RFP CSI-2603 Digital Exam Assessment Solution.pdf

[COVER PAGE PLACEHOLDER]

[Grab your reader’s attention with a great quote from the document or use this space to emphasize a key point.

To place this text box anywhere on the page, just drag it.]

REQUEST FOR PROPOSALS

CSI-2603

Digital Exam Assessment Solution Issue Date: June 2, 2026 Proposal Submission Due: July 8, 2026

Designated Contact:

Marino Pawlowski 2800 Victory Boulevard, Building 3A Room 102 Staten Island, NY 10314 Marino.Pawlowski@csi.cuny.edu mailto:Marino.Pawlowski@csi.cuny.edu

Table of Contents

Part 1: Key Events and Dates; Designated Contacts; Proposal Due Location; Contract Term

Part 2: Proposer Qualifications and Requirements; and Diversity Participation Goals

Part 3: Project Objectives and Scope; Detailed Specifications and Deliverables and Certain Contract Specific Provisions

Part 4: Technical and Management Proposal Requirements (Proposal Volume II)

Part 5: Proposal Price Breakdown Pages (Proposal Volume III)

Part 6: Proposal Scoring Criteria and Weights

Part 7: Terms and Conditions of Contract

Part 8: Service Level Agreement (if applicable)

Part 9: Supplier Diversity Provisions

Part 10: RFP Requirements

FORMS THAT MUST BE SUBMITTED WITH THE PROPOSAL

� Form 1: Proper Information and Authorized Signature; Acceptance of Contract Terms; Proper Certifications;

Confidential Information; Signed RFP Addenda; and References

� Form 2: Offeror’s Affirmation of Understanding of And Agreement pursuant to State Finance Law § 139-j(3) and § 139-j(6)(b)

� Form 3: Offeror’s Disclosure of Prior Non-Responsibility Determinations and Certification of Compliance with State Finance Law § 139-j and § 139-k

� Form 4: Diversity Practices Questionnaire

� Form 5: Supplier Diversity (M/WBE/SDVOB) Utilization Plan and/or Supplier Diversity (MWBE/SDVOB) Request for Waiver Form (only for procurements with MWBE participation goals). Also see Supplier Diversity Provisions in Part 9.

� Form 6: RFP Checklist

FORMS THAT CUNY MAY REQUIRE FROM THE PRESUMPTIVE AWARDEE

If required by CUNY, the Presumptive Awardee selected as a result of this solicitation (the “Presumptive Awardee”) shall complete, sign, and submit the following forms and certifications as described in Section 2.3.5 through 2.3.12 of Part 10 of this RFP

� Form 7: Executive Law Article 15-A – Minority and Women-Owned Business Enterprises and Equal

Employment Opportunity Policy Statement

� Form 8: Evidence in form and substance satisfactory to the University that the Contractor maintains workers’ compensation coverage and disability insurance coverage as required by the New York State Workers’ Compensation Law, or is exempt from this requirement

� Form 9: New York State Vendor Responsibility Questionnaire (NYS VendRep)

� Form 10: New York City Vendor and Principal Questionnaire (NYC PASSPort)

� Form 20: Gender-Based Violence and the Workplace Certification

FORMS THAT THE CONTRACTOR MUST SUBMIT UPON REQUEST BY CUNY

� Form 11: CUNY Substitute W-9 Form

� Form 12: Workforce Utilization Report

� Form 13: Supplier Diversity (MWBE/SDVOB) Quarterly Contractor Compliance &Payment Report

� Form 14: State Consultant Services – Contractor’s Planned Employment (Consultant Disclosure Form A)

� Form 15: State Consultant Services Contractor’s Annual Employment Report (Consultant Disclosure Form B)

� Form 16: Tax Law §5-a, Form ST-220-CA – Contractor Certification (Contractor to send to the University)

� Form 17: Tax Law §5-a, Form ST-220-TD – Contractor Certification (Contractor to send to the State)

� Form 18: Certified Weekly Payroll Report (for building services and public works contracts)

� Form 19: Contractor’s Safety Protocols (prepared by the Contractor)

� If requested by the University, an Accessibility Conformance Report (“ACR”) or a completed Voluntary

Product Accessibility Template (“VPAT”) (If requested by University, MUST be submitted by Proposer, reviewed, verified, and accepted by CUNY prior to award of Contract, and Proposer MUST provide test temporary credentials for the appropriate University staff person to perform a test of the Services to ensure the Services meet the requisite accessibility standards).

� If requested by the University, a Service Organization Control (SOC) 2 Type 2, and a Higher Education

Community Vendor Assessment Toolkit (HECVAT), MUST be submitted by Proposer, reviewed, verified and accepted by CUNY prior to award of Contract.

