REQUEST FOR PROPOSALS

FOR

VENDOR VERIFICATION SOFTWARE

i

I. SUMMARY

II. GENERAL PROVISIONS

III. TIMETABLE & DESIGNATED CONTACT

IV. GENERAL REQUIREMENTS

V. PROPOSAL FORMAT AND CONTENTS

VI. INSURANCE REQUIREMENTS

VII. COST PROPOSAL FORMAT AND REQUIRED INCLUSIONS

VIII. SELECTION PROCESS

IX. NON-COLLUSION

X. IRAN DIVESTMENT ACT

XI. EXECUTIVE ORDER 16

EXHIBIT A – SCOPE OF WORK

EXHIBIT B – PROPOSAL SUBMISSION PACKET

EXHIBIT C – CONTRACTOR REQUIREMENTS AND PROCEDURES FOR PARTICIPATION BY

NEW YORK STATE-CERTIFIED MBEs/WBEs/SDVOBs AND EQUAL EMPLOYMENT

OPPORTUNITIES FOR MINORITY GROUP MEMBERS AND WOMEN

EXHIBIT D – LIST OF BPCA BOARD MEMBERS AND EMPLOYEES

EXHIBIT E – BPCA SAMPLE FORM OF CONTRACT

EXHIBIT F – COST PROPOSAL FORM

I. SUMMARY

Battery Park City Authority d/b/a Hugh L. Carey Battery Park City Authority (“BPCA”) requests proposals (individually, a “Proposal” and collectively, the “Proposals”) from qualified firms (each, a “Proposer” and collectively the “Proposers”) to provide a Vendor Verification Software solution that automates and enhances vendor onboarding, validation, and management. The solution should improve operational efficiency, strengthen compliance controls, mitigate fraud risk, and integrate with BPCA’s existing systems. A detailed scope of work is set forth in Exhibit A (Scope of Work) (the “Work”), which will be performed by the selected Proposer.

Created in 1968, BPCA is a New York State public benefit corporation responsible for financing, developing, constructing, maintaining, and operating Battery Park City as a richly diversified mixed-use community providing residential and commercial space, with related amenities such as parks, plazas, recreational areas, and a waterfront esplanade. A summary of BPCA’s structure, mission, and history, as well as the Battery Park City project area, may be viewed at: http://bpca.ny.gov/. Public information regarding BPCA’s finances, budget, internal controls, guidelines, and policies may be viewed at: http://bpca.ny.gov/public-information/.

New York State-certified Minority-Owned Business Enterprises (“MBE”), Women-Owned Business Enterprises (“WBE”) and Service-Disabled Veteran-Owned Business Enterprises (“SDVOB”) are encouraged to submit Proposals.

II. GENERAL PROVISIONS

This Request for Proposals, including attachments, exhibits, and any amendments or addenda (collectively, the “RFP” or “Solicitation”) is subject to the rights reserved by BPCA, including, but not limited to BPCA’s right to:

• Reject any or all Proposals received in response to the Solicitation.

• Withdraw the Solicitation at any time, at the Authority’s sole discretion.

• Make an award under the Solicitation in whole or in part.

• Disqualify any Proposer whose conduct and/or Proposal fails to conform to the requirements of the

Solicitation.

• Seek clarifications and/or revisions of the Proposal or any part of the Proposal.

• Use information obtained by the Authority through site visits, interviews, investigation of a Proposer’s qualifications, experience, ability or financial standing; and any other material or information provided by or received from the Proposer during the Proposal process.

• Prior to reviewing the Proposals, direct Proposers to submit modifications to their Proposals addressing subsequent amendments to the Solicitation.

• Request that Proposers submit best and final offers subsequent to the review of Proposals.

• Change any of the scheduled dates contained in this RFP.

• Waive any non-material requirements of this RFP.

• Negotiate with the selected Proposer within the scope of the Solicitation and in the best interests of the

Authority.

• Conduct contract negotiations with another responsible Proposer if the Authority is unable to finalize contractual terms with the first selected Proposer.

• Utilize any and all ideas submitted in the Proposals received regardless of whether a Contract is offered;

and

• Require clarification at any time during the Procurement process and/or require correction of arithmetic or other apparent errors for the purpose of assuring a full and complete understanding of a Bid and/or to determine a Proposer’s compliance with the requirements of the Solicitation.

BPCA is not liable or responsible in any way for any expenses incurred in the preparation of a Proposal in response to this RFP.

http://bpca.ny.gov/ http://bpca.ny.gov/public-information/

All information submitted in response to this RFP is subject to the Freedom of Information Law, Article 6 of the New York State Public Officers Law (“FOIL”), which requires public access to certain documents possessed by BPCA, unless a specific exemption applies. Proposers shall identify any information in their respective Proposals that they consider to be confidential and exempt from FOIL by clearly marking such information as confidential.

Notwithstanding the foregoing, BPCA is obligated to disclose information consistent with the requirements of FOIL, NYS Public Officers Law Section 87 and, to the extent that BPCA: (a) receives a request under FOIL for a Proposal submitted pursuant to this RFP; and (b) determines in its sole discretion that any information marked as confidential does not meet any of the exemptions contained in the applicable portions of the Public Officers Law, then BPCA will notify the Proposer of the information it intends to provide in response to the FOIL request and Proposer will have ten (10) business days to submit a written statement to BPCA explaining why such information should be exempt from disclosure under FOIL.

