[COVER PAGE PLACEHOLDER]

[Grab your reader’s attention with a great quote from the document or use this space to emphasize a key point.

To place this text box anywhere on the page, just drag it.]

REQUEST FOR PROPOSALS

UCO-997

Research Compliance Online Training

Issue Date: June 22, 2026 Proposal Submission Due: July 24, 2026, by 2:00 PM EST

Designated Contact:

Helena Gacina Purchasing Manager Helena.Gacina@cuny.edu

Table of Contents

Part 1: Key Events and Dates; Designated Contacts; Proposal Due Location; Contract Term

Part 2: Proposer Qualifications and Requirements; and Diversity Participation Goals

Part 3: Project Objectives and Scope; Detailed Specifications and Deliverables and Certain Contract Specific Provisions

Part 4: Technical and Management Proposal Requirements (Proposal Volume II)

Part 5: Proposal Price Breakdown Pages (Proposal Volume III)

Part 6: Proposal Scoring Criteria and Weights

Part 7: Terms and Conditions of Contract

Part 8: Service Level Agreement (if applicable)

Part 9: Supplier Diversity Provisions

Part 10: Important Notices to Proposers

FORMS THAT MUST BE SUBMITTED WITH THE PROPOSAL

□ Form 1: Proper Information and Authorized Signature; Acceptance of Contract Terms; Proper Certifications;

Confidential Information; Signed RFP Addenda; and References

□ Form 2: Offeror’s Affirmation of Understanding of And Agreement pursuant to State Finance Law § 139-j(3) and § 139-j(6)(b)

□ Form 3: Offeror’s Disclosure of Prior Non-Responsibility Determinations and Certification of Compliance with

State Finance Law § 139-j and § 139-k

□ Form 4: Diversity Practices Questionnaire

□ Form 5: Supplier Diversity (M/WBE/SDVOB) Utilization Plan and/or Supplier Diversity (MWBE/SDVOB)

Request for Waiver Form (only for procurements with MWBE participation goals). Also see Supplier

Diversity Provisions in Part 9.

□ Form 6: RFP Checklist and Minimum Requirements Checklist

□ Form 20: NYS State Finance Law § 139-Gender-Based Violence and the Workplace Certification

FORMS THAT CUNY MAY REQUIRE FROM THE PRESUMPTIVE AWARDEE

If required by CUNY, the Presumptive Awardee selected as a result of this solicitation (the “Presumptive Awardee”) shall complete, sign, and submit the following forms and certifications as described in Section 2.3.5 through 2.3.12 of Part 10 of this RFP.

□ Form 7: Executive Law Article 15-A – Minority and Women-Owned Business Enterprises and Equal

Employment Opportunity Policy Statement

UCO-997 page 2 of 119

□ Form 8: Evidence in form and substance satisfactory to the University that the Contractor maintains workers’ compensation coverage and disability insurance coverage as required by the New York State

Workers’ Compensation Law, or is exempt from this requirement.

□ Form 9: New York State Vendor Responsibility Questionnaire (NYS VendRep)

□ Form 10: New York City Vendor and Principal Questionnaire (NYC PASSPort)

FORMS THAT THE CONTRACTOR MUST SUBMIT UPON REQUEST BY CUNY BEFORE, DURING AND AFTER THE

PROPOSED CONTRACT TERM

□ Form 11: CUNY Substitute W-9 Form

□ Form 12: Workforce Utilization Report

□ Form 13: Supplier Diversity (MWBE/SDVOB) Quarterly Contractor Compliance & Payment Report

□ Form 14: State Consultant Services – Contractor’s Planned Employment (Consultant Disclosure Form A)

□ Form 15: State Consultant Services Contractor’s Annual Employment Report (Consultant Disclosure Form B)

□ Form 16: Tax Law §5-a, Form ST-220-CA – Contractor Certification (Contractor to send to the University)

□ Form 17: Tax Law §5-a, Form ST-220-TD – Contractor Certification (Contractor to send to the State)

□ Form 18: Certified Weekly Payroll Report (for building services and public works contracts)

□ Form 19: Contractor’s Safety Protocols (prepared by the Contractor)

□ If requested by the University, an Accessibility Conformance Report (“ACR”) or a completed Voluntary Product Accessibility Template (“VPAT”) (If requested by University, MUST be submitted by Proposer, reviewed, verified, and accepted by CUNY prior to award of Contract, and Proposer MUST provide test temporary credentials for the appropriate University staff person to perform a test of the Services to ensure the Services meet the requisite accessibility standards)

UCO-997 page 3 of 119

Part 1: Key Events and Dates; Designated Contacts; Proposal Due Location; Contract Term

Key Events and Dates Action Date

CUNY issues RFP for Research Compliance Online Training June 22, 2026

*Submission of Written Questions Due Date 1 June 30, 2026 by 1:00 PM Eastern Standard Time (EST)

*Submission of Written Questions Due Date 2 July 13, 2026 by 1:00 PM Eastern Standard Time (EST)

Proposal Submission Deadline July 24, 2026 by 2: 00 PM Eastern Standard time (EST)

Proposers are advised to read all sections of this RFP document carefully, with emphasis on all terms and conditions. By tendering a response to this solicitation, each proposer agrees that it accepts all terms and conditions in the package without exception. If a Proposer requires clarification, or seeks to propose a change or an exception to, any of the terms and conditions contained in the solicitation package, including to any of the terms and conditions to the form of contract in Part 7, then Proposer must make any and all such requests in writing prior to the Written Questions Due Dates listed above. Requests for revisions or exceptions will be evaluated on a case-by-case basis, and determinations will be published in an addendum to the RFP. Proposers are not to rely upon an exception agreed to for a prior contract award to govern the terms of this solicitation – all proposed exceptions must be introduced and incorporated via addendum issued specifically for this solicitation. A proposer who submits requests for changes to the solicitation or its terms after the Written Questions Due Date may result in the proposer’s Proposal submission being deemed non-responsive by the University and not considered for contract award. For the avoidance of doubt, the University will not consider any requests to revise the contract terms after the Proposal Submission Deadline, and the University will not consider any requests to revise the contract terms after tentative Contract award.

