Metropolitan Community College

Buyer requires an Information Technology contractor that can handle Personal Information with strict confidentiality. The contractor must implement comprehensive information security measures in compliance with various Privacy Laws including FERPA, GLBA, and FACTA. The contractor is expected to maintain robust security protocols, undergo regular audits, and promptly report any security incidents. The agreement includes provisions for protection of MCC Community Members' nonpublic personal information and establishes requirements for third-party risk management.

• 5/16/2025 - Proposal Due Date

• Maintain formal security and privacy program
• Have control framework for security
• Undergo penetration tests and vulnerability assessments
• Complete annual SOC1 and SOC2 Type 2 audits
• Maintain formal security incident response capability
• Carry cyber-liability insurance with minimum $1M per occurrence

• Protect Personal Information and maintain confidentiality
• Implement information security measures
• Undergo annual SOC1 and SOC2 Type 2 audits
• Maintain formal security and privacy program
• Conduct vulnerability assessments and penetration tests
• Establish formal security incident response capability
• Notify of security breaches within 24 hours
• Respond to annual questionnaires for third-party risk program
• Maintain cyber-liability insurance
• Return or destroy Personal Information upon completion