Vendor Risk Management SaaS Solution Implementation

Background
The University of North Carolina is seeking proposals for a Vendor Risk Management Software as a Service (SaaS) solution. This initiative aims to implement an automated Third-Party Vendor Risk Management System that will enhance collaboration and visibility across its 17 institutions and related entities.

The current manual systems are inadequate for expediting assessments, sharing information, and maintaining vendor dialogues. The goal is to create a secure shared repository for sensitive documents and facilitate workflow autonomy while enabling high-level monitoring by the parent organization.

Work Details
The contract includes the provision of a Third-Party Risk Management software tool with the following capabilities:

- Shared Repository functionalities
- Implementation Services
- Optional Scoring/Monitoring Software
- Managed Services

The system must support data classification labels, monitor/score risk, and integrate various compliance frameworks such as HECVAT, SIG, HIPAA, PCI, NIST 800-171, etc. Vendors must provide detailed specifications on how their solution meets these requirements, including security specifications for non-state hosted solutions and compliance with North Carolina's statewide data classification policies.

Period of Performance
The contract will have an initial term of one year from the effective date of the award, with the option to extend for up to four additional one-year periods at the discretion of the State.

Place of Performance
The services will be performed within the State of North Carolina across various campuses and institutions under the University of North Carolina system.