Nassau Community College Request for Proposal – R27-002 Managed Governance, Risk, Compliance and Cybersecurity Program Management Services

REQUEST FOR PROPOSALS (RFP)

FOR

MANAGED GOVERNANCE, RISK, COMPLIANCE

AND CYBERSECURITY PROGRAM MANAGEMENT SERVICES

NASSAU COMMUNITY COLLEGE

ONE EDUCATION DRIVE

GARDEN CITY, NY 11530

PROPOSAL DUE DATE – OCTOBER 27, 2026 NO LATER THAN 12:00 PM

FOR ADDITIONAL INFORMATION, CONTACT:

YVONNE SLOMA

TECHNICAL COORDINATOR

YVONNE.SLOMA@NCC.EDU

Procurement Office

One Education Drive Garden City, New York 11530-6793

SECTION 1

ADMINISTRATIVE INFORMATION

1. INTRODUCTION:

Nassau Community College ("College") seeks a qualified cybersecurity services partner to provide comprehensive Governance, Risk, Compliance ("GRC"), and Cybersecurity Program Management Services.

The College does not maintain a dedicated full-time Chief Information Security Officer and seeks a strategic partner that can provide both virtual Chief Information Security Officer ("vCISO") services and active program management support.

The selected firm shall serve as an extension of the College's Information Technology organization and work under the direction of the Associate Vice President of Information Technology Services. Services shall extend beyond advisory recommendations and include planning, coordination, documentation development, facilitation, risk management, compliance management, governance support, and execution oversight necessary to mature the College's cybersecurity program.

The College seeks a managed security governance model in which the selected firm actively drives cybersecurity initiatives, coordinates stakeholders, maintains security program documentation, tracks remediation efforts, and drives measurable improvements in cybersecurity maturity in collaboration with the College.

2. BACKGROUND INFORMATION:

Nassau Community College, a constituent member of the State University of New York system, is a comprehensive, full-opportunity institution of higher education. All who can benefit from its resources have the opportunity to expand their knowledge and skills and to pursue the goal of lifelong learning.

The College is dedicated to high-quality academics and student support services at an affordable tuition to meet the needs and interests of the Counties (primarily Nassau County) communities it serves. It is committed to and equity-minded approach to advancing student access, completion and post completion success. To this end, Nassau Community College offers Associate in Arts, Associate in Science, and Associate in Applied Science degrees, as well as Certificate and continuing education programs.

Its curricula span the liberal arts and sciences, as well as pre-professional and professional areas, for the benefit of a diverse population. The College places a high priority on small classes, taught by qualified, experienced faculty, to provide an optimal educational environment.

3. COORDINATING DEPARTMENT:

The College’s Procurement Office (contact listed below) is responsible for coordinating the issuance of the RFP. The contact for this RFP is:

Contact: Yvonne Sloma Technical Coordinator, Procurement Office One Education Drive Garden City, NY 11530 Yvonne.Sloma@ncc.edu

All communications during the RFP process shall be directed to the Procurement Office.

Communication with any other College employee or any incumbent company for the good or services being procured pursuant to this RFP may be cause for disqualification form the RFP process.

The College shall not be responsible for any oral instructions made by any employees or officers of the College regarding this RFP. Any changes to the RFP instructions, requirements, or scope of services shall be in the form of a written amendment, which will be furnished to all Proposers who are listed with the College as having received the Solicitation, and to any other Proposer who requests any of the RFP documents.

4. RFP DEADLINES:

i. Administrative Questions shall be submitted via email to the Contact identified in Paragraph 3. Coordinating Department above. The deadline for submission of Technical Questions is October 14, 2026 at 12:00 PM. The College will develop responses to the technical questions. Responses will be issued by the College in the form of an Addendum to this RFP.

ii. Proposers’ Conference: None scheduled.

iii. Proposal Due Date is October 27, 2026 no later than 12:00 PM.

iv. Effective Period of Offer: This offer shall remain in effect for a period of ninety (90) calendar days from the RFP submission date and is irrevocable.

5. SELECTION PROCESS:

The College will evaluate the proposals through a point rating system, set forth below in Paragraph 6. The College may invite Proposers to make presentations to the Evaluation Committee to demonstrate their qualifications and approach to the project. The final selection will represent the best interest of the College.

6. AWARD CRITERIA:

Proposals will be evaluated and ranked based on the award criteria below which is further described in Section 2. Award Criteria:

Criteria Points Minimum Qualifications PASS/FAIL Qualifications, Experience and References 30 Proposed Approach and Methodology 40 Cost Proposal 25 M/WBE Participation 5

7. PROPOSAL SUBMISSION:

i. Number of Copies:

Proposals are accepted electronically. Electronic proposals shall be emailed before the RFP Due Date and Time to the following email address:

Procurement@NCC.edu. When submitting the proposal, please send a separate email to the RFP contact identified in Paragraph 3 above to advise that the proposal has been submitted. If the proposal is being sent electronically via email, paper documents will not be required. Alternatively, Proposers can submit paper proposals. In this case, the College requires one (1) original (Clearly Labeled), plus five (5) copies, of the entire Proposal in a properly labeled and sealed envelope. In addition, the College requires a thumb drive that includes electronic copies of all the documents submitted in the Proposal. Faxed proposals will not be considered.

ii. Proposal Format:

Proposals shall include the information requested below and, in the order listed.