CUNY reserves the right to amend any or all of the above dates and will issue such change in writing.

I. Designated Contact(s):

In compliance with the Procurement Lobbying Law, the individual(s) identified below are the Designated Contact(s) for this Request for Proposals solicitation and may be contacted for all inquiries regarding this solicitation:

The City University of New York 205 East 42nd Street New York, NY 10017 Attention: Helena Gacina Email: helena.gacina@cuny.edu

New York State Procurement Lobbying Law permits rejection of a Proposal if a Proposer has made any unauthorized contact during the Restricted Period (as defined in the Procurement Lobbying Law).

Multiple violations of procurement lobbying restrictions regarding permissible contacts may lead to a Proposer’s being debarred from participating in future New York State procurements.

UCO-997 page 4 of 119 mailto:helena.gacina@cuny.edu

II. Proposal Due Location:

CUNY is not responsible for the delivery or submission of Proposals. Only Proposals that are sent, and accepted by the Designated Contact, shall be accepted. CUNY is not responsible for Proposals received after the deadline, regardless of the reason for lateness. On a case-by-case basis, CUNY may deem it acceptable for Proposals to be submitted via e-mail. For this solicitation, CUNY will be accepting proposals via email. Proposals may be sent to: Helena.Gacina@cuny.edu.

• Proposals submitted via e-mail must include scans of original (wet) signatures and notarizations to be considered a valid Proposal.

• Proposals (including any Excel spreadsheets) must be clearly labeled with three (3) separate pdf attachments clearly named for Volume I (Forms), Volume II (Technical Proposal), and Volume III (Price Proposal).

• Proposals submitted via e-mail must be clearly labeled with Proposer’s name and the RFP’s Project name by including the following subject line:

[Firm’s Name] – UCO 997 Research Compliance Online Training Proposal Submission

III. Anticipated Number of Contracts

CUNY anticipates awarding one (1) contract based on an evaluation of best value, as further described in

Part 6 of this RFP.

IV. Anticipated Contract Term:

The Contract Term will be for five (5) years, commencing on the date that the Contract is approved by the Attorney General and the New York State or New York City Comptroller, as applicable.

[INTENTIONALLY LEFT BLANK]

UCO-997 page 5 of 118UCO-997 page 5 of 119

Part 2: Proposer Qualifications and Requirements; and Diversity Participation Goals

Paragraph I: Minimum Proposer Qualifications [mandatory qualifications]:

CUNY seeks a firm with experience in providing the services described herein. To be considered for Contract award, the Proposer and any Subcontractor(s) must meet the following minimum qualifications:

a. Proposer shall have at least five (5) years of verifiable experience providing and supporting web-based research compliance training programs for higher education institutions.

b. Proposer must have successfully implemented such solutions at three (3) or more higher education institutions of similar scale and scope.

c. Proposer’s solution shall comply with all mandatory requirements listed in Part 3. As such, the Proposer shall submit all completed Part 3, Attachment A: Technical Requirements Checklist, and meet the requirements listed therein.

d. Proposer must be authorized to conduct business and provide its Services in the State of New York.

e. Proposer’s Subcontractors, if any, must also possess appropriate qualifications and an acceptable level of experience, as determined by CUNY in its sole discretion.

Paragraph II: Non-Mandatory Proposer Qualifications:

Not applicable.

Paragraph III: Supplier Diversity Participation Goals

• CUNY has established a 0% participation goal (based on the current availability of qualified MWBEs) in the aggregate for New York State certified Minority-Owned Business Enterprise ("MBE") and Women-Owned

Business Enterprises ("WBE", and, together with MBE, "MWBEs") and a 0% participation goal (based on the current availability of qualified SDVOBs) for New York State certified Service-Disabled Veteran-Owned

Businesses ("SDVOB"), to be part of the proposed team to provide the services as subcontractor(s) or suppliers (the "Subcontractor(s)"). The Contractor shall be required to use good faith efforts to meet these participation goals.

• Proposers may identify potential MWBE Subcontractor(s) by, among other means, referencing the directory of New York State certified MWBEs found at the following internet address: https://ny.newnycontracts.com/

• Proposers may identify potential SDVOB Subcontractor(s) by, among other means, referencing the list of New

York State certified SDVOBs found at the following internet address: https://ogs.ny.gov/veterans.

As part of the proposer's response, a Supplier Diversity — MWBE/SDVOB Utilization Plan or a Request for Waiver form that is accompanied by supporting documentation must be submitted in order for the proposal to be considered responsive. The selected Contractor will be required to complete a Quarterly Contractor Compliance & Payment Report accompanied by proof of payment to MWBE/SDVOB Subcontractor(s), in such format as shall be required by CUNY on a quarterly basis during the term of the contract. Sample CUNY Supplier Diversity forms and reports may be found at https://www1.cuny.edu/sites/selltocuny/.