III. TIMETABLE & DESIGNATED CONTACT

A. Key Dates

Subject to change at BPCA’s discretion, the following are key dates for this RFP:

RFP Issued: October 1, 2026

Deadline to submit questions to BPCA: October 8, 2026 (by email only)

All questions regarding this RFP should be submitted in writing via email to the “Designated Contact”:

Danah Alexander at danah.alexander@bpca.ny.gov.

BPCA’s response to substantive questions: October 15, 2026. Responses will be provided in the form of an addendum to be posted to the Authority’s website: https://bpca.ny.gov/apply/rfp-opp/

PROPOSAL DUE DATE: October 23, 2026, by 3:00 p.m. (the “Due Date”)

Anticipated Contract Start Date: December 2026

B. Anticipated Contract Term

The anticipated term of the contract awarded pursuant to this RFP (the “Contract”) will be three (3) years with two (2) one-year renewal options, each exercisable at BPCA’s sole discretion. BPCA reserves the right to terminate the Contract at any time, with or without cause, in accordance with the terms of the Contract. BPCA’s sample form of contract is attached as Exhibit E.

IV. GENERAL REQUIREMENTS

A. Minimum Qualification Requirements

The following are the minimum qualification requirements for this RFP. Proposals that fail to meet these requirements will be rejected:

1) Proposer must be lawfully authorized to do business in the State of New York and registered with the NYS Department of State.

2) Proposer must have a minimum of three (3) consecutive years of experience in developing, hosting, and supporting enterprise Software-as-a-Service (SaaS) vendor onboarding and compliance verification platforms.

https://bpca.ny.gov/apply/rfp-opp/

3) Proposer must have successfully implemented its SaaS platform for at least three (3) client organizations of comparable size and complexity, including at least one (1) public sector, governmental, quasi-governmental, or similarly regulated organization.

4) Proposer must possess a valid, current SOC 2 Type II report covering the proposed solution and applicable hosting environment, or equivalent and demonstrate compliance with NYS Information Security Policies (including AES-256 encryption at rest and TLS 1.3 in transit).

B. MBE/WBE/SDVOB Participation, Joint Ventures, and Sub-contracting Goals

Contractor requirements and procedures for business participation opportunities for New York State certified MBEs/WBEs/SDVOBs and equal employment opportunity requirements relating to minority group members and women are attached as Exhibit C. For questions relating to MBE/WBE/SDVOB participation, joint ventures and sub-contracting goals only, please contact the “MBE/WBE/SDVOB Designated Contact” Zag Kimpolo at zag.kimpolo@bpca.ny.gov or 212-417-2339.

C. Restricted Period

New York State’s State Finance Law sections 139-j and 139-k apply to this RFP, restricting Proposers’ contacts with BPCA. Proposers are restricted from making any contact (defined as oral, written or electronic communications with BPCA under circumstances where a reasonable person would infer that a communication was intended to influence BPCA’s conduct or decision with respect to a procurement) relating to this RFP with anyone other than the Designated Contact, as specified in Section III.A., or MBE/WBE/SDVOB Designated Contact, as specified in Section IV.B., from the time of Proposer’s receipt of notice of this RFP through the date of the Final Award as defined in BPCA’s Procurement Guidelines (the “Restricted Period”). BPCA employees must record certain contacts during the Restricted Period, including, but not limited to, any oral or written communications that could reasonably be seen as intended to influence BPCA’s conduct or award of this RFP. Upon notice of an improper contact, BPCA shall make a determination regarding the Proposer’s eligibility to continue participating in this RFP.

D. Submission of Proposals

Proposals must be received by BPCA no later than the Proposal Due Date set forth above.

• Each Proposer must e-mail their Technical Proposal to the following e-mail address: technicalproposals@bpca.ny.gov

The Technical Proposal must be clearly labeled as “Technical Proposal – Vendor Verification Software RFP.”

• Each Proposer must also e-mail their Cost Proposal to the following e-mail address:

costproposals@bpca.ny.gov

The Cost Proposal must be separately attached and clearly labeled as “Cost Proposal – Vendor Verification Software RFP.”

• Each Proposer is responsible for the successful delivery and receipt of their Proposal. BPCA is not accepting Proposals sent via messenger, overnight courier, or certified mail to BPCA offices. If a Proposer has already sent a Proposal via one of these methods, please e-mail the Proposal to the above e-mail address by the Due Date. If a Technical Proposal’s file size is too large to submit by e-mail, the Proposer must make alternate electronic accommodations (e.g., mailto:zag.kimpolo@bpca.ny.gov linking to a file sharing website), which shall also be transmitted through technicalproposals@bpca.ny.gov. Please contact the Designated Contact prior to the Due Date in order to ensure successful transmission of the documents prior to the Due Date.

• Proposals must arrive at the time and place specified herein. Please leave ample time for submission. Late Proposals, no matter the cause of their lateness, will NOT be accepted. Hard copy or faxed Proposals will NOT be accepted. A Proposer may, after submitting a Proposal, amend its Proposal by submitting an amended Proposal, clearly labeled “Amended Proposal – Vendor Verification Software,” as long as the amended Proposal is submitted by the Due Date.

V. PROPOSAL FORMAT AND CONTENTS

A. Proposal Format

The Proposal must:

• Have numbered pages,

• Be formatted to 8½” x 11” sized pages,

• Use a minimum font size of 10 point and,

• Be submitted in Adobe PDF, Microsoft Word or Excel format.

