Agenda packet — Newark City Council, September 24, 2026 (part 1 of 2)

Teleconference Location: Council Member Grindall participating remotely from Hotel Lulu, 1850 S Harbor Boulevard, Anaheim, California 92802 Regular Meeting Agenda
Thursday, September 24, 2026
7:00 P.M.

The City Council will hold a hybrid meeting in the Council Chambers and virtually via Zoom.

How to observe the Meeting:

1. Cable Channel 30

2. YouTube Live stream
How to provide live Public Comment during the City Council Meeting:

1. Participate in the Council Chambers.

2. Join remotely using Zoom. Meeting ID: 869 5232 7798.

To request to speak, use the “raise hand” function in Zoom.

3. Join by Phone: Dial 1-669-444-9171. Meeting ID: 869 5232 7798.

Press *9 to request to speak and *6 to unmute/mute.

How to submit written Public Comment:

Please submit email comments to the [email protected] by 3:00 p.m. on the day of the meeting, including the corresponding agenda item number. Comments will be shared with the City Council and made available for public viewing.

A. ROLL CALL
September 24, 2026 City Council Regular Meeting Page Number 1 of 4 B. PRESENTATIONS

1. Proclaiming National CERT Week

2. Proclaiming September as National Preparedness Month C. PUBLIC COMMENT
The public is invited to address the City Council on any item not listed on the agenda. Public comments are generally limited to five minutes per speaker.

The Presiding Officer may reduce the time allotted for each speaker as needed. Please note that State law prohibits the Council from taking action on items not listed on the agenda.

D. CONSENT CALENDAR
Consent Calendar items are considered to be routine and may be approved by one motion. There will be no separate discussion on these items unless there is a request by a Council Member, a staff member, or a member of the public to remove an item for separate discussion and action.

1. Approval of Audited Demands

2. Approval of September 10, 2026, City Council Minutes

3. Waive further reading and adopt an ordinance amending Chapter 2.09 of the Newark Municipal Code ("City Councilmembers-Compensation") to increase the salaries of the Mayor and City Councilmembers

4. Waive further reading and adopt an ordinance amending the Newark Zoning Map to include specific additional parcels in the -BRH Overlay District to comply with state law and ensure consistency among the City's code

5. Adopt a resolution authorizing an agreement with Advanced Exercise Fitness Solutions for Fitness Equipment and Flooring Replacement at the George M.

Silliman Community Activity Center and amending the 2026-2028 Biennial Budget and Capital Improvement Plan

6. Adopt a resolution approving and authorizing the acceptance of the 2026-2027 Selective Traffic Enforcement Program (STEP) federal grant through the State of California Office of Traffic Safety (OTS) and amending the 2026-2028 Biennial Budget
September 24, 2026 City Council Regular Meeting Page Number 2 of 4

7. Adopt a resolution authorizing the City Manager to execute the Fourth Amendment to the Contractual Services Agreement with Granicus LLC in an additional amount of $13,031.92 for website maintenance, hosting, and licensing services

8. Adopt a resolution amending the Citywide Salary Schedule to change the classification title of Maintenance Superintendent to Public Works Maintenance Manager in conformance with California Code of Regulations, Title 2, Section 570.5
E. PUBLIC HEARINGS
F. GENERAL BUSINESS / NON-CONSENT ITEMS

1. Year-end budget review and adoption of a resolution amending the 2024–2026 Biennial Budget and Capital Improvement Plan for fiscal year 2025–26 G. CITY MANAGER UPDATES
H. CITY COUNCIL MATTERS
City Council Members report on attendance at intergovernmental agency meetings, conferences, and seminars since the last meeting. City Council Members may also announce upcoming events and coordinate attendance; report on local events attended since the last meeting; and make brief comments on issues of concern.

1. Adopt a resolution approving the Mayor’s appointment to the Public Art Committee
I. CLOSED SESSION
J. ADJOURNMENT

MEETING INFORMATION
September 24, 2026 City Council Regular Meeting Page Number 3 of 4

MEETING INFORMATION
Accessibility
This meeting is wheelchair accessible. For special accommodations, contact the City Clerk’s Office at (510) 578-4266 or [email protected] at least 72 hours in advance.

Council Meeting Materials
Agenda packets are generally posted on the City website by the Friday before the meeting, and at least 72 hours before regular meetings or 24 hours before special meetings. Supplemental materials released later are available for public viewing at City Hall, 37101 Newark Boulevard, during regular business hours. City Council agendas are available at newarkca.gov/councilagendas. Visit the Agenda Translation Webpage to view the agenda in your preferred language.

Policy on Telephonic/Internet Service Disruption (SB 707) The Council’s policy outlines procedures for handling disruptions to telephonic or internet service during meetings, including recess requirements and steps to restore access.

Certification of Meeting Notice and Agenda Posting
This notice and agenda were posted on the City’s website newarkca.gov/councilagendas and at the City Hall bulletin board located at 37101 Newark Boulevard, Newark, CA, at least 72 hours prior to the meeting date, in accordance with the Ralph M. Brown Act.
/s/ Neetu Salwan, CMC, City Clerk
Mission Statement Vision Statement
It is our mission to serve and
partner with our community to
continually enhance the quality of
life of everyone in Newark.

We are a welcoming city…
…where it is safe to live, to play, and to raise children. …where diverse and energetic people strive to live in harmony. …that cherishes small town values and also enjoys being progressive. …where educational programs are available and first-rate. …where cultural and recreational opportunities are plentiful and spiritually enriching. …with residents filled with civic pride, social concerns, and community involvement. …with tree-lined streets and a diverse system of parks and open spaces. …where economy is strong and vital and provides jobs.
…where government is financially stable, accessible, and responsive. …that provides timely, accurate, and transparent communication. …that is well-planned, well-managed, and well-maintained.

SENIOR STAFF MEMBERS
David J. Benoun
City Manager
Lenka Hovorka
Assistant City Manager
Kristopher J. Kokotaylo
City Attorney
Steven Turner
Community Development Director
Jonathan Arguello
Police Chief
Krysten Lee
Finance Director
Brittney Frye
Human Resources Director
Edwin Miranda
Chief Information Officer/Information Technology Director Howard Young
Public Works Director
Ryan Nishimoto
Alameda County Fire Department Deputy Chief
Roya Gonzalez
Strategic Initiatives Manager
Alicia Day
Recreation and Community Services Director
Neetu Salwan
City Clerk
Colleen Lettire
Communications and Public Engagement Manager
September 24, 2026 City Council Regular Meeting Page Number 4 of 4 Item B. 1.

DATE 09/24/2026
TO Honorable Mayor and City Council Members
FROM Neetu Salwan, City Clerk
SUBJECT Proclaiming National CERT Week
National CERT Week is held annually on the third week of September in conjunction with National Preparedness Month. In 2026, National CERT Week will be held September 20-26. A proclamation has been prepared and Emergency Services Coordinator Richard Martinez and members of CERT will be at the meeting to accept it.

Attachments
Attachment 1: Proclamation No. 1991
PROCLAMATION NO. 1991

NATIONAL CERT WEEK
WHEREAS, communities across the nation are strengthened when individuals are prepared, connected, and empowered to take an active role in emergency preparedness, response, and recovery; and WHEREAS, the Community Emergency Response Team (CERT) program was established in 1986 to educate and train community members in disaster preparedness, basic response skills, and ways to support their communities during emergencies; and
WHEREAS, City of Newark CERT program was established in 2009; and WHEREAS, City of Newark recognizes the invaluable contributions of City of Newark CERT volunteers and supports efforts to expand emergency preparedness, increase community engagement, and ensure that the City of Newark CERT mission continues for generations to come; and WHEREAS, City of Newark CERT program represents the enduring spirit of volunteerism and demonstrates that community resilience begins with individuals who are willing to learn, lead, and support one another before, during, and after disasters; and
WHEREAS, CERT volunteers dedicate 470 hours this year to training, emergency response support, exercises, public education, and community service, providing a valuable resource to the City of Newark; and
WHEREAS, National CERT Week provides an opportunity to recognize the service and accomplishments of CERT volunteers, highlight the important role of community-based preparedness, promote training, and volunteer opportunities, and encourage residents to become more prepared for emergencies; and
WHEREAS, the theme of National CERT Week 2026, “Carrying the Torch 40 Years & Beyond,” honors the legacy of those who built and strengthened the CERT program over the past four decades while inspiring the next generation of volunteers to continue advancing preparedness, resilience, and community service; and
NOW, THEREFORE, I, Michael K. Hannon, Mayor of City of Newark, do hereby proclaim September 20–26, 2026, as

NATIONAL CERT WEEK
in City of Newark and encourage all residents to recognize the accomplishments of CERT volunteers, participate in emergency preparedness activities, and learn how they can contribute to building safer, stronger, and more resilient communities.

IN WITNESS WHEREOF, I have hereunto set my hand and caused the official seal of City of Newark to be affixed this Twenty-fourth Day of September, Two Thousand Twenty-six.

MICHAEL K. HANNON
Mayor
Item B. 2.

DATE 09/24/2026
TO Honorable Mayor and City Council Members
FROM Neetu Salwan, City Clerk
SUBJECT Proclaiming September as National Preparedness Month National Preparedness Month is an observance each September to raise awareness about the importance of preparing for disasters and emergencies that could happen at any time. Emergency Services Coordinator Richard Martinez and members of the Community Emergency Response Team will be at the meeting to accept the proclamation.

Attachments
Attachment 1 - Proclamation No. 1992
PROCLAMATION NO. 1992

NATIONAL PREPAREDNESS MONTH
WHEREAS, National Preparedness Month has been observed each September since 2004, encouraging individuals, families, businesses, and communities to take proactive steps to prepare for emergencies such as natural disasters, public health crises, and man-made incidents; and
WHEREAS, the California Legislature officially designated September 2025 as California Emergency Preparedness Month by way of Senate Concurrent Resolution 97 (SCR 97), recognizing the importance of readiness and resilience statewide; and WHEREAS, the City of Newark maintains a robust Emergency Operations Plan and would activate its Emergency Operations Center (EOC) in times of large-scale disaster to coordinate response and recovery efforts for the safety of all residents; and WHEREAS, Community Emergency Response Teams (CERT) provide vital training in skills such as light search and rescue, basic fire suppression, disaster preparedness, and assembling essential emergency kits—empowering residents to act effectively in the critical early hours after a disaster; and WHEREAS, this proclamation aligns with the City’s ongoing commitment to fostering community resilience and encouraging active participation in preparedness efforts.

NOW, THEREFORE, I, Michael K. Hannon, Mayor of the City of Newark, California, do hereby proclaim the month of September 2026 as:

NATIONAL PREPAREDNESS MONTH
in Newark and encourage everyone to recognize the importance of preparedness and work together to enhance our resilience and readiness.

IN WITNESS THEREOF, I have hereunto set forth my hand and caused the Official Seal of the City of Newark, State of California, to be affixed this Twenty-fourth Day of September, Two Thousand Twenty-six.

MICHAEL K. HANNON
Mayor
Item D. 1.

DATE 09/24/2026
TO Honorable Mayor and City Council Members
FROM Bengil Ranillo, Accounting Assistant II
SUBJECT Approval of Audited Demands
Attachments
Attachment 1: Audited Demands 08.27.26
Attachment 2: Audited Demands 09.03.26

Item D. 2.

DATE 09/24/2026
TO Honorable Mayor and City Council Members
FROM Neetu Salwan, City Clerk
SUBJECT Approval of September 10, 2026, City Council Minutes Approval of the September 10, 2026, City Council Minutes for the regular meeting.

Attachments
Attachment 1: September 10, 2026, Regular Meeting Minutes Thursday, September 10, 2026, Regular Meeting Draft Minutes Page 1 of 5

CITY OF NEWARK

CITY COUNCIL REGULAR MEETING
Council Chambers, 37101 Newark Boulevard, Newark, CA 94560 | (510) 578-4266 | E-mail: [email protected]

DRAFT MINUTES
Thursday, September 10, 2026
7:00 P.M.

A. ROLL CALL
Mayor Hannon called the meeting to order at 7:02 p.m. Vice Mayor Jorgens, Council Members Grindall, and Little were present.

Mayor Hannon announced that he would adjourn the meeting in memory of John Mathews, Newark resident.

Mayor Hannon presented a commendation to City Manger David J. Benoun in recognition of his designation as an ICMA-Credentialed Manager.

B. PRESENTATIONS

1. Proclaiming September as Childhood Cancer Awareness Month Mayor Hannon presented a proclamation to Angela Crawford with the Jammers Strong Foundation.

2. Proclaiming September 2026 as Hunger Action Month
Mayor Hannon presented a proclamation President of Viola Blythe Community Services John Becker and Executive Director Linda Leu of Tri-City Volunteer.

3. Proclaiming Newark Days
Mayor Hannon presented a proclamation to the Newark Days Committee members.

4. Introduction of employees
Mayor Hannon introduced new employee Recreation and Community Services Director Alicia Day and announced the promotions of Senior Management Analyst Deepa Iyer and Senior Customer Service Representative Gabriela Mendes.

Mayor called for a recess at 7:49 p.m. The meeting resumed at 7:55 p.m.

C. PUBLIC COMMENT
Eric and Edward, representing STEMbridge, a local volunteer group, addressed the Council regarding their efforts to provide STEM education kits and workshops to children in the Bay Area. They requested City support to establish a permanent STEM Corner at the Newark Library for local youth.

Thursday, September 10, 2026, Regular Meeting Draft Minutes Page 2 of 5 D. CONSENT CALENDAR
No one from the audience requested to speak.

Vice Mayor Jorgens moved, Council Member Grindall seconded, to approve Consent Calendar items D.1, D2, D.3, D.4, D.5, D.6, and D.7, that the resolutions be numbered consecutively, and that reading of the titles suffice for adoption. The motion was passed 5 AYES.

1. Approval of Audited Demands

2. Approval of July 23, 2026, City Council Minutes

3. Adopt a resolution amending the Compensation and Benefits Plans for the Management, Supervisory and Professional Employee Group and the Confidential Employee Group to clarify special assignment pay provisions
Resolution No. 11888

4. Adopt a resolution approving a Side Letter of Agreement with the Newark Police Association (NPA) regarding compensation reporting and special assignment pay Resolution No. 11889

5. Adopt a resolution approving a Side Letter of Agreement with the Newark Association of Miscellaneous Employees to add the Recreation Assistant classification to the memorandum of Understanding (MOU) and amending the Citywide Salary Schedule in conformance with California Code of Regulations, Title 2, Section 570.5
Resolution No. 11890

6. Report on Administrative Actions During August Recess

7. Adopt a resolution approving the First Amendment to the Contractual Services Agreement with KBA Document Solutions, LLC, increasing the total not-to-exceed compensation from $390,000 to $500,000, and amending the 2026–2028 Biennial Budget for Fiscal Year 2026-27 Resolution No. 11891
E. PUBLIC HEARINGS

1. Hearing to consider an Ordinance amending Title 17 (Zoning) of the Newark Municipal Code to add Chapter 17.28 (Residential and Residential Mixed-Use Design Standards) and Chapter 17.42 (Reasonable Accommodation) and amend Division II (Base and Overlay Districts) Chapter 17.17 (General Site Regulations) Chapter 17.21 (Landscaping), Chapter 17.23 (Parking and Loading), Chapter 17.34 (Design Review), Chapter 17.37 (Waivers), and Chapter 17.46 (Definitions), generally affecting development and design standards for residential and residential mixed-use development
City Manager Benoun provided introductory remarks and project background.

Senior Planner Carmelisa Lopez, Housing Policies and Programs Manager Michael Coulom, Nicholas Hamilton and Ralph Robinson from Good City Company gave the presentation. The presentation is on file with the City Clerk.

Thursday, September 10, 2026, Regular Meeting Draft Minutes Page 3 of 5 Mayor Hannon opened the public hearing.

No one from the audience requested to speak.

Mayor Hannon closed the public hearing.

The City Council asked clarifying questions and held discussion.

Vice Mayor Jorgens moved, Council Member Catancio seconded, to adopt an ordinance implementing a Zoning Text Amendment (ZTA) (Z2025-004), which would amend Title 17 (Zoning) of the Newark Municipal Code (Zoning Code) to establish Objective Design Standards (ODS) for residential and residential mixed-use projects and other revisions to implement Housing Element programs, encourage residential development, and streamline project reviews. The motion was passed 5 AYES.

Vice Mayor Jorgens announced that he would recuse himself due to a conflict of interest and left the City Council Chambers.

2. Public Hearing to consider adopting an ordinance amending the Newark Zoning Map to rezone certain property into the - BRH Overlay District
City Manager Benoun provided introductory remarks and project background.

Housing Policies and Programs Manager Michael Coulom gave the presentation. The presentation is on file with the City Clerk.

Mayor Hannon opened the public hearing.

No one from the audience requested to speak.

Mayor Hannon closed the public hearing.

The City Council asked clarifying questions and held discussion.

Council Member Grindall moved, Council Member Catancio seconded, to adopt an ordinance amending the Newark Zoning Map to include specific additional parcels in the -BRH Overlay District to comply with state law and ensure consistency among the City's code. The motion was passed by the following votes: AYES: Grindall, Catancio, Little, Hannon; RECUSED: Jorgens.

Vice Mayor Jorgens returned to the Council Chambers.

F. OTHER BUSINESS

1. Waive full reading and introduce by title only an ordinance of the City Council of the City of Newark amending Chapter 2.09 of the Newark Municipal Code ("City Councilmembers-Compensation") to increase the salaries of the Mayor and City Councilmembers City Manager Benoun provided introductory remarks and project background.

Assistant City Manager Lenka Hovorka gave the report.

No one from the audience requested to speak.

Council Members asked clarifying questions.

Thursday, September 10, 2026, Regular Meeting Draft Minutes Page 4 of 5 Council Member Little moved, Council Member Catancio seconded, to adopt an ordinance amending Chapter 2.09 of the Newark Municipal Code ("City Councilmembers-Compensation") to increase the salaries of the Mayor and City Councilmembers by seven and one-half percent (7.5%).

The motion was passed by the following votes: AYES: Catancio, Little, Jorgens, Hannon; NOES:

Grindall.

G. CITY MANAGER UPDATES
City Manager Benoun announced:

1. The latest edition of the Newark News weekly newsletter is available at NewarkCA.gov/newsletters.

2. Applications for the six-week Newark Youth Leadership Academy program are now open through Friday, September 13. For more information, visit NewarkCA.gov/YouthLeadershipAcademy.

3. The Newark CERT Open House is scheduled for Saturday, September 12, from 9:00 a.m. to 12:00 p.m. at Fire Station 27. Attendees can meet the local CERT team, participate in a live HAM radio demonstration and hands-on CPR presentation, and tour the CERT trailer.

4. Newark Days 2026 is scheduled for September 17–20, celebrating Newark’s 71st anniversary. For more information, visit newarkdays.org.

5. The Down Payment Assistance Loan Program is available to first-time homebuyers, with preapplications accepted through October 15, 2026. For more information, visit HelloHousing.org/downpayment-assistance/newark.

6. The Newark Resource Center is now open at Ash Street Park. The August–October schedule is available at NewarkCA.gov/HumanServices.

