What SUNY asked for

Source: SUNY RFP CM004257, released January 21, 2025. This is the tender, not proof of the final contract, current build, or completed user research. All page numbers below are PDF pages. Printed page 1 is PDF page 5.

Reading status: fully reviewed. All 103 pages, visuals and the annotation check are covered. Referenced separate attachments are identified below as missing from this file.

What matters for the experience

• E-001, documented priority: SUNY first wants reliable records across campuses, including unique learner counts, completion, employment outcomes, and movement between non-credit and credit study. Search and online payment follow that foundation (pages 8, 31). Confidence is strong for the tender's stated priorities. Current release priorities need later sources.
• E-002, requested research: discovery must include interviews, personas, journey maps, and other work to understand end users (page 32). This establishes an expectation, not evidence that those activities happened. Confidence is strong for the request; completion is unknown.
• E-003, varied participation: the tender includes individuals, guests, employers registering groups, staff handling exceptions, youth learning, and people moving into credit study (pages 17–23). This supports a broad service audience. It does not establish each group's size, behavior, or priority.

Pages 1–13: purpose and current conditions

• Pages 1–6: cover, contents, summary, and signature forms. The cover says bids are due February 21, 2025; the summary says February 28. Award and start dates are not set. The bidder certifies understanding, accuracy, and commitments. Page 4 continues the contents.
• Pages 7–8: combined software and services, a five-year term and possible five-year renewal. Historical SUNY figures are 64 campuses, about 400,000 students, 7,500 degree/certificate programs, and three million alumni. Non-credit scale is over one million registrations and nearly 26,000 instructional activities. Do not reuse these as current research statistics.
• Pages 8–9: campus processes differ. SUNY describes duplicated or incomplete records, manual entry, and limited ability to follow learners and employment outcomes across systems. The service should link campus systems and support staggered adoption. Implementation may take up to 24 months after required approval.
• Pages 10–11: migration, integration, security, data accuracy, delivery experience, and complete cost are mandatory. Features span profiles, discovery, registration, payment, communication, languages, scheduling and reporting. Suppliers need relevant experience and references.
• Pages 11–13: the narrative describes multiple learner handoffs and a more connected future service. Their visual details are recorded under Visual and file checks.

Pages 14–23: ten service areas

The checklist distinguishes built-in, add-on, custom and unmet capability. A listed feature is not proof it is built or approved for release 1.

Pages 23–28: access, identity, integration and delivery

• Pages 23–26: flexible architecture, security and accessibility. Page 25 refers to WCAG 2.2, keyboard/voice access, readable size/contrast, screen readers and 12 state languages. These are source requirements; current legal dates and the accepted project baseline need confirmation when used for acceptance.
• Page 23 says close to 6,000 registered courses; page 8 says nearly 26,000 instructional activities. Definitions may differ. Do not combine or silently choose one.
• Pages 25–26: shared identity, duplicate matching, campus links, SUNY authentication/MFA, central roles, batch and near-real-time exchange. Banner and Brightspace are examples. Campus payment services and interface updates must be supported.
• Pages 27–28: 17 delivery items cover plans, scope/ownership, requirements/mockups, functional and technical specifications, architecture, source inventory, components, testing, traceability, acceptance testing, integration, mapping/migration, knowledge transfer and training. Required artifacts are not evidence of completed or accepted work.

Pages 29–32: priorities and discovery

• Pages 29–30: governance, communication, escalation, roles, capacity, security and sustainable delivery; relevant project examples, staff credentials and subcontractor disclosure.
• Page 31: SUNY sets priorities during requirements work. Database/integrations, counts, labor outcomes and transitions lead; search/payment follow. Bidders distinguish existing, configurable and new capability.
• Page 32: interviews, personas and journey maps belong in discovery. Later phases cover common processes, architecture, customization, specifications, testing, traceability, acceptance and integration. Look for the research records before treating proposed personas as validated.