B. Proposal Content

In addition to the separately submitted Cost Proposal, described in Section VII below, each Proposal must include the following in the order listed, which shall comprise the Proposer’s Technical Proposal:

a. Executive Summary. Executive Summary may not exceed two (2) single-sided pages.

b. Completed Proposal Submission Packet, attached as Exhibit B.

c. Completed Cost Proposal Form, attached as Exhibit F.

d. Additional Documentation:

i. Financial Statements:

Provide a copy of your firm’s most recent Audited Financial Statements (within the last year) or where an audited financial statement is not available, the most recent tax return.

In the event you do not have an audited financial statement you must provide a statement to that effect and summary financial information for the calendar year most recently ended certified by an authorized officer.

ii. A copy of the Proposer’s Internal Revenue Service (“IRS”) W-9 form

(https://www.irs.gov/pub/irs-pdf/fw9.pdf)

iii. Appendices:

1. Attach professional biographies for all key team members you intend to assign to this engagement.

2. A detailed list identifying any and all exceptions taken to BPCA’s form of retainer, attached as Exhibit E, explaining the reasons for such exceptions.

https://www.irs.gov/pub/irs-pdf/fw9.pdf

Such exceptions must be detailed in an appendix to your Proposal labeled, “Appendix: Objections to BPCA Form of Contract.” BPCA will consider any exceptions submitted in evaluating the Proposals but is under no obligation to accept them.

NOTE: EXCEPTIONS THAT ARE NOT SUBMITTED WITH THE

PROPOSAL WILL NOT BE CONSIDERED. BPCA will not accept any additional exceptions to the Contract after submission of the Proposals and reserves the right to reject Proposals based on non-conformance with the standard form of Contract.

BPCA reserves the right to reject any Proposals that fail to include any required item described in this Section V. B., that are unsigned or fail to include each of the above representations (including an appendix, if applicable).

VI. INSURANCE REQUIREMENTS

A. General Requirements

The total cost of the required insurance listed in paragraphs B) and C) below must be incorporated into the Cost Proposal. The additional insured protection afforded BPCA and the State of New York must be on a primary and non-contributory basis. All policies must include a waiver of subrogation in favor of BPCA and the State of New York, and no policies may contain any limitations / exclusions for New York Labor Law claims.

All of the carriers that provide the below required insurance must provide direct written notice of cancellation or non-renewal to BPCA and the State of New York at least 30 days before such cancellation or non-renewal is effective, except for cancellations due to non-payment of premium, in which case 10 days written notice is acceptable.

B. Insurance Requirements for the Selected Proposer

The selected Proposer will be required to obtain and provide proof of the types and amounts of insurance listed below: (i) as a condition precedent to the award of the contract for the work; and (ii) continuing throughout the entire term of the Contract. The insurance policies listed below must also conform to the applicable terms of the Contract, as shown in BPCA’s sample form of contract attached as Exhibit E.

• Commercial General Liability Insurance, written on ISO Form CG 00 01 or its equivalent and with no modification to the contractual liability coverage provided therein, shall be provided on an occurrence basis and limits shall not be less than:

• $1,000,000 per occurrence

• $2,000,000 general aggregate, which must apply on a per location/per project basis

• $2,000,000 products/completed operations aggregate

BPCA and the State of New York must be protected as additional insureds on ISO Form CG 2010 (11/85) or its equivalent on policies held by the selected Proposer and any of its subcontractors. Should the Proposer’s work include construction activities of any kind then the Proposer must maintain Products / Completed Operations coverage for no less than three years after the construction work is completed, and continue to include Additional Insured protection for BPCA & The State of New York for the prescribed timeframe. Securing the required limits via a combination of primary and umbrella/excess liability policies is allowed.

The General Aggregate limit must apply on a per project basis on the primary General Liability policy should a combination of primary and Umbrella/Excess liability policies be utilized to secure the required total limits of coverage.

• Automobile Liability Insurance with a combined single limit of not less than $1,000,000.

Coverage must apply to the Proposer’s owned, hired, and non-owned vehicles and protect BPCA and the State of New York as additional insured.

• Workers’ Compensation, Employer’s Liability, and Disability Benefits shall not be less than statutory limits, including United States Longshore and Harbor Workers Act coverage as applicable to the operations of the Proposer.

• Data Breach and Privacy/Cyber Liability: Contractors are required to maintain during the term of this Contract and as otherwise required herein, Network and Privacy/Cyber Liability Insurance, including coverage for failure to protect confidential information and failure of the security of the Contractor’s computer systems or the Authorized Users’ systems due to the actions of the Contractor which results in unauthorized access to the Authorized User(s) or their data. Said insurance shall be maintained with a limit of not less than $1,000,000.

Said insurance shall provide coverage for damages arising from, but not limited to the following:

o Breach of duty to protect the security and confidentiality of nonpublic proprietary corporate information;

o Personally identifiable nonpublic information (e.g., medical, financial, or personal in nature in electronic or non-electronic form);

o Privacy notification costs, breach response sublimit should be at least 50% of the liability limit o Regulatory defense and penalties;

o Website media liability; and o Cyber theft of customer’s property, including but not limited to money and securities.

o Computer network systems attacks o Denial or loss of service o Introduction, implantation or spread of malicious software code o Unauthorized access and use of computer systems o Other necessary and customary coverages.