Each section and sub-section must be separated by a cover page that clearly identifies/labels each section. In addition, pages shall be numbered. Proposal shall be signed by an employee of the firm who is authorized to sign the Proposal.

Proposal shall include the necessary information needed to establish the Proposer’s background, expertise, and qualifications to provide the services as set forth in the Scope of Services. Services and cost proposals shall reflect and include the necessary level of effort required to complete all the services outlined in the RFP. It is recommended that Proposer limit its proposal to twenty-five (25) pages, excluding resumes. In case of error in the extension of prices in the cost proposal, the unit price will govern. Periods of time, stated as a number of days, shall be calendar days.

i. Table of Contents: A Proposal Checklist has been provided at the end of this Section One – Administrative Information, to assist with the assembly and ensure completeness of the proposal package. This Proposal Checklist mailto:Procurement@NCC.edu must be included as the first item of the Proposal and used as the only Table of Contents.

ii. Introductory Statement on Company Letterhead: Signed by a corporate office or an authorized agent of the firm.

iii. Technical Proposal:

• Minimum Qualifications

• Qualifications, Experience and References

• Proposed Approach and Methodology

• Cost Proposal

• MWBE

iv. Proposer Certification and Qualification Statement

v. Acknowledgement of Addenda

vi. Comments or proposed changes to the Terms and Conditions or Form of

Contract: A lack of comments will be considered full acceptance of the contract terms on the part of the firm. Proposer should identify any terms and conditions not set forth in the Form of Contract.

Note: Failure to submit any of the required documents may deem the Proposer non-responsive.

8. RFP TERMS AND CONDITIONS:

i. The RFP document and all relevant documentation, including addenda, can be accessed by visiting the College’s website at https://www.ncc.edu/aboutncc/ourpeople/administration/procurement/aspx/Def ault.aspx.

ii. It is the College’s intent to select the Consultant that provides the best solution for the College’s needs.

iii. Reference is made to the Form of Contract attached for the terms and conditions of the agreement to be entered into, including indemnification and insurance.

The Form of Contract is subject to revision arising out of the terms and conditions imposed by law or deemed appropriate by the College.

iv. The RFP and the Consultant’s response to this RFP, as may subsequently be modified in negotiations with the College, may be included as exhibits in any contracts that the College may execute with the Consultant.

https://www.ncc.edu/aboutncc/ourpeople/administration/procurement/aspx/Default.aspx https://www.ncc.edu/aboutncc/ourpeople/administration/procurement/aspx/Default.aspx

v. The College reserves the right to amend this RFP, to reject any or all of the proposals or any part thereof, submitted in response to this RFP, and reserves the right to waive informalities, if such action is deemed to be in the best interest of the College. The College reserves the right to request additional information from any Proposer. The submission of a proposal gives permission to the College and to its consultants to make inquiries concerning the Contractor and its principals, officers and directors to any persons or firms the College deems appropriate.

vi. The College reserves the right to award negotiated contracts to one or more

Consultants.

vii. This RFP is not intended and shall not be construed to commit the College to pay any costs incurred in connection with any proposal or to procure or contract for any services.

viii. The decision to award a contract shall be based on Proposer’s ability to provide quality services and products and to comply with all applicable laws, rules and regulations. The Proposer’s products, services and facilities shall be in full compliance with all applicable Federal, State and local health, environmental and safety laws, regulations, standards, and ordinances regardless of whether or not reference is made to same in this RFP.

ix. Prior Proposer performance in regard to product, service, or representation of/from the Proposer may be used in evaluation of this offer. Unsatisfactory performance to the County of Nassau may be considered sufficient grounds for rejection of this offer. No offer will be awarded to any Proposer that is in default on any contract with the County of Nassau.

x. The award of any contract will be made as judged to be in the best interest of the College. The final selection of the Consultant will be made by the College Evaluation Committee.

xi. Each Proposal will be examined to determine whether it is responsive to the requirements of this RFP. All responsive proposals will be evaluated in accordance with the criteria set forth herein.

xii. While the College is under no obligation to contact Proposers for clarification, it reserves the right to do so. Depending on the number and quality of the proposals submitted, the College may elect to interview all or some of the Proposers during the selection process and to request presentations, including demonstrations of products and services. The College’s Procurement Office will be responsible for scheduling presentations with the selected Proposers.

xiii. It is agreed that the Proposer shall be fully responsible for making any correction, replacement, or modification necessary for specification or legal compliance.

xiv. Any agreement entered into is subject to the provisions of Article 18 of the

General Municipal Law and the State of New York, as amended, and section 22-

4.2 of the Administrative Code of Nassau County and the provisions of the Anti- Discrimination Order of Nassau County.

xv. It is expressly understood that the College shall not be construed or be held to be a partner, agent or associated by joint venture or otherwise of contractor in the conduct of its business.

