Anonymous Compliance and Ethics Reporting System

George Mason University, a public institution of higher education in Virginia, is seeking proposals through a competitive Request for Proposals (RFP) process to establish a contract with one or more qualified vendors to provide an outsourced anonymous compliance and ethics reporting system. The procurement calls for a 24/7 third-party anonymous reporting platform that enables individuals to submit concerns regarding ethical misconduct, non-compliance, or ethics guidance while maintaining reporter anonymity through multiple reporting channels including telephone, web, and smart device access. Key deliverables include trained intake personnel familiar with higher education environments, translation services in multiple languages, case management software, automated reporting capabilities, and a vendor-hosted Software-as-a-Service (SaaS) solution with no on-premises deployment required. The system must comply with WCAG 2.1 Level AA, ADA, and Section 508 accessibility standards, implement industry best-practice anonymity safeguards including network-level anonymity and voice distortion, and maintain all university data within the United States while providing current SOC 2 Type II reports and VPAT/Accessibility Conformance Reports. Proposals will be evaluated based on five criteria: quality and suitability of products/services (25 points), offeror qualifications and experience including references (25 points), specific plans and methodology (20 points), pricing (20 points), and Virginia Small Business and Supplier Diversity (SWaM) certification status (10 points). The proposal submission deadline is March 3, 2026 at 2:00 PM Eastern Time through the Bonfire portal, with written inquiries due by February 10, 2026 and responses posted by February 19, 2026. The initial contract term is one year with nine successive one-year renewal options, and oral presentations and demonstrations may be required prior to award, which is subject to approval by Mason's Architectural Standards Review Board and typically requires six to eight weeks.

Virginia Small Business and Supplier Diversity (SWaM) certification status at proposal submission is a weighted evaluation criterion worth 10 points, encouraging participation from certified small businesses and diverse suppliers, though no explicit set-aside restrictions limit competition to these entities. All potential offerors must complete and submit the Small Business Subcontracting Plan and identify any exceptions to Mason's standard two-party contract terms. The contractor must maintain specific insurance coverage including Commercial General Liability of at least $1,000,000 per occurrence, Workers' Compensation Insurance at statutory limits, Commercial Automobile Liability Insurance of at least $1,000,000 per occurrence, an umbrella/excess policy of at least $5,000,000, and Cyber Liability Insurance of at least $2,000,000 per incident. The selected vendor must comply with all applicable federal and state laws including FERPA, HIPAA, HITECH, ADA, Section 508, and Virginia privacy statutes, and the system requires no single sign-on integration with Mason's enterprise systems. While no specific budget range or award value is disclosed in the RFP documentation, detailed pricing proposals must include all implementation, integration, support services, training, data transfer, and maintenance costs broken down separately for recurring and one-time expenses, with travel expenses within a 50-mile radius of Mason's Fairfax campus included in proposal rates. Mason reserves the right to cancel the contract without penalty upon 60 days' written notice and may extend the contract to other public bodies, educational institutions, or affiliated corporations for cooperative procurement purposes.