[REMAINDER OF PAGE INTENTIONALLY LEFT BLANK]

Part 1: Key Events and Dates; Designated Contacts; Proposal Due Location; Contract Term

Key Events and Dates

Action Date CUNY issues RFP for Digital Exam Assessment Solution

June 2, 2026

Procurement Lobbying Law Restrictions Begin June 2, 2026 Submission of Written Questions Due Date 1 Submission of Written Questions Due Date 2

June 11, 2026 June 25, 2026

Proposal Submission Due Date and Time Proposal Due Location:

[see below]

July 8, 2026 at 12:00 pm Eastern Standard Time

Proposers are advised to read all sections of this RFP document carefully, with emphasis on all terms and conditions. By tendering a response to this solicitation, each Proposer agrees that it accepts all terms and conditions in the package without exception. If a Proposer requires clarification on, or seeks to propose an exception to, any of the terms and conditions contained in this RFP solicitation package, including to any of the terms and conditions to the form of contract in Part 7, then Proposer must make any and all such requests in writing as part of a submission of written questions prior to the Written Questions Due Dates listed above. Requests for revisions or exceptions will be evaluated on a case-by-case basis, and determinations will be published in an addendum to the RFP. Proposers are not to rely upon an exception agreed to for a prior contract award to govern the terms of this solicitation – all proposed exceptions must be introduced and incorporated via addendum issued specifically for this solicitation. A Proposer who submits requests for changes to the contract terms to the solicitation after the Written Questions Due Dates may result in the Proposer’s submittal being deemed non-responsive by the University and not considered for contract award. For the avoidance of doubt, the University will not consider any requests to revise the contract terms after the Proposal Submission Due Date, and the University will not consider any requests to revise the contract terms after tentative Contract Award.

CUNY reserves the right to amend any or all of the above dates and CUNY will issue such amendment in writing.

I. Designated Contact(s):

In compliance with the Procurement Lobbying Law, the individual(s) identified below are the Designated Contact(s) for this Request for Proposals solicitation and may be contacted by email for all inquiries regarding this solicitation:

The City University of New York – College of Staten Island 2800 Victory Boulevard Staten Island, NY 10314 Attention: Marino Pawlowski, Finance Procurement Director E-mail: Marino.Pawlowski@csi.cuny.edu

New York State Procurement Lobbying Law permits rejection of a Proposal if a Proposer has made any unauthorized contact during the Restricted Period (as defined in the Procurement Lobbying Law).

mailto:Marino.Pawlowski@csi.cuny.edu

Multiple violations of procurement lobbying restrictions regarding permissible contacts may lead to a Proposer’s being debarred from participating in future New York State procurements.

II. Proposal Due Location:

The City University of New York – College of Staten Island 2800 Victory Boulevard Building 3A – Room 102 Staten Island, NY 10314 Attn: RFP CSI-2603 – Digital Exam Assessment Solution

The College is not responsible for the delivery or submission of responses to this RFP (“Proposals”).

To ensure proper sorting, please note that the package must list the RFP # and the Proposer’s name clearly on the outside of the package. Only Proposals that are sent, and accepted by the Designated Contact, shall be accepted. CUNY is not responsible for Proposals received after the deadline, regardless of the reason for lateness. The College is not responsible for the misidentification of packages.

III. Anticipated Number of Contracts & Method of Award

CUNY anticipates awarding up to one (1) contract as a result of this RFP (the “Contract”), which will be awarded, if at all, to the Proposer with the highest scoring Proposal (the “Contractor”) in accordance with the evaluation process outlined in Part 6 (such written determination by the University to a Proposer stating that the University has accepted a Proposal, a “Contract Award”).

The University reserves the right to determine the maximum amount of the Contract. provided that the rate(s) payable for the Services shall not exceed the rates established in the Contractor’s Proposal Price Breakdown (Part 5 of this RFP).

IV. Contract Term:

The Contract will have an initial term of three (3) years (the “Initial Term”). The College, in its sole discretion, may extend the Contract for up to two (2) additional one-year terms (each, an “Additional Term”). The Initial Term, plus each Additional Term, if any, comprise the term of the Contract (the “Term”). The anticipated start date of the Term is anticipated to coincide with the first day of the College’s Spring 2027 semester, subject to review and approval by the Attorney General and the New York State Comptroller as applicable.

[INTENTIONALLY LEFT BLANK]

Part 2: Proposer Qualifications and Requirements; and Diversity Participation Goals

Paragraph I: Minimum Proposer Qualifications:

CUNY seeks a firm with experience in providing the services described herein. To be considered for Contract award, the Proposer and any Subcontractor(s) must meet the following minimum qualifications:

a. Proposer shall have at least three (3) years of verifiable experience in onboarding, implementing and supporting a digital exam assessment solution for higher education institutions that are comparable in size and complexity to the College of Staten Island;

b. Within the past five (5) years, the Proposer shall have had at least three (3) contracts for this service with higher education or public sector customers that are comparable in size and complexity to the College of Staten Island;

c. Proposer’s solution shall comply with all mandatory requirements listed in Part 3. As such, the Proposer shall submit completed Part 3, Attachment A: Technical Requirements Checklist, and meet the requirements listed therein.

Paragraph II: Non-Mandatory Proposer Qualifications:

Not Applicable

Paragraph III: Diversity Participation Goals

CUNY has established a 0% participation goal (based on the current availability of qualified MWBEs) in the aggregate for New York State certified Minority-Owned Business Enterprise ("MBE") and Women-Owned Business Enterprises ("WBE", and, together with MBE, "MWBEs") and a 0% participation goal (based on the current availability of qualified SDVOBs) for New York State certified Service-Disabled Veteran-Owned Businesses ("SDVOB"), to be part of the proposed team to provide the services as subcontractor(s) or suppliers (the "Subcontractor(s)"). The Contractor shall be required to use good faith efforts to meet these participation goals.

