applicable WCAG version and required conformance level that will

The University will amend the RFP via Addendum 02 to clarify that WCAG 2.2 Level AA governs proposal evaluation and contract performance. The Section 3.3.8 reference to WCAG 2.1 is superseded by this clarification.

govern the proposal evaluation and contract performance.

Section 2.1; 2.3;

2.4

Is the base year intended as a pilot with a named set of UNC institutions and community colleges, or as a go-live across all 17 constituent institutions plus community colleges and independent institutions? A one-year term cannot honestly cover the full ecosystem.

The base year is a starting point, with statewide implementation being a longer-term process. Expanding on current initiatives or starting from scratch should be addressed by the vendor (speaks to the overall project possibility as well as what can be accomplished in year 1).

Section 2.3;

3.4.1; 3.5.1

Which student information systems and degree-audit products must the Year-1 connector support (Banner, Colleague, PeopleSoft Campus Solutions, Degree Works, or others)? Will the System Office name the pilot campuses before award?

Across 74 public institutions (58 community colleges and 16 universities), there are a variety of systems used. Between them all, there are instances of Colleague, Banner, and PeopleSoft.

Numerous degree audit software are supported, but we do not maintain a centralized list. Part of this process will be the catalog the different software utilized and how to read in the key information. Participating pilot institutions will not be fully selected before identifying the vendor.

Section 2.3;

3.4.1; 3.5.1

The RFP asks for electronic return of university credit to the community college without a fresh official-transcript request. Is an existing data-sharing agreement in place for that, or is the awarded vendor expected to operate only after the System and the colleges execute one?

There is an existing agreement between UNC System universities and NC community colleges regarding data exchanges related to the Reverse Transfer program.

Section 3.5.1

Are these available to the awarded vendor as an API or file in the first 60 days, and who is the owner we would integrate with?

The University is unable to understand what this question is asking.

Section 3.2.2

Will a GovRAMP Security Snapshot Score at submission, plus that 15-month commitment, be treated as responsive?

No. Due to the amended requirements supplanting GovRAMP requirements, the Security Snapshot Score and related GovRAMP requirements do not apply, but in reference to the question, no, a commitment alone does not replace the required review and approval process. A vendor’s security evidence will instead be reviewed under the University’s current risk-based process. A vendor that lacks current recognized independent assurance evidence noted previously in this document, or whose evidence contains material unresolved findings, may be asked to provide additional security evidence and may be considered only through the University’s documented conditional-approval process.

Section 3.2.1;

3.2.2; 3.5.1

Is a vendor-operated US-region SaaS acceptable, or must the workload run in a UNC-controlled account?

A vendor-operated SaaS solution in a U.S. region is acceptable.

The current TPRM requirements do not require the workload to operate in a UNC-controlled account. The University will review the service’s hosting and processing location, data flow, integrations, access model, subcontractor use, and proposed contractual protections as part of the vendor review. Any specific data residency or architecture requirements stated elsewhere in the solicitation remain applicable.

Section 2.1; 2.3;

4.1

Roughly how many transfer evaluations and reverse-transfer candidates a year should pricing assume?

This will vary based on the current number of transfer applications and admissions, as well as the hope that transfer interest will expand. Please visit the UNC System data dashboards to review total applications, admissions, and enrollment figures.

Section 4.1 Attachment D was blank. How shall a vendor lay out the cost matrix?

Vendors should provide pricing in their own formats.

Section 2.6; 2.3

Concerning partial, progressive, or multiple awards, should vendors price the three needs separately so the System can award evaluation, planning, and reverse transfer independently?

Vendors may present costs any way that seems appropriate for their solution. This includes providing proposals for individual solutions. If one product addresses multiple needs, prices can be presented in whatever way makes the most sense for the vendor.

Reference:

Section 3.4 item

Reference: Section 3.4 item 2 Does UNC envision one statewide discovery and transfer-planning experience with institution-specific branding, separate institution-branded deployments, or both? Please identify who will supply and approve branding assets, navigation, institutional descriptions, and required disclosures. How should institutional attribution appear when information is delivered through external advising applications or AI assistants used by prospective and enrolled learners?

see previous response

Reference:

Sections 2.3 and

3.4 items 3 through 5;

Section 3.5 item

Please clarify whether the required student experience is limited to discovery, comparison, and transfer planning, or also includes application handoff, enrollment requests, course registration, or other transactions. What institution, program, course, and pathway information must be available for comparison during the initial contract term? Should the solution also support exploration of career goals and connect those see previous response goals to relevant programs, credentials, and learning pathways, or should this be proposed as an optional capability?