If policy or policies are written on a claims-made basis, coverage must be in place for a period of at least 12 months after the completion or termination of the Agreement.

Certificates of Insurance and Additional Insured Endorsements reflecting applicable limits, sub-limits, self-insured retention or deductibles will be provided to BPCA. BPCA will be named as an Additional Insured and will be provided with a waiver of subrogation by endorsement to the required Cyber Liability policy. All insurance carrier(s) must carry an

A.M. Best rating of at least A-, Class VIII.

• Technology Errors and Omissions insurance with a limit of not less than $1,000,000 for damages arising from computer-related services including, but not limited to, the following:

o Consulting, o Data processing, o Programming, o System integration, o Hardware or software development, o Installation, o Distribution or maintenance, o Systems analysis or design, o Training, and o Staffing or other support services.

C. Insurance Requirements for all Subcontractors

Any subcontractor(s) utilized by the selected Proposer will be required to obtain the types and amounts of insurance listed below: (i) as a condition of commencing any Work; and (ii) continuing throughout the duration of the subcontractor’s Work. The insurance policies listed below must also conform to the applicable terms of the Contract, as shown in BPCA’s sample form of contract attached:

• Commercial General Liability Insurance, written on ISO Form CG 00 01 or its equivalent and with no modification to the contractual liability coverage provided therein, shall be provided on an occurrence basis and limits shall not be less than:

o $1,000,000 per occurrence o $2,000,000 general aggregate which must apply on a per location / per project basis o $2,000,000 products/completed operations aggregate

• BPCA and the State of New York must be protected as additional insureds on ISO Form CG

2010 (11/85) or its equivalent on policies held by all subcontractors. Should the subcontractor’s work include construction activities of any kind then the subcontractor must maintain Products / Completed Operations coverage for no less than three years after the construction work is completed and continue to include Additional Insured protection for BPCA & The State of New York for the prescribed timeframe. Securing the required limits via a combination of primary and umbrella/excess liability policies is allowed. The General Aggregate limit must apply on a per project basis on the primary General Liability policy should a combination of primary and Umbrella/Excess liability policies be utilized to secure the required total limits of coverage.

• Automobile Liability Insurance with a combined single limit of not less than $1,000,000.

Coverage must apply to the subcontractor’s owned, hired, and non-owned vehicles and protect BPCA and the State of New York as additional insured.

• Workers’ Compensation, Employer’s Liability, and Disability Benefits shall not be less than statutory limits, including United States Longshore and Harbor Workers Act coverage as applicable to the operations of the subcontractor.

Subcontractors will also be required to obtain all other insurances listed in Section VI

(B) unless otherwise approved in writing by BPCA prior to commencement of any Subcontractor’s work.

VII. COST PROPOSAL: FORMAT AND REQUIRED INCLUSIONS

Each Proposer must complete and submit a comprehensive Cost Proposal in the exact format set forth in Exhibit F: Cost Proposal Form. All pricing shall include all labor, supervision, materials, software, licensing, hosting, implementation, training, support, travel, overhead, profit, and all other costs necessary to provide the services described in Exhibit A.

BPCA reserves the right to request clarification of any proposed pricing and to determine whether proposed pricing is fair, reasonable, and in BPCA's best interest.

VIII. SELECTION PROCESS

A. Evaluation

Each timely submitted Proposal will be reviewed for compliance with the form and content requirements of this RFP. A committee of BPCA employees selected by BPCA (the “Committee”) will then review and evaluate the Proposals in accordance with the evaluation criteria set forth below.

While only Committee members will score the evaluation criteria, the Committee may consult an outside expert for advisement on the evaluation of matters requiring technical expertise. Before final selection, BPCA must determine that the proposed selected Proposer is responsible, in accordance with applicable law and BPCA’s Procurement Guidelines, which may be viewed at:

http://bpca.ny.gov/public-information/.

B. Interviews

BPCA reserves the right to decide whether to interview any or all of the Proposers. The Committee may conduct interviews for many reasons, including to further assess a Proposer’s ability to perform the Work or provide specific services, or to seek information related to any other evaluation criteria.

The proposed Lead PM, as well all other key personnel proposed to perform the Work, must be available to participate in the interview.

C. Evaluation Criteria for Selection

Selection will be based upon the following criteria:

1) Technical Evaluation:

http://bpca.ny.gov/public-information/

Evaluation Criteria Weight A) Demonstrated Functional & Compliance Capabilities 30%

B) Demonstrated Architecture, Integration Agility & Security 25%

C) Proposer Experience & Public Sector Track Record 25%

D) Implementation Methodology & Support 15%

E) New York State Certified MWBE or SDVOB Firm 5%

2) Cost Proposal Evaluation.

D. Basis for Contract Award

The Contract will be awarded to the highest technically rated Proposer whose Proposal is determined to be responsive and in the best interests of BPCA, subject to a determination that the Cost Proposal is fair, reasonable, and provides the best value to BPCA given the requirements of the project.

IX. NON-COLLUSION

By submitting a Proposal, each Proposer warrants and represents that any ensuing Contract has not been solicited or secured directly or indirectly in a manner contrary to the laws of the State of New York, and that said laws have not been violated and shall not be violated as they relate to the procurement or the performance of the Contract by any conduct, including the paying or giving of any fee, commission, compensation, gift, or gratuity or consideration of any kind, directly or indirectly, to any member of the board of directors, employee, officer or official of BPCA.