7. Community members are encouraged to provide input on the future Cultural Arts Center by completing the Newark Community Cultural Arts Center Planning Survey at SurveyHero.com/c/newarkCCAC.

8. Newark was recognized for excellence in financial reporting by the Government Finance Officers Association (GFOA) for its FY 2024–25 annual financial report.

H. CITY COUNCIL MATTERS

1. Provide direction regarding staff preparation of City Council meeting minutes and approve the July 9, 2026, City Council meeting minutes
City Manager Benoun provided introductory remarks and project background.

Assistant City Manager Lenka Hovorka gave the report.

No one from the audience requested to speak.

Council Members asked clarifying questions.

Thursday, September 10, 2026, Regular Meeting Draft Minutes Page 5 of 5 Council Member Grindall moved, Council Member Little seconded, to approve July 9, 2026, meeting minutes as amended and directed staff to proceed with preparing Hybrid Action and Summary Minutes for future meeting minutes. The motion was passed 5 AYES.

City Council Reports:

Council Member Catancio reported on recent community activities, including a National Night Out ridealong with the Newark Police Department, a neighborhood potluck, the Hong Kong Festival, Relay for Life, the Recreation and Regional Parks event, and Assembly Member Alex Lee’s Young Legislators Program. She also participated in the San Jose Parade and attended local community and business events, encouraging residents to shop Newark.

Council Member Little thanked the community for attending the City’s first Sports, Recreation, and Wellness Fair held on August 29. She highlighted the free pop-up roller-skating event on September 12 from 2:00 to 5:00 p.m. at Ash Street Park, Newark Days parking at First Presbyterian Church benefiting Boy Scout Troop 186, the Elmwood Library book drive, and the second annual Heroes in the Community event scheduled for the first Saturday in October from 10:00 a.m. to 1:00 p.m. at the Silliman Community Activity Center.

Council Member Grindall discussed participating in the Newark 4K and noted he would attend the upcoming League of California Cities conference, where he would vote on a measure regarding local control of land use decisions. He also announced that he would participate remotely in the next Council meeting while attending the conference.

Vice Mayor Jorgens shared historical information about Newark’s early fire service, noting that firefighting began in 1910 with volunteer equipment and that the City’s first permanent fire station was dedicated in 1939. He noted that the community continues to celebrate Newark’s fire services as part of Newark Days.

Mayor Hannon recognized a new Newark business, La La La, the Finance Department for its Government Finance Officers Association (GFOA) award, Lori Gates and Joe Stoner for their contributions to Newark Days, and the Newark Police Department for its bicycle and pedestrian safety event and DUI checkpoint. He reminded the community to follow traffic laws and recognized those who serve the public.

I. CLOSED SESSION
None.

J. ADJOURNMENT
Mayor Hannon adjourned the meeting at 9:59 p.m. in memory of John Manthews. _____________________________
Neetu Salwan, City Clerk
Item D. 3.

DATE 09/24/2026
TO Honorable Mayor and City Council Members
FROM Lenka Hovorka, Assistant City Manager
SUBJECT Waive further reading and adopt an ordinance amending Chapter 2.09 of the Newark Municipal Code ("City
Councilmembers-Compensation") to increase the salaries of the Mayor and City Councilmembers
The ordinance was introduced at the September 10, 2026, City Council meeting.

A second reading of the ordinance is required prior to adoption.

Attachments
Attachment 1: Ordinance 568
ORDINANCE NO. 568

AN ORDINANCE OF THE CITY COUNCIL OF THE CITY OF
NEWARK AMENDING CHAPTER 2.09, CITY

COUNCILMEMBERS - COMPENSATION, OF THE NEWARK

MUNICIPAL CODE TO INCREASE THE SALARIES OF CITY

COUNCILMEMBERS AND MAYOR BY SEVEN AND ONE-HALF
PERCENT (7.5%)
WHEREAS, Chapter 2.09 ("City Councilmembers - Compensation") of the Newark Municipal Code provides for the payment of salaries and benefits to Newark City Councilmembers and the Mayor; and
WHEREAS, Newark Municipal Code section 2.09.010 establishes a Councilmember salary of one thousand four hundred fifty-three dollars ($1,453) per month; and WHEREAS, Newark Municipal Code section 2.09.010 establishes a Mayoral salary of three thousand one hundred seventy-nine dollars ($3,179) per month; and WHEREAS, said salaries took effect January 1, 2025; and WHEREAS, City Councilmembers and the Mayor have not received an increase in salary since January 1, 2025; and
WHEREAS, the City Council is authorized by Government Code Section 36516 to increase the salary of Councilmembers in an amount not to exceed five percent (5%) per calendar year from the operative date of the last adjustment of salary; and WHEREAS, the City Council is authorized by Government Code Section 36516.1 to pay an elected Mayor salary in excess to that which they receive as a Councilmember; and WHEREAS, at the City Council meeting held on May 28, 2026, City staff provided a presentation to the City Council regarding the Mayoral and City Councilmember salaries; and WHEREAS, at the City Council meeting held on June 25, 2026, the City Council adopted the 2026-2028 Biennial Budget which included seven one-half percent (7.5%) salary increases for the Mayor and City Councilmembers; and
WHEREAS, the City Council desires to increase salaries of the Councilmembers and Mayor by seven and one-half percent (7.5%) starting January 1, 2027.

NOW, THEREFORE, the City Council of the City of Newark does ordain as follows:

SECTION 1. Recitals. The above recitals are true and correct and made a part of this Ordinance.

SECTION 2. Amendment of Section 2.09.010 the Newark Municipal Code. Subsections (A) and (B) of Section 2.09.010 (“Salary”) of Chapter 2.09 (“City Council”) of Title 2 ("Administration and Personnel") are hereby amended as follows (replacements in double underline; deletions in strikethrough):

2.09.010 Salary.

A. Pursuant to Government Code Sections 36516 and 36516.5, each councilmember, other than the mayor, shall receive a salary of one thousand four hundred fifty-three dollars one thousand five hundred sixty-one dollars per month commencing January 1, 2025 January 1, 2027.

B. Pursuant to Government Code Section 36516.1, the elective mayor shall receive compensation in the amount of three thousand one hundred seventy-nine dollars three thousand four hundred seventeen dollars per month commencing January 1, 2025 January 1, 2027.

SECTION 3. Severability. If any provision of this Ordinance or the application thereof to any person or circumstance is held invalid, the remainder of the Ordinance, including the application of such part or provision to other persons or circumstances shall not be affected thereby and shall continue in full force and effect. To this end, provisions of this Ordinance are severable. The City Council hereby declares that it would have passed each section, subsection, subdivision, paragraph, sentence, clause, or phrase hereof irrespective of the fact that any one or more sections, subsections, subdivisions, paragraphs, sentences, clauses, or phrases be held unconstitutional, invalid, or unenforceable.

SECTION 4. CEQA. Approval of the ordinance is exempt from further environmental review under the general rule in California Environmental Quality Act (CEQA) Guidelines Section 15061(b)(3) that CEQA only applies to projects that have the potential for causing a significant effect on the environment. As a series of text amendments and additions that do not authorize any new activity, it can be seen with certainty that there is no possibility that the ordinance will have a significant effect on the environment.

SECTION 5. Publication and Effective Date. In accordance with Government Code section 36516.5, this ordinance shall take effect January 1, 2027. Before expiration of fifteen (15) days after its passage, this ordinance shall be published in the Tri-City Voice, a newspaper of general circulation published and printed in the County of Alameda and circulated in the City of Newark.

Item D. 4.

DATE 09/24/2026
TO Honorable Mayor and City Council Members
FROM Michael Coulom, Housing Policy and Programs Manager SUBJECT Waive further reading and adopt an ordinance amending the Newark Zoning Map to include specific additional parcels in the -BRH Overlay District to comply with state law and ensure consistency among the City's code
The ordinance was introduced at the September 10, 2026, City Council meeting.

A second reading of the ordinance is required prior to adoption.

Attachments
Attachment 1: Ordinance 567
Attachment 2: Exhibit A, B, and C
ORDINANCE NO. 567

ORDINANCE OF THE CITY OF NEWARK AMENDING THE

NEWARK ZONING MAP TO REZONE CERTAIN PROPERTY

INTO THE -BRH OVERLAY DISTRICT
WHEREAS, The City Council of the City of Newark adopted Resolution No. 9,684 adopting a Housing Element Update for the Fourth Cycle period between 2009 and 2014 (the 4th Cycle Housing Element), which identified housing sites that would accommodate the City of Newark’s (City) Regional Housing Needs Allocation (RHNA); and WHEREAS, The City Council of the City of Newark adopted Resolution No. 10,361 approving the amendment to the General Plan by adopting the Fifth Cycle Housing Element for the period between 2015 and 2023 (the 5th Cycle Housing Element), which identified housing sites that would accommodate the City’s RHNA; and
WHEREAS, the California Legislature has found that “California has a housing supply and affordability crisis of historic proportions. The consequences of failing to effectively and aggressively confront this crisis are hurting millions of Californians, robbing future generations of the chance to call California home, stifling economic opportunities for workers and businesses, worsening poverty and homelessness, and undermining the state’s environmental and climate objectives” (Gov. Code Section 65589.5); and
WHEREAS, State Housing Element Law (Government Code Sections 65580 et seq.) requires that the City Council adopt a Housing Element for the eight-year period 2023-2031 to accommodate the City of Newark’s (City) RHNA of 1,874 housing units, comprised of 464 verylow-income units, 268 low-income units, 318 moderate-income units, and 824 above moderateincome units; and WHEREAS, the City Council adopted Resolution No. 11,575, adopting a general plan amendment to repeal the 5th Cycle Housing Element and adopt the Sixth Cycle Housing Element of the General Plan for the period between 2023 and 2031 (the 6th Cycle Housing Element) and adopt the Safety Element of the General Plan, in compliance with State Housing Element Law; and
WHEREAS, certain housing sites identified in the 5th Cycle Housing Element were not developed with residential uses during the period between 2015-2023 and were “carried over” to the 6th Cycle Housing Element to be used as sites that can accommodate housing units meeting the City’s RHNA; and.

WHEREAS, Government Code Section 65583.2(c) provides that if a nonvacant site identified in the 5th Cycle Housing Element, or a vacant site identified in both the both the 4th Cycle Housing Element and 5th Cycle Housing Element, was not developed with a residential use, that site may only be included in the Housing Element if the City rezones the site within a specified period of time to allow residential use by right for housing developments in which at least 20% of the units are affordable to lower income households; and WHEREAS, the 6th Cycle Housing Element includes 43 parcels that were carried over from the 4th and 5th Cycle Housing Elements and identified as sites to accommodate the City’s RHNA; and
WHEREAS, the identified carry-over sites are capable to be developed with residential uses having densities of at least 20 units per acre; and WHEREAS, the City Council of the City of Newark adopted Ordinance No. 547 to update the Zoning Code by adding Chapter 17.15, By Right Housing (-BRH) Overlay District, amend the Newark Zoning Map by applying the -BRH Overlay District to specific parcels throughout the City, and make other miscellaneous related changes to implement the Housing Element and, more specifically, identify the applicability standards for residential development that may be developed by-right without discretionary review; and
WHEREAS, Ordinance No. 547 unintentionally omitted specific parcels from the list of parcels to be included in the -BRH Overlay Zone and amended Newark Zoning Map; and WHEREAS, the City desires to amend the Newark Zoning Map to include the omitted parcels to comply with Government Code Section 65583.2(c) and implement the 6th Cycle Housing Element; and
WHEREAS, the amendment of the Newark Zoning Map is referred to as the “Project”; and WHEREAS, a staff report dated July 28, 2026, and incorporated herein by reference, described and analyzed the Project for the Planning Commission; and WHEREAS, on July 28, 2026, the Planning Commission reviewed the staff report at a noticed public hearing on the Project, at which time all interested parties had the opportunity to be heard; and
WHEREAS, following the public hearing, the Planning Commission considered the staff recommendation as provided in the staff report, adopted Resolution 2037 incorporated herein by reference, and transmitted the resolution to the City Council; and WHEREAS, a staff report dated September 10, 2026, and incorporated herein by reference described and analyzed the Project for City Council; and WHEREAS, on September 10, 2026, the City Council reviewed the staff report at a duly noticed public hearing on the Project, at which time all interested parties had the opportunity to be heard; and
WHEREAS, pursuant to Newark Municipal Code section 17.31.060 and pursuant to State law, the City published a public hearing notice in The Tri City Voice on August 25, 2026 and mailed as required for a public hearing before the City Council at 7:00 p.m. on September 10, 2026; and
WHEREAS, the City Council fully considered the Project at the public hearing; and WHEREAS, the City Council finds that the Project meets the requisite findings of fact necessary for approval as further explained in the staff report and the recommended findings of fact and determinations associated with this Ordinance, as identified in “Exhibit A” attached to this Ordinance; and
WHEREAS, the location and custodian of the Project application and other documents that constitute a record of proceedings for the Project is the City of Newark, 37101 Newark Blvd., Newark, CA 94560; and
WHEREAS, the City’s General Plan, Zoning Code, and Municipal Code are incorporated herein by reference and are available for review at City Hall during normal business hours and on the City’s website.

NOW, THEREFORE, BE IT RESOLVED, that the City Council of the City of Newark does ordain as follows:

Section 1. The foregoing recitals are true and correct and are incorporated by reference into this action.

Section 2. The Project is exempt from further environmental review under the California Environmental Quality Act (“CEQA”) pursuant to CEQA Guidelines Section 15061(b)(3) since the proposed amendments to the Zoning Map have no potential for causing a significant effect on the environment. The proposed changes to the Zoning Map do not provide entitlements for any land use development projects, nor do they change the allowed uses of land or the intensity of any previously authorized use of land. Therefore, it can be seen with certainty that adoption of the proposed Zoning Map amendments will have no significant effect of the environment.

Section 3. Pursuant to NMC Sections 17.39.070 and 17.39.080, the City Council of the City of Newark does hereby make the findings of fact and determinations required by the City of Newark Municipal Code as further explained in the staff report and set forth in “Exhibit A” attached hereto and incorporated herein by this reference.

Section 4. The City Council hereby approves an amendment to the Newark General Plan land use and Zoning Map by applying the By Right Housing (-BRH) Overlay District to specific parcels, as identified in “Exhibits B & C”, attached hereto and incorporated herein by reference.

Section 6: If any section, subsection, subdivision, paragraph, sentence, clause or phrase of this Ordinance, or its application to any person or circumstance, is for any reason held to be invalid or unenforceable, such invalidity or unenforceability shall not affect the validity or enforceability of the remaining sections, subsections, subdivisions, paragraphs, sentences, clauses or phrases of this Ordinance, or its application to any other person or circumstance. The City Council of the City of Newark hereby declares that it would have adopted each section, subsection, subdivision, paragraph, sentence, clause or phrase hereof, irrespective of the fact that any one or more other sections, subsections, subdivisions, paragraphs, sentences, clauses or phrases hereof is declared invalid or unenforceable.

Section 7. Effective Date. This ordinance shall take effect thirty (30) days from the date of its passage. Before expiration of fifteen (15) days after its passage, this ordinance shall be published in The Tri-City Voice, a newspaper of general circulation published and printed in the County of Alameda and circulated in the City of Newark.

Exhibit A: Findings of Fact
Exhibit B: Parcels to be Rezoned with the By Right Housing (-BRH) Overlay District Exhibit C: Map of Parcels to be Rezoned with the -BRH Overlay District

Page 1 of 1 ends

Exhibit A
Findings of Fact
Pursuant to Newark Municipal Code Sections 17.39.070 and 17.39.080, the City Council of the City of Newark does hereby make the findings of fact and determinations required by the City of Newark Municipal Code.

The City Council shall not approve a zoning amendment unless the proposed amendment meets the following criteria:

A. The amendment is consistent with the general plan, in that on October 26, 2023, the City Council of the City of Newark adopted Resolution No. 11,575, adopting a general plan amendment to repeal the Fifth Cycle Housing Element for the period of 2015-2023 and adopt the Housing Element of the General Plan for the Period of 2023-2031 and adopt the Safety Element of the General Plan, in compliance with State Housing Element Law. The 2023-2031 Housing Element contains the following policy and program related to the recommended action:

POLICY H3.1: Allow By-Right Approval of Projects with 20 Percent Affordable Units on “Reused” Sites. Pursuant to AB 1397, amend the Zoning Ordinance to require by-right approval of housing development that includes 20 percent of the units as housing affordable to lower-income households, on sites being used to meet the 6th Cycle RHNA that represent “reuse sites” previously identified in the 4th and 5th Cycles Housing Element, and on sites that are subject to a text amendment to accommodate the lower-income RHNA.

PROGRAM H3.6: Pursuant to AB 1397, amend the Zoning Ordinance to require by-right approval of housing development that includes 20 percent of the units as housing affordable to lower-income households, on sites being used to meet the 6th Cycle RHNA that represent “reuse sites” previously identified in the 4th and 5th Cycles Housing Element. The nine sites listed in [Housing Element] Table 6-2 will be adjusted by text amendment to accommodate the lower income RHNA as needed.

B. Any change in district boundaries is necessary to achieve the balance of land uses desired by the city, consistent with the general plan, and to increase the inventory of land within a given zoning district. There are no changes to district boundaries proposed as part of the action.

C. The amendment will promote the growth of the city in an orderly manner and to promote and protect the public health, safety, peace, comfort and general welfare, in that the proposed action is necessary to comply with State law and may result in the production of additional housing that is affordable to lower-income households throughout the community.

Page 1 of 1 ends

Exhibit B
Parcels to be Rezoned with the By Right Housing (-BRH) Overlay District Parcels to be Added to the -BRH Overlay District Parcels Currently in the -BRH Overlay District Assessor’s Parcel Number Street Address Assessor’s Parcel Number Street Address 92-29-14-2 6505 THORNTON AVE 92-30-17-2 6765 THORNTON AVE 92-29-15-2 6521 THORNTON AVE 92-30-14-3 6717 THORNTON AVE 92-50-1-3 6658 THORNTON AVE 92-30-16-2 6749 THORNTON AVE 92-50-2-3 6642 THORNTON AVE 92-30-18-4 6781 THORNTON AVE 92-50-3-3 6626 THORNTON AVE 92-30-15-2 6733 THORNTON AVE 92A-919-11-2 6263 THORNTON AVE 92-31-16-2 6825 THORNTON AVE 92A-919-12-2 6275 THORNTON AVE 92-31-15 36965 OLIVE ST
92A-919-13-2 6289 THORNTON AVE 92A-900-1-2 36601 NEWARK BLVD 92A-919-14-2 6319 THORNTON AVE 92-29-20-2 36976 MULBERRY ST 92A-919-15-2 6333 THORNTON AVE 92-29-16-2 6537 THORNTON AVE 92A-919-19-2 6389 THORNTON AVE 92-29-19-2 6625 THORNTON AVE 92A-919-20-2 6417 THORNTON AVE 92-29-18-2 6609 THORNTON AVE 92A-919-21-2 6433 THORNTON AVE 92-51-5-3 6716 THORNTON AVE 92A-919-22-2 6449 THORNTON AVE 92-29-17-2 6553 THORNTON AVE 92A-2375-33 38290 CEDAR BLVD 92-29-13 36937 CHERRY ST
92-51-2-3 6788 THORNTON AVE
92A-2125-17 37900 CEDAR BLVD
92A-2125-11-2 37750 TIMBER ST
92A-2125-13 37640 CEDAR BLVD
92A-2585-32 5545 CEDAR CT
92-50-13 37053 CHERRY ST
92-255-11 37200 SYCAMORE ST
92A-2375-32 38290 CEDAR BLVD
92-131-3 37257 FILBERT ST
92-131-2-4 37243 FILBERT ST
92-131-1-9 FILBERT ST

Page 1 of 1 ends

Exhibit C
Map of Parcels Currently Zoned in the (-BRH) Overlay District and Parcels to be Rezoned with the (-BRH) Overlay District
Item D. 5.

