RFP CSI-2603 - Addendum No. 1.pdf

RFP No. CSI-2603 – Digital Exam Assessment Solution – Addendum No. 1

June 17, 2026

ADDENDUM No. 1

TO: Prospective Proposers

FROM: Marino Pawlowski (Marino.Pawlowski@csi.cuny.edu) The City University of New York on behalf of the College of Staten Island

RE: RFP No. CSI-2603 Digital Exam Assessment Solution

Addendum No. 1 to the above-referenced RFP is being issued to:

a. Respond to questions submitted by Prospective Proposers;

b. Advise all Proposers that the form of RFP Attachment B: Information Technology

Performance Requirements is hereby deleted in its entirety and replaced with the amended form of the document attached to this Addendum No. 1;

c. Confirm the Proposal Due Date and Time has been updated on the NYS Contract Reporter to match the information stated in the RFP Documents: July 8, 2026 at 12 PM Eastern Time.

The Addendum Questions and Answers begin on the next page.

mailto:(Marino.Pawlowski@csi.cuny.edu)

Questions and Answers

Q1: Proposed Exception : Data Usage for Plagiarism Detection and Source Database Retention

RFP References: Part 4, Section 4.5; Appendix C-AI, Sections 5 and 7

Proposer's plagiarism detection and AI writing detection services function by comparing submissions against a proprietary database of previously submitted works (the "Source Database"). This requires retention of submission content in the Source Database beyond the Contract Term for comparison purposes, which is integral to the service the University is procuring. Proposer requests that the Contract acknowledge: (a) retention of submissions in the Source Database for plagiarism and AI writing detection comparison purposes is a permitted use under the Contract, subject to CUNY's right to request deletion at any time; and (b) the AI restrictions in Appendix C-AI do not prohibit the use of anonymized and aggregated data derived from submissions for the purpose of improving plagiarism detection and AI writing detection accuracy, which is distinct from general-purpose AI model training. Proposer will not use identifiable CUNY data to train, retrain, or improve AI models for purposes unrelated to the Services.

A1: Section 5 of the Part 7: Terms and Conditions of Contract is hereby modified to add a new paragraph (h) and (i), to read as follows:

(h) The Parties acknowledge and agree that Contractor’s plagiarism detection and AI writing detection services function by comparing submissions against a proprietary database of previously submitted works (the "Source Database"). Notwithstanding paragraph (g) above, Contractor may retain College’s submissions in the Contractor’s Source Database for plagiarism and AI writing detection comparison purposes. The College may request deletion of its submissions at any time and the Contractor shall delete all College submissions within thirty (30) calendar days. Upon the request of the College, Contractor shall certify in writing that it has complied with the obligations set forth in this paragraph.

(i) The Parties acknowledge and agree that the AI restrictions in Appendix C-AI do not prohibit the use of anonymized and aggregated data derived from submissions for the purpose of improving plagiarism detection and AI writing detection accuracy, which is distinct from general-purpose AI model training. Contractor shall not use identifiable CUNY data to train, retrain, or improve AI models for purposes unrelated to the Services.

Q2: Proposed Exception : Limitations of Liability

RFP References: Part 7, Section 28; Part 4, Section 4.5

Proposer acknowledges the RFP's liability cap of 3x the Contract value or the limits of applicable required insurance, whichever is greater. Proposer requests that: (a) this cap apply to all claims arising under or related to the Contract, including indemnification under Section 27 and confidentiality under Section 25; and (b) neither Party be liable to the other for indirect, special, incidental, or consequential damages, except in cases of gross negligence or willful misconduct.

A2: This section of the RFP will remain unchanged.

Q3: Proposed Exception : Security Breach Cost Reimbursement

RFP Reference: Appendix B, Information Security, Section (i)

Proposer requests that the Contractor's obligation to reimburse breach-related costs under Appendix B, Section (i) be: (a) subject to the liability cap established in Section 28 of the Contract; (b) limited to breaches caused by Contractor's failure to comply with its documented security obligations under the Contract; and (c) not applicable to breaches caused by the acts or omissions of CUNY or its Authorized Users.