X. IRAN DIVESTMENT ACT

By submitting a Proposal or by assuming the responsibility of any Contract awarded hereunder, each Proposer certifies that it is not on the “Entities Determined To Be Non-Responsive Bidders/Offerors Pursuant to The New York State Iran Divestment Act of 2012” list (“Prohibited Entities List”) posted on the New York State Office of General Services website at:

http://www.ogs.ny.gov/about/regs/docs/ListofEntities.pdf and further certifies that it will not utilize any subcontractor/consultant that is identified on the Prohibited Entities List on this Contract. The selected Proposer agrees that should it seek to renew or extend any Contract awarded hereunder, it must provide the same certification at the time the Contract is renewed or extended. The selected Proposer also agrees that any proposed assignee of the Contract will be required to certify that it is not on the Prohibited Entities List before BPCA may approve a request for assignment of the Contract.

During the term of any Contract awarded hereunder, should BPCA receive information that a person (as defined in State Finance Law §165-a) is in violation of the above-referenced certifications, BPCA will review such information and offer the person an opportunity to respond. If the person fails to demonstrate that it has ceased its engagement in the investment activity which is in violation of the New York State Iran Divestment Act of 2012 within 90 days after the determination of such violation, then BPCA shall take such action as may be appropriate and provided for by law, rule, or contract, including, but not limited to, seeking compliance, recovering damages, or declaring the selected Proposer in default of the awarded Contract.

BPCA reserves the right to reject any request for renewal, extension, or assignment for an entity that appears on the Prohibited Entities List prior to the renewal, extension, or assignment of the Contract, and to pursue a responsibility review with the selected Proposer should it appear on the Prohibited Entities List hereafter.

XI. EXECUTIVE ORDER 16

Pursuant to Executive Order 16 dated March 17, 2022, all State agencies and authorities are prohibited from entering into any new contract or renewing any existing contract with an entity conducting business operations in Russia. As part of this solicitation, each firm is required to certify that the firm is not an ‘entity conducting business operations in Russia.’ Certification under Executive Order No. 16 can be found in section XV of Exhibit B: Proposal Submission Packet.

A-1

EXHIBIT A

(Scope of Work)

The selected Consultant shall provide a turnkey, cloud-hosted Software-as-a-Service (“SaaS”) Vendor Verification Platform that automates vendor intake, compliance verification, risk screening, approval workflows, and system synchronization.

The Platform must support BPCA’s current operating environment, including Microsoft Dynamics Great Plains (“Dynamics GP”), while providing modern integration capabilities to support BPCA’s future Enterprise Resource Planning (“ERP”) architecture.

1. Vendor Self-Service Intake Portal The Platform shall:

• Provide a secure, mobile-responsive self-service portal supporting Multi-Factor Authentication (“MFA”) and Single Sign-On (“SSO”), including SAML 2.0 where applicable.

• Enable vendors to initiate registration, upload required documentation, including W-9/W-8 forms, ACH/direct-deposit forms, and Certificates of Insurance (“COIs”), update vendor profiles, and monitor onboarding and approval status.

• Support configurable workflows based on vendor type, spending threshold, procurement category, and other BPCA-defined criteria.

2. Automated Compliance Verification and Sanctions Screening

The Platform shall provide automated compliance verification capabilities, including:

• Taxpayer Identification: Automated IRS Taxpayer Identification Number (“TIN”) Matching, or equivalent IRS-authorized validation capability, to validate legal name and EIN/SSN information provided through Form W-9.

• Insurance Compliance: Optical Character Recognition (“OCR”) or equivalent automated extraction of COI information, validation against BPCA-defined insurance requirements, and automated expiration tracking and notifications.

• Sanctions and Debarment Screening: Automated screening against applicable federal and New York State sanctions, exclusion, and debarment sources, including SAM.gov, the New York State debarment list, and Office of Foreign Assets Control (“OFAC”) datasets.

3. Fraud Prevention and Payment Safety

The Platform shall:

• Provide automated verification of vendor banking information, including routing and account information, using NACHA-compliant or equivalent industry-standard account-validation methods prior to vendor activation.

A-2

• Support configurable change-management workflows requiring secondary authorization or other BPCA-approved controls for post-onboarding changes to vendor banking information.

• Maintain an auditable record of vendor banking-information verification, changes, and approvals.

4. Integration Architecture and ERP Agility

The Platform shall support BPCA’s current and anticipated future financial-system environments as follows:

• Phase I – Interim/Legacy Environment: Provide automated scheduled flat-file export and import capabilities, including CSV and Secure File Transfer Protocol (“SFTP”), compatible with BPCA’s Dynamics GP environment.

• Phase II – Future ERP Environment: Provide documented RESTful APIs and webhooks capable of supporting bidirectional real-time or near-real-time data synchronization with modern cloud ERP solutions without requiring material re-architecture of the Platform.

5. Audit Trail, Reporting, and FOIL Readiness

The Platform shall:

• Maintain immutable, date- and time-stamped audit logs documenting vendor submissions, internal approvals, data changes, verification results, banking-information changes, and other material vendor-onboarding activity.

• Provide reporting and audit capabilities sufficient to support BPCA internal controls, audits, investigations, records-management requirements, and obligations under the New York Freedom of Information Law (“FOIL”).