Pages 33–42: protection, acceptance and purchasing

• Pages 33–35: operating guidance, deployment, as-built repository, handover and acceptance. SUNY owns supplied/created data. Access and disclosure are purpose-limited. AI training/model development requires written consent; automated decisions have human-oversight and non-discrimination conditions. This does not establish permission for a particular tool. Continental-US storage is specified unless agreed otherwise. Education privacy and other obligations apply where relevant.
• Pages 36–37: security plans, testing, annual assessments, incident handling and assurance evidence are requested. The specified route combines a higher-education assessment with audit/certification and penetration-test evidence. No proof of the current system passing these checks is provided here.
• Page 38: an accessibility conformance report using the specified VPAT version covers interfaces and roles. Independent evaluation is required if the report was not completed by a third party. A standards reference alone cannot show conformance.
• Pages 38–40: complete fixed costs, included travel, tax treatment, conflict certification and formal procurement questions. Only written addenda carry official clarification. These are historical purchasing procedures.
• Pages 40–42: administrative, technical and cost review, demonstrations, responsibility checks, and tentative award subject to approval. Scoring: technical 50, cost 25, demonstration 25. These weights are not design priorities.

Questions to carry forward

1. Which signed scope, amendments and accepted release plan govern today?
2. Where are the interviews and journey research requested on page 32, if conducted?
3. Which activities allow account-free registration under 3.7?
4. How do campus payment and record-keeping choices affect the next learner step?
5. Which definitions explain the different course/activity counts?

Outside research and design recommendations have not been added.

Pages 43–56: evaluation and supplier obligations

• Pages 43–44: price scoring compares total costs. Demonstrations assess business understanding, logical user flows, clear and accessible screens, needed data, security, reporting, integration, training and support. Ease of use is an explicit evaluation concern, but no usability test results are reported.
• Pages 44–46: SUNY reserves rights to reject, clarify, amend, negotiate and check proposals. Responses must cover each requested point, separate cost from technical content, disclose deviations and be signed by an authorized person. The offer period here is 180 days (90 for specified goods), while page 38 mentions 60-day pricing. This is another tender detail for the contract owner, not a design decision.
• Pages 47–52: vendor responsibility, restricted procurement contacts, non-collusion, workforce reporting, anti-discrimination and harassment-prevention certifications, and subcontractor disclosure. Participation goals are 6% service-disabled veteran-owned businesses and 30% minority/women-owned businesses (16% and 14%). Required plans, evidence of good-faith efforts, deficiency responses and possible waivers are described.
• Pages 52–55: insurance requirements include general liability ($1m per occurrence, $2m aggregate), applicable auto liability ($2m), technology errors/omissions ($2m), cyber/privacy cover ($10m), and worker benefits. Applicable coverage must be maintained; some claims-made cover needs three-year tail coverage. These are procurement requirements, not evidence of a supplier's actual insurance.
• Pages 55–56: annual consulting-employment reporting and the contract clauses to be incorporated. Exhibits A and A-1 take precedence over conflicting RFP/contract terms according to this section.

Pages 57–75: forms and missing separate attachments

The supplied RFP is complete as a 103-page file, but it refers to separate attachments. The original RFP glossary on page 102 is also only a placeholder. The later Confluence business glossary should not automatically be treated as that original exhibit.

Pages 76–86: standard clauses and fair participation

• Pages 76–79, Exhibit A clauses 1–31: funding limits, assignment/approval, worker coverage, non-discrimination, wages, independent bidding, boycott restrictions, set-off, records retention/access, payment identifiers/privacy, equal opportunity, precedence, governing law, payment/disputes, service of process, restricted materials, fair-employment principles, local participation, sanctions, breach notices, consulting disclosures, apparel procurement, lobbying/tax certifications, Iran restrictions, electronic copies, and conditional hospital provisions. The hospital clauses preserve hospital authority and records access; they do not establish a medical use case for this product.
• Page 76 clause 10 continues on page 77: contract records must be kept for the balance of their creation year plus six years, with specified inspection access. This is a contract-record rule, not a confirmed learner-record retention policy.
• Pages 80–86, Exhibit A-1: definitions of covered contracts and certified enterprises; equal-opportunity plans, staffing and workforce reports; subcontractor commitments; evidence of recruitment and participation efforts; utilization plans and waivers; goals, compliance reports, enforcement and damages. Participation must not be double-counted across minority-owned and women-owned goals.
• Page 84 gives 20 days for review of a utilization plan, whereas page 51 gives 30 days for the statewide plan. Preserve both contexts; the contract owner should settle applicability if it matters. These sections do not supply learner evidence.

