Attachment 14.6 - Vendor Compliance and Security Checklist.docx

Vendor Compliance and Security Requirements SUNY Potsdam Attachment 14.6 - Vendor Compliance and Security Checklist

1. Purpose SUNY Potsdam is a public higher education organization that processes and stores sensitive information, including but not limited to student records, financial information, payment card data, employee information, research data, and protected health information. As part of the procurement process, all bidders must demonstrate compliance with applicable federal, state, security, privacy, and procurement requirements.

Failure to provide the requested documentation may result in disqualification from consideration.

2. Supply Chain and Trade Compliance

2.1 NDAA Compliance

The Bidder shall certify compliance with Section 889 of the National Defense Authorization Act (NDAA), including Parts A and B, and shall attest that prohibited telecommunications equipment and services are not used in the performance of the contract.

Required Documentation

· Signed NDAA Section 889 Compliance Certification

· Country of origin information for applicable products

2.2 Trade Agreements Act (TAA) Compliance

Where applicable, products and services offered under this procurement shall comply with the Trade Agreements Act (TAA).

Required Documentation

· TAA Compliance Certification

· Country of origin information for applicable products

· Manufacturer certifications, if applicable

3. Information Security Requirements The Bidder shall maintain a formal information security program aligned with recognized industry standards.

Acceptable frameworks include:

· NIST Cybersecurity Framework (CSF)

· NIST SP 800-53

· ISO/IEC 27001

· CIS Critical Security Controls Required Documentation

· Information Security Policy Summary

· Security Architecture Overview

· Vulnerability Management Overview

· Incident Response Plan Summary

· Business Continuity and Disaster Recovery Overview

4. Security Assessment Documentation

4.1 HECVAT

Because SUNY Potsdam is a higher education organization, completion of the Higher Education Community Vendor Assessment Toolkit (HECVAT) is preferred.

Documentation requirements:

· Current HECVAT (Full, Lite, or On-Premise version as applicable)

· Completed by the Bidder and signed by an authorized representative

4.2 SOC Reports

The Bidder shall provide independent third-party assurance reports.

Required Documentation One of the following:

· SOC 2 Type II Report (preferred)

· SOC 2 Type I Report (if Type II is unavailable)

· SOC 1 Type II Report (where financial processing functions are provided) If a report contains exceptions or qualified findings, the Bidder shall provide:

· Management response

· Remediation plan

· Current status of remediation efforts

5. Privacy Requirements The Bidder shall comply with all privacy laws applicable to the services being provided.

Depending on the nature of the services, applicable requirements may include:

· FERPA

· HIPAA

· GLBA

· State privacy laws

· State breach notification requirements Required Documentation

· Data Privacy Policy

· Data Retention and Disposal Policy

· Data Classification Policy

· Description of privacy governance practices

6. Student Data Protection Where student information is collected, transmitted, stored, or processed, the Bidder shall protect educational records and personally identifiable information (PII).

Required Documentation

· FERPA compliance statement

· Description of controls protecting student records

7. Health Information Protection Where protected health information (PHI) may be accessed, stored, or processed, the Bidder shall maintain safeguards consistent with HIPAA requirements.

Required Documentation

· HIPAA compliance statement

· HIPAA Security Rule controls overview

8. Financial and Payment Security Where payment card data, financial information, banking information, or financial transactions are involved, the Bidder shall maintain appropriate controls to protect such information.

Required Documentation As applicable:

· PCI DSS Attestation of Compliance (AOC)

· PCI DSS Report on Compliance (ROC), if available

· Description of financial data protection controls

9. Cloud and Hosting Providers The Bidder shall identify all cloud providers, hosting providers, subcontractors, and third-party service providers involved in delivering the proposed solution.

Required Documentation

· List of all subcontractors and service providers with access to institutional data

· Data hosting locations

· Description of third-party risk management practices

10. Incident Reporting The Bidder shall notify the Institution of any actual or suspected security incident involving Institutional data without unreasonable delay and no later than the notification period specified in the final contract.

Required Documentation

· Incident Response Policy

· Breach Notification Procedures

· Designated Security Contact Information

11. Submission Checklist Bidders shall provide the following documentation, whichever is applicable:

☐ NDAA Section 889 Certification ☐ TAA Compliance Certification ☐ Current HECVAT ☐ SOC 2 Type II Report (or equivalent) ☐ Penetration Test Executive Summary ☐ Information Security Policies ☐ Incident Response Summary ☐ Business Continuity and Disaster Recovery Summary ☐ FERPA Compliance Statement ☐ HIPAA Compliance Statement ☐ PCI DSS Documentation ☐ Data Privacy Documentation ☐ List of Subcontractors and Third Parties ☐ Any Additional Exceptions or Compliance Disclosures

12. Reservation of Rights The Institution reserves the right to:

· Request additional documentation or evidence of compliance.

· Conduct follow-up security and privacy reviews.

· Require remediation of identified deficiencies prior to contract award.

· Reject proposals that fail to meet minimum compliance, security, privacy, legal, or procurement requirements.