Proposers may identify potential MWBE Subcontractor(s) by, among other means, referencing the directory of New York State certified MWBEs found at the following internet address:

https://ny.newnycontracts.com/

Proposers may identify potential SDVOB Subcontractor(s) by, among other means, referencing the list of New York State certified SDVOBs found at the following internet address: https://ogs.ny.gov/veterans.

As part of the proposer's response, a Supplier Diversity — MWBE/SDVOB Utilization Plan or a Request for Waiver form that is accompanied by supporting documentation must be submitted in order for the proposal to be considered responsive. The selected Contractor will be required to complete a Quarterly Contractor Compliance & Payment Report accompanied by proof of payment to MWBE/SDVOB Subcontractor(s), in such format as shall be required by CUNY on a quarterly basis during the term of the contract. Sample CUNY Supplier Diversity forms and reports may be found at https://www1.cuny.edu/sites/selltocuny/.

https://ny.newnycontracts.com/ https://ogs.ny.gov/veterans https://www1.cuny.edu/sites/selltocuny/

Part 3: Project Objectives and Scope; Detailed Specifications and Deliverables;

and Certain Contract-Specific Provisions

Part 3: Project Objectives and Scope; Detailed Specifications and Deliverables;

and Certain Contract-Specific Provisions

3.1 Project Objectives and Scope:

The City University of New York (“University”), on behalf of the College of Staten Island (“College” or “CSI”) is soliciting proposals from vendors that can furnish a commercial off the shelf software solution (“Solution”) designed to administer digital exam assessments in a secure environment for the College’s Department of Nursing. The College seeks a product that is user-friendly and user-adaptive, with the capability to administer feedback on student knowledge gaps and provide recommendations to improve student learning outcomes on the National Council Licensure Examination (the “NCLEX”), as described in further detail herein.

Access to the Solution shall be provided on an annual basis, and the Contractor shall provide a firm fixed price for licenses for each student enrolled in the Nursing program and administrator-level access provided to Department of Nursing faculty and staff. The College’s Nursing Department typically enrolls 400 students and has approximately 20 faculty members.

The Contract Term will be for an initial term of three (3) years. The College, in its sole discretion, may renew this Contract for two (2) additional one-year terms. The anticipated start date of the Contract is anticipated to coincide with the first day of the College’s Spring 2027 semester.

In order to meet the requirements to provide a Solution as stated above, the College shall evaluate proposals to determine the proposal that provides the best value to the College in accordance with the scoring criteria set forth in Part 6 of this RFP, and enter into contract with the selected vendor to: (a) furnish a software Solution that complies with the requirements stated herein on a per-seat basis for each student enrolled in the Nursing program as well as faculty/staff/administrator(s); (b) provide any requisite initial onboarding/provisioning of the software Solution, and ongoing technical support, on an as-needed basis; and (c) provide training on the system, if requested by CUNY (collectively, the “Services”).

The highest-scoring responsive and responsible proposer (per the terms of this RFP) which enters into a contract with the College, is referred to in this RFP as the “Contractor.” The RFP document to which this Scope attached, including all attachments and exhibits incorporated herein, shall, together with the Contractor’s Proposal and its attachments, comprise the full agreement between the College and Contractor (the “Contract”). This resulting Contract, including all terms of this RFP, shall supersede any “click-through,” “click-wrap,” and all other electronically presented or posted End User License Agreements or other similar terms and conditions provided by Contractor or any parent or affiliate thereof. Furthermore, all such “click-through,” “click-wrap,” and all other electronically presented or posted End User License Agreements or other similar terms and conditions shall be void except to the extent included in Contractor’s Proposal in accordance with Part 4 of this RFP.

3.2 Mandatory Requirements. Contractor shall provide a Solution that includes, at a minimum, all of the following capabilities:

3.2.1 – System Requirements

a. The Solution must comply with the University’s “Information Technology Performance

Requirements” incorporated herein Attachment B, and Appendix B: Information

Security. All Respondents are advised that award of the Contract is contingent on an IT Security Review approval;

b. The Solution must meet the Americans with Disabilities (ADA) compliance requirements, subject to review and confirmation by the College as a pre-requisite to contract award, including confirmation that the proposed solution meets WCAG Guidelines;

c. The Solution must be capable of integrating with single sign-on to the University’s IT framework;

d. The Solution must include access to an online support and/or help center that covers basic troubleshooting issues without direct Contractor intervention; and

e. The Solution must have a notification feature in the event of a security breach, as well as an audit trail to indicate when users and administrators accessed the system.

3.2.2 – Content/Functional Requirements

a. The Solution must be capable of generating a variety of question types, including but not limited to multiple choice, hot-spot highlighting, drag and drop, drop-down selections, matching, and spreadsheet completion;

b. The Solution must be capable of creating and storing test banks;

c. The Solution must be capable of automatically grading and posting exams for student review;

d. The Solution must be capable of integrating instructor feedback, either on specific questions or on the overall exam result, as required;

e. The Solution must be capable of generating analytics that are capable of interpreting individual student and student group performance, based on responses to questions.

