RFP 170-4437-25 Attachment K SOC 2 Confirmation_FINAL.docx

This is a Service Organization Control (SOC) 2 Audit Confirmation attachment for RFP 170-4437-25, a digital marketing services opportunity administered by the State of Oregon, specifically the Oregon State Treasury in partnership with what appears to be a retirement savings program network. The solicitation seeks a technical assessment and digital marketing plan focused on retirement industry landscape analysis and auto-IRA programs comparable to OregonSaves, with emphasis on digital marketing opportunities. Proposers are required to complete and sign Attachment J to confirm their organization maintains a current SOC 2 audit report conducted in accordance with the Statement on Standards for Attestation Engagements (SSAE). The confirmation form requires the proposer's legal business name, address, city, state, and postal code, along with authorization by a representative with printed name, title, and signature with date.

The SOC 2 report must be available upon request and will be reviewed by Oregon State Treasury during the due diligence process following proposal submission. Failure to provide the SOC 2 audit report upon request may result in disqualification from contract award. This requirement demonstrates Oregon State Treasury's emphasis on information security and service organization controls for vendors handling sensitive retirement savings program data. The attachment serves as a mandatory compliance certification rather than a pricing or terms document, establishing baseline security and audit standards that must be met by all proposers competing for this marketing services contract.