A3: A liability cap will not be applied to Appendix B, Information Security, Section (i). However, the College will agree to limit breach-related costs to breaches caused by the Contractor’s failure to comply with its documented security obligations under the Contract, and confirm such costs are not applicable to breaches caused by the acts or omission of CUNY or its Authorized Users.

Q4: Proposed Exception : Insurance Requirements

RFP Reference: Part 7, Section 29

As a SaaS provider, Proposer does not operate vehicles in connection with the Services.

Proposer requests:

(a) removal of the automobile liability insurance requirement under Section 29(a)(iv); and

(b) that the University's right to require additional insurance under Section 29(f) be limited to requirements that are commercially reasonable and directly related to the Services being provided.

A4: Section 29 of Part 7: Terms and Conditions is hereby modified to:

1. Delete subparagraph (a)(iv) (pertaining to automobile liability insurance); and

2. Modify subparagraph (f) to read as follows: The University reserves the right to add additional insurance requirements to the extent these additional requirements are commercially reasonable and directly related to the Work.

Contractor shall procure such additional insurance requirements within thirty

(30) calendar days of notice to Contractor.

Q5: Proposed Exception : Intellectual Property Ownership

RFP Reference: Part 7, Section 13(b) and 13(c) Proposer's Solution is a commercial off-the-shelf software platform that is continuously improved across Proposer's entire customer base. Proposer requests clarification that Sections 13(b) and 13(c) of the Contract do not apply to: (a) improvements, enhancements, or modifications to Proposer's pre-existing software platform, algorithms, or proprietary technology, even where such improvements are informed by the performance of the Services; or (b) any component of Proposer's pre-existing intellectual property or derivative works thereof. For the avoidance of doubt, all Output generated by CUNY's use of the Solution (including reports and assessment results) is owned by

CUNY.

A5: Section 13 of Part 7: Terms and Conditions is hereby modified to add a new paragraph 13(d), to read as follows:

(d) The Parties agree that paragraphs (b) and (c) do not apply to: (i) improvements, enhancements, or modifications to Contractor’s pre-existing software platform, algorithms, or proprietary technology, even where such improvements are informed by the performance of the Services; or (ii) any component of Contractor’s pre-existing intellectual property or derivative works thereof. For the avoidance of doubt, all output generated by CUNY's use of the Solution (including reports and assessment results) will be owned by CUNY.

Q6: Proposed Exception : Data Return Timeline

RFP Reference: Part 3, Section 3.8.5

Proposer requests that the ten (10) calendar day period for return and certified destruction of CUNY data upon termination be extended to thirty (30) calendar days. This extended timeline is consistent with industry practice for cloud-based platforms and reflects the operational requirements of securely exporting and certifying destruction of data across distributed systems.

A6: Section 3.8.5 of Part 3: Project Objectives and Scope is hereby modified to read as follows:

Within thirty (30) calendar days of termination of the Contract for any reason, Contractor shall, with respect to all CUNY documents and data, in whatever media, whether originally provided or created during performance of the Services.

Q7: Proposed Exception : Termination for Convenience

RFP Reference: Part 7, Section 17(b)

Proposer acknowledges CUNY's right to terminate for convenience. Proposer requests that, in the event of a termination for convenience under Section 17(b), CUNY remain responsible for fees through the end of the then-current billing period (semester), given that student licenses are provisioned and activated on a semesterly basis per Section 3.11 of the Scope of Work.

A7: Section 17(b) of Part 7: Terms and Conditions hereby modified to add the following sentence: “In the event of a termination under this Paragraph, CUNY will remain responsible for all non-cancellable fees through the end of the current billing period.”

Q8: Proposed Exception : Indemnification Scope

RFP References: Part 7, Section 27; Part 4, Section 4.5

Proposer acknowledges its obligation to indemnify CUNY for claims arising from Proposer's performance of the Services. Proposer requests that: (a) Proposer's indemnification obligation under Section 27 be limited to claims arising from Proposer's negligence, willful misconduct, material breach of the Contract, or infringement of third-party intellectual property rights by the Solution as provided to CUNY; (b) the indemnification obligation not extend to claims arising from CUNY's or its Authorized Users' misuse of the Solution, modification of the Solution by parties other than Proposer, or CUNY's failure to use the Solution in accordance with the Contract or applicable documentation; and (c) Proposer be afforded the procedural protections of prompt written notice and the opportunity to control the defense of any claim for which indemnification is sought.