• Enable authorized BPCA users to retrieve and export relevant audit records in commonly usable formats.

6. Cybersecurity, Privacy and Data Protection

The Consultant shall maintain appropriate administrative, technical, and physical safeguards to protect BPCA systems, accounts, data, and information throughout the Contract term.

Proposers shall identify the location(s) where BPCA data will be stored, processed, transmitted, and backed up, together with any applicable security, privacy, and compliance controls. Data residency within the United States is required.

At a minimum, the Consultant shall:

• Encrypt BPCA data in transit and at rest using current industry-standard encryption.

• Support secure authentication and authorization controls, including MFA, SSO, role-based access control, least-privilege principles, and privileged-access protections.

• Maintain a formal vulnerability-management program, timely security patching, and periodic independent penetration testing.

• Maintain appropriate security logs for authentication activity, privileged access, administrative activity, data exports, integration activity, and cybersecurity events.

A-3

• Protect vendor banking, tax, and other sensitive information through restricted access, masking where appropriate, encryption, and segregation of duties.

• Maintain documented incident-response procedures and promptly notify BPCA of confirmed or suspected cybersecurity incidents affecting BPCA data, systems, or services.

• Maintain secure backup, business-continuity, and disaster-recovery capabilities, including documented recovery objectives and periodic testing.

• Scan uploaded files for malware and other malicious content.

• Disclose hosting locations, material subprocessors, and third parties that store, access, transmit, or otherwise process BPCA information.

• Maintain appropriate independent security assurance, such as SOC 2 Type II or equivalent, and provide relevant security documentation to BPCA upon request.

• Protect APIs and integrations through secure authentication, encryption, logging, credential-management, and other industry-standard security controls.

• Not sell, monetize, disclose for unrelated commercial purposes, or use BPCA data to train or improve artificial intelligence or machine-learning models without BPCA’s prior written approval.

• Cooperate with BPCA cybersecurity reviews, audits, risk assessments, and reasonable remediation requirements.

7. Data Portability and Contract Transition

BPCA shall retain ownership of all BPCA data processed, stored, or maintained through the Platform.

The Consultant shall:

• Provide BPCA with the ability to obtain a complete export of its data in a commonly usable, non-proprietary format during the Contract term and upon expiration or termination of the Contract.

• Provide reasonable transition assistance to support migration of BPCA data to a successor system or provider.

• Maintain BPCA data in accordance with applicable records-retention requirements during the transition period.

• Securely delete BPCA data following completion of BPCA-approved transition activities and applicable retention obligations.

• Provide written certification of data deletion upon BPCA’s request.

8. Production Support and Maintenance

The Consultant shall provide ongoing production support and maintenance throughout the Contract term, including:

• Hosting and system monitoring;

A-4

• Routine system maintenance;

• Security patches and remediation;

• Software updates and upgrades;

• Help-desk and technical support;

• Service-level commitments for system availability, incident response, and issue resolution;

• Escalation procedures; and

• Ongoing account and technical support.

B. Deliverables

Deliverable 1: Project Plan and Architecture Design Document

A detailed project implementation plan addressing the project schedule, key milestones, responsibilities, workflow mapping, integration requirements, and data-flow architecture, including the interim SFTP/flat-file integration and anticipated future API integration architecture.

Deliverable 2: System Sandbox and Configuration

Provisioning and configuration of a fully functional testing or sandbox environment, including workflow rules, vendor-registration requirements, COI processing rules, user roles, and applicable SSO/MFA configuration.

Deliverable 3: System Testing and User Acceptance Testing

Completion of end-to-end system testing and User Acceptance Testing (“UAT”), including security verification, TIN-matching validation, workflow testing, and flat-file integration testing with BPCA-designated staff.

Deliverable 4: Data Migration and Cleansing Support

Support for migration of BPCA vendor-master data, including data review, cleanup, deduplication, field mapping, validation, and baseline import of historical active vendor records.

Deliverable 5: Administrative and Vendor Training

Delivery of tailored training materials, user guides, administrative documentation, and live training sessions for BPCA staff and, as applicable, external vendors.

Deliverable 6: Go-Live and Post-Implementation Hypercare

Production deployment of the Platform, including go-live support and thirty (30) days of dedicated post-implementation hypercare, issue resolution, stabilization support, and final implementation sign-off.

Deliverable 7: Production Support and Maintenance

Ongoing provision of the production support and maintenance services described in Section A.8 throughout the Contract term.

A-5

(This page is intentionally left blank)

B-1

EXHIBIT B

(Proposal Submission Packet)

B-2

XII. PROPOSAL SUBMISSION CHECKLIST AND CONFIRMATION STATEMENT

[ ] The Proposer hereby certifies that they meet the Minimum Qualification Requirements as stated in Section IV.A of the RFP.

[ ] The Proposer hereby certifies that except as disclosed in the Proposal, no officer or employee of the Proposer is directly or indirectly a party to or in any other manner interested financially or otherwise in this RFP.

[ ] The Proposer hereby certifies that they have reviewed BPCA’s form of contract, attached as Exhibit E to the RFP, and either has no objections or has detailed their objections in an appendix to their Proposal.

[ ] The Proposer hereby certifies that they possess the experience, ability, resources and financial standing to perform the Services and shall, upon request by the Authority, provide documentation of such.