DATE 09/24/2026
TO Honorable Mayor and City Council Members
FROM Cheryl Galvez, Recreation Supervisor I
SUBJECT Adopt a resolution authorizing an agreement with Advanced Exercise Fitness Solutions for Fitness Equipment and
Flooring Replacement at the George M. Silliman Community Activity Center and amending the 2026-2028 Biennial Budget and Capital Improvement Plan
SUMMARY AND RECOMMENDATION
The existing fitness equipment and flooring in the George M. Silliman Community Activity Center has reached or exceeded its useful life. Staff recommends the City Council adopt a resolution authorizing the City Manager to execute an agreement with Advanced Exercise Fitness Solutions in the amount not-to-exceed $192,197 for the replacement of fitness equipment and flooring in the George M. Silliman Community Activity Center and amend the 2026-2028 Biennial Budget and Capital Improvement Plan.

BACKGROUND
The fitness center at the George M. Silliman Community Activity Center serves residents ages 12 and older and is among Newark’s most widely utilized recreation and wellness amenities. The existing fitness equipment was acquired over multiple years and has reached or exceeded its useful life. Several pieces are obsolete, and replacement parts are no longer manufactured or readily available, resulting in recurring downtime, increasing maintenance costs, and reduced availability for users.

DISCUSSION/ANALYSIS
The proposed project includes replacement of outdated cardiovascular and strength-training equipment and a professionally planned fitness equipment layout to improve the functionality and overall user experience. Replacement of the aging fitness equipment is necessary to maintain safe, reliable, accessible, and attractive fitness services for Newark residents. Modern equipment provides improved ergonomics, accessibility features, digital connectivity, energy efficiency, and exercise variety compared with the existing inventory.

Staff also evaluated the existing floor pad system. While the flooring remains functional, it shows significant wear from years of use and is approaching the end of its expected service life. Because the flooring is located beneath and around the fitness equipment, replacing it concurrently with the equipment will provide an efficient opportunity to address both needs while minimizing future disruption. The new flooring system is expected to have a useful life of approximately 15 to 20 years and includes a five-year warranty, further reducing future replacement and maintenance expenses.

The proposed equipment package and fitness center layout were developed in consultation with Advanced Exercise Fitness Solutions, a commercial fitness equipment provider serving municipal, recreation, higher education, and community fitness facilities. The company provides facility assessments, equipment planning and design, installation, training, and ongoing maintenance support. The proposed layout is designed to enhance safety, accessibility, functionality, and the overall user experience and has been reviewed to ensure compliance with applicable accessibility standards. The proposed new equipment is expected to have a useful life of approximately five to seven years for cardiovascular equipment and seven to ten years for strength equipment. The equipment includes warranties ranging from one to three years, depending on the specific piece of equipment.

The proposed agreement with Advanced Exercise Fitness Solutions includes the purchase and installation of fitness equipment and flooring. Advanced Exercise Fitness Solutions is the exclusive dealer partner with Life Fitness and offers fitness equipment and related services through the OMNIA Partners cooperative purchasing program. OMNIA Partners is a cooperative purchasing organization that provides public agencies access to competitively solicited contracts for goods and services. This approach provides competitively solicited, nationally negotiated pricing while satisfying public procurement requirements and eliminating the need for a separate competitive solicitation. The cooperative purchasing process also reduces administrative costs, shortens procurement timelines, and provides greater pricing transparency and efficiency. Through the OMNIA Partners agreement, the City is eligible for negotiated discounts of approximately 35% to 45% below manufacturer’s suggested retail pricing (MSRP) on fitness equipment and related services.

Completion of the project is expected to:

Improve user safety by replacing aging and worn equipment.

Increase equipment reliability and reduce maintenance and repair costs.

Improve accessibility and inclusivity through updated equipment and facility layout.

Enhance the overall customer experience and attractiveness of the Fitness Center.

Support membership retention and growth.

Promote community health, wellness, and quality of life for Newark residents.

FISCAL IMPACT
The total project cost is estimated at $192,196.20, with City Council authorization not to exceed $192,197.

The $139,235.06 fitness equipment cost will be funded with approximately $9,000 from existing Recreation and Community Services Department appropriations in account 130.70.072.720.6120 and $130,235.06 from the Equipment Replacement Fund, account 701.87.701.800.8050.

The $52,961.14 flooring replacement cost will be funded from the Capital Projects Fund (Fund 610), CIP001433, account 610.90.094.940.CIP001433.

Adoption of the resolution will appropriate a total of $183,196.20 from the Equipment Replacement Fund and Capital Projects Fund. The approximately $9,000 funded from the existing Recreation operating budget does not require an additional appropriation.

STRATEGIC PRIORITY AREA
The recommended action aligns with the City Council's strategic priority area of Foster a Safe and Healthy Community.

REVIEW AND APPROVAL
Prepared by - Cherly Galvez, Recreation Supervisor I
Reviewed by - Roya Gonzalez, Strategic Initiatives Manager Reviewed by - Lenka Hovorka, Assistant City Manager
Reviewed by - Krysten Lee, Finance Director
Reviewed by - Kristopher J. Kokotaylo, City Attorney
Approved by - David J. Benoun, City Manager
Attachments
Attachment 1: Exercise Equipment Proposal
Attachment 2: Flooring Proposal
Attachment 3: Resolution Advanced Exercise
Attachment 4: OMNIA Partners Master Contract
Fitness Solutions
Prepared For
City of Newark Silliman
Center
By
Allan Franks
February 16, 2026
advancedexercise.com | 861 SouthPark Drive #100, Littleton, CO 80120 | 800.520.1112 Page | 1 of 9

CONSULTANT
Allan Franks
[email protected]
Phone: 916-205-5378
Fax: 303-996-0063
Date: February 16, 2026
Quote Expires: 30 day(s)
Proposal # 087532-R2

BILL TO
City of Newark Silliman Center

SHIP TO
City of Newark Silliman Center
6800 Mowry Avenue
Newark, Ca 94560

Model Brand Description Specifications Unit Price Qty Total Ext MISC Advanced
Exercise
Dtecto 439S weigh beam
physician's scale
775.00 1 $775.00

CARDIO EQUIPMENT
Model Brand Description Specifications Unit Price Qty Total Ext 06001 NuStep T6 Pro Recumbent CrossTrainer6,495.00 1 $6,495.00 20001 NuStep UE8 Pro Upper Body
Ergometer
6,495.00 1 $6,495.00
Proposal # 087532-R2
Page | 2 of 9

CARDIO EQUIPMENT
Model Brand Description Specifications Unit Price Qty Total Ext 22101 NuStep RB8 Pro Recumbent Bike 4,495.00 1 $4,495.00 INT-SL-XF-14 Life Fitness Integrity+ Treadmill with SL
Console
 SL LED Console
 Bluetooth Connectivity
 WiFi, ANT+ & NFC Compatible
 Connects to Apple Watch
 0.5-14 mph 0%-15% incline
 4.0 H.P AC peak performance motor
 DX3 deck and belt system with
Flexdeck
 60" x 22" running surface
 82"L x 36"W x 56"H
 120V dedicated 20 amp NEMA 5-20R
required
6,694.35 3 $20,083.05
INC-SL-XF-13 Life Fitness Integrity+ Upright Lifecycle
Bike with SL Console
 SL LED Console
 Bluetooth Connectivity
 WiFi, ANT+ & NFC Compatible
 Connects to Apple Watch
 Resistance levels 0-25
 Generator drive system
 Self-leveling Wide Ride pedals
 Comfort Curve seat
 41.5" L x 24.5" W x 54.5" H
 120V 20A outlet
3,346.85 1 $3,346.85
INPM-SL-XF-13 Life Fitness PowerMill with SL Console  SL LED Console  Bluetooth Connectivity
 WiFi, ANT+ & NFC Compatible
 Connects to Apple Watch
 Step dimensions 205 sq in - 20.75" W
x 9.875" L x 10.5" H
 Motor: 3HP; AC motor with
MagnaDrive motor controller
 Resistance levels 0-25
 Max user weight 400 lbs
 Unit weight 473 lbs
 55.92" L x 32.81" W x 82.3" H
8,033.35 1 $8,033.35
INA-TSL-XF-13 Life Fitness Total Body Arc Trainer with
SL Console
 SL LED Console
 Bluetooth Connectivity
 WiFi, ANT+ & NFC Compatible
 Connects to Apple Watch
 Stride length 24"
 100 resistance levels
 Max user weight 400 lbs
 Unit weight 412 lbs
 76.5" x 36.25" x 62.5"
7,229.95 2 $14,459.90
Proposal # 087532-R2
Page | 3 of 9

STRENGTH EQUIPMENT
Model Brand Description Specifications Unit Price Qty Total Ext STB-NA Hammer
Strength
None (Includes Stability
Feet)

0.00 1 $
HS-XX-7002-A Hammer
Strength
HS Upgrade to SE: ABC,

ADC, BE, HAB, HAD, HG,

PD, SC, SLP
 Hammer Strength Select Upgrade to
SE
345.00 1 $345.00
OP-HAA Life Fitness Axiom Hip
Abductor/Adductor
 11-gauge oval tubing steel frames
 Low Profile 53 inch tower height
 Solid Steel Weight stacks with 7.5 lb
drop down increment weight
 Placards with QR code/ NFC Chip, for
product usage instructions
 Integrated storage in Tower top cap
 Standard rear shroud and optional full
shroud
 Dimensions: 68"x67"x73"
 Weight 432 lbs
3,561.75 1 $3,561.75
OP-LP Life Fitness Axiom Leg Press  11-gauge oval tubing steel frames  Low Profile 53 inch tower height
 Solid Steel Weight stacks with 7.5 lb
drop down increment weight
 Placards with QR code/ NFC Chip, for
product usage instructions
 Integrated storage in Tower top cap
 Standard rear shroud and optional full
shroud
 Dimensions: 86"x40"x53"
 Weight 592 lbs
4,385.25 1 $4,385.25
OP-MP Life Fitness Axiom Multi-Press  11-gauge oval tubing steel frames  Low Profile 53 inch tower height
 Solid Steel Weight stacks with 7.5 lb
drop down increment weight
 Placards with QR code/ NFC Chip, for
product usage instructions
 Integrated storage in Tower top cap
 Standard rear shroud and optional full
shroud
3,939.75 1 $3,939.75
OP-LR Life Fitness Axiom Pulldown/Row  11-gauge oval tubing steel frames  Low Profile 53 inch tower height
 Solid Steel Weight stacks with 7.5 lb
drop down increment weight
 Placards with QR code/ NFC Chip, for
product usage instructions
 Integrated storage in Tower top cap
 Standard rear shroud and optional full
shroud
 Dimensions: 91"x35"x85"
 Weight 452 lbs
3,561.75 1 $3,561.75
Proposal # 087532-R2
Page | 4 of 9

STRENGTH EQUIPMENT
Model Brand Description Specifications Unit Price Qty Total Ext OP-DAP Life Fitness Axiom Dual Adjustable
Pulley
 Oval Steel Frame with Powder Coat
Finish
 Full Steel Weight Stack Shrouds
 2 ea 165lb Solid Steel Weight Stacks
 1:2 Cable Ratio
 5lb. Starting Resistance
 Includes 1 pair of Adjustable Single
Hand Straps
 Includes Triceps Rope & Ab Strap
 Includes Storage Pegs
 Machine Weight: 630lb. standard
weight stack; 730lb. heavy weight
stack
 Weight Stack: 2 x 165lb.
 Dimensions: 56.2"L x 54.6"W x 84"H
4,464.00 1 $4,464.00
SAR Life Fitness Signature Accessory
Storage Rack
 Accessory Storage Rack
 Top Shelf Holds 3 Medicine Balls
 3 Flat Shelves Hold Kettlebells, Foam
Rollers, Medicine Balls
 Unit Weight 190lbs.
 36" L X 25" D X 67" H
1,287.00 1 $1,287.00
SAR-6214 Life Fitness 3 Stability Ball Storage
(Left Side)
 Attaches to SAR
 Holds 3 Stability Balls
336.75 1 $336.75
SAR-6216 /
6316
Life Fitness SAR Side Storage Option
(Left/Right Side): Mat
Storage
 Attaches to Signature Accessory
Storage Rack
 Can be used on the left or right side
(Must specify)
145.50 1 $145.50
HDW-HR-STRD Hammer
Strength
NX Standard Half Rack  3" x 3" 11 Gauge American Steel  91" Tall Uprights
 2 Handle Pull Up Bar
 Premium Bar Supports
 Standard Bar Catches
 5pr Standard Weight Horns
 21" Single Storage Depth
 Custom Sign Compatible
 Includes Hammer Strength Sign
 Includes Stability Feet
 Requires bolt to floor unless stability
feet are utilized
2,908.50 1 $2,908.50
Proposal # 087532-R2
Page | 5 of 9

STRENGTH EQUIPMENT
Model Brand Description Specifications Unit Price Qty Total Ext HS-ADC Hammer
Strength
Hammer Select Assist Dip /
Chin
 2" x 4" and 2" x 3" 11 gauge steel
tubing
 Start Position is adjusted in five 10-
degree increments
 Lift & Lock Seat System
 Rear Weight Stack Shroud
 Add On Incremental Weight System
 Incorporates two different exercises in
one machine
 Knee pad folds down for unassisted
training
 Multi-position handles allow for
exercise variety
 Machine Weight: 655lb.
 Weight Stack: 190lb.
 Dimensions: 46"L x 45"W x 87"H
 Made in USA
4,515.00 1 $4,515.00
OP-ABBA Life Fitness Axiom Abdominal/Back
Extension
 11-gauge oval tubing steel frames
 Low Profile 53 inch tower height
 Solid Steel Weight stacks with 7.5 lb
drop down increment weight
 Placards with QR code/ NFC Chip, for
product usage instructions
 Integrated storage in Tower top cap
 Standard rear shroud and optional full
shroud
3,561.75 1 $3,561.75
FWMAB Hammer
Strength
Multi-Adjustable Bench  Adjusts in 8 different positions from 0- 80 degrees
 Seat automatically adjusts with back
pad adjustment
 11-gauge steel frame with powder
coat finish
 Wheels with transportation handle
 Made in USA
 Machine Weight: 115 lb.
 Dimensions: 55”L x 26” W
1,475.00 1 $1,475.00
LBR-DB Life Fitness Adjustable
Decline/Abdominal Crunch
 Oval Steel Tubing
 Lightweight Adjustable Angle
Positions
 Transport Handle & Wheels
 Assist Handle
 Marked Visual Angles +10, O, -10, -
20, -30 degrees
 Bench Weight: 175 lbs
 Dimensions: 73"L x 29"W x 41"H
1,468.00 1 $1,468.00
Proposal # 087532-R2
Page | 6 of 9

STRENGTH EQUIPMENT
Model Brand Description Specifications Unit Price Qty Total Ext OP-SLCE Life Fitness Axiom Seated Leg
Curl/Extension
 11-gauge oval tubing steel frames
 Low Profile 53 inch tower height
 Solid Steel Weight stacks with 7.5 lb
drop down increment weight
 Placards with QR code/ NFC Chip, for
product usage instructions
 Integrated storage in Tower top cap
 Standard rear shroud and optional full
shroud
 D
4,202.40 1 $4,202.40
FW-D3 Hammer
Strength
Dumbbell Rack - Three Tier  Angled trays with saddle for each dumbbell
 Pinch free design
 Holds 15 pair of round head
dumbbells
 11-gauge steel frame with powder
coat finish
 Made in USA
 Machine Weight: 155 lb.
 Dimensions: 90”L x 31.5” W x 32” H
1,554.40 1 $1,554.40

FREE WEIGHTS
Model Brand Description Specifications Unit Price Qty Total Ext GOB-1800 Troy Barbell 7ft. Hard Chrome Olympic
Power Bar
 270,000 psi test bar
 28.5 mm, no center knurling, hard
chrome finish
 self lubricating double bushings
 Dual markings for Olympic and
powerlifting
395.60 1 $395.60
GOZ-47 Troy Barbell 47in. Olympic Economy EZ
Curl Bar

88.18 1 $88.18
Proposal # 087532-R2
Page | 7 of 9

FREE WEIGHTS
Model Brand Description Specifications Unit Price Qty Total Ext GO-002U Troy Barbell Urethane Encased Olympic
Grip Plate 2.5lb.

25.00 4 $100.00
GO-005U Troy Barbell Urethane Encased Olympic
Plate 5lb.

35.00 4 $140.00
GO-025U Troy Barbell Urethane Encased Olympic
Grip Plate 25lb.
125.00 4 $500.00
50475 Power
Systems
Lock-Jaw Barbell Collar -
Olympic - Black - (1 Pair)

44.50 2 $89.00
TSD-005-050U Troy Barbell 12-Sided Urethane Encased
Dumbbells 5-50lb. Set
3,075.00 1 $3,075.00
Proposal # 087532-R2
Page | 8 of 9

FREE WEIGHTS
Model Brand Description Specifications Unit Price Qty Total Ext TSD-055-075U Troy Barbell 12-Sided Urethane Encased
Dumbbells 55-75lb. Set
2,575.00 1 $2,575.00
GO-045U Troy Barbell Urethane Encased Olympic
Grip Plate 45lb.
225.00 6 $1,350.00

SERVICES & FEES
Model Brand Description Specifications Unit Price Qty Total Ext SURCHARGE Advanced
Exercise
Manufacturer Surcharge 0.00 1 $
Subtotal: $114,207.73
Freight, Delivery and Install: 12,750.00
Taxes As Applicable
Comments:

Life Fitness Omnia contract# 2021003109
FDI includes same day extraction of existing
equipment
Total: $126,957.73
Estimated tax at 10.75%: $12,277.33
Total Cost with tax: $139,235.06
Proposal # 087532-R2
Page | 9 of 9
Terms & Conditions
Terms: All new customers are required to pay 50% down and balance due prior to install. Residential customers, personal trainers, and orders for resale, require 100% payment before the order can be placed. All other terms and credit lines are subject to credit approval.

Invoice will be due and payable, based on the original requested installation date, unless Advanced Exercise is notified in writing 60 days prior to the requested installation date with a change of the installation date. We accept checks, money orders, ACH and credit cards (under $2000). A late payment fee will be assessed at a rate of 1.5% (18% annual) per month on any unpaid balance remaining 30 days after the due date. Special Orders: A 100% prepayment is required for all customized products including but not limited to custom colors, sports flooring and products with logos such as plates, dumbbells and platforms.