xvi. The Contractor is an independent contractor of the College or County. The

Contractor shall not, nor shall any officer, director, employee, servant, agent or independent contractor of the Contractor (a “Contractor Agent”), be (i) deemed a College or County employee, (ii) commit the College or County to any obligation, or (iii) hold itself, himself, or herself out as a College or County employee or Person with the authority to commit the College or County to any obligation. As used in any Agreement awarded as a result of this RFP, the word “Person” means any individual person, entity (including partnerships, corporations and limited liability companies), and government or political subdivision thereof (including agencies, bureaus, offices and departments thereof).

xvii. Any and all contracts created as a result of this RFP shall be governed by the laws of New York State.

xviii. Contractor warrants that it is not in arrears to Nassau Community College or the County of Nassau upon debt or Contract and is not a defaulter as surety, Contractor or otherwise upon any obligation to Nassau Community College or the County of Nassau.

xix. The attached contract, a generic sample of which is attached to and made part of this RFP (see Attachment “A”, Form of Contract) will represent the total agreement between the College and Contractor. Any exceptions to this agreement must be clearly noted. All terms and conditions included in the “Form of Contract” (see Attachment A) shall also be considered a part of this Request for Proposal.

xx. Failure or delay by the College to exercise any right, power, or privilege shall not be deemed a waiver thereof.

xxi. If a Proposer has any contract documents for the College to sign in order to contract with the College, then Proposer must note same on the proposal return and supply copies of the documents with proposal response so that the College can review same and determine whether the College can accept and sign them.

The College will not view any Proposer’s contracts that are presented after the Request for Proposal opening date and time.

xxii. The College is not committed to assigning any services to the Consultant, and reserves the right to engage the services of other Consultants, if the College feels the circumstances require such action. The College does not guarantee nor will it be obligated under the ensuing contract to spend any amount of money.

xxiii. If payment terms are not indicated, terms of NET 30 days shall be applied by the

College. Payment terms to apply after receipt of invoice or final acceptance of the products/services, whichever is later. The payment terms will be considered in the price evaluation of offers. Payment terms offering less than 20 days for payment will not be considered in the price evaluation of offers.

xxiv. The Contractor and the College recognize that the continuation of any contract after the close of any given fiscal year of the College; which fiscal year ends on August 31, shall be subject to the approval of the budget of the Nassau Community College providing the contract item is an expenditure therein. The College does not guarantee that the budget item will be actually adopted, as it is the determination of the County of Nassau at the time of the adoption of the budget.

xxv. In case of default by the contractor, the College may, by written notice, cancel this contract and repurchase from another source and may recover the excess costs by

(1) deduction from an unpaid balance due; (2) collection against the bid bond; or (3) a combination of the aforementioned remedies or other remedies as provided by law.

xxvi. All materials and documentation developed under this agreement shall be the exclusive property of the College. Should the selected contractor default at any time during the agreement term, all materials and documentation developed under this agreement shall be returned to the College.

xxvii. The New York State Freedom of Information Law (Public Officers Law Article 6) provides for public access to College records. Public Officers Law § 87(2)(d) provides for exceptions to disclosure for records or portions thereof that are “trade secrets or are submitted to an agency by a commercial enterprise or derived from information obtained from a commercial enterprise and which if disclosed would cause substantial injury to the competitive position of the subject enterprise.” Information that the proposer wishes to have treated as proprietary and confidential trade information should be identified and labeled “Confidential” or “Proprietary” on each page at the time of submittal. This information should include a written request to except it from disclosure, including a written statement of the reasons why the information should be excepted.

xxviii. The Contract executed as a result of this RFP may be extended to additional States or Government Jurisdictions upon mutual written agreement between the College and the Consultant. Political Subdivisions and other authorized entities within each participating State or Government Jurisdictions may also participate in this Contract if authorized by applicable law. The College reserves the right to negotiate additional discounts based on any increased volume generated by such extensions. Consultant agrees to honor all orders from State Agencies, Political Subdivisions and others authorized by law to participate in this Contract which are in compliance with the pricing, terms, and conditions contained herein.

xxix. PROPOSER’S SEXUAL HARASSMENT POLICY: By submission of a proposal, each proposer and each person signing on behalf of any proposer certifies, and in the case of a joint proposal submission each party thereto certifies as to its own organization, under penalty of perjury, that the proposer(s) has/have implemented a written policy addressing sexual harassment prevention in the workplace and provides annual sexual harassment prevention training to all of its employees. Such policy shall, at a minimum, meet the requirements of section two hundred one-g of the labor law.

xxx. COLLEGE SEXUAL HARASSMENT POLICY: Proposers are advised that the College’s

Sexual Harassment Policy can be accessed using the following link:

https://www.ncc.edu/aboutncc/ourpeople/board_of_trustees/pdfs/Policy_2200_Sexual_Haras sment_and_Sexual_Violence.pdf

xxxi. DEFINITIONS:

• The term, “County”, as used herein, shall be deemed as reference to the County of Nassau, State of New York.

• The term, “Contractor” or “Consultant”, as used herein, shall be deemed as reference to the successful Proposer, Vendor, Proprietor, Partnership or Corporation receiving an award to perform any or all of the services specified in accordance with the terms of this agreement.