[ ] The Proposer hereby certifies that their Proposal submitted for Vendor Verification Software RFP includes the following required documents and forms, or that, where any required form or document may not be included, a written explanation has been provided for that omission:

1. Forms & Items included in this Exhibit:

[ ] This Checklist [ ] Answers to “Information Required” [ ] Vendor Responsibility Questionnaire / Certificate of No Change [ ] Statement of Non-Collusion [ ] Affirmation of Understanding of and Agreement Pursuant to State Finance Law §139-j(3) and §139-j(6)(b) [ ] Certification of Compliance with New York State Finance Law §139-k(5) [ ] Disclosure of Prior Non-Responsibility Determinations [ ] Encouraging the Use of New York State Businesses Statement [ ] Acknowledgement of Addenda Form [ ] MWBE Utilization Plan [ ] SDVOB Utilization Plan [ ] Minority and Women Owned Business Enterprises And Equal Employment Opportunity Policy Statement [ ] Executive Order 16 Certification [ ] Gender-Based Violence and the Workplace Certification

2. Additional Required Documents

[ ] Executive Summary [ ] Copy of the Proposer’s IRS W9 Form (https://www.irs.gov/pub/irs-pdf/fw9.pdf) [ ] Copy of the Proposer’s financial statements per section V.B.d.i [ ] Copies of appendices listed in section V.B.d.iii

Name of Proposer:

Officer Name:

Officer Title: ________________________________ (Signature of Officer) https://www.irs.gov/pub/irs-pdf/fw9.pdf

B-3

XIII. INFORMATION REQUIRED

The information requested in Sections A and B below is mandatory, and your Proposal shall be rejected as non-responsive if it does not contain responses to these questions. Answers may be written in the space provided, or included on separate pages, as part of the Proposal.

A. Questions and Information Sought Relating to the Work

1) Vendor Intake and Workflow

Describe the proposed Platform’s vendor self-service intake and onboarding capabilities. Include the vendor registration process, document submission and management, profile updates, approval-status tracking, configurable workflows, user authentication, and administrative controls.

2) Taxpayer Identification and Sanctions Screening

Describe the Platform’s capabilities for validating vendor taxpayer information and performing sanctions, exclusion, and debarment screening. Include:

a. the method used for IRS Taxpayer Identification Number (“TIN”) Matching or equivalent IRS-authorized validation;

b. whether validation is performed in real time, asynchronously, or through batch processing;

c. how mismatches or exceptions are handled;

d. the sanctions and debarment sources screened; and

e. the frequency of screening and procedures for handling potential matches.

3) Certificate of Insurance Management

Describe the Platform’s capabilities for receiving, extracting, reviewing, and monitoring Certificates of Insurance (“COIs”), including any Optical Character Recognition (“OCR”) or comparable technology used to extract policy information, validate coverage against BPCA-defined requirements, track expiration dates, and issue notifications.

B-4

4) Vendor Banking Verification and Payment Fraud Controls

Describe the Platform’s methods for validating vendor banking information and mitigating payment fraud. Include account-validation methods, controls applicable to initial onboarding, and approval or verification procedures for subsequent changes to vendor banking information.

5) Integration with Microsoft Dynamics Great Plains

Describe the proposed approach for exchanging vendor data with BPCA’s current Microsoft Dynamics Great Plains environment, including SFTP and/or flat-file capabilities, supported file formats, data mapping, transmission frequency, reconciliation, error handling, and notification of failed transactions or records.

6) Future ERP Integration

Describe how the Platform supports integration with modern cloud ERP solutions through RESTful APIs, webhooks, or other integration methods. Include available API documentation, authentication methods, supported inbound and outbound data exchange, and the approach for transitioning BPCA to a future ERP environment without requiring material re-architecture of the Platform.

7) Audit Trail and Reporting

Describe the Platform’s audit-trail, reporting, and data-retrieval capabilities. Include the types of vendor and administrative activities logged, retention and search capabilities, available standard and configurable reports, and the ability to export information to support audits, investigations, records-management requirements, and FOIL requests.

8) Implementation Approach and Schedule

Describe the proposed implementation methodology and schedule from project kickoff through production deployment. Provide a detailed project plan and Gantt chart identifying major phases, milestones, dependencies, deliverables, and anticipated timeframes. The response should identify:

B-5

a. key implementation activities and milestones;

b. anticipated implementation duration and proposed go-live date or timeframe;

c. Consultant and BPCA roles and responsibilities;

d. configuration and integration activities;

e. data migration and validation activities;

f. system testing and User Acceptance Testing (“UAT”);

g. training and deployment activities; and

h. post-implementation stabilization/hypercare.

9) Data Migration and Cleansing

Describe the proposed methodology for migrating BPCA’s existing vendor data to the Platform, including data mapping, cleansing, deduplication, validation, exception handling, and baseline import of active vendor records.

10) Training and Change Management

Describe the training and change-management services included in the proposed solution, including administrator training, user guides and documentation, live training, ongoing educational resources, and assistance available to external vendors using the Platform.

11) Production Support and Maintenance

Describe the post-implementation support and maintenance model, including:

a. help-desk availability and support hours, including coverage during Eastern Time business hours;

b. methods for submitting and tracking support requests;

c. incident classification, escalation, and resolution procedures;

d. standard system-availability commitments and service levels;

e. routine maintenance and planned outages; and

f. software updates, upgrades, and security remediation.