Return Policy: Any returns require approval in writing by Advanced Exercise Project Management. A minimum 25% restocking fee, plus freight, will be incurred for all non-custom products returned. Customized products are nonreturnable. All products with color choices are defined as custom products.

Bolt Down Requirements: Life Fitness recommends that all strength training equipment be secured to the floor in order to prevent tipping, rocking or displacement which might occur in the event of unanticipated use of the equipment. Life Fitness requires that certain strength training equipment (specifically the Synrgy 360 90, T, XS, XM, HD Elite Half Rack/Short Base, Athletic Series Rigs, Athletic Series Racks with Wing option, Cybex PWR Play, Synrgy Outdoor BlueSky and other products to be used for body weight strap training) be secured to the floor. In the case of Synrgy 360S, T, XS, XM and the Elite HD Half Rack Short Base, the customer acknowledges:
• Customer has determined the proper placement of the equipment to be secured. Customer Initial ______ • Customer has identified and informed Advanced Exercise of the location of any utility, service lines, including but not limited to post tension cables. It is the customer’s responsibility to identify the locations of any cables or lines prior to installation.

Customer Initial ______
• Customer has confirmed that the subfloor consists of no less than 4.0 inches of concrete. Customer Initial ______ • Customer has obtained any and all consents to the drilling of holes in the flooring and subflooring. Customer Initial ______ If your order includes any of the equipment requiring bolting to the floor, initials are required above and an additional signed waiver will be required to place the order. Additional products may require bolting to the floor, wall or ceiling. Bolting is not included on these products unless otherwise noted on the quotation. Customer is responsible for bolting these products to meet the manufacturer’s requirements. This includes TRX, Core Energy, Boxing mounts and other products that require bolting to the facility structure.

Wall & Ceiling Attached Items: The installation of any items such as TRX Multi Mounts., X Mounts, Wall Mat Racks, etc. that require bolting to walls or ceilings are not included in the proposal unless otherwise noted.

Flooring Installation: Refer to the product specifications to ensure that the sub floor meets the material installation requirements.

Freight offloading, inside delivery, adhesive, moisture tests, moisture reducers, base boards, sub floor prep, sub floor cleaning, transition strips and existing floor removal and disposal are not included unless otherwise noted on the quotation.

Storage: We reserve the right to assess storage fees not to exceed 1.5% per month, or fraction thereof and request payment in full on the related customer's invoice, when a customer's original requested delivery date is delayed by circumstances beyond our control.

Taxes: We collect sales or use taxes only in jurisdictions where we are licensed to do so. Customer agrees to accept sole liability and responsibility to pay for any and all uncollected sales or use tax liabilities, related penalties and interest that arise as a result of the purchase of products and/or services from our company.

Security: Until all products are paid in full, customer hereby grants to, and Advanced Exercise shall retain, a security interest in and lien on all products sold to the customer.

I accept the terms and conditions of this quote.

Signature:

Name:

Date: Customer Requested Install Date:
advancedexercise.com | 861 SouthPark Drive #100, Littleton, CO 80120 | 800.520.1112 Page | 1 of 3

CONSULTANT
Allan Franks
[email protected]
Phone: 916-205-5378
Fax: 702-407-4026
Date: March 04, 2026
Quote Expires: 30 day(s)
Proposal # 094509-R0

BILL TO
City of Newark Silliman Center

SHIP TO
City of Newark Silliman Center
6800 Mowry Avenue
Newark, Ca 94560

SPORTS FLOORING
Model Brand Description Specifications Unit Price Qty Total Ext LMNT-000827 Ecore
Athletic
Motivate Performance Plus
Rolled Rubber ES513 Raw
Titanium
 10.5 MM total thickness and 48 in
wide rolls (2.5 MM vulcanized
composition rubber surface layer, 8
mm vulcanized compostion rubber
base layer)

8.17 2,380 $19,444.60
TRD-000002 Ecore
Athletic
E-Grip III Adhesive 4 Gallon
Pail
275.00 7 $1,925.00
TRD-000067 Ecore
Athletic
Ecore All Purpose Cleaner
(E-Cleaner)

40.00 1 $40.00

SERVICES & FEES
Model Brand Description Specifications Unit Price Qty Total Ext SURCHARGE Advanced
Exercise
Manufacturer Surcharge 0.00 1 $
Proposal # 094509-R0
Page | 2 of 3
Subtotal: $21,409.60
Flooring Freight Delivery and Install: 29,250.00
Taxes As Applicable
Comments:

FDI includes demo and floor prep
Ecore - Omnia
Total: $50,659.60
Estimated tax at 10.75%: $2,301.54
Total Cost with tax: $52,961.14
Proposal # 094509-R0
Page | 3 of 3
Terms & Conditions
Terms: All new customers are required to pay 50% down and balance due prior to install. Residential customers, personal trainers, and orders for resale, require 100% payment before the order can be placed. All other terms and credit lines are subject to credit approval.

Flooring Installation: Refer to the product specifications to ensure that the sub floor meets the material installation requirements.

Security: Until all products are paid in full, customer hereby grants to, and Advanced Exercise shall retain, a security interest in and lien on all products sold to the customer.

I accept the terms and conditions of this quote.

Signature:

Name:

Date: Customer Requested Install Date:

RESOLUTION NO.

RESOLUTION OF THE CITY COUNCIL OF THE CITY OF

NEWARK AUTHORIZING THE CITY MANAGER TO EXECUTE

AN AGREEMENT WITH ADVANCED EXERCISE FITNESS

SOLUTIONS FOR FITNESS EQUIPMENT AND FLOORING
REPLACEMENT AT THE GEORGE M. SILLIMAN COMMUNITY
ACTIVITY CENTER AND AMENDING THE 2026-2028 BIENNIAL

BUDGET AND CAPITAL IMPROVEMENT PLAN
WHEREAS, the existing fitness equipment at the George M. Silliman Community Activity Center has reached or exceeded its useful life, and the fitness flooring shows significant wear and is approaching the end of its expected service life; and
WHEREAS, replacing the fitness equipment and flooring concurrently will improve safety, accessibility, functionality, and reliability while minimizing disruption to the facility; and WHEREAS, Advanced Exercise Fitness Solutions is the exclusive dealer partner with Life Fitness and offers fitness equipment and related services through the OMNIA Partners cooperative purchasing program; and
WHEREAS, the OMNIA Partners cooperative purchasing contract was competitively solicited and provides public agencies access to competitively solicited contracts for goods and services, satisfying the City's applicable purchasing requirements and eliminating the need for a separate competitive solicitation; and
WHEREAS, the fitness equipment portion of the project totals $139,235, of which approximately $9,000 will be funded from existing Recreation and Community Services Department appropriations in account 130.70.072.720.6120 and $130,235 will be funded from the Equipment Replacement Fund (Fund 701); and
WHEREAS, the flooring replacement totals $52,962 and will be funded from the Capital Projects Fund (Fund 610) account 610.90.094.940.CIP001433, resulting in a total estimated project cost and a City Council authorization not to exceed $192,197.

NOW, THEREFORE, BE IT RESOLVED that the City Council of the City of Newark hereby authorizes the City Manager to execute an agreement with Advanced Exercise Fitness Solutions for the purchase and installation of fitness equipment and replacement of flooring at the George M. Silliman Community Activity Center in an amount not to exceed $192,197, in a form approved by the City Attorney.

BE IT FURTHER RESOLVED that the City Council approves an amendment to the 2026-2028 Biennial Budget and Capital Improvement Plan for fiscal year 2026-27 to increase expenditure appropriations by a total of $183,197, consisting of $130,235 in the Equipment Replacement Fund, account 701.87.701.800.8050, and $52,962 in the Capital Projects Fund (Fund 610), CIP001433, account 610.90.094.940.CIP001433. Approximately $9,000 of the fitness equipment purchase will be funded from existing Recreation and Community Services Department appropriations in account 130.70.072.720.6120 and does not require an additional appropriation.

The University of California
Contract # 2021003109
for
UC System-Wide Fitness Equipment
with
Life Fitness, LLC
Effective: October 10, 2021
The following documents comprise the executed contract between the University of California and Life Fitness, LLC, effective October 10, 2021:

I. UC Wide Life Fitness 2021003109 Purchasing Agreement II. UC Terms and Conditions of Purchase – dated 4-5-2021 (REVISED) (included with comments)
III. Attachment A – Statement of Work Template
IV. Attachment B – Life Fitness Price List
V. UC Request for Proposal # 02295-DEC2020 UC System-wide Fitness Equipment
VI. Supplier’s response thereto submitted on or about April 15th 2021 (“RFP Response”)
VII. UC Sustainable Practices Policy
VIII. UC HECVAT Form – Optional – Campus Specific Template IX. Life Fitness Family of Brands Warranties 2020
X. Securing Strength Product Acknowledgment v7

Terms and Conditions of Purchase
Revised 4.5.21 1
ARTICLE 1 – GENERAL
The equipment, materials, or supplies (“Goods”) and/or services (“Services”) furnished by Supplier (together, the “Goods and Services”) and covered by the UC Purchase Order (“PO”) and/or other agreement (which, when combined with these Terms and Conditions and any other documents incorporated by reference, will constitute the “Agreement”) are governed by the terms and conditions set forth herein. As used herein, the term "Supplier" includes Supplier and its sub-suppliers at any tier.

As used herein, “UC” refers to The Regents of the University of California, a corporation described in California Constitution Art. IX, Sec. 9, on behalf of the UC Locations identified in the Agreement and/or the PO. UC and Supplier individually will be referred to as “Party” and collectively as “Parties.” Any defined terms not defined in these Terms and Conditions of Purchase will have the meaning ascribed to such term in any of the other documents incorporated in and constituting the Agreement. No other terms or conditions will be binding upon the Parties unless accepted by them in writing. Supplier accepts all of the Agreement’s terms and conditions either in writing, by shipping any portion of the Goods, or performing any portion of the Services. The terms of any proposal referred to in the Agreement are included and made a part of the Agreement only to the extent the proposal specifies the Goods and/or Services ordered, the price therefor, and the delivery thereof, and then only to the extent that such terms are consistent with the terms and conditions of the Agreement.

ARTICLE 2 – TERM AND TERMINATION
A. As applicable, the term of the Agreement (“Initial Term”) will be stated in the Agreement. Following the Initial Term, the Agreement may be extended by written mutual agreement.

B. UC’s obligation to proceed is conditioned upon the appropriation of state, federal and other sources of funds not controlled by UC ("Funding"). UC will have the right to terminate the Agreement without damage, penalty, cost or further obligation in the event that through no action or inaction on the part of UC, the Funding is withdrawn.

C. UC may, by written notice stating the extent and effective date thereof, terminate the Agreement for convenience in whole or in part, at any time. The effective date of such termination shall be consistent with any requirements for providing notice specified in the Agreement, or immediate if no such terms are set forth in the Agreement. As specified in the termination notice, UC will pay Supplier as full compensation the pro rata Agreement price for performance through the later of the date that
a. UC provided Supplier with notice of termination or
b. Supplier’s provision of Goods and/or Services will terminate.

D. UC may by written notice terminate the Agreement for Supplier’s breach of the Agreement, in whole or in part, at any time, if Supplier refuses or fails to comply with the provisions of the Agreement, or so fails to make progress as to endanger performance and does not cure such failure within five (5) business days, or fails to supply the Goods and/or Services within the time specified or any written extension thereof. In such event, UC may purchase or otherwise secure Goods and/or Services and, except as otherwise provided herein, Supplier will be liable to UC for any excess costs UC incurs thereby.

E. If any of the following appendices are incorporated in to the agreement, then they will control in the event that the appendices conflict with the provisions of this Article:

UC’s Appendix – Data Security,
Appendix – BAA, and/or
Appendix – GDPR
Terms and Conditions of Purchase
Revised 4.5.21 2
ARTICLE 3 – PRICING, INVOICING METHOD, AND SETTLEMENT METHOD AND TERMS.

Pricing is set forth in the Agreement or PO, and the amount UC is charged and responsible for shall not exceed the amount specified in the Agreement unless UC has given prior written approval. Unless otherwise agreed in writing by UC, Supplier will use the invoicing method and payment settlement method (and will extend the terms applicable to such settlement method) set forth in UC’s Supplier Invoicing, Terms & Settlement Matrix (https://www.ucop.edu/procurement-services/procurementsystems/supplier-invoicing,-terms-and-settlement-matrix.html). UC will pay Supplier, upon submission of acceptable invoices, for Goods and/or Services provided and accepted. Invoices must be itemized and reference the Agreement or PO number. UC will not pay shipping, packaging or handling expenses, unless specified in the Agreement or PO. Unless otherwise provided, freight is to be FOB destination.

Any of Supplier’s expenses that UC agrees to reimburse will be reimbursed under UC’s Travel Policy, which may be found at http://www.ucop.edu/central-travel-management/resources/index.html. Where applicable, Supplier will pay all taxes imposed on Supplier in connection with its performance under the Agreement, including any federal, state and local income, sales, use, excise and other taxes or assessments. Notwithstanding any other provision to the contrary, UC will not be responsible for any fees, interest or surcharges Supplier wishes to impose.

ARTICLE 4 – INSPECTION.

The Goods and/or Services furnished will be exactly as specified in the Agreement, free from all defects in Supplier's performance, design, skill and materials, and, except as otherwise provided in the Agreement, will be subject to inspection and test by UC at all times and places. If, prior to final acceptance, any Goods and/or Services furnished are found to be incomplete, or not as specified, UC may reject them, require Supplier to correct them at the sole cost of Supplier, or require provision of such Goods and/or Services at a reduction in price that is equitable under the circumstances. If Supplier is unable or refuses to correct such deficiencies within a time UC deems reasonable, UC may terminate the Agreement in whole or in part. Supplier will bear all risks as to rejected Goods and/or Services and, in addition to any costs for which Supplier may become liable to UC under other provisions of the Agreement, will reimburse UC for all transportation costs, other related costs incurred, or payments to Supplier in accordance with the terms of the Agreement for unaccepted Goods and/or Services and materials and supplies incidental thereto. Notwithstanding final acceptance and payment, Supplier will be liable for latent defects, fraud or such gross mistakes as amount to fraud.

ARTICLE 5 – ASSIGNED PERSONNEL; CHARACTER OF SERVICES
Supplier will provide the Services as an independent contractor and furnish all equipment, personnel, and supplies sufficient to provide the Services expeditiously and efficiently, during as many hours per shift and shifts per week, and at such locations as UC may so require. Supplier will devote only its bestqualified personnel to work under the Agreement. Should UC inform Supplier that anyone providing the Services is not working to this standard, Supplier will immediately remove such personnel from providing Services and those individuals will not again be assigned to provide Services without UC’s written permission. At no time will Supplier or Supplier’s employees, sub-suppliers, agents, or assigns be considered employees of UC for any purpose, including but not limited to workers’ compensation provisions. Supplier shall not have the power nor right to bind or obligate UC, and Supplier shall not hold itself out as having such authority. Supplier shall be responsible to UC for all Services performed by Supplier’s employees, agents and subcontractors, including being responsible for ensuring payment of all unemployment, social security, payroll, contributions and other taxes with respect to such employees, agents and subcontractors.

Terms and Conditions of Purchase
Revised 4.5.21 3
ARTICLE 6 – WARRANTIES
In addition to the warranties set forth in Articles 11, 12, 17, 23, 24, 25 and 26 herein, Supplier makes the following warranties. Supplier acknowledges that failure to comply with any of the warranties in the Agreement will constitute a material breach of the Agreement and UC will have the right to terminate the Agreement without damage, penalty, cost or further obligation.

A. General Warranties. Supplier represents, warrants and covenants that: (i) Supplier is free to enter into this Agreement and that Supplier is not, and will not become, during the Term, subject to any restrictions that might restrict or prohibit Supplier from performing the Services or providing the Goods ordered hereunder; (ii) Supplier will comply with all applicable laws, rules and regulations in performing Supplier’s obligations hereunder; (iii) the Goods and/or Services shall be rendered with promptness and diligence and shall be executed in a skilled manner by competent personnel, in accordance with the prevailing industry standards; and if UC Appendix Data Security is NOT included:(iv) Supplier has developed a business interruption and disaster recovery program and is executing such program to assess and reduce the extent to which Supplier’s hardware, software and embedded systems may be susceptible to errors or failures in various crisis (or force majeure) situations; (v) if Supplier uses electronic systems for creating, modifying, maintaining, archiving, retrieving or transmitting any records, including test results that are required by, or subject to inspection by an applicable regulatory authority, then Supplier represents and warrants that Supplier’s systems for electronic records are in compliance; and (vi) Supplier agrees that the Goods and/or Services furnished under the Agreement will be covered by the most favorable warranties Supplier gives to any customer for the same or substantially similar goods or services, or such other more favorable warranties as specified in the Agreement. The rights and remedies so provided are in addition to and do not limit any rights afforded to UC by any other article of the Agreement.

B. Permits and Licenses. Supplier agrees to procure all necessary permits or licenses and abide by all applicable laws, regulations and ordinances of the United States and of the state, territory and political subdivision or any other country in which the Goods and/or Services are provided.

C. Federal and State Water and Air Pollution Laws. Where applicable, Supplier warrants that it complies with the requirements in UC Business and Finance Bulletin BUS-56 (Materiel Management; Purchases from Entities Violating State or Federal Water or Air Pollution Laws). Consistent with California Government Code 4477, these requirements do not permit UC to contract with entities in violation of Federal or State water or air pollution laws.

D. Web Accessibility Requirements. As applicable to the Supplies and/or Services being provided under the Agreement, Supplier warrants that:
a. It complies with California and federal disability laws and regulations; and b. The Goods and/or Services will conform to the accessibility requirements of WCAG 2.0AA. c. Supplier agrees to promptly respond to and resolve any complaint regarding accessibility of its Goods and/or Services;
E. General Accessibility Requirements. Supplier warrants that:
a. It will comply with California and federal disability laws and regulations; b. Supplier will promptly respond to remediate to any identified accessibility defects in the Goods and Services to conform to WCAG 2.0 AA; and
c. Supplier agrees to promptly respond to and use reasonable efforts to resolve and remediate any complaint regarding accessibility of its Goods and/or Services.

F. Warranty of Quiet Enjoyment. Supplier warrants that Supplier has the right of Quiet Enjoyment in, and conveys the right of Quiet Enjoyment to UC for UC’s use of, any and all intellectual property that Terms and Conditions of Purchase
Revised 4.5.21 4
will be needed for Supplier’s provision, and UC’s use of, the Goods and/or Services provided by Supplier under the Agreement.

G. California Child Abuse and Neglect Reporting Act ("CANRA"). Where applicable, Supplier warrants that it complies with CANRA.

H. Debarment, Suspension, U.S. Government Restricted Party Lists. Supplier warrants that it is not on the U.S. government’s Denied Parties List, the Unverified List, the Entities List, the Specially Designated Nationals and Blocked Parties List, and is not presently debarred, suspended, proposed for debarment or otherwise declared ineligible for award of federal contracts or participation in federal assistance programs or activities.