• The term, “College”, as used herein, shall be deemed as reference to Nassau Community College.

https://www.ncc.edu/aboutncc/ourpeople/board_of_trustees/pdfs/Policy_2200_Sexual_Harassment_and_Sexual_Violence.pdf https://www.ncc.edu/aboutncc/ourpeople/board_of_trustees/pdfs/Policy_2200_Sexual_Harassment_and_Sexual_Violence.pdf

• The term, “Director”, as used herein, shall be deemed as reference to the Director of Procurement.

TABLE OF CONTENTS

Note: This form MUST be included in your proposal as the Table of Contents and

PROPOSAL MUST BE SUBMITTED IN THE ORDER LISTED BELOW

Please check if TAB ITEM Included or N/A

1. Table of Contents

2. Introductory Statement

3. Technical Proposal Minimum Qualifications

A. Qualifications, Experience and References of Firm and Proposed Team B. Proposed Approach and Methodology C. Cost Proposal D. M/WBE Participation

4. Proposer Certification and Qualification Statement (Exhibit 1)

5. Acknowledgement of Addenda

6. Comments Regarding RFP Terms and Conditions or Form of Contract

7. Supplemental Information (Optional)

8. Appendix L – Certificate of Compliance

SECTION 2

AWARD CRITERIA

Responses to the items set forth under each of the categories below, will be used by the College’s Evaluation Committee to assess the appropriateness and relevance of the information provided in the proposals and make a recommendation for award. Failure to include information as requested under any of the sub-sections in the Proposal may result in the firm being disqualified. The responses to each of the categories must be separated by clearly labeled tabs into the sections and sub-sections identified below, and reflected in the Table of Contents (form provided in Section One) of the Proposal submitted.

I. Technical Proposal:

Minimum Qualifications – PASS/FAIL Proposers shall demonstrate that they meet the following pass/fail requirements. Failure to meet these minimum qualifications will result in the proposal being deemed non-responsive.

i. Firm must have been providing cybersecurity consulting, virtual Chief Information Security Officer (vCISO), Governance, Risk, and Compliance (GRC), or cybersecurity program management services for a minimum of five (5) years.

ii. Firm must have provided cybersecurity services to at least five (5) institutions of similar size and complexity to the College within the last five (5) years. At least three (3) of these institutions must be public institutions of higher education.

iii. Firm must have experience providing cybersecurity governance, risk management, compliance, or vCISO services to at least three (3) higher education institutions.

iv. Firm must identify a proposed Lead vCISO with a minimum of ten (10) years of cybersecurity experience and at least five (5) years serving in a cybersecurity leadership role.

Section A – Qualifications, Experience and References of Firm and Proposed Team

a. General Information/Company History

i. Company Name, e-mail, main address and all branch office addresses.

ii. Describe the nature of your organization (e.g. corporation, not-for-profit organization, sole proprietorship, etc.). If applicable, identify all principals and the ownership interest of each.

iii. Year Company was founded and brief history.

iv. Total number of employees. Include an organization chart as relevant.

v. Location(s) from which majority of the staff will be providing services.

vi. The general and specific specialties/expertise and overall resources.

b. Expertise of Proposer and all Sub-consultants, including Qualifications and Experience of Personnel

i. Experience: Provide general background information explaining why the firm and any proposed sub-consultants are qualified to perform the services described in this RFP. The response shall describe the firm's relevant experience and resources, with particular emphasis on:

• Managed Governance, Risk, and Compliance (GRC), vCISO, cybersecurity governance, and cybersecurity program management services;

• Experience supporting higher education institutions, particularly public colleges and universities, community colleges, SUNY, CUNY, or other state-supported institutions;

• Experience supporting organizations subject to FERPA, GLBA Safeguards Rule, New York State regulatory requirements, and other applicable cybersecurity or privacy requirements;

• Development and management of cybersecurity governance programs, risk registers, Plans of Action and Milestones (POA&Ms), cybersecurity roadmaps, executive and Board-level reporting, and related program-management activities;

• Development and maintenance of enterprise technology and application inventories, vendor and third-party risk management programs, business continuity and disaster recovery programs, and cybersecurity policies, standards, and procedures;

• NIST Cybersecurity Framework (CSF) assessments and cybersecurity maturity improvement initiatives; and

• Cybersecurity governance and program management for complex organizations with multiple stakeholders and decentralized operations.

The Proposer shall also describe the qualifications and experience of the firm and its personnel as they relate specifically to the Scope of Services and explain how the proposed team is positioned to provide the required services throughout the contract term.

ii. References: Proposer must submit a list of at least five (5) higher education clients, and include the following information for each:

o Client/company name;

o Name, title, and role of reference;

o Client/Company address, phone number, and email address;

o A detailed description of the scope;

o Dates when services were provided.

The College reserves the right to contact any client listed. Proposers should check the references they submit to ensure that each reference and the associated contact information is current.

iii. Staff Qualifications/Resumes: Describe the qualifications, certifications, experience, availability, and proposed roles of all personnel who will be assigned to the College's account, including personnel of any proposed sub-consultants. If sub-consultants will not be used, the Proposer shall include a statement to that effect.