A8: This Section of the RFP will remain unchanged.

Q9: Proposed Exception : Warranty and Exclusive Remedy

RFP Reference: Part 4, Section 4.5

Proposer acknowledges the RFP's requirement that the Solution function in all material respects as required by the Contract and in accordance with applicable product documentation throughout the Term. Proposer requests that, in the event the Solution is found to be defective or not in compliance with this warranty, Proposer's sole obligation and CUNY's exclusive remedy be for Proposer to use commercially reasonable efforts to repair or replace the non-conforming aspect of the Solution at no additional cost to CUNY. If Proposer is unable to repair or replace the non-conforming aspect within a commercially reasonable timeframe, CUNY shall have the right to terminate the Contract and receive a pro rata refund of prepaid fees for the remainder of the then-current Term.

A9: In the event that the Contractor’s Solution is found to be defective or otherwise not in compliance with the material requirements of the College’s RFP, the College retains the right to all equitable relief specified under this RFP, including but not limited to: (a) the Remedies set forth in Part 7, Section 18; (b) the Exclusive Remedy for any instance where the Contractor fails to meet a service level of >99.5% ; and/or (c) any rights granted by law or in equity.

Q10: Proposed Exception : Acceptance and Payment

RFP Reference: Part 7, Section 43(F)

Section 43(F) of the RFP requires that the University confirm written Acceptance before Contractor may invoice, and provides that Acceptance "can never occur by the passage of time." For a SaaS subscription billed on a per-student, per-semester basis, Proposer requests that: (a) Acceptance be deemed granted if CUNY does not provide written notice of non-acceptance, specifying the basis for non-acceptance in reasonable detail, within fifteen (15) business days after receipt of an invoice; and (b) any partial nonacceptance apply only to the disputed portion of the invoice, with undisputed amounts remaining due in accordance with the Contract's payment terms.

A10: This Section of the RFP will remain unchanged.

Q11: Proposed Exception : Force Majeure

RFP Reference: Part 7, Section 14

Section 14 of the RFP limits force majeure events to "Acts of God, government action and war." As a cloud based SaaS provider, Proposer's delivery of the Services depends on telecommunications infrastructure and third-party hosting platforms that are outside Proposer's reasonable control. Proposer requests that the definition of force majeure be expanded to include: telecommunications or internet service failures, cyberattacks or distributed denial-of-service attacks, third-party cloud infrastructure outages, pandemics, epidemics, and any other events beyond a Party's reasonable control. This is consistent with the broader force majeure provisions common in technology services agreements with public-sector institutions.

A11: Section 14 of Part 7: Terms and Conditions, is hereby deleted and replaced with a new Section 14, to read as follows:

14. FORCE MAJEURE

Contractor shall be excused from performance for reasons beyond its reasonable control and not brought on by any act or omission of the Contractor, including, but not limited to, Acts of God, government action, war, civil commotion, terrorism, and labor disputes (each, a “Force Majeure Event”). For purposes of this Agreement, a Force

Majeure Event will also include telecommunications or internet service failures, cyberattacks or distributed denial-of-service attacks, third-party cloud infrastructure outages, pandemics, and epidemics.

Q12: Proposed Exception : Publicity and Customer Name Usage

RFP Reference: Part 7, Section 43(E)

Section 43(E) of the RFP requires CUNY's prior written consent before Proposer uses CUNY's name in any form of advertising or publicity. Proposer requests a limited carve-out permitting Proposer to include the University's name in general customer lists and marketing materials identifying CUNY as a subscriber to the Services, without requiring prior written consent for each instance. Proposer will not use CUNY's name in press releases, case studies, or endorsement-style materials without CUNY's prior written consent.

A12: This Section of the RFP will remain unchanged.