Additionally, the Solution’s analytics must be capable of interpreting whether gaps in curriculum may exist and/or linked to learning outcomes;

f. The Solution must have a tagging system for questions to allow for ease of organization, and to assist in determining areas of strength or weakness in student’s understanding of material;

g. The Solution must have a lock-out feature and block Wi-Fi access to ensure integrity during a student’s exam attempt.

3.2.3 Support Services

a. Contractor shall provide online technical services, minimally through online and chat, as well as course access assistance during business hours. This includes online interaction with both students and faculty regarding student access to and/or completion status of courses. No integration into CUNY’s Learning Management System (LMS) is required from the Contractor.

b. Contractor shall identify a liaison to communicate with faculty for support related to student access, completion certificates, or technical issues. CUNY will directly contact the liaison to provide student lists and seek clarifications on matters such as student access, course progression, and completion details.

3.3 Security and Technical Requirements

3.3.1 The Contractor shall provide a Solution that meets the following standards concerning data protection:

a. Includes a secure multi-level network and application infrastructure.

b. Provides regular updates on application security through vulnerability assessment and penetration testing tools.

c. Capability to assign a user ID by CUNY to each user with access to a computer and ensure passwords are complex and not easy to guess.

d. Restricts access to CUNY data based upon the individual's business need to know designation.

e. Maintains a security policy that applies to all personnel with access to CUNY data.

f. Encrypts transmission and storage of all non-public University information, including passwords accessible through a web application, email, bulk data transmission, and data storage at hosting onsite or offsite locations.

3.3.2 Contractor shall comply with all applicable CUNY IT policies and procedures.

3.3.3 The Contractor’s Solution and user functionality must be fully responsive and accessible via multiple devices, including desktops, laptops, tablets, and smartphones. The Contractor shall not be responsible for providing such devices. The Solution must support the latest versions of major web browsers and operating systems.

3.4 Training Requirements

If requested by CUNY, the Contractor shall provide training on usage of the Solution. The Contractor shall develop a training plan, including any training materials, subject to review and approval by the College that will cover usage by user type and permissions. The Contractor shall also deliver the training remotely or in person at no extra charge if requested by the College, using a meeting modality (Microsoft Teams, Zoom) to be determined by the College. The College anticipates holding up to (3) training sessions, each with 5-10 College faculty and staff. The College reserves the discretion to request fewer than three training sessions, and will pay on a per-session basis in accordance with the Contractor’s Proposal Price.

The College reserves the right to record any training(s) for future internal training use.

3.5 Project Team

The Contractor shall designate to CUNY a manager of the Contractor's firm as the Contractor's manager for this software subscription ("Manager"). The Manager shall:

a. serve as the principal liaison between CUNY and the Contractor for purposes of administration of the Contract;

b. be an employee of the Contractor (and not a consultant, Contractor or subcontractor);

c. have full decision-making authority on behalf of the Contractor, including the authority to obligate the Contractor;

d. maintain control over the Solution;

e. conduct meetings and provide status reports as requested;

f. provide meeting summaries (minutes) within two (2) business days of meetings; and

g. resolve any CUNY questions and comments on the submitted deliverables.

In the event of a mid-term change of the Manager or during the Manager's absence, the Contractor shall promptly provide a detailed continuity plan for CUNY's approval.

The Contractor shall ensure that CUNY has access to an individual with full authority to make decisions on the Contractor's behalf. Nothing in this section shall be deemed to preclude CUNY from discussing matters relating to the Contract with any other contractor organization members.

3.8 Contractor Responsibilities – General

3.8.1 Subcontracting.

See Part 7 of this RFP (Terms and Conditions).

3.8.2 Location of Services.

Contractor shall provide and use its own equipment for its staff providing the services. Other than the Training, as described in Section 3.4, which may be conducted on-site at the College’s option, CUNY will determine whether any other Services at any given point in time will be provided in-person or remotely, and Contractor shall comply with CUNY’s instructions regarding work location.

CUNY reserves the right to require all Services to be provided in-person, or to be provided remotely.

3.8.3 Communications

Contractor shall obtain CUNY’s prior written approval before Contractor, or any of its officers, employees, agents or subcontractor(s), makes any statement to the press or issues any communication or publication concerning, or related to, the Services.

3.8.4 Document Delivery

Not Applicable.

3.8.5. Return of CUNY Information at Termination

Within ten (10) calendar days of termination of the Contract for any reason, Contractor shall, with respect to all CUNY documents and data, in whatever media, whether originally provided or created during performance of the Services:

3.8.5.1 return them to CUNY; and

3.8.5.2 provide independent certification of destruction of all copies not returned to CUNY.

3.8.6 Invoices

3.8.6.1 Contractor shall submit invoices to –College’s Accounts Payable Department at a time interval and in a format approved by the Business Office with a copy to the

Department Chair of Nursing or their designee. Students will be enrolled in courses on a semesterly basis and billing shall reflect semesterly enrollment.

Invoices shall indicate the price per student, for the applicable billing period, as well as the number of enrolled students in each course during the billing period.

3.8.6.2 Contractor shall provide sufficient and appropriate documentation with invoices.

CUNY reserves the right to request additional information at any time.