I. UC Trademark Licensing Code of Conduct. If the Goods will bear UC’s name (including UC campus names, abbreviations of these names, UC logos, UC mascots, or UC seals) or other trademarks owned by UC, Supplier warrants that it holds a valid license from UC and complies with the Trademark Licensing Code of Conduct policy, available at http://policy.ucop.edu/doc/3000130/TrademarkLicensing
J. Outsourcing (Public Contract Code section 12147) Compliance. Supplier warrants that if the Agreement will displace UC employees, no funds paid under the Agreement will be used to train workers who are located outside of the United States, or plan to relocate outside the United States as part of the Agreement. Additionally, Supplier warrants that no work will be performed under the Agreement with workers outside the United States, except as described in Supplier’s bid. If Supplier or its sub-supplier performs the Agreement with workers outside the United States during the life of the Agreement and Supplier did not describe such work in its bid, Supplier acknowledges and agrees that (i) UC may terminate the Agreement without further obligation for noncompliance, and (ii) Supplier will forfeit to UC the amount UC paid for the percentage of work that was performed with workers outside the United States and not described in Supplier’s bid.

K. Supplier warrants that the Goods and Services rendered under this Agreement will not require Supplier to use for UC, or provide to UC to use, "covered telecommunications equipment or services" as a substantial or essential component of any system, or as critical technology as part of any system, within the meaning of Federal Acquisition Regulation (“FAR”) Section 52.204-25.

Supplier will provide “Timely Notice” to the UC of any changes to the statements, confirmations or representations made in its proposal response or in any information provided as part of the contract award process, including in particular any changes to the certifications or representations made regarding NDAA Section 889. Timely Notice means that Supplier will notify UC in writing within 3 business days of any changes to the representations or confirmations made in relation to NDAA Section 889. Notice shall include the representations or confirmations made and the changes to those representations or confirmations. The notice shall be provided by a Supplier representative authorized to bind the Supplier.

ARTICLE 7 – INTELLECTUAL PROPERTY, COPYRIGHT, PATENTS, AND DATA RIGHTS A. Goods and/or Services Involving Work Made for Hire.
a. Unless UC indicates that the Goods and/or Services do not involve work made for hire, Supplier acknowledges and agrees that any deliverables provided to UC by Supplier in the performance of the Agreement, and any intellectual property rights therein, (hereinafter the "Deliverables") will be owned by UC. The Deliverables will be considered "work made for hire" under U.S. copyright law and all right, title, and interest to and in such Deliverables including, but not limited to, any and all copyrights or trademarks, will be owned by UC. In Terms and Conditions of Purchase
Revised 4.5.21 5
the event that it is determined that UC is not the owner of such Deliverables under the "work made for hire" doctrine of U.S. copyright law, Supplier hereby irrevocably assigns to UC all right, title, and interest to and in such Deliverables and any copyrights or trademarks thereto.
b. The Deliverables must be new and original. Supplier must not use any pre-existing copyrightable or trademarked images, writings, or other proprietary materials (hereinafter "Pre-Existing Materials") in the Deliverables without UC’s prior written permission. In the event that Supplier uses any Pre-Existing Materials in the Deliverables in which Supplier has an ownership interest, UC is hereby granted, and will have, a non-exclusive, royalty-free, irrevocable, perpetual, paid-up, worldwide license (with the right to sublicense) to make, have made, copy, modify, make derivative works of, use, perform, display publicly, sell, and otherwise distribute such Pre-Existing Materials in connection with the Deliverables. c. Whenever any invention or discovery is made or conceived by Supplier in the course of or in connection with the Agreement, Supplier will promptly furnish UC with complete information with respect thereto and UC will have the sole power to determine whether and where a patent application will be filed and to determine the disposition of title to and all rights under any application or patent that may result. d. Supplier is specifically subject to an obligation to, and hereby does, assign all right, title and interest in any such intellectual property rights to UC as well as all right, title and interest in tangible research products embodying any such inventions whether the inventions are patentable or not. Supplier agrees to promptly execute any additional documents or forms that UC may require in order to effectuate such assignment.

B. Goods and/or Services Not Involving Work Made for Hire. a. If the Goods and/or Services do not involve work made for hire, and in the event that Supplier uses any Pre-Existing Materials in the Deliverables in which Supplier has an ownership interest, UC is hereby granted, and will have, a non-exclusive, royalty-free, irrevocable, perpetual, paid-up, worldwide license (with the right to sublicense) to make, have made, copy, modify, make derivative works of, use, perform, display publicly, sell, and otherwise distribute such Pre-Existing Materials in connection with the Deliverables. b. The Deliverables must be new and original. Supplier must not use any Pre-Existing Materials in the Deliverables without UC’s prior written permission. c. Whenever any invention or discovery is made or conceived by Supplier in the course of or in connection with the Agreement, Supplier will promptly furnish UC complete information with respect thereto and UC will have the sole power to determine whether and where a patent application will be filed and to determine the disposition of title to and all rights under any application or patent that may result.
d. Supplier is specifically subject to an obligation to, and hereby does, assign all right, title and interest in any such intellectual property rights to UC as well as all right, title and interest in tangible research products embodying any such inventions whether the inventions are patentable or not. Supplier agrees to promptly execute any additional documents or forms that UC may require in order to effectuate such assignment.

C. General. Should the Goods and/or Services become, or in Supplier’s opinion be likely to become, the subject of a claim of infringement of any patent, copyright, trademark, trade name, trade secret, or other proprietary or contractual right of any third party, Supplier will provide written notice to UC of the circumstances giving rise to such claim or likely claim. In the event that UC receives notice of a claim of infringement or is made a party to or is threatened with being made a party to any claim of Terms and Conditions of Purchase
Revised 4.5.21 6
infringement related to the Goods and/or Services, UC will provide Supplier with notice of such claim or threat. Following receipt of such notice, Supplier will either (at Supplier’s sole election) (i) procure for UC the right to continue to use the affected portion of the Goods and/or Services, or (ii) replace or otherwise modify the affected portion of the Goods and/or Services to make them noninfringing, or obtain a reasonable substitute product for the affected portion of the Goods and/or Services, provided that any replacement, modification or substitution under this paragraph does not effect a material change in the Goods and/or Services’ functionality. If none of the foregoing options is reasonably acceptable to UC, UC will have the right to terminate the Agreement without damage, penalty, cost or further obligation.

D. UC Rights to Institutional Information. Institutional Information shall belong exclusively to UC and unless expressly provided, this Agreement shall not be construed as conferring on Supplier any patent, copyright, trademark, license right or trade secret owned or obtained by UC. Any right for Supplier to use Institutional Information is solely provided on a non-exclusive basis, and only to the extent required for Supplier to provide the Goods or Services under the Agreement. As used herein, “Institutional Information” means any information or data created, received, and/or collected by UC or on its behalf, including but not limited to application logs, metadata and data derived from such data.

ARTICLE 8 – INDEMNITY AND LIABILITY
To the fullest extent permitted by law, Supplier will defend, indemnify, and hold harmless UC, its officers, employees, and agents, from and against all losses, expenses (including, without limitation, reasonable attorneys' fees and costs), damages, and liabilities of any kind resulting from or arising out of the Agreement, including the performance hereunder of Supplier, its officers, employees, agents, subsuppliers, or anyone directly or indirectly employed by Supplier, or any person or persons under Supplier's direction and control, provided such losses, expenses, damages and liabilities are due or claimed to be due to the acts or omissions of Supplier, its officers, employees, agents, sub-suppliers, or anyone directly or indirectly employed by Supplier, or any person or persons under Supplier's direction and control. UC agrees to provide Supplier with prompt notice of any such claim or action and to permit Supplier to defend any claim or action, and that UC will cooperate fully in such defense. UC retains the right to participate in the defense against any such claim or action, and the right to consent to any settlement, which consent will not unreasonably be withheld.

In the event Appendix DS applies to this Agreement, Supplier shall reimburse or otherwise be responsible for any costs, fines or penalties imposed against UC as a result of Supplier’s Breach of Institutional Information and/or failure to cooperate with UC’s response to such Breach. As used herein, “Breach” means:
a. Any disclosure of Institutional Information to an unauthorized party or in an unlawful manner; b. Unauthorized or unlawful acquisition of information that compromises the security, confidentiality or integrity of Institutional Information and/or IT Resources; and c. The acquisition, access, use, or disclosure of Protected Health Information or medical information in a manner not permitted under the Health Insurance Portability and Accountability Act (HIPAA) or California law. “IT Resources” means IT infrastructure, cloud services, software, and/or hardware with computing and/or networking capability that is Supplier owned/managed, or UC-owned, or a personally owned device that stores Institutional Information, is connected to UC systems, is connected to UC networks, or is used for UC business.

Terms and Conditions of Purchase
Revised 4.5.21 7
ARTICLE 9 – INSURANCE
Supplier, at its sole cost and expense, will insure its activities in connection with providing the Goods and/or Services and obtain, keep in force, and maintain the following insurance with the minimum limits set forth below, unless UC specifies otherwise:

A. Commercial Form General Liability Insurance (contractual liability included) with limits as follows:
a. Each Occurrence $ 1,000,000
b. Products/Completed Operations Aggregate $ 2,000,000
c. Personal and Advertising Injury $ 1,000,000
d. General Aggregate $ 2,000,000
B. Business Automobile Liability Insurance for owned, scheduled, non-owned, or hired automobiles with a combined single limit of not less than one million dollars ($1,000,000) per occurrence. (Required only if Supplier drives on UC premises or transports UC employees, officers, invitees, or agents in the course of supplying the Goods and/or Services to UC.) C. If applicable, Professional Liability Insurance with a limit of two million dollars ($2,000,000) per occurrence or claim with an aggregate of not less than two million dollars ($2,000,000). If this insurance is written on a claims-made form, it will continue for three years following termination of the Agreement. The insurance will have a retroactive date of placement prior to or coinciding with the effective date of the Agreement.

D. Workers' Compensation as required by applicable state law and Employer’s Liability with limits of one million dollars ($1,000,000) per occurrence.

E. If applicable, Supplier Fidelity Bond or Crime coverage for the dishonest acts of its employees in a minimum amount of one million dollars ($1,000,000). Supplier will endorse such policy to include a “Regents of the University of California Coverage” or “Joint Payee Coverage” endorsement. UC and, if so requested, UC’s officers, employees, agents and sub-suppliers will be named as "Loss Payee, as Their Interest May Appear” in such Fidelity Bond.

F. In the event Appendix DS applies to this Agreement, Supplier, at its sole cost and expense, will obtain, keep in force, and maintain one or more insurance policies that provide coverage for technology, professional liability, data protection, and/or cyber liability. Typically referred to as Privacy, Technology and Data Security Liability, Cyber Liability, or Technology Professional Liability insurance, it will cover liabilities for financial loss due to the acts, omissions, or intentional misconduct of Supplier, its officers, employees, agents, sub-suppliers, or anyone directly or indirectly employed by Supplier, or any person or persons under Supplier’s direction and control, in connection with the performance of this Agreement, as well as all Supplier costs, including damages it is obligated to pay UC or any third party, that are associated with any confirmed or suspected Breach or compromise of Institutional Information. In some cases, Professional Liability policies may include some coverage for data breaches or loss of Institutional Information. Regardless of the type of policy(ies) in place, such coverage will include without limitation:
a. Costs to notify parties whose data were lost or compromised; b. Costs to provide credit monitoring and credit restoration services to parties whose data were lost or compromised;
c. Costs associated with third party claims arising from the confirmed or suspected Breach or loss of Institutional Information, including litigation costs and settlement costs; d. Any investigation, enforcement, fines and penalties, or similar miscellaneous costs; and e. Any payment made to a third party as a result of extortion related to a confirmed or suspected Breach. The following insurance coverage is based on the highest Protection Level Classification of Institutional Information identified in Exhibit 1 to Appendix DS:

Terms and Conditions of Purchase
Revised 4.5.21 8
P1 - This insurance policy must have minimum limits of $500,000 each occurrence and $500,000 in the aggregate.

P2 - This insurance policy must have minimum limits of $1,000,000 each occurrence and $1,000,000 in the aggregate.

P3 and P4, less than 70,000 records - this insurance policy must have minimum limits of $5,000,000 each occurrence and $5,000,000 in the aggregate.

P3 and P4, 70,000 or more records - this insurance policy must have minimum limits of $10,000,000 each occurrence and $10,000,000 in the aggregate.

G. Protection Level Classifications are defined in the UC Systemwide Information Security Classification of Information and IT Resources: https://security.ucop.edu/policies/institutional-information-and-itresource-classification.html H. Additional other insurance in such amounts as may be reasonably required by UC against other insurable risks relating to performance. If the above insurance is written on a claims-made form, it will continue for three years following termination of the Agreement. The insurance will have a retroactive date of placement prior to or coinciding with the effective date of the Agreement. If the above insurance coverage is modified, changed or cancelled, Supplier will provide UC with not less than fifteen (15) days’ advance written notice of such modification, change, or cancellation, and will promptly obtain replacement coverage that complies with this Article.

I. The coverages referred to under A and B of this Article must include UC as an additional insured. It is understood that the coverage and limits referred to under A, B and C of this Article will not in any way limit Supplier’s liability. Supplier will furnish UC with certificates of insurance (and the relevant endorsement pages) evidencing compliance with all requirements prior to commencing work under the Agreement. Such certificates will:
a. Indicate that The Regents of the University of California has been endorsed as an additional insured for the coverage referred to under A and B of this Article. This provision will only apply in proportion to and to the extent of the negligent acts or omissions of Supplier, its officers, agents, or employees.
b. Include a provision that the coverage will be primary and will not participate with or be excess over any valid and collectible insurance or program of self-insurance carried or maintained by UC.

ARTICLE 10 – USE OF UC NAME AND TRADEMARKS
Supplier will not use the UC name, abbreviation of the UC name, trade names and/or trademarks (i.e., logos and seals) or any derivation thereof, in any form or manner in advertisements, reports, or other information released to the public, or place the UC name, abbreviations, trade names and/or trademarks or any derivation thereof on any consumer goods, products, or services for sale or distribution to the public, without UC’s prior written approval. Supplier agrees to comply at all times with California Education Code Section 92000.

ARTICLE 11 – FEDERAL FUNDS
Supplier who supplies Goods and/or Services certifies and represents its compliance with the following clauses, as applicable. Supplier shall promptly notify UC of any change of status with regard to these certifications and representations. These certifications and representations are material statements upon which UC will rely.

Terms and Conditions of Purchase
Revised 4.5.21 9
A. For commercial transactions involving funds on a federal contract (federal awards governed by the FAR), the following provisions apply, as applicable:
a. FAR 52.203-13, Contractor Code of Business Ethics and Conduct; b. FAR 52.203-17, Contractor Employee Whistleblower Rights and Requirement to Inform Employees of Whistleblower Rights;
c. FAR 52.203-19, Prohibition on Requiring Certain Internal Confidentiality Agreements or Statements;
d. FAR 52.219-8, Utilization of Small Business Concerns; e. FAR 52.222-17, Non-displacement of Qualified Workers; f. FAR 52.222-21, Prohibition of Segregated Facilities; g. FAR 52.222-26, Equal Opportunity;
h. FAR 52.222-35, Equal Opportunity for Veterans;
i. FAR 52.222-36, Equal Opportunity for Workers with Disabilities; j. FAR 52.222-37, Employment Reports on Veterans;
k. FAR 52.222-40, Notification of Employee Rights Under the National Labor Relations Act; l. FAR 52.222-41, Service Contract Labor Standards;
m. FAR 52.222-50, Combating Trafficking in Persons;
n. FAR 52.222-51, Exemption from Application of the Service Contract Labor Standards to Contracts for Maintenance, Calibration, or Repair of Certain Equipment - Requirements; o. FAR 52.222-53, Exemption from Application of the Service Contract Labor Standards to Contracts for Certain Services - Requirements;
p. FAR 52.222-54, Employment Eligibility Verification;
q. FAR 52.222-55, Minimum Wages Under Executive Order 13658; r. FAR 52.222-62, Paid Sick Leave under Executive Order 13706; s. FAR 52.224-3, Privacy Training;
t. FAR 52.226-6, Promoting Excess Food Donation to Nonprofit Organizations; u. FAR 52.233-1, Disputes; and
v. FAR 52.247-64, Preference for Privately Owned U.S.-Flag Commercial Vessels.

B. For non-commercial transactions involving funds on a federal contract, the UC Appendix titled ‘Federal Government Contracts Special terms and Conditions (Non-Commercial Items or Services)’ and located at www.ucop.edu/procurement-services/policies-forms/index.html is hereby incorporated herein by this reference.

C. For transactions involving funds on a federal grant or cooperative agreement (federal awards governed by CFR Title 2, Subtitle A, Chapter II, Part 200) the following provisions apply, as applicable:
a. Rights to Inventions. If Supplier is a small business firm or nonprofit organization, and is providing experimental, development, or research work under this transaction, Supplier must comply with the requirements of 3 CFR Part 401, “Rights to Inventions Made by nonprofit Organizations and Small Business Firms Under Government Grants, Contracts, and Cooperative Agreements”.
b. Clean Air Act. Supplier agrees to comply with all applicable standards, orders or regulations issued pursuant to the Clean Air Act (42 U.S.C. 7401-7671q) and the Federal Water Pollution Control Act as amended (33 U.S.C. 1251-1387). Violations must be reported to the Federal awarding agency and the Regional Office of the Environmental Protection Agency (EPA). c. Byrd Anti-Lobbying. Supplier certifies that it will not, and has not used Federal appropriated funds to pay any person or organization for influencing or attempting to influence an officer Terms and Conditions of Purchase
Revised 4.5.21 10
or employee of any agency, a member of Congress, officer or employee of Congress, or an employee of a member of Congress in connection with obtaining any Federal contract, grant or any other award covered by 31 U.S.C. 1352.
d. Procurement of Recovered Materials. If Supplier is a state agency or agency of a political subdivision of a state, then Supplier must comply with section 6002 of the Solid Waste Disposal Act, as amended by the Resource Conservation and Recovery Act. e. Domestic Preferences for Procurements. As appropriate and to the extent consistent with law, Supplier should, to the greatest extent practicable under a Federal award, provide a preference for the purchase, acquisition, or use of goods, products, or materials produced in the United States (including but not limited to iron, aluminum, steel, cement, and other manufactured products). ‘‘Produced in the United States’’ means, for iron and steel products, that all manufacturing processes, from the initial melting stage through the application of coatings, occurred in the United States. ‘‘Manufactured products’’ means items and construction materials composed in whole or in part of non-ferrous metals such as aluminum; plastics and polymer-based products such as polyvinyl chloride pipe; aggregates such as concrete; glass, including optical fiber; and lumber.