UCO-997 page 6 of 119 https://ny.newnycontracts.com/ https://ogs.ny.gov/veterans https://www1.cuny.edu/sites/selltocuny/

Part 3: Project Objectives and Scope; Detailed Specifications and Deliverables;

and Contract-Specific Provisions

3.1 Project Objectives and Scope of Work:

The City University of New York (“CUNY” or the “University”) is the largest public university system in the United States. With twenty-six (26) colleges and schools, CUNY supports a broad and complex research enterprise involving faculty, staff, students, postdoctoral scholars, and affiliated researchers.

3.1.1 CUNY is committed to fostering a culture of ethical and compliant research. To support this mission, CUNY seeks to provide comprehensive, engaging, and accessible asynchronous online training in research compliance for all CUNY researchers. CUNY is soliciting proposals from experienced vendors to provide existing subscription-based, asynchronous, web-based research compliance training that uses both developed and customizable content, is delivered through the vendor’s hosted platform or compatible with CUNY’s learning management system, and is designed for use in higher education and other research-active environments (the “Solution”).

In order to meet the University’s research compliance training needs as described above, the selected vendor shall: (a) furnish a Solution that complies with the requirements set forth in this RFP; and (b) provide associated services, as applicable, including implementation support, configuration, training, and ongoing technical support. The provision of the Solution along with the aforementioned services in section (b) of this paragraph shall be referred to collectively as the “Services” throughout this RFP.

3.1.2 The highest-scoring responsive and responsible proposer (per the terms of this RFP) which enters into a contract with the University, is referred to in this RFP as the “Contractor.” The RFP document to which this Scope attached, including all attachments and exhibits incorporated herein, shall, together with the Contractor’s Proposal and its attachments, comprise the full agreement between the College and Contractor (the “Contract”). This resulting Contract, including all terms of this RFP, shall supersede any “click-through,” “click-wrap,” and all other electronically presented or posted End User License Agreements or other similar terms and conditions provided by Contractor or any parent or affiliate thereof. Furthermore, all such “click-through,” “click-wrap,” and all other electronically presented or posted End User License Agreements or other similar terms and conditions shall be void except to the extent included in Contractor’s Proposal in accordance with Part 4 of this RFP.

3.1.3 The language of the RFP is directed at Contractor unless specifically stated otherwise. The RFP language and attachments are complementary, and what is called for by one shall be as binding as if called for by all. In the event of conflicting provisions within or among the specifications, and the terms and conditions, Contractor is obligated to seek clarification from University as soon as Contractor becomes aware of any conflicting provisions; in general, however, Contractor is obligated to provide the most expensive option, and the more specific provision will take precedence over the less specific; the more stringent will take precedence over the less stringent; and the more expensive item will take precedence over the less expensive item, as applicable.

3.1.4 Contractor shall comply with all applicable laws, regulations, rules, orders – including executive orders, requirements, and the like of federal, state, and local governments, courts, governmental authorities, legislative bodies, boards, agencies, commissions, and the like (“Law(s)”) with respect to this RFP and the resulting Contract. If there is a conflict between or among any Laws and specific requirements of this RFP or Contract, then Contractor shall comply with the most stringent Law in each instance. By noting any specific Laws with particularity in this RFP or Contract or in any other prior or future communication, Contractor is not relieved of any obligation to comply with all Laws applicable to the Contractor and its provision of the Services, and the University does not waive any rights it may have

UCO-997 page 7 of 118UCO-997 page 7 of 119 with respect to such compliance.

3.1.5 Proposers must address every System requirement below (3.2, 3.3, and 3.4) in their Technical Proposal and indicate compliance in Attachment A (Technical Requirements Checklist). In addition to all requirements below, Contractor shall comply with CUNY’s Information Technology Performance Requirements, attached hereto as Attachment B and incorporated herein.

3.2 Mandatory System Requirements. Contractor’s Solution must include all of the following capabilities:

3.2.1 A secure, web-based research compliance training platform for use across all CUNY colleges and schools. A list of CUNY Colleges can be found here: https://www.cuny.edu/about/colleges/.

3.2.2 The Solution architecture must be designed for a single, multi‑institution implementation that centrally supports all 26 CUNY colleges and the CUNY Central Office, rather than requiring individual deployments for each college.

3.2.3 Delivery of asynchronous, self-paced online training modules accessible on demand to authorized users.

3.2.4 Licensing and delivery of existing training content and/or development of custom training content, as applicable.

3.2.5 Ability to integrate with CUNY’s Single Sign-On (SSO) authentication system (CUNY Login) powered by Oracle Access Management (OAM) as the IdP, supporting SAML 2.0 and/or OpenID Connect (OIDC) with secure attribute mapping (e.g., emplID, email, roles) and session management including timeout and Single Logout (SLO), in accordance with Attachment B.

3.2.6 Able to integrate with CUNY’s learning management system (Brightspace D2L).

3.2.7 Adherence to best practices for accessibility and the accessibility requirements set forth in Attachment

B of this Part 3 of the RFP.

3.2.8 Maintain system availability and performance, in accordance with the Service-Level Agreements (SLA) and escalation procedures set forth in Part 8 of this RFP.