3.8.6.3 Report preparation, including editing, printing and delivery to the University and Colleges, shall be the sole responsibility of the Contractor and shall not be reimbursable as a direct cost. If unusual circumstances are encountered that make it necessary for the Contractor to provide additional services, Contractor will be required to report such conditions to the College. No services outside the scope or beyond the stated term of the Contract may be performed unless authorized in writing by CUNY in advance.

3.9 CUNY Responsibilities and Exclusions

3.9.1 CUNY will identify a Manager to act as the liaison with the Contractor.

3.9.2 CUNY staff will be available to provide documentation and explanations as may be required, subject to reasonable scheduling restrictions.

3.9.3 CUNY will provide Contractor with CUNY holiday schedules.

3.9.4 CUNY will not provide clerical support.

3.9.5 CUNY will pay Contractor only upon acceptance properly prepared invoices with sufficient supporting documentation. Further, CUNY reserves the right to specify the method of payment (i.e. wire or check or electronic funds transfer). CUNY reserves the right to request additional information at any time and CUNY may reject any invoice that does not contain the information that CUNY requires.

3.9.6 CUNY will not pay Contractor for work performed beyond the scope of this Contract or for any Services or change order not duly authorized.

3.9.7 CUNY will not provide Contractor with any computer hardware, software, or other equipment.

3.10 Invoicing and Payment for Services

CUNY agrees to pay, and the Contractor agrees to accept the total amount indicated in the Price Proposal Breakdown (Attachment 5) as the maximum payment for the Services provided under this Contract. There is no minimum guarantee of Services under this Contract and Contractor’s total proposal price shall in no way be construed as a guaranteed payment.

3.10.1 Prices proposed by Contractor shall be fully-loaded rates, inclusive of all costs and expenses necessary to complete the Services, including but not limited to labor, supplies, travel, insurance, and taxes. No other amounts shall be payable under this Contract.

3.10.2 Contractor shall submit invoices on a monthly basis (or such other frequency as designated by CUNY in writing), indicating the amount of hours worked by each individual during the billing period, and including supporting documentation as required by CUNY to verify the billings.

3.11 Student Selection and Enrollment

3.11.1 At the start of each annual billing period, the College will provide the Contractor with a list of students who are enrolled in the applicable program(s) at the College and will require access (or continued access) to the Solution. Thirty (30) days after the first day of class for each cohort, the College will provide an updated list of students who are still enrolled, for billing purposes.

3.11.2 Contractor shall provide login credentials and access to the Solution for students identified by the College at the start of the semester.

3.12 Accessibility

3.12.1 The Contractor shall comply with all applicable federal and state laws and regulations regarding the accessibility of the Solution for those who are disabled. Any network-based information and applications development, or programming, including, but not limited to, websites delivered to or by the State of New York pursuant to this contract or procurement, will comply with Section 508 of the Rehabilitation Act of 1973, as amended, Executive Law Section 170-f, as amended, and be consistent with New York State Enterprise IT Policy NYS- P08-005, Accessibility of Information Communication Technology, as such policy may be amended, modified or superseded (the “Accessibility Policy”). The Accessibility Policy requires that State Entity Information Communication Technology shall be accessible to all users, including those with disabilities as determined by accessibility compliance testing.

Such accessibility compliance testing will be conducted by CUNY and any report on the results of such testing must be satisfactory to CUNY, as an explicit condition of being awarded the Contract.

3.12.2 In accordance with Section 170-f of the New York State Executive Law, Contractor represents and warrants that the Solution’s online content and functionality shall conform to the most current version of the Web Content Accessibility Guidelines adopted by the World Wide Web Consortium for accessibility (“WCAG Standards”), or any successor standards, which is incorporated herein by reference.

3.12.3 If requested by the College, Contractor shall provide, prior to Contract Award, an

Accessibility Conformance Report (“ACR”) or a completed Voluntary Product Accessibility Template (“VPAT”) that clearly indicates the Solution’s compliance with the WCAG Standards. Please note that this document need not be submitted with the Proposal, but must be submitted as an explicit condition of being awarded the Contract, if requested by the College. If so requested, Contractor’s ACR or VPAT must be reviewed, verified, and accepted by the University prior to award of Contract. Proposer must provide test temporary credentials for the appropriate University staff person to perform a test of the Solution to ensure the Solution meets the requisite accessibility standards. The ACR or VPAT must reflect the Contractor’s current software release to CUNY. Contractor warrants that the Solution’s online content and functionality shall meet or exceed the accessibility standards specified in Contractor’s ACR or VPAT (if any) throughout the Term of this Contract.

3.12.4 If CUNY determines that a user of the Solution requires a special modification in order to make full use of the Solution, then CUNY shall promptly submit a written request to the Contractor for a modification to the software in writing, and Contractor shall use commercially reasonable efforts to provide such modification promptly. In the event that the requested modification requires more than commercially reasonable efforts, then the Contractor shall engage in good faith negotiations with CUNY to amend the Contract as necessary to provide for the requested modification of the Services. In the event that the Services cannot, following good faith negotiations by both parties, be modified in accordance with this section to enable the user to make full use of the Solution, then the University shall have the right to terminate the Contract upon thirty (30) days’ written notice.