The response shall include:

A. Team Structure and Responsibilities

• Organizational chart identifying the personnel proposed for the College's account;

• Identification of the Lead vCISO, Cybersecurity Program Manager, and other key personnel;

• Title, role, responsibilities, qualifications, and relevant experience of each proposed team member;

• Availability and anticipated level of involvement of proposed personnel throughout the contract term;

• Identification of primary and backup resources for key positions; and

• Identification of any anticipated use of subcontractors.

B. Lead vCISO Identify the individual proposed to serve as the Lead vCISO and provide information regarding:

• Years of cybersecurity experience;

• Years of cybersecurity leadership experience;

• Experience supporting higher education institutions;

• Experience providing cybersecurity governance and program leadership;

• Experience presenting to executive leadership and governing boards;

and

• Relevant professional certifications, including, but not limited to, CISSP, CISM, CGEIT, CRISC, or equivalent certifications.

C. Cybersecurity Program Management

Identify the individual(s) responsible for cybersecurity program management and describe their relevant qualifications and experience, including:

• Cybersecurity program management and governance;

• Risk management and remediation tracking;

• Executive and Board-level reporting;

• Management of risk registers, POA&Ms, project plans, and cybersecurity roadmaps; and

• Coordination of cybersecurity initiatives involving multiple stakeholders, business units, and technical teams.

D. Personnel Continuity The College places significant importance on continuity of service. The Proposer shall describe its approach to maintaining continuity of the proposed team throughout the contract term, including procedures for managing staff transitions and replacing key personnel.

Any proposed change to the Lead vCISO, Cybersecurity Program Manager, or other key personnel identified in the proposal shall require the prior written approval of the College. The College reserves the right to deny payment for services provided by a replacement team member who has not been approved in writing by the College. Any replacement personnel shall possess qualifications and experience equal to or greater than those of the personnel originally proposed for the position.

iv. Supplemental Information: Include any brief supplemental information that may be relevant to your qualifications for the work. Elaborate or superfluous material should not be presented and may count against the company in the evaluation.

Section B - Proposed Approach and Methodology The Proposer shall demonstrate its understanding of the services required under this RFP and describe its proposed methodology for delivering Managed Governance, Risk, Compliance, and Cybersecurity Program Management Services.

Responses should include, but not limited to, the following:

a. Understanding of NCC's Cybersecurity Program Needs The Proposer shall demonstrate its understanding of the challenges commonly facing higher education cybersecurity programs and the operational realities of institutions with limited dedicated cybersecurity staffing. The response should address:

i. The Proposer's service delivery approach for providing Managed Governance, Risk, Compliance, and Cybersecurity Program Management Services.

ii. How the Proposer differentiates its service model from a traditional advisory-only vCISO engagement.

iii. The Proposer's approach to balancing strategic cybersecurity leadership with operational program management.

iv. How the Proposer will collaborate with College’s leadership and internal resources while maintaining accountability for program coordination and management.

b. Governance and Cybersecurity Program Management Approach The Proposer shall describe its approach to establishing, managing, and maturing cybersecurity governance programs. The response should address:

i. Governance structure and operating model

ii. Risk management methodology.

iii. Maintenance of risk registers and Plans of Action and Milestones (POA&Ms).

iv. Management of remediation activities.

v. Coordination of cybersecurity initiatives across technical and business stakeholders.

vi. Executive and Board reporting processes.

vii. Methods used to establish accountability, ownership, and milestone tracking.

c. Program Transition and Baseline Establishment The Proposer shall describe its approach to onboarding and establishment of the initial cybersecurity program baseline. The response should address:

i. Review and reconciliation of existing cybersecurity documentation, assessments, plans, and risk registers.

ii. Establishment of a single authoritative source of record.

iii. Validation of existing remediation plans and cybersecurity priorities.

iv. Identification and resolution of conflicting or incomplete information.

v. Transition timeline, milestones, and expected deliverables during the first six (6) months of the engagement.

d. Inventory, Documentation, and Governance Processes The Proposer shall describe its methodology for developing and maintaining foundational cybersecurity governance artifacts. The response should address:

i. Technology inventory development and maintenance.

ii. Ownership assignment and accountability processes.

iii. Policy, standards, and procedure management.

iv. Document review and version-control processes.

v. Methods used to maintain documentation accuracy and regulatory alignment.

e. Business Continuity, Disaster Recovery, and Vendor Risk Management

The Proposer shall describe its methodology for managing organizational resilience and third-party risk. The response should address:

i. Business continuity planning methodology.

ii. Disaster recovery planning methodology.

iii. Business impact analysis approach.

iv. Recovery testing and tabletop exercise methodology.

v. Vendor risk assessment processes.

vi. Security review processes for new technology acquisitions.

vii. Ongoing third-party risk monitoring activities.

f. System of Record and Program Tracking

The Proposer shall describe the tools, platforms, and processes that will be used to manage the cybersecurity program. The response should address:

i. Proposed system of record.

ii. Ownership and access to data.

iii. Tracking of risks, assessments, findings, POA&Ms, remediation activities, and governance actions.