3.2.9 Comply with all applicable CUNY IT policies (See Security Policies & Procedures at https://www.cuny.edu/about/administration/offices/cis/information-security/security-policies-procedures/), including secure authentication and data storage protocols.

3.2.10 Role-based access controls to support varying levels of administrative and user permissions.

3.2.11 Tracking of user participation and completion of required training modules, with configurable dashboards and reporting that capture enrollment, progress, completion status, timestamps, and certification issuance for individual users and aggregated groups, supporting institution‑wide compliance monitoring and audit needs.

3.2.12 Automated issuance of and retention of certificates of completion upon successful completion of training. Certificates must be retained in the user’s profile for the duration of the Term.

3.2.13 Reporting capabilities to support institution-wide and campus-level oversight.

3.2.14 Ability to export data on users and training completion to support institution-wide and campus-level oversight.

3.2.15 Regular maintenance and updates to the platform to address security vulnerabilities and system performance.

3.2.16 The Solution must encrypt all data—source files, notebooks, research outputs, user profiles, and log records—in transit using TLS 1.2 or higher and at rest using industry-standard algorithms (e.g., AES- 256).

3.2.17 To the extent the Solution incorporates artificial intelligence or machine learning features, the Contractor must comply with Attachment C, Artificial Intelligence Clauses (attached to this Part 3 of the RFP), and the Contractor must ensure that CUNY data—including user-generated content, citation libraries, uploaded documents, usage data, and any other data submitted by or generated on behalf of CUNY users—is used solely for the purpose of providing the Services to CUNY and shall not be used to train, fine-tune, or otherwise improve any artificial intelligence or machine learning model, whether proprietary to the Contractor or provided by a third party. Contractor must disclose in its technical proposal all AI or machine learning features present in the Solution and identify any third-party AI

UCO-997 page 8 of 119 service providers whose models interact with CUNY data.

3.3 Mandatory Functional Requirements. Contractor’s Solution must include the following functionalities for CUNY administrators University-wide:

3.3.1 Ability to assign required training to users based on role, affiliation, unit, or learner type.

3.3.2 Administrative tools that allow authorized users to view, monitor, and manage training completion status for assigned users.

3.3.3 Standard and ad hoc reporting functionality related to training participation and completion.

3.3.4 Export of training records and reports in commonly used electronic formats.

3.3.5 Automated notifications and reminders related to training requirements and completion status.

3.3.6 Centralized administration of the Solution with support for campus-level access and reporting, as authorized by CUNY.

3.3.7 Issuance and management of certificates of completion for individual training modules or defined training curricula.

3.4 Mandatory Training Content Requirements. Contractor’s Solution must meet the following requirements:

3.4.1 Training modules covering key areas of research compliance, which shall include, but not be limited to, the following:

3.4.1.1 Responsible conduct of research (RCR), with content applicable to a range of disciplines 3.4.1.2 Human subjects protections (Institutional Review Board – IRB)

3.4.1.3 Animal care and use (Institutional Animal Care and Use Committee – IACUC)

3.4.1.4 Conflicts of interest (COI)

3.4.1.5 Export controls

3.4.1.6 Research security

3.4.1.7 Biosafety

3.4.1.8 Sponsored projects and research administration

3.4.1.9 Good Clinical Practice (GCP) standards

3.4.1.10 Data security and privacy, including but not limited to HIPAA and FERPA

3.4.2 Contractor shall ensure that all training content is current, evidence-based, and aligned with applicable federal regulations and sponsor requirements, including but not limited to NIH, NSF, OHRP, FDA, and DoD.

3.4.3 Contractor shall provide options for Spanish-language translations of training content.

3.5 Mandatory Implementation, Training, and Support Requirements. Contractor shall provide implementation and ongoing support services necessary to ensure successful deployment and use of the Solution (“Implementation Services”).

3.5.1 Implementation Services shall include, but is not limited to:

3.5.1.1 Configuration of the Solution for use across all CUNY colleges and schools.

3.5.1.2 Integration with CUNY Single Sign-On (SSO), as applicable.

3.5.1.3 Validation testing to confirm proper system functionality prior to full deployment.

3.5.1.4 Development and delivery of an implementation plan and timeline reflecting completion of implementation by June 1, 2027, which plan must be submitted as part of the Proposal. The Solution must be implemented and go live by June 1, 2027. As used in this RFP and the Contract, “Go-Live” date shall mean the date upon which the Solution is fully configured per the Contract requirements, meets the mutually agreed upon system integration cutover criteria, and the University is able to use the fully-configured Solution.

3.5.2 The Contractor shall provide a minimum of one hour of training to designated administrators on use of the Solution. Contractor shall develop a training plan, including training materials, which must be submitted as part of the Proposal. Training may be delivered remotely by Contractor, and may be recorded solely by CUNY for future use.

3.5.3 Postproduction support services shall include, but are not limited to:

3.5.3.1 Ongoing technical support for users and administrators.

UCO-997 page 9 of 119

3.5.3.2 Regular updates to training content to reflect changes in applicable regulations and guidance.

3.5.4 Implementation Scope Note: Implementation Services may range from simple licensing and account provisioning to complex technical integration, depending on the proposed Solution. Proposers must clearly specify in their technical proposal which implementation activities are required for their Solution and adjust their implementation timeline and pricing accordingly.

