State University of New York

Buyer is seeking a contractor to provide services under specified contract terms and conditions. Buyer requires strict compliance with data privacy, security, and accessibility requirements. The contractor must implement comprehensive security measures, disaster recovery capabilities, and ensure compliance with various regulations including FERPA, GLBA, HIPAA, and accessibility standards.

• 5/6/2025 - Proposal Due Date

• Develop data security plan compliant with PCI DSS requirements
• Implement information security incident response policy
• Provide SOC 2 Type 2 or equivalent security audit reports
• Ensure web-based products conform to WCAG 2.1 AA standards
• Make non-web products meet Section 508 accessibility requirements
• Provide accessibility testing results and documentation
• Maintain disaster recovery services at dedicated facility
• Test disaster recovery capabilities annually
• Implement business continuity plan
• Ensure data portability for smooth transfer of services
• Safeguard SUNY data with appropriate privacy controls
• Comply with FERPA for student education records
• Adhere to GLBA for financial institution requirements
• Follow HIPAA requirements for health information
• Maintain industry standard security features and protocols
• Complete Higher Education Community Vendor Assessment Tool
• Comply with breach notification laws (ISBNA/SHIELD)
• Provide accessibility remediation plans when needed
• Ensure no SUNY data stored outside the United States
• Address security across multiple data access methods