Reference:

Sections 2.3; 3.4 item 1; 3.5 items 7, 10, and 11

Please describe the current reverse-transfer process and the future-state operating model UNC expects the selected solution to support.

Specifically, please identify participating institutions and systems, annual or anticipated transaction volumes, student-matching method, current data-exchange mechanism, current manual steps, credential-evaluation process, data/consent prerequisites, and the intended roles of UNC institutions and North Carolina Community Colleges in reviewing, posting, notifying, and awarding credentials.

Please review existing information regarding North Carolina's reverse transfer program. Begin here:

https://www.northcarolina.edu/students/transfer/NCCCS/#reverse

Reference:

Sections 5.1–5.3

Please describe the anticipated functional representation on the evaluation committee and in any interview, presentation, demonstration, security review, or final-selection process.

There will be members of UNC System Office teams from Academic Affairs, Strategy and Policy, and Digital Transformation (including AI and IT). A colleague from the NC Community College system office will also be a member.

Are the five Section 3.4.1 Yes/No requirements scored pass/fail, or weighted within “conformance with the specifications”?

These will be scored pass/fail for this section, but that does not automatically eliminate any vendor. These are key requirements as we have identified them and hope that the solutions presented will address most, if not all, of the requirements.

Can you please confirm the requirement of GovRAMP? Refer to Addendum 02.

Section 3.2.2(d): For a vendor without a verified GovRAMP status at submission, will proof of GovRAMP membership and enrollment in the Progressing Security Snapshot program, with the Snapshot Score pending and provided once issued, satisfy the security requirement for responsiveness? Will a current TX-RAMP Level 2 certification and a SOC 2

GovRAMP membership, enrollment, and a pending Security Snapshot Score are not requirements of the amended solicitation and do not substitute for the University’s review. A current SOC 2 Type II report is acceptable independent assurance evidence.

TX-RAMP Level 2 may be submitted as supplemental information. Vendors should identify their security contact and be prepared to provide secure access to the current report and any additional evidence requested during evaluation.

https://www.northcarolina.edu/students/transfer/NCCCS/#reverse

Type II report be accepted as supplementary evidence?

Section 6.3.2(c) requests a Security Vendor Readiness Assessment Report (VRAR).

Is a VRAR required at submission for vendors providing a Snapshot Score instead?

No. VRAR will be executed by the UNC System Office. No form is required to be filled out as part of the RFP submission.

What volumes should vendors price against for year one (number of UNC institutions, NC community colleges and private institutions participating; approximate annual transfer transcripts;

expected student users)?

There will be variation during the first year as the project gets started. Vendors are invited to offer pricing based on whatever models they are most comfortable with--ie, institution type/size, FTE, general categories (small, medium, large), etc.

Which student information systems and degree audit systems are in use at the participating institutions (e.g., Banner/Colleague/PeopleSoft;

Degree Works/uAchieve)?

Across 74 public institutions (58 community colleges and 16 universities), there are a variety of systems used. Between them all, there are instances of Colleague, Banner, and PeopleSoft.

Numerous degree audit software are supported, but we do not maintain a centralized list. Part of this process will be the catalog the different software utilized and how to read in the key information.

Is the award expected to include implementation at all 17 constituent institutions within the one-year term, or a pilot subset?

A subset.

Will the State accept milestone-based payments, including a milestone for initial deployment?

Yes

Can the State's license be limited to deliverables built specifically for UNC, excluding the vendor's pre-existing platform?

What are the specifications for the Military Equivalency System and Common Numbering System?

Both systems are built internally at the UNC System Office and pull from a master equivalency table. Ideally, a third equivalency table will not be built but pull information from individual institutional systems. More can be found by looking at https://coursetransfer.northcarolina.edu/index.htm

The RFP specifies a one-year initial term with an optional one-year extension. Can the System clarify whether funding is anticipated for continued use of the solution beyond the initial term, including the optional extension, and how ongoing services would be procured

The hope is that there will be continued funding to launch the solution at institutions and then identify how individual institutions can fund this locally.

and funded after the extension expires?