D. In these provisions, the term "contractor" as used therein will refer to Supplier, and the terms “Government” or “Contracting Officer” as used therein will refer to UC. Where a purchase of items is for fulfillment of a specific U.S. Government prime or subcontract, additional information and/or terms and conditions may be included in an attached supplement. By submitting an invoice to UC, Supplier is representing to UC that, at the time of submission:
a. Neither Supplier nor its principals are presently debarred, suspended, or proposed for debarment by the U.S. government (see FAR 52.209-6);
b. Supplier has filed all compliance reports required by the Equal Opportunity clause (see FAR

52.222-22); and
c. Any Supplier representations to UC about U.S. Small Business Administration or state and local classifications, including but not limited to size standards, ownership, and control, are accurate and complete.
d. Byrd Anti-Lobbying. Supplier certifies that it will not, and has not used Federal appropriated funds to pay any person or organization for influencing or attempting to influence an officer or employee of any agency, a member of Congress, officer or employee of Congress, or an employee of a member of Congress in connection with obtaining any Federal contract, grant or any other award covered by 31 U.S.C. 1352.

ARTICLE 12 – EQUAL OPPORTUNITY AFFIRMATIVE ACTION
Supplier will abide by the requirements set forth in Executive Orders 11246 and 11375. Where applicable, Supplier will comply with 41 CFR §§ 60-1.4(a), 60-300.5(a) and 60-741.5(a), incorporated by reference with this statement: “This contractor and subcontractor shall abide by the requirements of 41 CFR §§ 60-1.4(a), 60-300.5(a) and 60-741.5(a). These regulations prohibit discrimination against qualified individuals based on their status as protected veterans or individuals with disabilities, and prohibit discrimination against all individuals based on their race, color, religion, sex, sexual orientation, gender identity, or national origin. Moreover, these regulations require that covered prime contractors and subcontractors take affirmative action to employ and advance in employment individuals without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status or disability.” With respect to activities occurring in the State of California, Supplier agrees to adhere to the California Fair Employment and Housing Act. Supplier will provide UC on request a Terms and Conditions of Purchase
Revised 4.5.21 11
breakdown of its labor force by groups as specified by UC, and will discuss with UC its policies and practices relating to its affirmative action programs. Supplier will not maintain or provide facilities for employees at any establishment under its control that are segregated on a basis prohibited by federal law. Separate or single-user restrooms and necessary dressing or sleeping areas must be provided, however, to ensure privacy.

ARTICLE 13 – LIENS
Supplier agrees that upon UC’s request, Supplier will submit a sworn statement setting forth the work performed or material furnished by sub-suppliers and material men, and the amount due and to become due to each, and that before the final payment called for under the Agreement, will upon UC’s request submit to UC a complete set of vouchers showing what payments have been made for such work performed or material furnished. Supplier will promptly notify UC in writing, of any claims, demands, causes of action, liens or suits brought to its attention that arise out of the Agreement. UC will not make final payment until Supplier, if required, delivers to UC a complete release of all liens arising out of the Agreement, or receipts in full in lieu thereof, as UC may require, and if required in either case, an affidavit that as far as it has knowledge or information, the receipts include all the labor and materials for which a lien could be filed; but Supplier may, if any sub-supplier refuses to furnish a release or receipt in full, furnish a bond satisfactory to UC to indemnify it against any claim by lien or otherwise.

If any lien or claim remains unsatisfied after all payments are made, Supplier will refund to UC all monies that UC may be compelled to pay in discharging such lien or claim, including all costs and reasonable attorneys' fees.

ARTICLE 14 – PREMISES WHERE SERVICES ARE PROVIDED
A. Cleaning Up. Supplier will at all times keep UC premises where the Services are performed and adjoining premises free from accumulations of waste material or rubbish caused by its employees or work of any of its sub-suppliers, and, at the completion of the Services; will remove all rubbish from and about the premises and all its tools, scaffolding, and surplus materials, and will leave the premises "broom clean" or its equivalent, unless more exactly specified. In case of dispute between Supplier and its sub-suppliers as to responsibility for the removal of the rubbish, or if it is not promptly removed, UC may remove the rubbish and charge the cost to Supplier.

B. Environmental, Safety, Health and Fire Protection. Supplier will take all reasonable precautions in providing the Goods and Services to protect the health and safety of UC employees and members of the public and to minimize danger from all hazards to life and property, and will comply with all applicable environmental protection, health, safety, and fire protection regulations and requirements (including reporting requirements). In the event that Supplier fails to comply with such regulations and requirements, UC may, without prejudice to any other legal or contractual rights of UC, issue an order stopping all or any part of the provision of the Goods and/or Services; thereafter a start order for resumption of providing the Goods and/or Services may be issued at UC’s discretion. Supplier will not be entitled to make a claim for extension of time or for compensation or damages by reason of or in connection with such stoppage. Supplier will have sole responsibility for the safety of all persons employed by Supplier and its sub-suppliers on UC premises, or any other person who enters upon UC premises for reasons relating to the Agreement.

Supplier will at all times maintain good order among its employees and all other persons who come onto UC's premises at Supplier's request and will not engage any unfit or unskilled person to provide the Goods and/or Services. Supplier will confine its employees and all other persons who come onto UC's premises at Supplier's request or for reasons relating to the Agreement and its equipment to Terms and Conditions of Purchase
Revised 4.5.21 12
that portion of UC's premises where the Services are to be provided or to roads leading to and from such work sites, and to any other area which UC may permit Supplier to use. Supplier will take all reasonable measures and precautions at all times to prevent injuries to or the death of any of its employees or any other person who enters upon UC premises at Supplier’s request. Such measures and precautions will include, but will not be limited to, all safeguards and warnings necessary to protect workers and others against any conditions on the premises that could be dangerous and to prevent accidents of any kind whenever the Goods and/or Services are being provided in proximity to any moving or operating machinery, equipment or facilities, whether such machinery, equipment or facilities are the property of or are being operated by, Supplier, its sub-suppliers, UC or other persons. To the extent compliance is required, Supplier will comply with all relevant UC safety rules and regulations when on UC premises.

C. Tobacco-free Campus. UC is a tobacco-free institution. Use of cigarettes, cigars, oral tobacco, electronic cigarettes and all other tobacco products is prohibited on all UC owned or leased sites.

ARTICLE 15 – LIABILITY FOR UC - FURNISHED PROPERTY
Supplier assumes complete liability for any materials UC furnishes to Supplier in connection with the Agreement and Supplier agrees to pay for any UC materials Supplier damages or otherwise is not able to account for to UC's satisfaction. UC furnishing to Supplier any materials in connection with the Agreement will not, unless otherwise expressly provided in writing by UC, be construed to vest title thereto in Supplier.

ARTICLE 16 – COOPERATION
Supplier and its sub-suppliers, if any, will cooperate with UC and other suppliers and will so provide the Services that other cooperating suppliers will not be hindered, delayed or interfered with in the progress of their work, and so that all of such work will be a finished and complete job of its kind.

ARTICLE 17 – ADDITIONAL TERMS APPLICABLE TO THE FURNISHING OF GOODS The terms in this Article have special application to the furnishing of Goods:

A. Price Decreases. Supplier agrees immediately to notify UC of any price decreases from its suppliers, and to pass through to UC any price decreases.

B. Declared Valuation of Shipments. Except as otherwise provided in the Agreement, all shipments by Supplier under the Agreement for UC's account will be made at the maximum declared value applicable to the lowest transportation rate or classification and the bill of lading will so note.

C. Title. Title to the Goods purchased under the Agreement will pass directly from Supplier to UC at the f.o.b. point shown, or as otherwise specified in the Agreement, subject to UC’s right to reject upon inspection.

D. Changes. Notwithstanding the terms in Article 34, Amendments, UC may make changes within the general scope of the Agreement in drawings and specifications for specially manufactured Goods, place of delivery, method of shipment or packing of the Agreement by giving notice to Supplier and subsequently confirming such changes in writing. If such changes affect the cost of or the time required for performance of the Agreement, UC and Supplier will agree upon an equitable adjustment in the price and/or delivery terms. Supplier may not make changes without UC’s written approval. Any claim of Supplier for an adjustment under the Agreement must be made in writing within thirty (30) days from the date Supplier receives notice of such change unless UC waives this condition in writing. Nothing in the Agreement will excuse Supplier from proceeding with Terms and Conditions of Purchase
Revised 4.5.21 13
performance of the Agreement as changed hereunder. Supplier may not alter or misbrand, within the meaning of the applicable Federal and State laws, the Goods furnished.

E. Forced, Convict and Indentured Labor. Supplier warrants that no foreign-made Goods furnished to UC pursuant to the Agreement will be produced in whole or in part by forced labor, convict labor, or indentured labor under penal sanction. If UC determines that Supplier knew or should have known that it was breaching this warranty, UC may, in addition to terminating the Agreement, remove Supplier from consideration for UC contracts for a period not to exceed one year. This warranty is in addition to any applicable warranties in Articles 6 and 11.

F. Export Control. Supplier agrees to provide UC (the contact listed on the PO) with written notification that identifies the export-controlled Goods and such Goods’ export classification if any of the Goods is export-controlled under the International Traffic in Arms Regulations (ITAR) (22 CFR §§ 120-130), the Export Administration Regulations (15 CFR §§ 730-774) 500 or 600 series, or controlled on a military strategic goods list. Supplier agrees to provide UC (the contact listed on the PO) with written notification if Supplier will be providing information necessary for the operation, installation (including on-site installation), maintenance (checking), repair, overhaul, and refurbishing of the Goods that is beyond a standard user manual (i.e. ”Use” technology as defined under the EAR 15 CFR § 772.1), or “Technical Data” (as defined under the ITAR 22 CFR § 120.10).

ARTICLE 18 – CONFLICT OF INTEREST
Supplier affirms that, to the best of Supplier’s knowledge, no UC employee who has participated in UC’s decision-making concerning the Agreement has an “economic interest” in the Agreement or Supplier. A UC employee’s “economic interest” means:

A. An investment worth $2,000 or more in Supplier or its affiliate; B. A position as director, officer, partner, trustee, employee or manager of Supplier or its affiliate; C. Receipt during the past 12 months of $500 in income or $440 in gifts from Supplier or its affiliate; or D. A personal financial benefit from the Agreement in the amount of $250 or more.

In the event of a change in these economic interests, Supplier will provide written notice to UC within thirty (30) days after such change, noting such changes. Supplier will not be in a reporting relationship to a UC employee who is a near relative, nor will a near relative be in a decision making position with respect to Supplier.

ARTICLE 19 – AUDIT REQUIREMENTS
The Agreement, and any pertinent records involving transactions relating to this Agreement, is subject to the examination and audit of the Auditor General of the State of California or Comptroller General of the United States or designated Federal authority for a period of up to five (5) years after final payment under the Agreement. UC, and if the underlying grant, cooperative agreement or federal contract so provides, the other contracting Party or grantor (and if that be the United States or an instrumentality thereof, then the Comptroller General of the United States) will have access to and the right to examine Supplier’s pertinent books, documents, papers, and records involving transactions and work related to the Agreement until the expiration of five (5) years after final payment under the Agreement. The examination and audit will be confined to those matters connected with the performance of the Agreement, including the costs of administering the Agreement.

ARTICLE 20 – PROHIBITION ON UNAUTHORIZED USE OR DISCLOSURE OF INSTITUTIONAL

INFORMATION
Terms and Conditions of Purchase
Revised 4.5.21 14
A. Prohibition on Access, Use and Disclosure of Institutional Information. Supplier will not access, use or disclose Institutional Information, other than to carry out the purposes for which UC disclosed the Institutional Information to Supplier, except as required by applicable law, or as otherwise authorized in writing by UC prior to Supplier’s disclosure. Supplier shall have the limited right to disclose Institutional Information to Supplier’s employees provided that: (i) Supplier shall disclose only such Institutional Information as is necessary for the Supplier to perform its obligations under this Agreement, and (ii) Supplier informs such employees of the obligations governing the access, use and disclosure of Institutional Information prior to Supplier’s disclosure. Supplier shall be liable for any breach of this Agreement by its employees. For avoidance of doubt, this provision prohibits Supplier from using for its own benefit Institutional Information and any information derived therefrom. For the avoidance of doubt, the sale of Institutional Information is expressly prohibited.

B. Compliance with Applicable Laws and Industry Best Practices. Supplier agrees to comply with all applicable state, federal, and foreign laws, as well as industry best practices, governing the collection, access, use, disclosure, safeguarding and destruction of Institutional Information.

Supplier agrees to protect the privacy and security of Institutional Information according to all applicable laws and industry best practices, and no less rigorously than it protects its own information, but in no case less than reasonable care.

C. Confidential Institutional Information. Supplier agrees to hold UC’s Confidential Institutional Information, and any information derived therefrom, in strict confidence. Confidential Institutional Information shall be defined as any Institutional Information which is (i) marked as “Confidential” at the time of disclosure; (ii) if disclosed orally, identified at the time of such oral disclosure as confidential, and reduced to writing as “Confidential” within thirty (30) days of such oral disclosure; and (iii) if not marked as “Confidential,” information that would be considered by a reasonable person in the relevant field to be confidential given its content and the circumstances of its disclosure. Confidential Information will not be considered confidential to the extent that: (i) Supplier can demonstrate by written records was known to Supplier prior to the effective date of the Agreement; (ii) is currently in, or in the future enters, the public domain other than through a breach of the Agreement or through other acts or omissions of Supplier; (iii) is obtained lawfully from a third party; or (iv) is disclosed under the California Public Records Act or legal process. For the avoidance of doubt, as applicable to Supplier’s Services, Confidential Institutional Information may include any information that identifies or is capable of identifying a specific individual, including but not limited to:
a. Personally identifiable information,
b. Protected Health Information as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the HIPAA regulations (including, but not limited to 45 C.F.R. § 160.103),
c. Medical information as defined by California Civil Code § 56.05, d. Cardholder data,
e. Student records, or
f. Individual financial information that is subject to laws restricting the use and disclosure of such information, including but not limited to:
i. Article 1, Section 1 of the California Constitution; the California Information Practices Act (Civil Code § 1798 et seq.);
ii. The federal Gramm-Leach-Bliley Act (15 U.S.C. §§ 6801(b) and 6805(b)(2)); iii. The federal Family Educational Rights and Privacy Act (20 U.S.C. § 1232g); iv. The federal Fair and Accurate Credit Transactions Act (15 U.S.C. § 1601 et seq.); Terms and Conditions of Purchase
Revised 4.5.21 15
v. The Fair Credit Reporting Act (15 U.S.C. § 1681 et seq), and vi. Applicable international privacy laws, including, but not limited to the General Data Protection Regulation.

D. Required Disclosures of Institutional Information. If Supplier is required by a court of competent jurisdiction or an administrative body to disclose Institutional Information, Supplier will notify UC in writing immediately upon receiving notice of such requirement and prior to any such disclosure (unless Supplier is prohibited by law from doing so), to give UC an opportunity to oppose or otherwise respond to such disclosure. To the extent Supplier still required to disclose Institutional Information, Supplier will furnish only that portion that is legally required and will exercise all reasonable efforts to obtain reliable assurance that confidential treatment will be afforded to any Confidential Institutional Information.

E. No Offshoring. Supplier’s transmission, transportation or storage of Institutional Information outside the United States, or access of Institutional Information from outside the United States, is prohibited except with prior written authorization by UC.

F. Conflict in Terms. UC’s Appendix – Data Security, Appendix – BAA, and/or Appendix GDPR will control in the event that one or more appendices is incorporated into the Agreement and conflicts with the provisions of this Article.

G. Acknowledgement. Supplier acknowledges that remedies at law would be inadequate to protect UC against any actual or threatened breach of this Section by Supplier, and, without prejudice to any other rights and remedies otherwise available to UC, Supplier agrees to the granting of injunctive relief in UC’s favor without proof of actual damages.

ARTICLE 21 – UC WHISTLEBLOWER POLICY
UC is committed to conducting its affairs in compliance with the law, and has established a process for reporting and investigating suspected improper governmental activities. Please visit http://www.ucop.edu/uc-whistleblower/ for more information.

ARTICLE 22 – SUSTAINABLE PROCUREMENT GUIDELINES
Supplier will conduct business using environmentally, socially, and economically sustainable products and services (defined as products and services with a lesser or reduced effect on human health and the environment, and which generate benefits to the University as well as to society and the economy, while remaining within the carrying capacity of the environment), to the maximum possible extent consistent with the Agreement, and with the University of California Sustainable Practices Policy (https://policy.ucop.edu/doc/3100155) and the University of California Sustainable Procurement Guidelines:
https://www.ucop.edu/procurement-services/for-ucstaff/sustainableprocurement/sustainableprocurementguidelines.pdf In accordance with the University of California Sustainable Practices Policy, Supplier will adhere to the following requirements and standards, as applicable. Supplier acknowledges that failure to comply with any of the sustainability standards and requirements in the Agreement will constitute a material breach of the Agreement and UC will have the right to terminate the Agreement without damage, penalty, cost or further obligation.

A. Sustainability Marketing Standards. Supplier sustainability related claims, where applicable, must meet UC recognized certifications and standards set forth in the UC Sustainable Procurement Guidelines and/or meet the standards of Federal Trade Commission’s (FTC) Green Guides.

Terms and Conditions of Purchase
Revised 4.5.21 16
B. Electronic Transfer of Supplier Information. Suppliers, when interacting with the UC, shall be prohibited from providing hard copies of presentations, marketing material, or other informational materials. Suppliers will be required to present all information in electronic format that is easily transferable to UC staff. Materials may be provided in hard copy or physical format if specifically required or requested by a UC representative.

C. Packaging Requirements. All packaging must be compliant with the Toxics in Packaging Prevention Act (AB 455) and must meet all additional standards and requirements set forth in the UC Sustainable Practices Policy. In addition, UC requires that all packaging meet at least one of the criteria listed below:
a. Uses bulk packaging;
b. Uses reusable packaging (e.g. totes reused by delivery service for next delivery); c. Uses innovative packaging that reduces the weight of packaging, reduces packaging waste, or utilizes packaging that is a component of the product; d. Maximizes recycled content and/or meets or exceeds the minimum post-consumer content level for packaging in the U.S. Environmental Protection Agency Comprehensive Procurement Guidelines;
e. Uses locally recyclable or certified compostable material.

D. Foodservice Foam Ban. As of 2018, the University no longer allows packaging foam or expanded polystyrene (EPS) for takeaway containers or other food service items, in any University-owned or - operated food service facility.

E. Product Packaging Foam Ban. Beginning January 1st, 2020, the University will prohibit all contracted and non-contracted suppliers from selling or distributing packaging foam (other than that utilized for laboratory supply or medical packaging) to UC campuses. Packaging foam is defined as any open or closed cell, solidified, polymeric foam used for cushioning or packaging, including but not limited to: low-density polyethylene foam, polypropylene foam, polystyrene foam (i.e. expanded polystyrene (EPS)), polyurethane foam, polyethylene foam, polyvinyl chloride (PVC) foam, and microcellular foam. Not included in this ban are easily biodegradable, plant-based foams such as those derived from corn or mushrooms.

F. E-Waste Recycling Requirements. All recyclers of UC electronic equipment must be e-Steward certified by the Basel Action Network (BAN).

G. Hosted and Punch-out Catalog Requirements. Suppliers enabled with eProcurement hosted catalog functionality must clearly identify products with UC-recognized certifications, as defined by the UC Sustainable Procurement Guidelines, in both hosted and punch-out catalog e-procurement environments.