3.6 Project Team

The Contractor shall provide a dedicated project manager for this Contract ("Project Manager"). The Project Manager shall:

a. serve as the principal liaison between CUNY and the Contractor for purposes of administration of the

Contract;

b. be an employee of the Contractor (and not a consultant, Contractor or subcontractor);

c. have full decision-making authority on behalf of the Contractor, including the authority to obligate the

Contractor;

d. maintain control over the work duties, schedule, and performance of the Contractor’s team;

e. conduct status meetings and provide status reports as requested;

f. provide meeting summaries (minutes) within two (2) business days of meetings; and

g. resolve any CUNY questions and comments on the submitted deliverables.

In the event of a mid-term change of the Project Manager or during the Project Manager's absence, the Contractor shall promptly provide a detailed continuity plan for CUNY's approval.

The Contractor shall ensure that CUNY has access to an individual with full authority to make decisions on the Contractor's behalf. Nothing in this section shall be deemed to preclude CUNY from discussing matters relating to the Contract with any other contractor organization members.

3.7 Contractor Responsibilities – General

3.7.1 Subcontracting

See Part 7 of this RFP (Terms and Conditions).

3.7.2 Location of Services

Contractor shall provide and use its own equipment to provide the services. Contractor shall provide all services remotely.

3.7.3 Communications

Contractor shall obtain CUNY’s prior written approval before Contractor, or any of its officers, employees, agents or subcontractor(s), makes any statement to the press or issues any communication or publication concerning, or related to, the Services.

3.7.4 Document Delivery

The Contractor shall provide the following documentation and materials as deliverables during implementation, operation, and contract close‑out, at no additional cost. Contractor shall provide all draft versions of the deliverables described herein, as required, to CUNY in sufficient time for CUNY review, including comment and to

UCO-997 page 10 of 118UCO-997 page 10 of 119 provide final approval. Contractor shall transmit each deliverable to CUNY with a dated and signed transmittal letter.

1. Project Management & Planning Project Plan – including milestones, dependencies, roles/responsibilities (e.g., RACI), and risk assumptions.

Implementation Timeline – from kickoff through go‑live and stabilization.

Status Reports – periodic (e.g., weekly or bi‑weekly) progress updates during implementation.

RAID Log – risks, assumptions, issues, and decisions tracked throughout implementation.

2. System Architecture & Configuration Solution Architecture Diagram – high‑level and logical architecture showing hosting model, integrations, and data flows.

Configuration Documentation – description of system configuration settings, roles, permissions, and institution‑wide

vs. campus‑level controls.

Environment Description – documentation of production (and, if applicable, test/UAT) environments.

3. Integration & Technical Documentation SSO Integration Documentation – including supported protocols (SAML/OIDC), attribute mappings, and session management.

LMS Integration Documentation – description of integration with Brightspace (data exchange, enrollment, completion reporting).

API / Data Exchange Documentation – if applicable, covering endpoints, formats, and authentication.

Data Flow & Data Dictionary – what data is collected, stored, exchanged, and retained.

4. Security, Privacy & Compliance Security Controls Summary – technical and administrative safeguards protecting the Solution.

Data Protection Documentation – FERPA/GDPR compliance narrative and redacted data‑processing addendum (if applicable).

Accessibility Documentation – VPAT or Accessibility Conformance Report (if requested).

Incident Response Summary – escalation and notification procedures for security or data incidents.

5. Training Deliverables Training Plan – audience, format, duration, and delivery method(s).

Administrator Training Materials – guides, slide decks, recordings, or job aids.

End‑User Training Materials – quick reference guides, videos, FAQs, or tutorials.

Recorded Training Sessions – if training is delivered live and recorded for future use.

6. Reporting & Analytics Reporting Catalog – list and description of standard reports and dashboards.

Sample Reports – example compliance, completion, and audit reports.

Data Export Specifications – supported formats, frequency, and scope of exports.

7. Operational & Support Documentation System Administration Guide – day‑to‑day administration tasks and best practices.

Support & Escalation Procedures – support tiers, response times, and contact paths.

Maintenance & Update Policy – cadence and notification process for updates.

Service Level Reporting – SLA metrics and reporting approach.

8. Go‑Live & Close‑Out Go‑Live Readiness Checklist – confirmation of completed implementation tasks.

Acceptance Documentation – criteria and confirmation of successful deployment.

Post‑Implementation / Stabilization Report – summary of issues, resolutions, and handoff to steady‑state operations.

UCO-997 page 11 of 118UCO-997 page 11 of 119

9. Contract‑End / Data Portability Data Export & Portability Documentation – procedures and formats for full data return.

Data Retention & Destruction Certification – upon termination or expiration of the contract.

3.7.5 Return of CUNY Information at Termination

Within ten (10) calendar days of termination of the Contract for any reason, Contractor shall, with respect to all CUNY documents and data, in whatever media, whether originally provided or created during performance of the services:

3.7.5.1 return them to CUNY; and

3.7.5.2 provide independent certification of destruction of all copies not returned to CUNY.

3.7.6 Invoices

3.7.6.1 Contractor shall submit invoices to CUNY’s Accounts Payable Department at a time interval and in a format approved by CUNY.

3.7.6.2 Contractor shall provide sufficient and appropriate documentation with invoices. CUNY reserves the right to request additional information at any time.

3.7.6.3 Contractor acknowledges and agrees that CUNY will pay Contractor only upon acceptance of properly prepared invoices with sufficient supporting documentation.