SIGNATURE PAGE FOLLOWS

THIS ADDENDUM NO. 1 IS PART OF YOUR PROPOSAL, AND IS TO BE INCLUDED

WITH YOUR PROPOSAL RESPONSE. YOUR SIGNATURE BELOW WARRANTS

THAT YOU UNDERSTAND THIS ADDENDUM AND THAT YOU HAVE MADE THE

APPROPRIATE ADJUSTMENTS TO YOUR PROPOSAL AND CALCULATIONS. THE

COLLEGE RESERVES THE RIGHT TO REJECT PROPOSALS SUBMITTED

WITHOUT ALL ADDENDA PROPERLY SIGNED.

Signature

Title

Company Name

Date

RFP CSI-2603, SCOPE OF WORK ATTACHMENT B

INFORMATION TECHNOLOGY PERFORMANCE REQUIREMENTS

AMENDED - ADDENDUM NO. 1

Introduction

The City University of New York (the “University” or “CUNY”) is committed to ensuring that all technology products and services adhere to required and industry standards of accessibility, security, and compatibility with existing enterprise systems.

These terms set forth essential requirements and standards that contractors must meet when providing technology solutions to CUNY - including accessibility, authentication and access control, IT security, PeopleSoft/CUNYfirst/Workday integrations, project management, and preferred service standards.

CUNY places a high priority on contractors providing exceptional technical support, customer service, and a positive user experience for the University's constituents; all contractors (the “Contractor(s)”) must ensure that their products, solutions, applications, platforms, and services (“Services”) are user-friendly, reliable, and supported by highly responsive customer service teams.

The language of the Solicitation or Contract is directed at Contractor unless specifically stated otherwise.

The Solicitation or Contract language and attachments are complementary, and what is called for by one shall be as binding as if called for by all. In the event of conflicting provisions within or among the specifications, and the terms and conditions, Contractor is obligated to seek clarification from University as soon as Contractor becomes aware of any conflicting provisions; in general, however, Contractor is obligated to provide the most expensive option, and the more specific provision will take precedence over the less specific; the more stringent will take precedence over the less stringent; and the more expensive item will take precedence over the less expensive item.

Contractor shall comply with all laws, regulations, rules, orders-including executive orders, requirements, and the like of federal, state, and local governments, courts, governmental authorities, legislative bodies, boards, agencies, commissions, and the like (“Law(s)”) with respect to this Solicitation or Contract. If there is a conflict between or among any laws and specific requirements of this Solicitation or Contract, then Contractor shall comply with the most stringent Law in each instance. By noting any specific Laws with particularity in this Solicitation or Contract or in any other prior or future communication, Contractor is not relieved of any obligation to comply with all Laws, and the University does not waive any rights it may have with respect to such compliance.

Accessibility

The Contractor must comply with all applicable federal and state laws and regulations regarding the accessibility of the Services for those who are disabled. Any network-based information and applications development, or programming, including, but not limited to, websites delivered to or by the State of New York pursuant to this contract or procurement, will comply with Section 508 of the Rehabilitation Act of 1973, as amended, Executive Law Section 170-f, as amended, and be consistent with New York State Enterprise IT Policy NYS-P08-005, Accessibility of Information Communication Technology, as such policy may be amended, modified, or superseded (the “Accessibility Policy”). The Accessibility Policy requires, and Contractor must ensure that State Entity Information Communication

Technology shall be accessible to all users, including those with disabilities as determined by accessibility compliance testing. Such accessibility compliance testing will be conducted by CUNY and any report on the results of such testing must be satisfactory to CUNY, as an explicit condition of being awarded the Contract.

In accordance with Section 170-f of the New York State Executive Law, Contractor represents and warrants that the Services’ online content and functionality shall conform to the most current version of the Web Content Accessibility Guidelines adopted by the World Wide Web Consortium for accessibility or any successor guidelines/standards (“WCAG Standards”), that are incorporated herein by reference.

Upon request and prior to Contract Award, vendors seeking to be awarded a contract by the University must provide an Accessibility Conformance Report (“ACR”) or a completed Voluntary Product Accessibility Template (“VPAT”) that includes vendor’s representation and warranty that the Services comply with the WCAG Standards. Please note that an ACR or VPAT need not be submitted with a Bid Submission, Proposal or Quote but if requested, then vendor must submit an ACR or VPAT upon request within the timeframe required by the University as an explicit condition prior to being awarded a Contract. The ACR or VPAT must reflect the vendor’s current software release of the Services. Vendor will be required to warrant that the Services’ online content and functionality shall meet or exceed the accessibility standards specified in its ACR or VPAT throughout the Term of this Contract.