ARTICLE 23 – PATIENT PROTECTION AND AFFORDABLE CARE ACT (PPACA) EMPLOYER SHARED

RESPONSIBILITY
If the Services involve Supplier furnishing UC with temporary or supplementary staffing, Supplier warrants that:

A. If Supplier is an Applicable Large Employer (as defined under Treasury Regulation Section 54.4980H1(a)(4)):
a. Supplier offers health coverage to its full-time employees who are performing Services for UC;
b. Supplier’s cost of enrolling such employees in Supplier’s health plan is factored into the fees for the Services; and
Terms and Conditions of Purchase
Revised 4.5.21 17
c. The fees for the Services are higher than what the Services would cost if Supplier did not offer health coverage to such full-time employees.

B. If Supplier is not an Applicable Large Employer (as defined above):
a. Supplier offers group health coverage to its full-time employees who are performing Services for UC and such coverage is considered Minimum Essential Coverage (as defined under Treasury Regulation Section 1-5000A-2) and is Affordable (as defined under Treasury Regulation Section 54.4980H-5(e)); or
b. Supplier’s full-time employees who are performing services for UC have individual coverage and such coverage satisfies the PPACA requirements for mandated individual coverage.

C. Supplier acknowledges that UC is relying on these warranties to ensure UC’s compliance with the PPACA Employer Shared Responsibility provision.

ARTICLE 24 - PREVAILING WAGES
Unless UC notifies Supplier that the Services are not subject to prevailing wage requirements, Supplier will comply, and will ensure that all sub-suppliers comply, with California prevailing wage provisions, including but not limited to those set forth in Labor Code sections 1770, 1771, 1771.1, 1772, 1773, 1773.1, 1774, 1775, 1776, 1777.5, and 1777.6. For purposes of the Agreement, the term “sub-supplier” means a person or firm, of all tiers, that has a contract with Supplier or with a sub-supplier to provide a portion of the Services. The term sub-supplier will not include suppliers, manufacturers, or distributors.

Specifically, and not by way of limitation, if apprenticable occupations are involved in providing the Services, Supplier will be responsible for ensuring that Supplier and any sub-suppliers comply with Labor Code Section 1777.5. Supplier and sub-supplier may not provide the Services unless currently registered and qualified to perform public work pursuant to Labor Code Section 1725.5 and 1771.1.

Notwithstanding the foregoing provisions, Supplier will be solely responsible for tracking and ensuring proper payment of prevailing wages regardless if Services are partially or wholly subject to prevailing wage requirements. In every instance, Supplier will pay not less than the UC Fair Wage (defined as $13 per hour as of 10/1/15, $14 per hour as of 10/1/16, and $15 per hour as of 10/1/17) for Services being performed at a UC Location (defined as any location owned or leased by UC).

The California Department of Industrial Relations (DIR) has ascertained the general prevailing per diem wage rates in the locality in which the Services are to be provided for each craft, classification, or type of worker required to provide the Services. A copy of the general prevailing per diem wage rates will be on file at each UC Location’s procurement office, and will be made available to any interested party upon request. Supplier will post at any job site:

A. Notice of the general prevailing per diem wage rates, and B. Any other notices required by DIR rule or regulation By this reference, such notices are made part of the Agreement. Supplier will pay not less than the prevailing wage rates, as specified in the schedule and any amendments thereto, to all workers employed by Supplier in providing the Services. Supplier will cause all subcontracts to include the provision that all sub-suppliers will pay not less than the prevailing rates to all workers employed by such sub-suppliers in providing the Services. The Services are subject to compliance monitoring and enforcement by the DIR. Supplier will forfeit, as a penalty, not more than $200 for each calendar day or portion thereof for each worker that is paid less than the prevailing rates as determined by the DIR for the work or craft in which the worker is employed for any portion of the Services provided by Supplier or any sub-supplier. The amount of this penalty will be determined pursuant to applicable law. Such Terms and Conditions of Purchase
Revised 4.5.21 18
forfeiture amounts may be deducted from the amounts due under the Agreement. If there are insufficient funds remaining in the amounts due under the Agreement, Supplier will be liable for any outstanding amount remaining due. Supplier will also pay to any worker who was paid less than the prevailing wage rate for the work or craft for which the worker was employed for any portion of the Services, for each day, or portion thereof, for which the worker was paid less than the specified prevailing per diem wage rate, an amount equal to the difference between the specified prevailing per diem wage rate and the amount which was paid to the worker. Review of any civil wage and penalty assessment will be made pursuant to California Labor Code section 1742.

ARTICLE 25 – FAIR WAGE/FAIR WORK
If the Agreement is for Services that will be performed at one or more UC Locations, does not solely involve furnishing Goods, and are not subject to extramural awards containing sponsor-mandated terms and conditions, Supplier warrants that it is in compliance with applicable federal, state and local working conditions requirements, including but not limited to those set forth in Articles 11, 12 and 14 herein, and that Supplier pays its employees performing the Services no less than the UC Fair Wage. Supplier agrees UC may conduct such UC Fair Wage/Fair Work interim compliance audits as UC reasonably requests, as determined in UC’s sole discretion. Supplier agrees to post UC Fair Wage/Fair Work notices, in the form supplied by UC, in public areas (such as break rooms and lunch rooms) frequented by Supplier employees who perform Services.

For Services rendered (actual spend) not subject to prevailing wage requirements in excess of $100,000 in a year (under the Agreement or any combination of agreements for the same service), Supplier will a. At Supplier’s expense, provide an annual independent verification (https://www.ucop.edu/procurement-services/for-suppliers/fwfw-resources-suppliers.html) performed by a licensed public accounting firm (independent accountant) or the Supplier’s independent internal audit department (http://na.theiia.org/standardsguidance/topics/Pages/Independence-and-Objectivity.aspx) in compliance with UC’s required verification standards and procedures (https://www.ucop.edu/procurement-services/forsuppliers/fwfw-resources-suppliers.html), concerning Supplier’s compliance with this provision, and
b. Ensure that in the case of a UC interim audit, its independent accountant/independent internal auditor makes available to UC its work papers for UC Fair Wage/Fair Work for the most recent verification period. Supplier agrees to provide UC with a UC Fair Wage/Fair Work verification annually, in a form acceptable to UC, no later than ninety days after the end of the 12-month period in which $100,000 in spend is reached.

The Fair Wage Fair Work annual independent verification requirement does not extend to contracts for professional services or consulting for which pre-certification has been provided to UC (https://www.ucop.edu/procurement-services/for-suppliers/fwfw-resources-suppliers.html). Please see the UC Procurement/Supply Chain Management Policy BUS-43 (https://www.ucop.edu/procurementservices/policies-forms/business-and-finance/index.html) for the definition of professional services and consulting.

ARTICLE 26 – MEDICAL DEVICES
Terms and Conditions of Purchase
Revised 4.5.21 19
This Article applies when the Goods and/or Services involve UC purchasing or leasing one or more medical devices from Supplier, or when Supplier uses one or more medical devices in providing Goods and/or Services to UC.

Medical Device as used herein will have the meaning provided by the U.S. Food and Drug Administration (“FDA”) and means an instrument, apparatus, implement, machine, contrivance, implant, in vitro reagent, or other similar or related article, including a component part, or accessory which is:
a. Recognized in the official National Formulary, or the United States Pharmacopoeia, or any supplement to them;
b. Intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease, in humans or other animals, or c. Intended to affect the structure or any function of the body of humans or other animals, and which does not achieve any of its primary intended purposes through chemical action within or on the body of humans or other animals and which is not dependent upon being metabolized for the achievement of any of its primary intended purposes.

Supplier warrants that prior to UC’s purchase or lease of any Medical Device or Supplier’s use of any Medical Device in providing Goods and/or Services hereunder, Supplier will:
a. Perform security testing and validation for each such Goods and/or Services or Medical Device, as applicable;
b. Perform security scans to detect malware on any software embedded within any Goods and/or Services or Medical Device, as applicable, in order to verify that the software does not contain any known malware;
c. Conduct a vulnerability scan encompassing all ports and fuzz testing; and d. Provide UC with reports for a-c. Supplier warrants that all Goods or Medical Devices are compliant with FDA’s most current guidance or regulation for the quality system related to the cybersecurity and the Management of Cybersecurity in Medical Devices, and that Supplier will maintain compliance with any updates to such guidance or regulations.

Throughout Supplier’s performance of this Agreement, Supplier will provide UC with reasonably up-todate patches, firmware and security updates for any Medical Device provided to UC, and any other Medical Device used in the course of providing Services, as applicable. All such patches and other security updates will be made available to UC within thirty (30) days of its commercial release or as otherwise recommended by Supplier or Supplier’s sub-supplier, whichever is earlier.

Supplier warrants that all software and installation media not specifically required for any Medical Device used by Supplier or Goods and/or Services delivered to UC under this Agreement as well as files, scripts, messaging services and data will be removed from all such Goods and/or Services or Medical Device following installation, and that all hardware ports and drivers not required for use or operation of such Goods and/or Services or Medical Device will be disabled at time of installation. In addition, Medical Devices must be configured so that only Supplier-approved applications will run on such Medical Devices.

Supplier agrees that UC may take any and all actions that it, in its sole discretion, deems necessary to address, mitigate and/or rectify any real or potential security threat, and that no such action, to the Terms and Conditions of Purchase
Revised 4.5.21 20
extent such action does not compromise device certification, will impact, limit, reduce or negate Supplier’s warranties or any of Supplier’s other obligations hereunder.

Supplier warrants that any Medical Device provided to UC, and any other Medical Device used in the course of providing such Goods and/or Services, meet and comply with all cyber-security guidance and similar standards promulgated by the FDA and any other applicable regulatory body.

If the Goods and/or Services entail provision or use of a Medical Device, Supplier will provide UC with a completed Manufacturer Disclosure Statement for Medical Device Security (MDS2) form for each such Medical Device before UC is obligated to purchase or lease such Medical Device or prior to Supplier’s use of such device in its performance of Services. If Supplier provides an MDS2 form to UC concurrently with its provision of Goods and/or Services, UC will have a reasonable period of time to review such MDS2 form, and if the MDS2 form is unacceptable to UC, then UC in its sole discretion may return the Goods or terminate the Agreement with no further obligation to Supplier.

ARTICLE 27 – FORCE MAJEURE
Neither Party shall be deemed to be in default of or to have breached any provision of this Agreement due to a delay, failure in performance or interruption of service, if such performance or service are impossible to execute, illegal or commercially impracticable, because of the following “force majeure” occurrences: acts of God, acts of civil or military authorities, civil disturbances, wars, strikes or other labor disputes, transportation contingencies, freight embargoes, acts or orders of any government or agency or official thereof, earthquakes, fires, floods, unusually severe weather, epidemics, pandemics, quarantine restrictions and other catastrophes or any other similar occurrences beyond such party’s reasonable control. In every case, the delay or failure in performance or interruption of service must be without the fault or negligence of the Party claiming excusable delay and the Party claiming excusable delay must promptly notify the other Party of such delay. Performance time under this Agreement shall be considered extended for a period of time equivalent to the time lost because of the force majeure occurrence; provided, however, that if any such delay continues for a period of more than thirty (30) days, UC shall have the option of terminating this Agreement upon written notice to Supplier.

ARTICLE 28 – ASSIGNMENT AND SUBCONTRACTING
Except as to any payment due hereunder, Supplier may not assign or subcontract the Agreement without UC’s written consent. In case such consent is given, the assignee or subcontractor will be subject to all of the terms of the Agreement.

ARTICLE 29 – NO THIRD-PARTY RIGHTS
Nothing in the Agreement, express or implied, is intended to make any person or entity that is not a signer to the Agreement a third-party beneficiary of any right created by this Agreement or by operation of law.

ARTICLE 30 – OTHER APPLICABLE LAWS
Any provision required to be included in a contract of this type by any applicable and valid federal, state or local law, ordinance, rule or regulations will be deemed to be incorporated herein.

ARTICLE 31 – NOTICES
Terms and Conditions of Purchase
Revised 4.5.21 21
A Party must send any notice required to be given under the Agreement by overnight delivery or by certified mail with return receipt requested, to the other Party’s representative at the address specified by such Party.

ARTICLE 32 – SEVERABILITY
If a provision of the Agreement becomes, or is determined to be, illegal, invalid, or unenforceable, that will not affect the legality, validity or enforceability of any other provision of the Agreement or of any portion of the invalidated provision that remains legal, valid, or enforceable.

ARTICLE 33 – WAIVER
Waiver or non-enforcement by either Party of a provision of the Agreement will not constitute a waiver or non-enforcement of any other provision or of any subsequent breach of the same or similar provision.

ARTICLE 34 – AMENDMENTS
The Parties may make changes in the Goods and/or Services or otherwise amend the Agreement, but only by a writing signed by both Parties’ authorized representatives. In the event there is a Material Change to the Agreement, the parties agree to meet and confer in good faith in order to modify the terms of the Agreement. A Material Change as used herein refers to:
a. A change to the scope of Goods and/or Services to be provided by Supplier, as agreed to by UC; b. A change in the Institutional Information Supplier is required to create, receive, maintain or transmit in performance of the Agreement, such that the Protection Level Classification of such Institutional Information changes;
c. Changes in the status of the parties;
d. Changes in flow down terms from external parties; and e. Changes in law or regulation applicable to this Agreement.

Each party shall notify the other party upon the occurrence of a Material Change.

ARTICLE 35 – GOVERNING LAW AND VENUE
California law will control the Agreement and any document to which it is appended. The exclusive jurisdiction and venue for any and all actions arising out of or brought under the Agreement is in a state court of competent jurisdiction, situated in the county in the State of California in which the UC Location is located or, where the procurement covers more than one UC Location, the exclusive venue is Alameda County, California.

ARTICLE 36 – ASSISTANCE IN LITIGATION OR ADMINISTRATIVE PROCEEDINGS Supplier will make itself and its employees, subcontractors, or agents assisting Supplier in the performance of its obligations reasonably available to UC at no cost to UC to testify as witnesses, or otherwise, in the event of investigations, or proceedings against UC, its directors, officers, agents, or employees relating to the Goods or Services.

ARTICLE 37 – SUPPLIER TERMS
Any additional terms that Supplier includes in an order form or similar document will be of no force and effect, unless UC expressly agrees in writing to such terms.

Terms and Conditions of Purchase
Revised 4.5.21 22
ARTICLE 38 – SURVIVAL CLAUSE
Upon expiration or termination of the Agreement, the following provisions will survive: WARRANTIES; INTELLECTUAL PROPERTY, COPYRIGHT, PATENTS, AND DATA RIGHTS; INDEMNITY AND LIABILITY; USE OF UC NAMES AND TRADEMARKS; LIABILITY FOR UC-FURNISHED PROPERTY; COOPERATION; TERMS APPLICABLE TO THE FURNISHING OF GOODS; AUDIT REQUIREMENTS; PROHIBITION ON UNAUTHORIZED USE OR DISCLOSURE OF INSTITUTIONAL INFORMATION; GOVERNING LAW AND VENUE, and, to the extent incorporated into the Agreement, the terms of the APPENDIX–DATA SECURITY, APPENDIX–BAA, and/or APPENDIX-GDPR.

ARTICLE 39 – CONTRACTING FOR COVERED SERVICES
Covered Services, for the purpose of this Agreement, are defined as work customarily performed by bargaining unit employees at the University in the categories of services described in Regents Policy 5402, and American Federation of State, County, and Municipal Employees (AFSCME) Collective Bargaining Agreement Article 5. Covered Services include, but are not necessarily limited to, the following services: cleaning, custodial, janitorial, or housekeeping services; food services; laundry services; grounds keeping; building maintenance (excluding skilled crafts); transportation and parking services; security services; billing and coding services; sterile processing; hospital or nursing assistant services; and medical imaging or other medical technician services.

Unless UC notifies Supplier that the Services are not Covered Services, Supplier warrants that it is in compliance with applicable federal, state and local working conditions requirements, including but not limited to those set forth in in other Articles of the Agreement. In accordance with Regents Policy 5402 and AFSCME Collective Bargaining Agreement Article 5, Supplier also warrants that it pays its employees performing the Covered Services at UC locations the equivalent value of the wages and benefits – as determined in the Wage and Benefit Parity Appendix – received by UC employees providing similar services at the same, or nearest UC location.

Supplier agrees UC may conduct such compliance audits as UC reasonably requests, and determined at UC’s sole discretion. Supplier agrees to post UC Contracting for Covered Services notices, in the template supplied by UC, in a prominent and accessible place (such as break rooms and lunch rooms) where it may be easily seen by workers who perform Covered Services. The term "Supplier" includes Supplier and its Sub-Suppliers at any tier. Supplier also agrees to:
a. Upon UC’s request, provide verification of an independent audit performed by Supplier’s independent auditor or independent internal audit department (http://na.theiia.org/standardsguidance/topics/Pages/Independence-and-Objectivity.aspx) and at Supplier’s expense; and b. Ensure that, in the case of a UC interim audit, Supplier’s auditor makes available to UC its Contracting for Covered Services work papers for the most recently audited time period. Supplier agrees to provide UC requested verification, in a form acceptable to UC, no later than ninety days after receiving UC’s request.

Revised 7/12/2017 Page 1 of 7
ATTACHMENT A TO PURCHASING AGREEMENT #______

STATEMENT OF WORK
This Statement of Work # __ (“SOW”) is issued pursuant to Purchasing Agreement #_______ dated _______________, 20__ between UC and Supplier (“Agreement”).

1. Title and Description of the Scope of Goods and/or Services [Buyer: Provide an overview and background of Goods and/or Services to be provided.]

2. Term of SOW
This SOW will begin on __________, 20__ (“Effective Date”) and continue through ______________, 20__. This SOW may not be renewed or otherwise amended except through a Change Order pursuant to the Change Management section below.

3. Key Tasks and Activities, Deliverables and Completion Timeframe Supplier Obligations
Task Activities Deliverables
Completion
Date or
Timeframe
1 [General
description]
[Specific details using action
verbs like “create”, “develop”,
“test”, “analyze”, “evaluate”,
etc.]
[List each discrete
tangible work
product that is
considered a
critical end result
from the Supplier;
deliverables are
nouns, not verbs]
[Specific dates
are best; can
be stated as
“Week 1”,
“Week 2”,
etc.]
2 3
4 5
Additional
as needed
Include: Identify all phases. If
additional phases will not be
known until first phase work
begins, be sure to specify
hourly rate and a not to exceed
price for this work.

Request Supplier to provide
data type, protected health
information and other data
Revised 7/12/17 Page 2 of 7

4. UC Obligations
[Buyer: Include as appropriate language such as: UC will provide working space, equipment, furniture, utilities, and services, as follows:]

5. Place(s) of Performance
[Buyer: Use this section if appropriate to outline where Services will be provided]

6. Key Personnel
Supplier’s Account Manager is listed below, is subject to UC approval, and has overall responsibility for managing the UC/Supplier relationship:

Name
Phone
Email
Address
Subcontractors authorized to provide Goods and/or Services under this SOW [Buyer: Names should be listed only if Agreement permits use of subcontractors]:

Name of Subcontractor Goods and/or Services the
Subcontractor will provide
Revised 7/12/17 Page 3 of 7
Supplier’s Account Management Team is:

Name
Phone
Email
Address
Name
Phone
Email
Address
Name
Phone
Email
Address
Name
Phone
Email
Address
UC’S Project Manager, responsible for acceptance/rejection of project results/deliverables, is:

Name
Phone
Email
Address

7. Reporting Requirements
[Buyer: Identify any key reports that should be produced by Supplier or critical reporting events. This can be included in the table above if preferred.]
Supplier agrees to provide other reports as reasonably requested by UC during the Term of the Agreement and any extension(s) to the Term at no additional cost to UC.