Section 2.3 permits vendors to respond to one, two, or all three identified needs, while Section 3.4 contains mandatory requirements spanning multiple needs.

Please confirm whether an offer limited to one need can be responsive and explain how mandatory requirements, evaluation, and pricing will be applied to partial or multiple awards.

This RFP searches for multiple solutions, ideally in one overall package. If all solutions are not available in one overall package, then pricing will be discussed to break the work into different parts (as appropriate). Success and streamlined integration are key factors, but if the ideal solution does not exist, the UNC System Office will explore alternatives.

Please provide the anticipated phase-one participating institutions and an inventory of their student information systems, degree-audit systems, identity providers, transcript services, and available integration methods, including supported APIs, PESC exchanges, batch interfaces, and institution-specific constraints.

Across 74 public institutions (58 community colleges and 16 universities), there are a variety of systems used. Between them all, there are instances of Colleague, Banner, and PeopleSoft.

Numerous degree audit software are supported, but we do not maintain a centralized list. Part of this process will be the catalog

Please identify the current statewide or institutional transfer-equivalency and reverse-transfer tools, the data available for migration, and estimated volumes for students, transcripts, courses, equivalencies, articulation rules, credentials, and annual transfer evaluations.

Individual institutions are responsible for their own equivalency work, with a few variations existing on:

https://coursetransfer.northcarolina.edu/index.htm. The reverse transfer process is described here:

For a SaaS product that does not hold GovRAMP Ready status at offer submission, what minimum Security Snapshot score or other evidence will UNC consider acceptable, and may the product process Confidential student data after enrollment in the Progressing Snapshot program but before achieving GovRAMP Ready?

Per the amended Section 3.2.2, there is no GovRAMP Security Snapshot score requirement and no GovRAMP Ready requirement. For this solicitation, vendors must make a current SOC 2 Type II report, FedRAMP authorization, HITRUST certification, or ISO 27001 certification available for review, together with any additional information the University requests.

The product may not process Confidential student data, or the Restricted data identified for this solicitation, until the required security review, approval, contract terms, and onboarding controls are complete, or a documented and time-limited risk acceptance has been approved.

Please provide the desired pilot and production dates, expected rollout sequence, and measurable acceptance criteria for the deliverables

The timeline for rollout will follow the timeline in the RFP. (section 2.4). We anticipate asking for an extended funding window (no more than a few months) in order to fulfill the legislative requirements of the bill. The UNC System Office retains the option to extend the agreement for one additional year. The initial https://coursetransfer.northcarolina.edu/index.htm.

upon which payments will be based, including whether UNC expects all participating institutions to be operational during the one-year base term.

work as well as a plan to expand should be completed within the original 12 month contract period. Specific milestone payments or other payment structures will be detailed during the contracting process.

Section 2.3 invites vendors to respond to one, two, or all three of the named needs, and Section 2.6 reserves the right to make partial or multiple awards. Section 3.4.1, Requirement 1, combines transfer credit evaluation, degree audit integration, and reverse transfer identification in a single Yes/No item. May a vendor respond to Needs 1 and 2 only, answer No to the reverse transfer element of Requirement 1, and remain responsive for evaluation?

Which institutions are committed to participate at contract start, which are optional, and is pricing expected per institution, per system, or both?

Institutions are interested but not committed yet because there is no selected vendor yet upon which to decide. Prices may be per institution or per system, whatever makes sense for the vendor's business model.

Which student information system and degree audit system does each participating institution run, and will the University provide a central data source or one connection per institution?

Across 74 public institutions (58 community colleges and 16 universities), there are a variety of systems used. Between them all, there are instances of Colleague, Banner, and PeopleSoft.

Numerous degree audit software are supported, but we do not maintain a centralized list. Part of this process will be the catalog

Is a phased rollout by institution acceptable within the one-year term, and who determines the rollout order?

The UNC System Office and NC Community College System Office will work together to identify UNC universities and potential community college participants. A phased rollout is to be expected based on variations in preparedness and availability.