3.12.5 The University will not award a Contract to any Proposer which: (a) fails to submit an ACR or completed VPAT (if requested) that clearly indicates the Solution’s compliance with the WCAG standards; (b) submits an ACR or completed VPAT that does not conform to the Solution’s accessibility features as verified and tested by the University; (c) proposes a Solution which, upon testing, the University determines do not meet the accessibility standards stated herein; or (d) does not provide the necessary credentials to allow the appropriate University staff person to test and verify the accessibility of the online content and functionality of the proposed Solution.

Attachment A: Technical Requirements Checklist.

Digital Examination Assessment Solution

Respondent’s Name ………………….

No Requirement Yes No

Mandatory System Requirements

1 Solution complies the University’s “Information Technology Performance Requirements” incorporated herein as Attachment B, and Appendix B: Information Security. Respondent acknowledges and understands that award of a Contract is contingent on an IT Security Review approval.

2 Solution complies with Americans with Disabilities (ADA) compliance requirements, and has attached a WCAG 2.2 with its Proposal response.

3 Solution has single sign-on integration capabilities, and can be integrated with the University’s IT framework.

4 Solution includes access to an online support and/or help center that covers basic troubleshooting issues without direct Contractor intervention.

5 Solution has a notification feature in the event of a security breach, as well as an audit trail to indicate when users and/or administrators accessed the system.

Mandatory Content/Functional Requirements

6 Solution is capable of generating a variety of question types, including but not limited to multiple choice, hot-spot highlighting, drag and drop, drop-down selections, matching, and spreadsheet completion.

7 Solution is capable of creating and storing exam banks.

8 Solution is capable of automatically grading and posting exams for student review.

9 Solution is capable of integrating instructor feedback, either on specific questions or on the overall exam result, as required.

10 Solution is capable of generating statistical analytics that are capable of interpreting individual student and student group performance, based on responses to questions. Examples of acceptable statistical analytics include, but are not necessarily limited to, point-biserial correlation, and Cronbach’s alpha measures. Additionally, the Solution’s analytics must be capable of providing descriptive statistics to indicate whether gaps in curriculum may exist and/or linked to learning outcomes.

11 The Solution must have a tagging system for questions to allow for ease of organization for multiple class sections, and to assist in determining areas of strength or weakness in student’s understanding of material

12 The Solution must have a lock-out feature and block Wi-Fi access and cheating detection functions to ensure integrity during a student’s exam attempt.

Signature Page Follows

Authorized Representative …………………………...

Signature …………………………...

Date …………………………...

RFP CSI-2603, SCOPE OF WORK ATTACHMENT B

INFORMATION TECHNOLOGY PERFORMANCE REQUIREMENTS

Introduction

The City University of New York (the “University” or “CUNY”) is committed to ensuring that all technology products and services adhere to required and industry standards of accessibility, security, and compatibility with existing enterprise systems.

These terms set forth essential requirements and standards that contractors must meet when providing technology solutions to CUNY - including accessibility, authentication and access control, IT security, PeopleSoft/CUNYfirst/Workday integrations, project management, and preferred service standards.

CUNY places a high priority on contractors providing exceptional technical support, customer service, and a positive user experience for the University's constituents; all contractors (the “Contractor(s)”) must ensure that their products, solutions, applications, platforms, and services (“Services”) are user-friendly, reliable, and supported by highly responsive customer service teams.

The language of the Solicitation or Contract is directed at Contractor unless specifically stated otherwise.

The Solicitation or Contract language and attachments are complementary, and what is called for by one shall be as binding as if called for by all. In the event of conflicting provisions within or among the specifications, and the terms and conditions, Contractor is obligated to seek clarification from University as soon as Contractor becomes aware of any conflicting provisions; in general, however, Contractor is obligated to provide the most expensive option, and the more specific provision will take precedence over the less specific; the more stringent will take precedence over the less stringent; and the more expensive item will take precedence over the less expensive item.

Contractor shall comply with all laws, regulations, rules, orders-including executive orders, requirements, and the like of federal, state, and local governments, courts, governmental authorities, legislative bodies, boards, agencies, commissions, and the like (“Law(s)”) with respect to this Solicitation or Contract. If there is a conflict between or among any laws and specific requirements of this Solicitation or Contract, then Contractor shall comply with the most stringent Law in each instance. By noting any specific Laws with particularity in this Solicitation or Contract or in any other prior or future communication, Contractor is not relieved of any obligation to comply with all Laws, and the University does not waive any rights it may have with respect to such compliance.

Accessibility

The Contractor must comply with all applicable federal and state laws and regulations regarding the accessibility of the Services for those who are disabled. Any network-based information and applications development, or programming, including, but not limited to, websites delivered to or by the State of New York pursuant to this contract or procurement, will comply with Section 508 of the Rehabilitation Act of 1973, as amended, Executive Law Section 170-f, as amended, and be consistent with New York State Enterprise IT Policy NYS-P08-005, Accessibility of Information Communication Technology, as such policy may be amended, modified, or superseded (the “Accessibility Policy”). The Accessibility Policy requires, and Contractor must ensure that State Entity Information Communication

Technology shall be accessible to all users, including those with disabilities as determined by accessibility compliance testing. Such accessibility compliance testing will be conducted by CUNY and any report on the results of such testing must be satisfactory to CUNY, as an explicit condition of being awarded the Contract.