Upon request, Contractor also must provide temporary test credentials to the University so that the University is able to perform a test of the Services to verify that the Services meet the requisite accessibility standards.

CUNY will need to review, verify, and accept Contractor’s ACR or VPAT prior to the award of a contract.

If after award of a contract to a vendor (“Contractor”), CUNY determines that a user of the Services requires a special modification in order to comply with WCAG Standards, then the University shall submit a written request to the Contractor for a modification to the Services, and the Contractor shall use commercially reasonable efforts to provide necessary modification(s) promptly. In the event that compliance with WCAG standards requires more than commercially reasonable efforts, then the Contractor shall engage in good faith negotiations with CUNY to amend the Contract. In the event that the Contractor cannot modify the Services to comply with WCAG Standards following good faith negotiations to amend the Contract, then the University shall have the right to terminate the Contract upon thirty (30) days’ written notice.

The University will not award a Contract to any vendor that: (a) if requested, fails to promptly submit an ACR or completed VPAT that verifies the Services’ compliance with WCAG Standards; (b) submits an ACR or completed VPAT that does not meet WCAG Standards ; (c) does not provide the necessary credentials to allow the University to test and verify the accessibility of the online content and functionality of the proposed Services; or (d) provides temporary test credentials that result in a determination that demonstrates that the Services do not meet requisite accessibility standards.

Authentication and Access Control

All Services must meet the following Single Sign-On (SSO) and Authentication Requirements.

Contractor must ensure that the fully configured software solution that it provides as part of the Services and deploys at CUNY, including all updates and patches (“Solution”) integrate with CUNY Login, the centralized authentication system powered by the Oracle Access Management (OAM) suite.

Contractor must support seamless integration of the Solution with CUNY Login to enable Single Sign-On (SSO) and secure authentication for all CUNY users.

To ensure compatibility and successful integration, the Contractor must ensure that the Solution must:

1. Support Standard Authentication Protocols:

• The Contractor must ensure that the Solution support one or more of the following standard authentication mechanisms to integrate with CUNY Login:

o SAML 2.0: The Contractor must ensure that the Solution act as a Service Provider (SP) and accept SAML assertions from CUNY Login.

o OpenID Connect (OIDC): The Solution must support OIDC flows for authentication.

o OAuth 2.0: If API-level access is required, the Solution must support OAuth 2.0 for token-based authentication.

o Header-Based Authentication: For Solutions hosted within CUNY’s data centers, the

Solution can support header-based authentication as an alternative mechanism provided by OAM if any of the federation protocols are not supported. The Solution must securely validate headers and handle user attributes passed through them.

2. Enable SSO Workflow:

• The Solution must redirect unauthenticated users to CUNY Login for authentication.

• The Solution must process the authentication response from OAM to establish user sessions.

3. Session Management:

• The Contractor must ensure that the Solution support session timeout and Single Logout (SLO) mechanisms as defined by CUNY Login. If the Contractor’s Solution does not support SAML SLO or SAML Logout, then the Solution must support the use of the IdP's logout redirect URL to ensure that sessions are cleared gracefully at the IdP level.

• In cases where logout-related options are unavailable, the Contractor, through its application development team, must work toward an enhancement solution in collaboration with CUNY’s IT team. The Contractor will submit the resulting solution to CUNY for review by CUNY and must be approved by CUNY prior to implementation.

4. Attribute Handling:

• The Contractor must ensure that the Solution supports the mapping of user attributes provided by CUNY Login, such as emplID, email, roles, and other custom attributes required for authorization and personalization.

5. Security and Compliance:

• The Contractor must ensure that the Solution uses secure protocols (e.g., HTTPS) for communication with CUNY Login.

• The Contractor must ensure that the Solution complies with CUNY’s security policies and relevant regulatory requirements for data protection.