Pages 87–94: general contract terms

• Page 87: written execution and approvals, requested sales reports, campus conduct, written amendments, and document precedence. The listed hierarchy places standard clauses and the agreement ahead of the solicitation, service-level agreement and supplier proposal. Exhibit letters in this generic clause differ from this RFP's exhibit list. Use document titles and the executed agreement when resolving authority.
• Pages 87–89: professional delivery warranties, security and breach handling, data disposal, service availability, annual disaster-recovery tests, continuity and data portability. Sections 7.1 and 7.2 are explicitly deleted; the separate RFP privacy requirements remain elsewhere in the source.
• Pages 89–90, section 10: web products must meet WCAG 2.1 AA in this general clause, with testing evidence, reporting of gaps, a plan to resolve them, and response to complaints. Page 25 refers to current WCAG 2.2. Record both; do not quietly choose the lower baseline or claim the project has established acceptance criteria.
• Pages 90–91: electronic vendor payment, information-disclosure conditions, independent-contractor status, exceptional disruption, liability, employment protections, safety, and use by other authorized entities. Public announcements need written SUNY approval. These clauses do not authorize us to publish project material.
• Pages 91–93: ethics, ownership of specifically commissioned deliverables (with exclusions for supplier tools and third-party components), severability, subcontractor review/coordination/insurance, ongoing responsibility, termination and orderly transfer of records/services.
• Page 94: use of SUNY names and marks is limited to the work and subject to review/approval.

Pages 95–103: institutions, submission rules and service levels

• Pages 95–96: 29 state-operated institutions, five statutory colleges (one at Alfred and four at Cornell), 30 community colleges, the Research Foundation and NY CREATES. Other related organizations may qualify with approval. This identifies institutional scope; it does not establish which campuses join each release.
• Pages 97–100: proposal ownership/confidentiality, protests, conflicts, award notices, New York business participation, acceptance and exceptions, competition, error notification, debriefing, written authorization for extra work and one-bid rules. Only expressly accepted additional terms become contractual terms.
• Page 101: hosting target is 99.9% monthly availability, excluding specified maintenance (up to 16 hours/month), third-party disruption and other causes beyond control. Credits are 15% at 97–99.9%, 25% at 94–96.9%, 50% at 92–93.9%, 75% at 90–91.9%, and 100% below 90%, capped at monthly fees. Monitoring is 24/7; onsite coverage is normal business hours. Maintenance should minimize disruption, with reasonable efforts to give three days' notice for relevant non-routine work. These are proposed service terms, not observed availability.
• Page 102: original RFP glossary is a separate PDF, absent from this file.
• Page 103: optional additional-terms exhibit title only.

Visual and file checks

• Page 4 is the remaining table of contents, not a blank page. Image-based headings and the contents on pages 2–4 were read visually.
• Page 12, figure 1.1: the prospect searches, seeks funding information, contacts the registrar and submits registration. The registrar checks places and communicates a waitlist or confirmation. Withdrawal, manual/online payment, confirmation, refunds, SIS registration, ID lookup/creation and later withdrawal/refunds involve staff. Email, visits, phone, forms, websites, payment services and learner IDs appear as channels. This is SUNY's documented process model, not an observed sample of learner journeys.
• Page 12, figure 1.2: employer bulk registration is included. Eligibility and aid sit alongside discovery; payment confirmation and SIS/ID creation include manual steps. The drawing connects existing channels and systems and shows a registrar waitlist check.
• Page 13, figure 2: future catalog search, applications, account management and payment connect through data integration to campus student systems, an LMS, a payment gateway and a reporting platform. The note says data uses SUNY HSDR infrastructure. A high-level diagram does not settle release scope or detailed ownership.
• Multi-column clauses on pages 76–86 and service terms on page 101 were read in column order to avoid misleading extraction order.
• One highlight annotation on page 10 is attributed to a PruTech reviewer, dated March 13, 2025; it contains no written comment. No embedded file attachments were found.
• S07's 20 pages match full-file PDF pages 7–26 in both normalized text and rendered page images. The source note below can be shared with that excerpt without counting it as independent evidence.

Reading coverage, completed October 26, 2026

All 103 PDF pages were read, including forms, appendices, contents, image headings, process diagrams and the annotation check. Truncated extraction batches were reread. Exact PDF page references were checked against extraction and visual content where layout mattered. Separate files referenced by the RFP remain a collection gap, listed above. No current legal advice or outside research has been added.

Related topics: cross-source findings.