In accordance with Section 170-f of the New York State Executive Law, Contractor represents and warrants that the Services’ online content and functionality shall conform to the most current version of the Web Content Accessibility Guidelines adopted by the World Wide Web Consortium for accessibility or any successor guidelines/standards (“WCAG Standards”), that are incorporated herein by reference.

Upon request and prior to Contract Award, vendors seeking to be awarded a contract by the University must provide an Accessibility Conformance Report (“ACR”) or a completed Voluntary Product Accessibility Template (“VPAT”) that includes vendor’s representation and warranty that the Services comply with the WCAG Standards. Please note that an ACR or VPAT need not be submitted with a Bid Submission, Proposal or Quote but if requested, then vendor must submit an ACR or VPAT upon request within the timeframe required by the University as an explicit condition prior to being awarded a Contract. The ACR or VPAT must reflect the vendor’s current software release of the Services. Vendor will be required to warrant that the Services’ online content and functionality shall meet or exceed the accessibility standards specified in its ACR or VPAT throughout the Term of this Contract.

Upon request, Contractor also must provide temporary test credentials to the University so that the University is able to perform a test of the Services to verify that the Services meet the requisite accessibility standards.

CUNY will need to review, verify, and accept Contractor’s ACR or VPAT prior to the award of a contract.

If after award of a contract to a vendor (“Contractor”), CUNY determines that a user of the Services requires a special modification in order to comply with WCAG Standards, then the University shall submit a written request to the Contractor for a modification to the Services, and the Contractor shall use commercially reasonable efforts to provide necessary modification(s) promptly. In the event that compliance with WCAG standards requires more than commercially reasonable efforts, then the Contractor shall engage in good faith negotiations with CUNY to amend the Contract. In the event that the Contractor cannot modify the Services to comply with WCAG Standards following good faith negotiations to amend the Contract, then the University shall have the right to terminate the Contract upon thirty (30) days’ written notice.

The University will not award a Contract to any vendor that: (a) if requested, fails to promptly submit an ACR or completed VPAT that verifies the Services’ compliance with WCAG Standards; (b) submits an ACR or completed VPAT that does not meet WCAG Standards ; (c) does not provide the necessary credentials to allow the University to test and verify the accessibility of the online content and functionality of the proposed Services; or (d) provides temporary test credentials that result in a determination that demonstrates that the Services do not meet requisite accessibility standards.

Authentication and Access Control

All Services must meet the following Single Sign-On (SSO) and Authentication Requirements.

Contractor must ensure that the fully configured software solution that it provides as part of the Services and deploys at CUNY, including all updates and patches (“Solution”) integrate with CUNY Login, the centralized authentication system powered by the Oracle Access Management (OAM) suite.

Contractor must support seamless integration of the Solution with CUNY Login to enable Single Sign-On (SSO) and secure authentication for all CUNY users.

To ensure compatibility and successful integration, the Contractor must ensure that the Solution must:

1. Support Standard Authentication Protocols:

• The Contractor must ensure that the Solution support one or more of the following standard authentication mechanisms to integrate with CUNY Login:

o SAML 2.0: The Contractor must ensure that the Solution act as a Service Provider (SP) and accept SAML assertions from CUNY Login.

o OpenID Connect (OIDC): The Solution must support OIDC flows for authentication.

o OAuth 2.0: If API-level access is required, the Solution must support OAuth 2.0 for token-based authentication.

o Header-Based Authentication: For Solutions hosted within CUNY’s data centers, the

Solution can support header-based authentication as an alternative mechanism provided by OAM if any of the federation protocols are not supported. The Solution must securely validate headers and handle user attributes passed through them.

2. Enable SSO Workflow:

• The Solution must redirect unauthenticated users to CUNY Login for authentication.

• The Solution must process the authentication response from OAM to establish user sessions.

3. Session Management:

• The Contractor must ensure that the Solution support session timeout and Single Logout (SLO) mechanisms as defined by CUNY Login. If the Contractor’s Solution does not support SAML SLO or SAML Logout, then the Solution must support the use of the IdP's logout redirect URL to ensure that sessions are cleared gracefully at the IdP level.

• In cases where logout-related options are unavailable, the Contractor, through its application development team, must work toward an enhancement solution in collaboration with CUNY’s IT team. The Contractor will submit the resulting solution to CUNY for review by CUNY and must be approved by CUNY prior to implementation.

4. Attribute Handling:

• The Contractor must ensure that the Solution supports the mapping of user attributes provided by CUNY Login, such as emplID, email, roles, and other custom attributes required for authorization and personalization.

5. Security and Compliance:

• The Contractor must ensure that the Solution uses secure protocols (e.g., HTTPS) for communication with CUNY Login.

• The Contractor must ensure that the Solution complies with CUNY’s security policies and relevant regulatory requirements for data protection.

IT Security

The University’s Information Security division provides a comprehensive management framework that includes policies, assessments, tools, and tested procedures to build defensive strategies and capabilities for effective responses.