IT Security

The University’s Information Security division provides a comprehensive management framework that includes policies, assessments, tools, and tested procedures to build defensive strategies and capabilities for effective responses.

The Contractor’s Services must adhere to industry best practices - including regular intrusion detection, firewalls, and layered security including anti-virus and anti-spam protection where applicable. The Solution must include/have measures to ensure that data records are transported, stored, and accessed in a secure manner and that information being displayed on websites or transmitted over internet has not been altered in any way by an unauthorized party.

To ensure the highest standards of IT security during the term of the Contract, Contractor must adhere to the CUNY Service Provider Standard, including incident response protocols during the term of the Contract. Also, annually, the Contractor must timely submit all required reports, including SOC2, PCI, or

SSAE.

In addition, where applicable (e.g., vendor processes credit card payments for CUNY), the Contractor must provide a PCI report to demonstrate compliance with industry standards and safeguard sensitive information when Contractor is required to provide the SOC report.

Vendors must follow CUNY's cybersecurity best practices to maintain a secure working environment, including adhering to the CUNY Policy on Acceptable Use of Digital Assets and Resources and the CUNY- Data-Classification-Standard

Service Standards/Service Level Agreements

The Contractor will be required to meet the following service standards. If service standards are not met, CUNY will be entitled to performance credits as described below.

Performance Service Levels

This Service Level Agreement ("SLA") sets forth the service level and performance objectives of the Contractor in providing its Solution (the "Services") to CUNY. The Contractor will use reasonable efforts to meet the following service level and performance objectives to support the operation of the facilities, server(s), computer equipment, operating software and connectivity used to provide the Services to CUNY.

(a) Uptime Commitment

The Contractor will use reasonable efforts to ensure the Contractor's Systems are available a https://www.cuny.edu/wp-content/uploads/sites/4/page-assets/about/administration/offices/cis/information-security/security-policies-procedures/CUNY-Service-Provider-Standard.pdf https://www.cuny.edu/wp-content/uploads/sites/4/page-assets/about/administration/offices/legal-affairs/policies-resources/Computer-Use-1.pdf https://www.cuny.edu/wp-content/uploads/sites/4/page-assets/about/administration/offices/cis/it-policies/CUNY-Data-Classification-Standard.pdf https://www.cuny.edu/wp-content/uploads/sites/4/page-assets/about/administration/offices/cis/it-policies/CUNY-Data-Classification-Standard.pdf minimum of 99.5% of the time (the "Uptime Commitment"). All Uptime Commitment will be measured within the Contractor's System on a monthly basis calculated to include twenty-four (24) hours per day over each month, but excluding from the numerator and denominator in the calculation the duration in time of any temporary shutdowns due to scheduled maintenance (which will not exceed in the aggregate sixteen (16) hours per month outside of normal business hours), telecommunications or power disruptions caused by third parties, and any other causes beyond Contractor's reasonable control. The Contractor agrees to notify CUNY promptly of any factor, occurrence, or event coming to its attention that may affect the Contractor's ability to meet the Uptime Commitment, or that is likely to cause any material interruption in the Services.

(b) Exclusive Remedy

The Contractor will use reasonable efforts to correct any material problems in the Services, including any failure to satisfy the Uptime Commitment. In the event that the Contractor fails to satisfy the Uptime Commitment for a given month, CUNY's sole and exclusive remedy will be to receive a service credit equal to the following percentage of the monthly fees for the Services for the stated uptime:

a. 98% to 99.5% 10%

b. 95% to 97.9% 25%

c. 92% to 94.9% 40%

d. 90'% to 91.9 60%

e. Below 90% 100%

In no event will the service credit exceed the monthly fees paid by CUNY for the Services.

CUNY acknowledges and agrees that if the remedies set forth in this section are applied, any failure of the Contractor to meet the requirements in this SLA will not constitute a breach of the Agreement.

(c) Scheduled Outages

Maintenance outages, if necessary, shall be conducted at a time and in a manner to minimize adverse impacts on the Services. Maintenance outages may include, but are not limited to the installation of upgrades, service packs and routine server or application configuration changes. Other maintenance outages may be necessary from time to time.