3.7.6.4 CUNY will not pay Contractor for work performed beyond the scope of this Project or for any change order not duly authorized.

3.7.6.5 Report preparation, including editing, printing and delivery to the University and Colleges, shall be the sole responsibility of the Contractor and shall not be reimbursable as a direct cost. If unusual circumstances are encountered that make it necessary for the Contractor to provide additional services, Contractor will be required to report such conditions to the Office of the University Comptroller. No services outside the scope or beyond the stated term of the Contract may be performed unless authorized in writing by CUNY in advance.

3.7.7 Miscellaneous

3.7.7.1 CUNY will identify a Contract Manager to act as the liaison with the Contractor.

3.7.7.2 CUNY staff will be available to provide documentation and explanations as may be required, subject to reasonable scheduling restrictions.

3.7.7.3 CUNY will provide Contractor with CUNY holiday schedules.

3.7.7.4 CUNY will not provide clerical support.

3.7.7.5 CUNY will not pay Contractor for work performed beyond the scope of this Contract or for any services or change order not duly authorized.

3.7.7.6 CUNY will not provide Contractor with any computer hardware, software, or other equipment.

3.7.7.7 Before performing any work under the Contract, Contractor shall procure and maintain with companies satisfactory to CUNY, the types of insurance in the amounts outlined in Part 7. Contractor shall maintain said insurance during the term of the Contract up and to the date of the final acceptance of the work, or termination of the Contract, whichever occurs later.

3.8 Invoicing and Payment for Services

3.8.1 CUNY agrees to pay, and the Contractor agrees to accept the total Proposal Price amount indicated in the Price Proposal Breakdown (RFP Part 5) as the maximum payment for the Services provided under this Contract.

Contractor shall be paid in accordance with the annual price indicated in the Price Proposal Breakdown (i.e.

Year 1, Year 2, etc.), as full payment for all support services and the Solution for each year during the Term of the Contract, and the Implementation Fee and Training Fee for all Implementation Services and Training

UCO-997 page 12 of 119

Services as set forth in Section 3.5 above and in Contractor’s Proposal.

3.8.2 Prices proposed by Contractor shall be fully-loaded rates, inclusive of all costs and expenses necessary to complete the Services, including but not limited to labor, supplies, travel, insurance, and taxes. No other amounts shall be payable under this Contract.

3.8.3 Invoicing Schedule.

3.8.3.1 Annual Price (lines 2 and 3 in Price Proposal Breakdown). The Contractor shall issue one (1) advance invoice on July 1st of each contract year (except for Year 1, see 3.8.3.2 below) for the annual Software License or Subscription Fee, and the annual Support and Maintenance Fees, respectively set forth in the Price Proposal Breakdown, net 30 calendar days.

3.8.3.2 Year 1 payments for Software License or Subscription Fee and annual Support and Maintenance Fees shall be payable, if at all, on a pro rata basis based on the amount of time remaining in Year 1 of the Contract when Implementation Services are completed. If production Go-Live occurs prior to the end of the first contract year, the Contractor shall submit a single, pro-rated invoice covering the period from the Contract’s Effective Date through the Go-Live date, and the University shall pay this pro rata amount rather than the full annual fees. The pro-ration shall be calculated on a daily basis.

Illustration: The Contractor proposed a combined price (Software License or Subscription Fee and annual Support and Maintenance Fees) for Year 1 of $12,000. If the Go-Live date occurs six months prior to the end of the first Contract year, Contractor would be paid $6,000 for Year 1. If, however, the Go-Live date occurs on the same day as the end of the first Contract year, the Contractor would receive no Software License or Subscription Fee or annual Support and Maintenance Fees for Year 1.

3.8.3.3 Implementation Fee. Milestone invoices for the one-time Implementation Fee are separate from the annual payments. Payment of the fixed Implementation Fee is due upon CUNY’s written acceptance of the implementation and Go-Live.

3.8.3.4 Training Fee. Payment for the Training Fee shall be made in a lump sum upon Contractor’s satisfactory completion of all training services described in Section 3.5 above and in Contractor’s Proposal. The invoice for the Training Fee is separate from the annual payments.

3.8.4 Price Proposal Breakdown. There are four (4) sections in the Price Proposal Breakdown, consisting of a one-time, non-recurring Implementation Fee (Line 1) for all Implementation Services provided hereunder, of a one-time, non-recurring Training Fee (Line 4) for all training services provided hereunder, and an Annual Price (Lines 2 and 3) for each contract year consisting of the annual Software License or Subscription Fee, and the annual Support and Maintenance Fees, respectively. Proposers must enter a single Implementation Fee for all Implementation Services and a single Training Fee for all Training Services. Proposers must also enter a price per year for both the annual Software License or Subscription Fee, and the annual Support and Maintenance Fees. Proposers shall then calculate the Total Price for each column. The Proposal Price shall be the sum of the Implementation Fee, plus the Training Fee, plus the sum of the annual prices for each of the five years of the Contract term.

UCO-997 page 13 of 118UCO-997 page 13 of 119

Attachment A: Technical Requirements Checklist:

Research Compliance Online Training

Respondent’s name …………………………...

Item No. Deliverable

YES

NO

Mandatory System Requirements

A secure, web-based research compliance training platform suitable for use across all CUNY colleges and schools.

The Solution architecture must be designed for a single, multi‑institution implementation that centrally supports all 26 CUNY colleges and the CUNY Central Office, rather than requiring individual deployments for each college.