The Contractor’s Services must adhere to industry best practices - including regular intrusion detection, firewalls, and layered security including anti-virus and anti-spam protection where applicable. The Solution must include/have measures to ensure that data records are transported, stored, and accessed in a secure manner and that information being displayed on websites or transmitted over internet has not been altered in any way by an unauthorized party.

To ensure the highest standards of IT security during the term of the Contract, Contractor must adhere to the CUNY Service Provider Standard, including incident response protocols during the term of the Contract. Also, annually, the Contractor must timely submit all required reports, including SOC2, PCI, or

SSAE.

Vendors must follow CUNY's cybersecurity best practices to maintain a secure working environment, including adhering to the CUNY Policy on Acceptable Use of Digital Assets and Resources and the CUNY- Data-Classification-Standard

Service Standards/Service Level Agreements

The Contractor will be required to meet the following service standards. If service standards are not met, CUNY will be entitled to performance credits as described below.

Performance Service Levels

This Service Level Agreement ("SLA") sets forth the service level and performance objectives of the Contractor in providing its Solution (the "Services") to CUNY. The Contractor will use reasonable efforts to meet the following service level and performance objectives to support the operation of the facilities, server(s), computer equipment, operating software and connectivity used to provide the Services to CUNY.

(a) Uptime Commitment

The Contractor will use reasonable efforts to ensure the Contractor's Systems are available a minimum of 99.5% of the time (the "Uptime Commitment"). All Uptime Commitment will https://www.cuny.edu/wp-content/uploads/sites/4/page-assets/about/administration/offices/cis/information-security/security-policies-procedures/CUNY-Service-Provider-Standard.pdf https://www.cuny.edu/wp-content/uploads/sites/4/page-assets/about/administration/offices/legal-affairs/policies-resources/Computer-Use-1.pdf https://www.cuny.edu/wp-content/uploads/sites/4/page-assets/about/administration/offices/cis/it-policies/CUNY-Data-Classification-Standard.pdf https://www.cuny.edu/wp-content/uploads/sites/4/page-assets/about/administration/offices/cis/it-policies/CUNY-Data-Classification-Standard.pdf be measured within the Contractor's System on a monthly basis calculated to include twenty-four (24) hours per day over each month, but excluding from the numerator and denominator in the calculation the duration in time of any temporary shutdowns due to scheduled maintenance (which will not exceed in the aggregate sixteen (16) hours per month outside of normal business hours), telecommunications or power disruptions caused by third parties, and any other causes beyond Contractor's reasonable control. The Contractor agrees to notify CUNY promptly of any factor, occurrence, or event coming to its attention that may affect the Contractor's ability to meet the Uptime Commitment, or that is likely to cause any material interruption in the Services.

(b) Exclusive Remedy

The Contractor will use reasonable efforts to correct any material problems in the Services, including any failure to satisfy the Uptime Commitment. In the event that the Contractor fails to satisfy the Uptime Commitment for a given month, CUNY's sole and exclusive remedy will be to receive a service credit equal to the following percentage of the monthly fees for the Services for the stated uptime:

a. 98% to 99.5% - 10%

b. 95% to 97.9% - 25%

c. 92% to 94.9% - 40%

d. 90'% to 91.9 - 60%

e. Below 90% - 100%

In no event will the service credit exceed the monthly fees paid by CUNY for the Services.

CUNY acknowledges and agrees that if the remedies set forth in this section are applied, any failure of the Contractor to meet the requirements in this SLA will not constitute a breach of the Agreement.

(c) Monitoring

Contractor shall monitor and maintain Contractor's Systems in working order each day (24 x 7). Contractor shall proactively manage and monitor all application server hardware devices and software to ensure optimal performance and reliability as well as to detect abnormal events or exceeded utilization or performance thresholds. Contractor shall proactively monitor the status of the operating systems (e.g., CPU, disk 1/0, memory, processes, etc.), critical application layer daemons and processes and trigger appropriate event notification alarms caused by errors, exceeded thresholds, etc.

(d) Maintenance

Contractor shall operate, monitor and administer all servers, applications and networks supporting the Services. In order to provide such coverage, Contractor may utilize a mixture of on-site and on-call support staff, automated server monitoring and automated paging technology. Contactor's on-site coverage is during Contractor's normal business hours, Monday through Friday, excluding holidays recognized by Contractor and previously identified to CUNY.

(e) Scheduled Outages

Maintenance outages, if necessary, shall be conducted at a time and in a manner to minimize adverse impacts on the Services. Maintenance outages may include, but are not limited to the installation of upgrades, service packs and routine server or application configuration changes. Other maintenance outages may be necessary from time to time.

Contractor shall provide CUNY with reasonable advance written notice of scheduled outages, and CUNY reserves the right to require Contractor to schedule such planned outages at a different time.

(f) Change Control

Contractor shall install new equipment, software, releases, upgrades, fixes, patches and other items necessary to maintain Contractor's Systems to industry standards. Contractor shall proactively gather information from appropriate server, peripheral, operating system or database vendors regarding upgrades. defect patches or fixes.

(g) Notice

Contractor shall use reasonable efforts to give CUNY three (3) days' notice prior to all non-routine management, maintenance, change control or other actions by Contractor that may materially impact the Solution adversely.

(h) Support

Contractor shall provide an online CRM for CUNY to report, manage, and track support issues as well as a toll free support number.