Section 3.2.2(d) requires a GovRAMP Security Snapshot score at offer submission. If a vendor has initiated the Snapshot process but the score has not been issued by October 14, will the University accept the score prior to award?

Per the amended Section 3.2.2, a GovRAMP Snapshot Score is not required. Vendors should respond to the amended security requirement and make current independent assurance evidence available through a secure review method when requested. If a current qualifying report has recently expired but had no material findings and a new assessment is underway, the University requires a bridge letter accompanying the most recent qualifying report and establish conditions for review of the completed current report.

Please confirm the GovRAMP status the University requires for this solution (Core, Ready, or Authorized) and the date by which it must be achieved, Per the amended Section 3.2.2, no GovRAMP status or GovRAMP deadline applies. The solicitation identifies Restricted data as the highest data classification; therefore, the University will apply the highest applicable review path. The University’s required security review and approval must be complete before given the Confidential data classification and the interim periods described in Section 3.2.2.

contract execution, production access, or protected data processing.

Attachment G requests three references with the proposed solution fully implemented in a setting similar to this solicitation's scope. Will references from single-institution implementations of the proposed functionality be accepted?

Section 5.2 lists the evaluation criteria. Will the University share the relative weights, or confirm whether cost is scored on the full-term total or on each cost form line?

The evaluation criteria are not weighted. The evaluation will be to determine the best value to the University. Per N.C.G.S. 143- 135.9(a)(1), Best Value procurement is defined as, " The selection of a contractor based on a determination of which proposal offers the best trade-off between price and performance, where quality is considered an integral performance factor. The award decision is made based on multiple factors, including: total cost of ownership, meaning the cost of acquiring, operating, maintaining, and supporting a product or service over its projected lifetime; the evaluated technical merit of the vendor's proposal; the vendor's past performance; and the evaluated probability of performing the requirements stated in the solicitation on time, with high quality, and in a manner that accomplishes the stated business objectives and maintains industry standards compliance."

May a vendor submit more than one pricing option within a single response, for example a phased implementation and an accelerated one?

May vendors submit exceptions to Attachment B with the offer, on the separate page described in Section 6.2.3, without the offer being deemed non-responsive?

Vendors may identify each requested exception and provide the required detailed redline and/or exception list with their proposal, as required by Section 6.2.3.

Section 3.5, Item 12, references the Military Equivalency System and Common Numbering System.

Will the University provide technical documentation or data specifications for these systems to the awarded vendor, or are they available to vendors during the response period?

Information will be provided after the award. General information on both can be found here:

Attachment D, Cost Form (page 38), appears blank in the posted solicitation. Is

Vendors should provide pricing in their own formats.

there a separate cost form vendors should use? If not, may vendors present costs in their own format, following Section 4.0?

Attachment H, Financial Review Form, asks vendors to submit the completed form as an Excel file without adding or deleting rows. We could not find the Excel file on eVP.

Could you share it, or confirm where it is posted?

Please disregard Attachment H and substitute the Certification of Financial Condition available at https://www.doa.nc.gov/pandc/onlineforms/pc-certification-financial-condition-92021-pdf/open in place of Attachment H.

Section 6.3.2(c) lists a

Assessment Report (VRAR) among the required offer documents, while Section

3.2.2 describes the GovRAMP Security Snapshot submission. Is a separate VRAR required in addition to the Snapshot score? If so, could you please provide the current template and instructions?

Vendors are not required to complete or submit the State of NC Department of Information Technology’s VRAR template. The UNC System Office will prepare its own Vendor Risk Assessment Report after it reviews the vendor’s information and evidence, for internal use only. Section 6.3.2 is amended to require vendors to identify a security contact and secure access to the evidence needed for the University’s review. Please see other responses to similar questions above.

Section 2.3 invites vendors to respond to one, two, or all three needs, while Section

3.1.1 states that an offer that cannot meet the Requirements will not be evaluated and Section 3.4.1 lists five Requirements as YES/NO. If a vendor responds to only one or two of the three needs, will a "No" on a Requirement tied to an unaddressed need render the entire offer non-responsive, or will partial offers be evaluated on the needs they address?

Partial offers will be reviewed

Which institutions are in scope at contract start: all 17 UNC universities, all North Carolina community colleges,…