Delivery of asynchronous, self-paced online training modules accessible on demand to authorized users.

Licensing and delivery of existing training content and/or development of custom training content, as applicable.

Ability to integrate with CUNY’s Single Sign-On (SSO) authentication system (CUNY Login) powered by Oracle Access Management (OAM) as the IdP, supporting SAML 2.0 and/or OpenID Connect (OIDC) with secure attribute mapping (e.g., emplID, email, roles) and session management including timeout and Single Logout (SLO), in accordance with Attachment B

Hosted on vendor’s platform, and able to integrate with CUNY’s learning management system (Brightspace D2L).

Adherence to best practices for accessibility and the accessibility requirements set forth in Attachment B of the RFP.

Maintain system availability and performance, in accordance with the Service-Level Agreements (SLA) and escalation procedures set forth in Part 8 of the RFP

Comply with all applicable CUNY IT policies (See Security Policies & Procedures at https://www.cuny.edu/about/administration/offices/cis/information-security/security-policies-procedures/), including secure authentication and data storage protocols.

Role-based access controls to support varying levels of administrative and user permissions.

Tracking of user participation and completion of required training modules, with configurable dashboards and reporting that capture enrollment, progress, completion status, timestamps, and certification issuance for individual users and aggregated groups, supporting institution‑wide compliance monitoring and audit needs

Automated issuance of certificates of completion upon successful completion of training.

13 Reporting capabilities to support institution-wide and campus-level oversight.

Ability to export data on users and training completion to support institution-wide and campus-level oversight

Regular maintenance and updates to the platform to address security vulnerabilities and system performance.

Encryption of all data—source files, notebooks, research outputs, user profiles, and log records—in transit using TLS 1.2 or higher and at rest using industry-standard algorithms (e.g., AES-256).

UCO-997 page 14 of 119

If the Solution incorporates artificial intelligence or machine learning features, all CUNY data—including user-generated content, citation libraries, uploaded documents, usage data, and any other data submitted by or generated on behalf of CUNY users—will be used solely for the purpose of providing the Services to CUNY and shall not be used to train, fine-tune, or otherwise improve any artificial intelligence or machine learning model, whether proprietary to the Contractor or provided by a third party.

Mandatory Functional Requirements

Ability to assign required training to users based on role, affiliation, unit, or learner type.

Administrative tools that allow authorized users to view, monitor, and manage training completion status for assigned users.

Standard and ad hoc reporting functionality related to training participation and completion.

21 Export of training records and reports in commonly used electronic formats.

Automated notifications and reminders related to training requirements and completion status.

Centralized administration of the Solution with support for campus-level access and reporting, as authorized by CUNY.

Issuance and management of certificates of completion for individual training modules or defined training curricula.

Mandatory Training Content Requirements

25 Training modules covering Responsible Conduct of Research (RCR).

Training modules covering human subjects protections (Institutional Review Board –

IRB).

Training modules covering animal care and use (Institutional Animal Care and Use Committee – IACUC).

28 Training modules covering conflict of interest (COI).

29 Training modules covering export controls.

30 Training modules covering research security.

31 Training modules covering biosafety.

32 Training modules covering sponsored projects and research administration.

33 Training modules covering Good Clinical Practice (GCP) standards.

Training modules covering data security and privacy, including but not limited to HIPAA and FERPA.

Training modules covering research misconduct, with content applicable to a range of disciplines.

Training content that is current, evidence-based, and aligned with applicable federal regulations and sponsor requirements (NIH, NSF, OHRP, FDA, USDA, DoD).

37 Options for Spanish-language translations of training content.

Mandatory Implementation, Training, and Support Requirements

38 Configuration of the Solution for use across all CUNY colleges and schools.

39 Integration with CUNY Single Sign-On (SSO), as applicable.

40 Validation testing to confirm proper system functionality prior to full deployment.

Development and delivery of an implementation plan and timeline for review and approval by CUNY.

Training plan, including minimum of one hour of training to designated administrators on use of the Solution and training materials.

43 Ongoing technical support for users and administrators.

Regular updates to training content to reflect changes in applicable regulations and guidance.

UCO-997 page 15 of 119

Authorized Representative Name …………………………...

Signature …………………………...

Date …………………………...

[REMAINDER OF PAGE INTENTIONALLY LEFT BLANK]

UCO-997 page 16 of 119

ATTACHMENT B: INFORMATION TECHNOLOGY PERFORMANCE REQUIREMENTS

(TERMS TO BE INCLUDED IN SOLICITATIONS AND CONTRACTS)

Introduction

The City University of New York (the “University” or “CUNY”) is committed to ensuring that all technology products and services adhere to required and industry standards of accessibility, security, and compatibility with existing enterprise systems.

These terms set forth essential requirements and standards that contractors must meet when providing technology solutions to CUNY - including accessibility, authentication and access control, IT security, PeopleSoft/CUNYfirst/Workday integrations, project management, and preferred service standards.

CUNY places a high priority on contractors providing exceptional technical support, customer service, and a positive user experience for the University's constituents; all contractors (the “Contractor(s)”) must ensure that their products, solutions, applications, platforms, and services (“Services”) are user-friendly, reliable, and supported by highly responsive customer service teams.

The language of the Solicitation or Contract is directed at Contractor unless specifically stated otherwise. The Solicitation or Contract language and attachments are complementary, and what is called for by one shall be as binding as if called for by all.