B-6

Provide the Proposer’s standard service-level agreement or equivalent documentation, if available.

12) Information Security and Independent Assurance

Describe the information-security program applicable to the proposed solution, including:

a. independent security certifications, attestations, or assessments, such as SOC 2 Type II or equivalent;

b. encryption of data in transit and at rest;

c. MFA, SSO, role-based access control, least privilege, and privileged-access protections;

d. vulnerability management and security patching;

e. penetration testing;

f. security logging and monitoring; and

g. protections for vendor banking, taxpayer, and other sensitive information.

Identify any security documentation that can be made available to BPCA during the procurement process or upon request.

13) Business Continuity, Disaster Recovery, and Incident Response

Describe the Proposer’s business-continuity, disaster-recovery, backup, and cybersecurity incident-response capabilities applicable to the proposed solution. Include backup frequency, redundancy and failover capabilities, recovery objectives, testing frequency, and procedures for notifying customers of cybersecurity incidents affecting customer data or services.

14) Hosting, Subprocessors, and Third-Party Risk

Identify all material subcontractors, subprocessors, hosting providers, and third-party services proposed in connection with the solution. For each, describe:

a. the services or functions performed;

b. where BPCA data will be hosted, processed, and stored;

B-7

c. whether BPCA data may be accessed, processed, transmitted, or stored outside the United States;

and

d. the controls used by the Proposer to assess and manage cybersecurity, privacy, and operational risks associated with such third parties.

15) Data Portability and Contract Transition

Describe the Platform’s data-export and transition capabilities, including available export formats, the process for obtaining a complete copy of BPCA data during the Contract term and upon termination, migration assistance available to a successor system or provider, applicable data-retention practices, secure deletion procedures, and availability of written certification of deletion.

16) Product Development and Technology Roadmap

Describe the Proposer’s approach to product development, software releases, upgrades, and technology modernization. Identify any material planned changes to the proposed Platform that may affect functionality, integrations, hosting, or BPCA’s use of the Platform during the anticipated Contract term.

17) Artificial Intelligence and Machine Learning

Identify any artificial intelligence (“AI”) or machine-learning functionality incorporated into or used in connection with the proposed Platform or services. Describe the purpose of such functionality, the data used by such functionality, applicable customer controls, and whether BPCA data would be used to train, improve, validate, or otherwise develop any AI or machine-learning model.

B-8

B. Questions and Information Sought Relating to Proposer’s Firm & Eligibility

18) Firm Experience and References

Describe the Proposer’s background, size, organizational structure, and experience providing vendor verification, vendor onboarding, compliance, or comparable SaaS platforms. Highlight experience with public benefit corporations, state agencies, municipalities, or other public-sector entities, where applicable.

Provide at least three (3) client references for which the Proposer has performed work similar in size and scope to the Work contemplated by this RFP. For each reference, provide the client name, description and date of the engagement, services performed, and the name, title, telephone number, and email address of a client representative familiar with the work.

19) Key Personnel

Identify the key personnel proposed for this engagement, including the individual who will serve as Lead Project Manager (“Lead PM”) and primary contact for BPCA. For each individual, provide:

a. title and position within the firm;

b. area(s) of specialization;

c. proposed role and services to be performed; and

d. relevant experience and qualifications.

Identify any individual the Proposer considers essential to successful performance of the engagement.

20) Firm and Eligibility Disclosures

Disclose the following and provide an explanation where applicable:

a. any significant changes in ownership, control, organizational structure, merger activity, acquisition activity, or restructuring within the past three (3) years, and any material changes presently anticipated;

b. the Proposer’s procedures for identifying and managing conflicts of interest and any actual or potential conflict of interest relating to the Proposer’s performance of the Work for BPCA;

c. any professional or personal relationships between the Proposer’s personnel and BPCA Board Members or employees identified in Exhibit D;

d. whether any individual proposed for this engagement was formerly employed by BPCA and, if so, the dates of such employment and that individual’s involvement, if any, in matters relating to this RFP;

B-9

e. any discipline, censure, or material regulatory action involving the Proposer or proposed key personnel during the past five (5) years that relates to the services contemplated by this RFP;

f. any material litigation, administrative proceeding, contract termination for cause, or termination of a public-sector client relationship during the past five (5) years relating to the provision of services similar to those contemplated by this RFP; and

g. any material cybersecurity breach or material loss of customer data experienced by the Proposer during the past five (5) years.

The Proposer shall also clearly identify any portion of its Proposal that it believes contains confidential or proprietary information exempt from disclosure under the New York Freedom of Information Law (“FOIL”) and state the basis for such claim. BPCA will determine, in its sole discretion and in accordance with applicable law, whether any requested records or portions thereof are exempt from disclosure.

B-10

XIV. VENDOR RESPONSIBILITY QUESTIONNAIRE

A. Instructions:

The Standard Vendor Responsibility Form should be filled out by someone in your firm who knows about tax filings, prior findings of non-responsibility by a governmental authority, etc., and can certify the accuracy of all information requested in the form (such as legal status, tax status, and debarment status).

You must answer every question on the questionnaire.

NOTE: You may fill out the “Certificate of No Change” form instead ONLY if your firm has submitted the Vendor Responsibility form to Battery Park City Authority already during this calendar year. If this is the first time your firm is proposing to do work for Battery Park City Authority this year, then you must fill out the entire Vendor Responsibility Questionnaire.

B-11

B.…