Contractor shall provide CUNY with reasonable advance written notice of scheduled outages, and CUNY reserves the right to require Contractor to schedule such planned outages at a different time.

(d) Change Control

Contractor shall install new equipment, software, releases, upgrades, fixes, patches and other items necessary to maintain Contractor's Systems to industry standards. Contractor shall proactively gather information from appropriate server, peripheral, operating system or database vendors regarding upgrades. defect patches or fixes.

(e) Notice

Contractor shall use reasonable efforts to give CUNY three (3) days' notice prior to all non-routine management, maintenance, change control or other actions by Contractor that may materially impact the Solution adversely.

(f) Support

Contractor shall provide an online CRM for CUNY to report, manage, and track support issues as well as a toll free support number. Contractor shall provide end-user support during business hours (Mon-Fri), and downed system support 24x7. Initial response times to support issues are as follows:

Response Level Description Initial Response I Saas Service is unavailable 1 hr.

II Production module is inoperable

2 hr.

III

Module feature working incorrectly; general performance issue

1 business day

IV

Non-performance related incidents, including:

general questions, requests for information, documentation questions, and enhancement

2 business days

In the event of Downtime (which shall consist of a Response Level I or II in the chart above), Contractor shall provide an online Downtime Status page to be updated in real-time until resolution of such Downtime event. All incidents of Downtime which are known by Contractor, and which affect CUNY shall be communicated via a support case or by email.

Support Response Times

The chart below represents required support response times. Contractor must meet such requirements;

if a Contractor would like to suggest alternate support response times for each level of severity, then it must do so by submitting questions by the Questions Due Date; if the required support response times are revised, then all vendors will be provided a revised support response times through an Addendum to the RFP solicitation document.

Support Response Times

Severity Definition Response Time

Resolution Time

Critical Complete system outage; business-critical impact to any CUNY entity serviced by vendor (e.g., college, Central Office, Research Foundation).

15–30 minutes

4–8 hours

High Severe disruption to core functions; significant impact to any CUNY entity serviced by vendor (e.g., college, Central Office, Research Foundation).

1 hour 1 business day

Medium Limited disruption; workarounds may exist to any CUNY entity serviced by vendor (e.g., college, Central Office, Research Foundation).

4 hours 2–3 business days

Low Minor issues or general inquiries to any CUNY entity serviced by vendor (e.g., college, Central Office, Research Foundation).

1 business day

5–7 business days

Helpdesk Availability Preferred Helpdesk availability is as follows. Vendors must provide a response regarding if they can meet such preferences and if not, what their Helpdesk availability is.

[State the requirements – not “preferences”]:

The Contractor must provide 24-7 Helpdesk availability; however, Helpdesk or similar service must be available at minimum during normal business hours (M-F 9am to 5pm EST) via the following contact channels:

1. Phone: Toll-free or direct support line for real-time assistance.

2. Email: For logging tickets or non-urgent queries.

3. Live Chat: Instant messaging platform for quicker resolutions.

4. Self-Service Portal: Ticket submission, knowledge base access, and status tracking.

Backup For SaaS based Solutions, the Contractor must ensure high availability for the Solution. High availability is defined as the ability for the Solution to operate as designed with zero downtime, unless for regular maintenance. In addition, the Contractor must have service running in multiple datacenters (minimum of two) and prefers 99.999% uptime; in addition, for a hosted Solution, when moving the service from one datacenter to another the Contractor must ensure zero downtime. The Contractor shall provide comprehensive redundant backups by implementing a backup strategy that includes performing daily backups (deltas between previous day's backup) with at least weekly full backup rotation; the Contractor must retain backup data for 90 days. The Contractor must provide cold storage option if CUNY determines that cold storage option is needed.

Data Portability

The Contractor must ensure that all data stored within the platform can be securely exported in a standard, non-proprietary format upon request or contract termination, to facilitate seamless data migration or compliance with CUNY's archival requirements.

Chronic System Failure

In the event of a Chronic SLA Failure, CUNY reserves the right to terminate the affected Service without penalty.

Chronic SLA Failure is defined as 3 consecutive months or 5 months within any 12-month period during which the Contractor does not meet the Performance Standards for System Availability.

Blank Page