UAlbany RFI #06162026JH - Physical Access Control System Solution.pdf

Request for Information (RFI)

Physical Access Control System Solution

Issuing Institution: State University of New York (SUNY) – University at Albany

RFI Number: 06162026JH

Release Date: 06/18/2026

Questions Due: 07/07/2026

Response Due Date: 07/17/2026

Purpose of this RFI University at Albany requests information on security solutions for an electronic physical access control system for our campuses.

This RFI is intended solely for information gathering and planning purposes. Responses to this RFI will assist the University in understanding available products, services, implementation approaches, industry best practices, and potential procurement strategies.

Organizational Background UAlbany is a mid-sized public institution enrolling over 17,000 students, with over 6,000 staff and faculty members and thousands of contractors on site every day. Combined with our summer conferences, active access control accounts range between 30,000 and 40,000 with some doors accommodating all patron credentials at the same time. Our multiple campuses and complexes in Albany, New York, include over 479 acres and 154 buildings with electronic access control implemented for most buildings’ interior and exterior doors and integrated traffic control gates.

Business and Technical Requirements Please respond to each of the following requirements and how the solution could meet these needs.

Must Haves:

• Solutions must be applicable but not limited to the following applications: residential, research laboratory, medical, office, classroom, datacenter, and other highly secure facility spaces and buildings.

• Solutions must be able to scale and support robust reporting and analytic capabilities from a centrally managed system to support our existing 4,000+ access control locations and future expansions. UAlbany currently uses card readers with Wiegand signaling from the door back to access control panels. Legacy devices include HID VertX control boards running CBORD/Illumia CSGold’s proprietary software; with all refreshed or newly installed locations using Mercury 4502 access controllers. Legacy door readers use magstripe or HID Prox technology while new and refreshed readers use our HID SEOS Elite Key format with HID Signo readers. UAlbany plans to convert to the OSDP signaling standard in the future.

• The access control solution must be able to integrate with our other enterprise systems for importing demographic, role, and scheduling information with a strong preference for open and well documented API-led integrations. We use o Oracle PeopleSoft Campus Solutions for student, staff, faculty, and class schedule information;

o Microsoft Entra ID or Shibboleth for Single Sign On (SSO);

o StarRez for housing assignments;

o CBORD/Ilumia CSGold with HID Fargo Connect for card issuance and credential management;

o Accruent’s EMS Event Management System for building hours, classroom scheduling, and event scheduling and management.

• APIs must support real-time activation and revocation of access assignments and/or schedules inside the access control system equipment and API, batch, webhook, or event-driven integrations for ingesting external system information for automated assignments.

• For roles and access assignments not automatically assigned via integration, the system must have a robust and auditable access request intake form and multi-level workflow with the ability for requests to be routed to appropriate approvers.

• Modern and intuitive administrative interfaces are accessible via the internet, accessed via desktop and mobile devices. These interfaces must be ADA-compliant per SUNY Standards https://www.suny.edu/accessibility/eit/

• Remote door open, unlock, lock, and status-checking capabilities.

• Emergency lockdown capabilities and access updates for rooms, buildings, zones, and pre-defined access schemas based on action plans.

https://www.suny.edu/accessibility/eit/

• Push notifications, alerts, and analytics for active security dashboards and management (card usage, security events, door patron velocity, anomaly detection, etc.).

• SSO compatibility with Microsoft Entra ID or Shibboleth, with preference to SAML or OpenID Connect.

• User-configurable role-based access control (RBAC) with varying access levels to all software modules and features and multirole support. Privileges would be held by roles/groups and users assigned to those roles/groups.

o Address role-based access control in the context of user permissions and building/door access level permissions.

o Indicate if any RBAC may be managed through integration.

• Bulk user and account management tools.

• Reporting and analytic capabilities with systems such as Tableau or Microsoft Fabric.

o Further, reporting and analytic export options (such as: CSV, Excel), custom reporting options, and access to full audit logs shall be required.

• Full lifecycle control of access control users, equipment, and entitlements via UI/APIs with bulk automation.

• User-configurable business rules.

• Time-based and rule-based access permissions.

• Support for multiple wired and wireless access control equipment manufacturers and technology including but not limited to door readers, biometrics, license plate readers, parking/car readers, intercoms, and cameras integrations.

• Ease of use and configuration of system and device settings and features including access control groups, facility trees/layouts, schedules, calendars, door alarms, and video camera interfaces.

• Mobile credential support (Apple Wallet / Google Wallet or equivalent).

• Describe system and equipment performance during failures and options to maintain operations. (EG battery backup, network offline modes, fail secure / open during power events, etc.).

Along with the above, the RFI should address the following:

• How does the system guide users through workflows and make tasks performable with minimal formal training?

• Self-service account management for patrons to perform actions such as:

o report cards or credentials lost and found, o request new credentials, o requests for access.

o Describe self-service functionality in your product.

Zoller, Jackie A Intercoms

• Business continuity, disaster recovery strategy, and data security plan.

• Cloud-based (SaaS) deployment options with documented Service Level Agreements.

• Data security, encryption, incident response, and industry standards compliance (FERPA, National Electrical Code, NYS Building and Fire Codes, etc.).

• Sandbox or test environment availability.

• Data migration tools and history transfer.

• Data retention and backup.

• Card issuance capabilities and recommended solutions.

• Equipment requirements, capacities, and specifications (readers, controllers, networking/communication needs, electrical needs, server requirements)

• Ability to interface with the University’s fire alarm monitoring systems

Additional Requested Information Please respond to the following questions

Solution Overview

1. Provide a summary of your product addressing the above business and technical requirements

2. What differentiates your solution from competitors?

3. What deployment options are available?

4. What are the licensing requirements for both internal and external components?

Implementation

5. Include a recommended timeline for installation, training, and implementation from the point of a purchase order.

6. How should system roles be structured?

7. What would the time allocation look like for both the university and vendors or subcontractors? Further, describe, broken out by equipment, programming, electrical work, etc. what will be required of the University to implement this system.

8. Provide an example of recommended device / facility layout or tree. Are there any limitations to the number of devices that can be grouped together?

9. Describe how the system interacts with police dispatch and security operation systems / dashboards; natively or through integrations.

Training and Support

10. Describe your support model

11. What Service Level Agreements are available

12. How frequently are updates released?

13. What level of client acceptance is required for an update to be implemented in production?

14. What training is typically needed or suggested for implementation and acceptable rollout/use?

15. What training is desirable for the ongoing, maximum efficiency, and best use of the system?

Higer Education Experience

16. Provide a list of comparable Institutions you currently support in Higher Education

17. Include Higher Education Community Vendor Assessment Toolkit (HECVAT, version 4.1 or above) and Product Accessibility Template (VPAT, version 2.5 or above) documents that have been updated in the past 12 months for evaluation.

a. Higher Education Community Vendor Assessment Toolkit | EDUCAUSE

Pricing Information (Optional)

18. The University is not currently requesting formal pricing. Any pricing information provided will be used solely for budgeting and planning purposes.

Submission Instructions

Responses should be submitted electronically in PDF format.

Submit responses to:

Jessica Hill jjhill@albany.edu

Responses desired to be received no later than:

July 17, 2026 at 5:00PM ET https://www.educause.edu/higher-education-community-vendor-assessment-toolkit

Additional Requested Information

Submission Instructions