iv. Reporting capabilities.

v. Dashboard and metric capabilities.

vi. Data retention and transition processes upon contract termination.

g. Performance Measurement and Continuous Improvement

The Proposer shall describe how cybersecurity program performance will be measured and reported. The response should address:

i. Proposed key performance indicators and metrics.

ii. Maturity measurement methodology.

iii. Progress reporting processes.

iv. Continuous improvement practices.

v. Examples of measurable outcomes achieved for similar higher education clients.

h. Communication and Service Delivery Model

The Proposer shall describe how ongoing communication, coordination, and service delivery will be maintained throughout the engagement. The response should address:

i. Meeting cadence.

ii. Escalation procedures.

iii. Availability of key personnel.

iv. Service delivery model.

v. Coordination with College leadership and technical staff.

vi. Methods used to ensure continuity of service.

i. Software Platform Compliance:

Provide the following:

i. Understanding of and compliance with system accessibility requirements in accordance with the following laws, policies, and subsequent updated requirements:

a. New York State Executive Law § 170-f

b. New York State Human Rights Law

c. DOJ rules under Title II of the Americans with Disabilities Act

d. The U.S. Department of Health and Human Services (“HHS”) rules under

Section 504 of the Rehabilitation Act https://www.nysenate.gov/legislation/laws/EXC/170-F https://dhr.ny.gov/new-york-state-human-rights-law https://www.federalregister.gov/documents/2024/04/24/2024-07758/nondiscrimination-on-the-basis-of-disability-accessibility-of-web-information-and-services-of-state https://www.federalregister.gov/documents/2024/05/09/2024-09237/nondiscrimination-on-the-basis-of-disability-in-programs-or-activities-receiving-federal-financial https://www.federalregister.gov/documents/2024/05/09/2024-09237/nondiscrimination-on-the-basis-of-disability-in-programs-or-activities-receiving-federal-financial e.SUNY Electronic and Information Technology (EIT) Accessibility

ii. Submit an Accessibility Conformance Report (ACR) with complete Voluntary Product

Assessment Tool (VPAT) including properly documented exceptions, if any, as well as a roadmap to compliance.

a. Accessibility Conformance Report (ACR) requirements:

1. Use the VPAT 2.5Rev WCAG (April 2025) format (or later, if updated).

2. A third party tested ACR is strongly preferred.

3. The ACR should reflect the current production version and be dated within the last 12 months (or since the last major release).

b. Gap List and Remediation Plan Requirements:

1. Identify any WCAG 2.1 AA and/or 2.2 AA gaps (based on whichever standard applies).

2. Provide a remediation roadmap with target dates for fixes (including interim mitigations, if needed) to align your systems with WCAG2.1AA and/or WCAG 2.2 AA.

3. Responses to Higher Education Community Vendor Assessment Toolkit (Higher Education Community Vendor Assessment Toolkit HECVAT) 4.1.4. accessibility questions (ITAC-01 to ITAC-18)

iii. Submit a completed Higher Educations Community Vendor Assessment Toolkit

(HECVAT):

a. The College requires firms to provide a completed HECVAT for the proposed product to confirm that information date and cybersecurity policies are in place to protect the College’s data.

b. The HECVAT is available at https://www.educause.edu/higher-education-community-vendor-assessment-toolkit. Failure to submit a completed HECVAT may result in the proposal being deemed non-responsive.

Section C – Cost Proposal:

Proposers shall submit a comprehensive Cost Proposal for providing all services described in the Scope of Services. The Cost Proposal shall include all personnel, management, administrative, technology, overhead, and other costs necessary to fully perform the services and deliverables required under the resulting Agreement, except for authorized travel expenses as specifically provided below.

1. Annual Fixed Fee Proposers shall propose a fixed annual fee for the complete performance of the Scope of Services.

The annual fixed fee shall include all services, activities, meetings, assessments, program management, reporting, documentation, deliverables, and ongoing support required under the Scope of Services.

The proposed annual fixed fee shall be payable in twelve (12) equal monthly installments. The fixed annual fee shall remain inclusive of all services required under the Scope of Services, regardless of https://www.suny.edu/sunypp/documents.cfm?doc_id=883 https://www.educause.edu/higher-education-community-vendor-assessment-toolkit https://www.educause.edu/higher-education-community-vendor-assessment-toolkit https://www.educause.edu/higher-education-community-vendor-assessment-toolkit the amount of time or effort required by the Consultant to fulfill its obligations.

Proposers shall not condition the performance of any service expressly included in the Scope of Services on the availability of unused hours or other time-based limitations. The College is procuring the services and deliverables described in the Scope of Services and not a predetermined quantity of consulting hours.

Annual Fixed Fee:

Year 1 $_________________

Year 2 $_________________

Year 3 $_________________

Year 4 $_________________

Year 5 $_________________

2. Anticipated Level of Effort and Staffing

Although the fixed annual fee shall not constitute a limitation on the services required under the Scope of Services, the Proposer shall identify the anticipated level of effort and staffing it has used as the basis for its proposed annual fee.