In the event of conflicting provisions within or among the specifications, and the terms and conditions, Contractor is obligated to seek clarification from University as soon as Contractor becomes aware of any conflicting provisions; in general, however, Contractor is obligated to provide the most expensive option, and the more specific provision will take precedence over the less specific; the more stringent will take precedence over the less stringent; and the more expensive item will take precedence over the less expensive item.

Contractor shall comply with all laws, regulations, rules, orders-including executive orders, requirements, and the like of federal, state, and local governments, courts, governmental authorities, legislative bodies, boards, agencies, commissions, and the like (“Law(s)”) with respect to this Solicitation or Contract. If there is a conflict between or among any laws and specific requirements of this Solicitation or Contract, then Contractor shall comply with the most stringent Law in each instance. By noting any specific Laws with particularity in this Solicitation or Contract or in any other prior or future communication, Contractor is not relieved of any obligation to comply with all Laws, and the University does not waive any rights it may have with respect to such compliance.

Accessibility

The Contractor must comply with all applicable federal and state laws and regulations regarding the accessibility of the Services for those who are disabled. Any network-based information and applications development, or programming, including, but not limited to, websites delivered to or by the State of New York pursuant to this contract or procurement, will comply with Section 508 of the Rehabilitation Act of 1973, as amended, Executive Law Section 170-f, as amended, and be consistent with New York State Enterprise IT Policy NYS-P08-005, Accessibility of Information Communication Technology, as such policy may be amended, modified, or superseded (the “Accessibility Policy”). The Accessibility Policy requires, and Contractor must ensure that State Entity Information Communication Technology shall be accessible to all users, including those with disabilities as determined by accessibility compliance testing. Such accessibility compliance testing will be conducted by CUNY and any report on the results of such testing must be satisfactory to CUNY, as an explicit condition of being awarded the Contract.

In accordance with Section 170-f of the New York State Executive Law, Contractor represents and warrants that the Services’ online content and functionality shall conform to the most current version of the Web Content Accessibility Guidelines

UCO-997 page 17 of 119 adopted by the World Wide Web Consortium for accessibility or any successor guidelines/standards (“WCAG Standards”), that are incorporated herein by reference.

Upon request and prior to Contract Award, vendors seeking to be awarded a contract by the University must provide an Accessibility Conformance Report (“ACR”) or a completed Voluntary Product Accessibility Template (“VPAT”) that includes vendor’s representation and warranty that the Services comply with the WCAG Standards. Please note that an ACR or VPAT need not be submitted with a Bid Submission, Proposal or Quote but if requested, then vendor must submit an ACR or VPAT upon request within the timeframe required by the University as an explicit condition prior to being awarded a Contract. The ACR or VPAT must reflect the vendor’s current software release of the Services. Vendor will be required to warrant that the Services’ online content and functionality shall meet or exceed the accessibility standards specified in its ACR or VPAT throughout the Term of this Contract.

Upon request, Contractor also must provide temporary test credentials to the University so that the University is able to perform a test of the Services to verify that the Services meet the requisite accessibility standards.

CUNY will need to review, verify, and accept Contractor’s ACR or VPAT prior to the award of a contract.

If after award of a contract to a vendor (“Contractor”), CUNY determines that a user of the Services requires a special modification in order to comply with WCAG Standards, then the University shall submit a written request to the Contractor for a modification to the Services, and the Contractor shall use commercially reasonable efforts to provide necessary modification(s) promptly. In the event that compliance with WCAG standards requires more than commercially reasonable efforts, then the Contractor shall engage in good faith negotiations with CUNY to amend the Contract. In the event that the Contractor cannot modify the Services to comply with WCAG Standards following good faith negotiations to amend the Contract, then the University shall have the right to terminate the Contract upon thirty (30) days’ written notice.

The University will not award a Contract to any vendor that: (a) if requested, fails to promptly submit an ACR or completed VPAT that verifies the Services’ compliance with WCAG Standards; (b) submits an ACR or completed VPAT that does not meet WCAG Standards ; (c) does not provide the necessary credentials to allow the University to test and verify the accessibility of the online content and functionality of the proposed Services; or (d) provides temporary test credentials that result in a determination that demonstrates that the Services do not meet requisite accessibility standards.

Authentication and Access Control

All Services must meet the following Single Sign-On (SSO) and Authentication Requirements.

Contractor must ensure that the fully configured software solution that it provides as part of the Services and deploys at CUNY, including all updates and patches (“Solution”) integrate with CUNY Login, the centralized authentication system powered by the Oracle Access Management (OAM) suite. Contractor must support seamless integration of the Solution with CUNY Login to enable Single Sign-On (SSO) and secure authentication for all CUNY users.

To ensure compatibility and successful integration, the Contractor must ensure that the Solution must:

1. Support Standard Authentication Protocols:

• The Contractor must ensure that the Solution support one or more of the following standard authentication mechanisms to integrate with CUNY Login:

o SAML 2.0: The Contractor must ensure that the Solution act as a Service Provider (SP) and accept SAML assertions from CUNY Login.

o OpenID Connect (OIDC): The Solution must support OIDC flows for authentication.

o OAuth 2.0: If API-level access is required, the Solution must support OAuth 2.0 for token-based authentication.

UCO-997 page 18 of 118UCO-997 page 18 of 119 o…