The Proposer shall provide:

• The anticipated total number of hours per year required to perform the Scope of Services;

• The anticipated number of hours by labor category or role;

• The proposed staffing model, including the roles and responsibilities of key personnel;

• The anticipated allocation of effort among key service areas, including governance, risk and compliance, cybersecurity program management, assessments, reporting, and other major components of the Scope of Services; and

• Any assumptions regarding the availability or participation of College personnel that were used in developing the proposed fee.

The anticipated hours provided by the Proposer are for informational, evaluation, and planning purposes only and shall not establish a maximum number of hours or otherwise limit the Respondent's obligation to perform the full Scope of Services for the proposed fixed annual fee.

The Respondent shall remain responsible for providing sufficient resources and effort to satisfactorily perform all services and deliverables required under the Agreement.

3. Additional Services and Hourly Rates The Proposer shall provide its proposed hourly billable rates for personnel who may be required to perform additional services that are related to the Scope of Services but are not specifically included within the Scope of Services. The billable rates shall be all inclusive, and include all profit and overhead.

The Cost Proposal shall identify, at a minimum, the following labor categories, if applicable:

Labor Category Billable Hourly Rate vCISO / Executive Cybersecurity Advisor $

Senior Cybersecurity / GRC Consultant $

Cybersecurity Program Manager $

Risk and Compliance Consultant $

Security Assessment / Technical Consultant $

Business Continuity / Disaster Recovery Consultant $

Vendor / Third-Party Risk Consultant $

The College shall have no obligation to purchase additional services. No additional service shall be performed or billed unless specifically authorized in advance by the College through an authorized representative and, where required, through an executed amendment, change order, purchase order, or other written authorization acceptable to the College.

Billable hourly rates proposed for additional services shall remain firm for the initial contract term, unless otherwise specified in the Proposer's Cost Proposal and accepted by the College.

The Proposer shall identify any proposed rate increases for subsequent years.

Additional services shall not include work that is reasonably necessary to fulfill the Scope of Services or to produce the required deliverables. The Proposer shall not bill the College separately for services, personnel, meetings, activities, revisions, or other work that is included within or reasonably necessary to accomplish the Scope of Services.

4. Travel Expenses

The annual fixed fee and hourly rates shall include all costs and expenses associated with the performance of the services, except for authorized travel expenses as provided in this section.

The College shall not be responsible for reimbursement of any other expenses, fees, surcharges, administrative costs, technology costs, equipment costs, materials, or other charges not expressly provided for in the Agreement.

If the College requires the Consultant to travel to the College to perform services, the College will reimburse the Consultant for reasonable and necessary travel expenses incurred in connection with such required travel, provided that such travel is authorized in advance by the College.

Reimbursable travel expenses shall be limited to allowable expenses and applicable rates established by the U.S. General Services Administration (GSA) for the location and period of travel. The Consultant shall provide appropriate supporting documentation for all reimbursable travel expenses.

Travel undertaken at the Consultant's discretion or for the Consultant's convenience shall not be reimbursable. Remote performance of services shall be the default unless the College determines that in-person attendance is required.

Section D – M/WBE Participation:

The College strongly encourages the use of M/WBE firms for participation as prime consultants, joint-venture partners, and sub-consultants for all College contracting opportunities. The College accepts M/WBE certifications from the County and the Empire State Development.

Please note that it is at the sole discretion and judgment of the Proposer to determine whether its proposed M/WBE firm(s) has/have the necessary qualifications and experience for the type of services and work to potentially be assigned. All proposers may select M/WBE sub-consultants or joint venture with an M/WBE firm to receive a maximum of five (5) M/WBE participation points.

To promote full participation by Minority-Owned/Women-Owned Business Enterprises (M/WBE) in the College’s contracting opportunities for professional service contracts, the College will evaluate proposals to determine the level of meaningful participation by M/WBE firms. M/WBE firms may participate as prime consultants, sub-consultants or as joint venture partners. The level of participation will apply to all firms submitting proposals and will be evaluated by the Selection Committee.

In order to receive evaluation credit for M/WBE participants, the proposed M/WBE firm(s) must be certified at the time of proposals submission to the College. The proposal must identify the specific certified M/WBE firm or firms upon which evaluation credit is sought, and shall indicate the extent and nature of the M/WBE’s work and include the percentage of the total engagement that will be performed by the M/WBE firm in connection with the proposal. M/WBE participation in auxiliary services (e.g., graphics, printing and other services) is acceptable, but will only be given evaluation credit if it augments the primary service of this RFP.

Proposers must provide the M/WBE’s current proof of certification as a minority-owned, or women-owned, business enterprise, at the time of submittal.

SUPPLEMENTAL INFORMATION

(not a weighted criterion) This section should include any additional information relevant to but not included in the previous sections, at the Proposer’s option.

SECTION 3

SCOPE OF WORK

I. SCOPE OF SERVICES

The Consultant shall provide Managed Governance, Risk, Compliance, and Cybersecurity Program Management Services as described below:

1. Strategic Objectives:

The Consultant shall assist the College in achieving the following objectives:

a. Establish and maintain a mature cybersecurity governance program.

b. Develop and maintain an accurate enterprise technology and information asset inventory.

c. Improve cybersecurity maturity across all NIST Cybersecurity Framework (CSF) 2.0 functions.

d. Establish accountability and ownership for cybersecurity risks and remediation activities.

e. Enhance Board-level and executive visibility into cybersecurity risks and program progress.

f. Formalize vendor and third-party risk management practices.

g. Develop and operationalize business continuity and disaster recovery capabilities.

h. Maintain compliance with applicable regulatory and higher education cybersecurity requirements.

i. Create and maintain a sustainable cybersecurity program that remains operational regardless of personnel changes.

2. Governance, Risk, and Compliance (GRC) Services:

The Consultant shall:

a. Governance Program Management:

• Serve as the College's designated virtual Chief Information Security Officer (vCISO).

• Provide strategic cybersecurity leadership and guidance to the AVP, IT leadership, executive leadership, and governance bodies.

• Facilitate cybersecurity governance activities and establish governance processes where needed.

• Assist the College in defining cybersecurity goals, priorities, and roadmap initiatives.

• Develop and maintain a multi-year cybersecurity strategy and maturity roadmap.

b. Risk Management

• Maintain the College's cybersecurity risk register.

• Conduct ongoing risk identification, analysis, documentation, and prioritization activities.

• Assign and maintain documented risk ownership in coordination with College’s leadership.

• Establish target remediation dates, implementation milestones, and risk treatment plans for identified risks.

• Track remediation activities and provide ongoing status reporting through resolution or formal risk acceptance.

• Provide quarterly risk trend analysis and reporting.

• Coordinate annual enterprise cybersecurity risk assessments.

• Facilitate risk acceptance and risk tolerance discussions with appropriate College stakeholders.

c. Compliance Management

• Assess cybersecurity controls against applicable frameworks and regulations.

• Maintain compliance documentation and supporting evidence repositories.

• Coordinate cybersecurity-related audits and assessments.

• Track findings through remediation and closure.

• Assist the College in preparing audit responses and corrective action plans.

3. Cybersecurity Program Management:

The Consultant shall provide active cybersecurity program management services and shall not be limited to advisory recommendations.

Services shall include:

• Maintaining a comprehensive cybersecurity program plan.

• Developing and maintaining project plans related to cybersecurity initiatives.

• Coordinating stakeholders, business owners, technical teams, and project resources.

• Conducting status meetings and action-item tracking.

• Monitoring progress toward remediation goals.

• Assigning and maintaining documented ownership for cybersecurity risks, systems, applications, services, vendors, and remediation activities in coordination with College’s leadership.

• Establishing target remediation dates and implementation milestones.

• Escalating delays, barriers, and unresolved risks to executive leadership as appropriate.

• Maintaining Plans of Action and Milestones (POA&M).

• Maintaining a centralized repository of cybersecurity initiatives and project status.

• Maintaining a single authoritative cybersecurity program plan and associated POA&M repository that serves as the College's official source of record for cybersecurity initiatives, remediation activities, milestones, dependencies, and completion evidence.

• Reconciling and eliminating conflicting status information across assessments, risk registers, security plans, audit findings, and other cybersecurity program documentation.

The Consultant shall be responsible for driving initiatives toward completion in coordination with College resources and maintaining accountability for program tracking and reporting.

Within the first six (6) months of the engagement, and as part of the initial onboarding and program transition activities, the Consultant shall review, reconcile, and establish a baseline for all cybersecurity program documentation, risk registers, assessments, security plans, remediation activities, and related program artifacts. The resulting baseline shall serve as the authoritative starting point for cybersecurity program management activities under this contract.

4. Enterprise Asset and Application Inventory Management:

The Consultant shall lead the development, completion, maintenance, and ongoing governance of the College's enterprise technology inventory in collaboration with designated College stakeholders.

The inventory shall serve as the authoritative record of the College's technology environment and include, at minimum, on-premises systems, cloud services, SaaS applications, infrastructure components, databases, security tools, third-party hosted services, and other technology assets deemed relevant to cybersecurity, business continuity, compliance, or operational risk management.

For each inventoried asset or service, the selected firm shall document and maintain information including, but not limited to:

• Business, technical, and system ownership

• Hosting and service delivery model

• Data classification and business criticality

• Vendor and contractual information

• Recovery objectives, including RTO, RPO, and maximum acceptable downtime

• Risk classification and review status

The Consultant shall establish and maintain documented relationships among systems, applications, business processes, vendors, data classifications, and recovery requirements to support risk management, business continuity planning, disaster recovery planning, vendor management, and regulatory compliance activities.

The Consultant shall be responsible for coordinating inventory data collection, validation, maintenance, and periodic review activities with College personnel and shall conduct, at minimum, quarterly updates and an annual comprehensive inventory validation.

5. Policy, Standards, and Procedure Management:

The Consultant shall develop, maintain, and manage the College's cybersecurity policy and procedure framework.

Services shall include:

• Reviewing all existing cybersecurity policies, standards, and procedures.

• Eliminating outdated, incomplete, or template-derived content.

• Ensuring all documentation reflects New York State, SUNY, GLBA, FERPA, and…