8. Assumptions
a) The following items are not included within the scope of Goods and/or Services to be provided under this SOW: [Buyer: Delete if not needed]
b) [Buyer: Add more as needed]
c) Additional assumptions include the following: [Buyer: Delete if not needed, but list any UC dependencies that must be fulfilled in order for Supplier to provide the Goods and/or Services] d) [Buyer: Add more as needed]
Revised 7/12/17 Page 4 of 7

9. Service Level Agreement
a) [Buyer: Any critical SLAs should be stated here. For goods, consider the following language:] During the Term of the Agreement, and any extension(s) of the Term, Supplier will provide the following minimum service standards:

Normal delivery -next business day
Rush delivery -within 4 hours
Pick up returns -within 2 business days
Request for reports -within 5 business days
Order fill rate -98%
Delivery accuracy -98%
Delivery, on-time -98%
Invoice/billing accuracy -98%
Customer service satisfaction -98%
The minimum service standards set forth above recognize that occasional errors are likely; however, Supplier further agrees to use its best efforts to achieve 100% of service levels. Should the service levels fall below the minimum standards and Supplier does not take corrective action within fourteen (14) days following UC written notification, UC reserves the right to terminate the Agreement immediately.

10. Pricing, Invoicing Method, and Settlement Method and Terms [Buyer: Pricing includes the contract amount (for instance, time and materials using an hourly rate; whether there is a not to exceed cap; and flat fee); and the payment schedule (what percentage must be paid at what times, including milestones)]
Pricing is addressed below. The Invoicing Method, and Settlement Method and Terms are addressed in the applicable Agreement. As regards Invoicing Method, and Settlement Method and Terms, the terms of the applicable Agreement will take precedence over any conflicting terms in this Statement of Work. a) “Fixed Price Services” to be rendered under this SOW, including deliverables to be provided as part of Fixed Price Services, are described in this section as:
b) “Time and Materials Services” to be rendered under this SOW, including deliverables to be provided as part of Time and Materials Services:
c) The rates applicable to each person who will render Time and Materials Services are as follows:

Name and Title of Person
Rendering Services
Rate per
Hour/Day
Estimated No. of
Days
Extended
Cost of
Fees
UC MRC
Estimated Maximum Expenses (if any): n/a
Revised 7/12/17 Page 5 of 7
Estimated Maximum Cost:
d) [Buyer: Outline Payment Schedule as needed]

11. Program Requirements
[Buyer: If items will be ordered by catalog, use the Appendix – Electronic Commerce. If applicable, consider using these additional terms for Goods:]
Order Packaging and Labeling. Supplier agrees that each UC order will be individually wrapped and labeled with the following information:

Purchase Order number;
Product description, quantity and catalog number of the product ordered and an open 30- character field for internal identification e.g., UC storehouse catalog numbers and/or internal customer order numbers; and
Other information, as may be requested by ordering UC Location.

Packaging slips will be attached to the outside of the package such that it can be inspected by UC at the requesting department and/or receiving dock.

Receiving Locations. Supplier agrees to provide desktop and dock delivery to all UC current and future authorized personnel delivery points, as requested by UC.

Standard Delivery Requirements. Supplier will deliver Monday through Friday, excluding UC- and Supplierobserved holidays. Supplier provide UC with a schedule on or before September 1 of the following calendar year showing holidays and other planned shutdowns (such as the annual inventory) that would impact Supplier’s ability to deliver the Goods and/or Services. Supplier agrees to deliver all UC orders received by 3:30pm Pacific Time the next business day as follows:

Campus direct (desktop delivery) - by 3:30 pm Pacific Time Storehouse (drop ship delivery) - by 10:00 am Pacific Time Delivery Delays. Supplier will report any delivery delay whatsoever to the ordering Location, as well as its cause, within two (2) hours after Supplier is able to reasonably determine there will be a delay; the report will be provided to UC by telephone, e-mail, or facsimile. Supplier will keep UC fully informed and will take all reasonable action in eliminating the cause of delay.

Rush Delivery Requirements. Supplier agrees to deliver UC emergency orders within four (4) hours after receipt of order at no additional charge to UC. Rush delivery orders for same day delivery must be requested by UC prior to 1:00 pm Pacific Time. Supplier cannot guarantee, but agrees to use good faith efforts to provide same day delivery for rush orders UC places after 1:00 pm Pacific Time.

Returns. Supplier agrees to accept Goods returned by UC if in resalable condition and if made within thirty (30) days of original shipment. Supplier must pick up returns from the ordering department location within two business days. Services under $20.00 do not need to be physically returned to Supplier.

Credit. Requests for credit can be transmitted by the ordering UC personnel via the established order management system (telephone, fax, paper return form, and web-based). Chargebacks and credit memos will be issued to UC ordering departments in the current month’s billing period. Return items will be credited at cost. If Goods were purchased via UC purchasing card, credit must be issued to the same purchasing card.

Revised 7/12/17 Page 6 of 7
Out of Stock Items. If there is an out of stock situation of any ordered inventoried item(s), the out of stock item will be added to the back order file and will be delivered to UC when the item is in stock without a further order being submitted.

Surveys. Supplier will, at UC’s request, conduct customer surveys of UC orders through questionnaires.

The content of these surveys will be approved by UC. UC will be responsible for the tabulation of these surveys.

12. Acceptance Criteria and Testing
[Buyer: Provide details of the Acceptance Criteria and testing which each Deliverable or Milestone must meet to be accepted, if specifics aren’t defined.]
a) [Buyer: Indicate any additional financial or other considerations resulting from acceptance testing]

13. Changes to the Services
UC may desire to change the Goods and/or Services following execution of an SOW. If so, UC will submit a written Amendment to Supplier describing the changes in appropriate detail. If an Amendment does not require Supplier to incur any additional material costs or expenses, then Supplier will make the modification within ten (10) business days of Supplier’s receipt of UC’s Amendment. If an Amendment does require that Supplier incur additional material costs or expenses, then Supplier in good faith will provide UC with a written, high level, non-binding assessment of the costs and expenses and the time required to perform the modifications required by the Amendment, within ten (10) business days of Supplier’s receipt of UC’s Amendment. UC will notify Supplier in writing within ten (10) business days after receipt of Supplier’s response to the Amendment as to whether UC wishes Supplier to implement the Amendment based on the response. UC will compensate Supplier for implementation of an Amendment in accordance with the terms and conditions of the relevant Amendment and Supplier’s response to the Amendment, if any. Supplier’s implementation of an Amendment will not delay the performance of Services and/or the delivery of deliverables not reasonably affected by an Amendment.

14. No Mandatory Use
Because there is no mandatory use policy at UC, nothing in this Statement of Work will be construed to prevent UC from entering into similar agreements with any third parties including, without limitation, suppliers that may be in competition with Supplier.

15. Additional Terms
[Buyer: If recording devices will be allowed, add the following: Supplier will use recording devices in discussions with UC employees only when UC and the employees so authorize; this authorization must be in writing. If applicable, Supplier's use of recording devices in such discussion is proposed as follows:
(Insert terms)]
Insurance Requirements [Buyer: insert terms, if needed or different from basic levels in T&Cs] Revised 7/12/17 Page 7 of 7
This Statement of Work is signed below by the parties’ duly authorized representatives.

THE REGENTS OF THE [SUPPLIER NAME]

UNIVERSITY OF CALIFORNIA
________________________________ ____________________________________ (Signature) (Signature)
________________________________ ____________________________________ (Printed Name, Title) (Printed Name, Title)
________________________________ ____________________________________ (Date) (Date)
OMNIA Discount Table
As of 6/3/2021
All prices in table presented as a discount off of MSRP Tier 1 Tier 2 Tier 3
Revenue of single order ($) 0-100K 100-350K 350K+
Cardio 30% 35% 40%
Group Exercise 25% 30% 35%
SciFit 25% 30% 35%
Insignia 25% 30% 30%
Signature B&R 25% 30% 30%
Signature PL 25% 30% 30%
Cable Motion 20% 25% 25%
Multi-Jungles 20% 25% 25%
Hammer Outdoor Box 20% 20% 20%
Hammer Select 25% 30% 30%
Hammer MTS 20% 25% 25%
Axiom/Optima 20% 25% 25%
Synrgy Core 25% 30% 30%
Syn Options 20% 25% 25%
Hammer PL/GB 15% 20% 20%
Hammer Racks/Rigs 20% 25% 25%
Wood Platforms 15% 20% 20%
Rubber Platforms 25% 30% 30%
Hammer B&R 15% 20% 20%
Strength Accessories 20% 25% 25%
LF Studio Collection 10% 15% 15%
LF Accessories 10% 15% 15%
Cybex Cardio 30% 35% 40%
Cybex Strength 25% 30% 30%
Billiards 35% 35% 35%
Digital Coach 0% 0% 0%
*All Extended Warranty and Preventative
Maintenance at 25%-43% off MSRP
The Regents
of
the University of California

REQUEST FOR PROPOSAL (RFP)
FOR
UC System-wide Fitness Equipment
RFP# 002295-DEC2020
Date Issued: 3/4/2021
It is the Supplier’s responsibility to read the entire document, any addendums and to comply with all requirements listed herein. Any addenda to this Request for Proposal will be directed to all participating Suppliers. It is the Suppliers responsibility to watch their e-mail for any addendums, notices, or changes to the RFP or process.

Issued By: The Regents of the University of California
RFP Administrator: Sean Parker, Acting Associate Director System-wide Procurement Services
Strategic Sourcing
University of California, Office of the President
1111 Franklin Street, 10th Floor
Oakland, CA 94607-5200
The information contained in this Request for Proposal (RFP) is confidential and proprietary to the University of California and is to be used by the recipient solely for the purpose of responding to this RFP.

TABLE OF CONTENTS
I. University of California Overview Page 1
II. Introduction to the Request for Proposal Page 2
III. Proposal Evaluation Methodology Page 4
IV. RFP Schedule Page 7
V. Supplier Requirements Page 7
VI. General Information Page 8
VII. Scope of Services Page 11
VIII. Questionnaires (CalUSource) Page 12
IX. Attachments Listed Page 13
1 SECTION I: UNIVERSITY OF CALIFORNIA OVERVIEW
A) Background
The University of California (“UC”), one of the largest and most acclaimed institutions of higher learning in the world, is dedicated to excellence in teaching, research, health care and public service. It is a public institution with annual resources of over $34 billion and encompasses ten campuses, six medical schools and five medical centers, four law schools and a statewide Division of Agriculture and Natural Resources. The University is also involved in the operation and management of three national laboratories for the U.S.

Department of Energy.

System-wide management of the University of California is assigned to the Office of the President based in Oakland, California. Its divisions oversee UC’s academic mission, budget, external relations, legal matters, and business and financial activities (including the UC Office of the Chief Investments Officer). The University is governed by a Board of Regents consisting of 26 members, 18 of whom are appointed by the Governor for 12-year overlapping terms.

Website: https://www.universityofcalifornia.edu/
Established: 1868
Fiscal Year: 07.01.XX - 06.30.XX
Official incorporated entity: The Regents of the University of California B) Recreation and Athletic Operations Summary
Each UC Campus has a combination of athletic training facilities and recreation centers dedicated to sports, recreation, and wellness. In addition to students, faculty and staff also participate in programs at these facilities and centers. It is anticipated that use of these facilities will increase which will in turn demand new equipment, maintenance and regular replacement equipment. These facilities manage large areas housing cardio and strength equipment; they allocate additional space to other disciplines including Pilates, yoga, massage, and group fitness.

Fitness equipment is purchased by UC campuses for:
• Replacement equipment for existing equipment that is older or that has a high failure rate
• Additional equipment for existing facilities
• Equipment for new, remodeled, or auxiliary facilities • New state of the art equipment for athletic focused departments The current estimated annual spend of UC fitness equipment products is $1,200,000.00 2 The above figure is provided as an annual estimate only to assist Suppliers in preparing proposals. The figure provided is indicative of the potential business volume and the complexity of the account. However, the University does not and cannot guarantee any specific quantities or business volume during the agreement period or any extensions thereto.

Currently, most UC locations have a Small Business Program in place for purchasing products and services from small and local businesses. The University will continue purchasing through its current Small Business Programs and these efforts are coordinated at the location level.

Most of the location’s central receiving docks can accommodate 45 ft. or larger delivery trucks; buildings without loading docks can accommodate 30-ft. and smaller delivery trucks.

SECTION II: INTRODUCTION TO THE REQUEST FOR PROPOSAL
The University of California’s overall objective of the RFP is to select a supplier or suppliers to assist UC in establishing the most cost effective and efficient procurement program for fitness equipment while maintaining high standards of quality and service. With that intent UC is interested in evaluating the costs and benefits of dealer and/or manufacturing partnerships for acquisition of fitness equipment focusing on cardio and strength training to UC locations.

This project was initiated to develop a supplier/UC alliance(s) and implement a UC system-wide program for fitness equipment that will provide maximum value to the University through superior equipment, enhanced variety, superior customer service, streamlined processes, maintenance, and lower total costs.

Qualified original equipment dealers and manufacturers are invited to submit proposals, based on the information provided in this RFP, to establish a business partnership with UC which will maximize the resources of both organizations to most effectively meet the fitness equipment needs of the University of California. The resulting awarded contract will consist of one term of five (5) years with the University’s option to renew five, one year extensions after the term is successfully completed (10 years total). The successful Supplier(s) shall be required to meet the requirements listed within this solicitation.

Qualified dealers and manufacturers are understood to have met the following requirements:

Dealers:

Previous experience with university/athlete clientele
Manufacturers:

Previous experience with university/athlete clientele, and Offer a minimum 5 year warranty on parts, services or a combination thereof 3 National Contract
The University of California, as the Principal Procurement Agency, defined in Exhibit A, has partnered with OMNIA Partners, Public Sector (“OMNIA Partners”) to make the resultant contract (also known as the “Master Agreement” in materials distributed by OMNIA Partners) from this solicitation available to other public agencies nationally, including state and local governmental entities, public and private primary, secondary and higher education entities, nonprofit entities, and agencies for the public benefit (“Public Agencies”), through OMNIA Partners’ cooperative purchasing program. The University of California is acting as the contracting agency for any other Public Agency that elects to utilize the resulting Master Agreement. Use of the Master Agreement by any Public Agency is preceded by their registration with OMNIA Partners (a “Participating Public Agency”) and by using the Master Agreement, any such Participating Public Agency agrees that it is registered with OMNIA Partners, whether pursuant to the terms of a Master Intergovernmental Cooperative Purchasing Agreement, a form of which is attached hereto on Exhibit C, or as otherwise agreed to. Exhibit A contains additional information about OMNIA Partners and the cooperative purchasing program.

OMNIA Partners is the largest and most experienced purchasing organization for public and private sector procurement. Through the economies of scale created by OMNIA Partners public sector subsidiaries and affiliates, National IPA and U.S. Communities, our participants now have access to more competitively solicited and publicly awarded cooperative agreements. The lead agency contracting process continues to be the foundation on which we are founded. OMNIA Partners is proud to offer more value and resources to state and local government, higher education, K-12 education and non-profits.

OMNIA Partners provides shared services and supply chain optimization to government, education and the private sector. With corporate, pricing and sales commitments from the Supplier, OMNIA Partners provides marketing and administrative support for the Supplier that directly promotes the Supplier’s products and services to Participating Public Agencies though multiple channels, each designed to promote specific products and services to Public Agencies on a national basis. Participating Public Agencies benefit from pricing based on aggregate spend and the convenience of a contract that has already been advertised and publicly competed. The Supplier benefits from a contract that generally allows Participating Public Agencies to directly purchase goods and services without the Supplier’s need to respond to additional competitive solicitations. As such, the Supplier must be able to accommodate a nationwide demand for services and to fulfill obligations as a nationwide Supplier and respond to the OMNIA Partners documents (Exhibit A, B, F, G).

The University of California anticipates spending approximately $12M over the full potential Master Agreement term for UC System-wide Fitness Equipment. While no minimum volume is guaranteed to the Supplier, the estimated annual volume of UC System-wide Fitness Equipment purchased under the Master Agreement through OMNIA Partners is approximately $36M. This projection is based on the current annual volumes among the University of California, other Participating Public Agencies anticipated to utilize the resulting Master Agreement to be made available to them through OMNIA Partners, and volume growth into other Public Agencies through a coordinated marketing approach between the Supplier and OMNIA Partners. 4 All products and services are subject to review and approval by the University.

SECTION III: PROPOSAL EVALUATION METHODOLOGY
Responsive Proposals will be evaluated using a Best Value method. Best Value means the most advantageous balance of price/cost, quality, service performance and other elements, as defined by the University. University evaluators will determine the Proposal’s value by scoring the Proposals based on a uniform set of weighted evaluation criteria. Each Proposal’s Best Value score will be the average of all evaluators’ total scores awarded for the Proposal. The University will have determined the Maximum Possible Price Score prior to the Proposal due date. The Proposal with the Maximum Possible Price Score will be considered the lowest responsive Proposal.

All other responsive Proposals will receive a proportion of the Maximum Possible Price Score equal to the quotient of the lowest Proposal’s cost divided by that Proposal’s cost. Each Proposal’s Price Score will be added to that Proposal’s Quality Point Score to get that Proposal’s Total Score. The Proposal with the highest Total Score will be considered the “Best Value”. The Proposal with the next highest Total Score will be considered the second Best Value, and so on. The University will then determine if the Supplier submitting the Best Value Proposal is responsible. The apparent RFP winner(s) will be the responsible Supplier(s) submitting the Best Value Proposal. The University’s selection may be made on the basis of the initial Proposals or the University may elect to negotiate with Suppliers who are selected as finalists. The Evaluation Team may utilize Supplier’s Oral Presentations, software demonstrations, additional material information, or References from the Supplier and others to come to a determination of award(s).

The University reserves the right to make evaluation decisions at its sole discretion. In performing its review of proposals, the University reserves the right to obtain and use in its evaluation any independently derived information including, but not limited to, financial reports and secondary customer references.

Right to Cancel/Modify
The University reserves the right to change any aspect of, terminate, or delay this RFP, the RFP process and/or the program outlined within this RFP at any time. Notice shall be provided in a timely manner thereafter. The University may award the contract without further discussion or may enter into negotiations with the apparent RFP winner. Should the apparent RFP winner fail to accept the award, the University may determine that that Supplier has abandoned its Proposal. The University may then enter into negotiations with the responsible Supplier submitting the second Best Value Proposal. If that Supplier fails to accept the award, the University may determine that that Supplier has abandoned its Proposal and enter into negotiations with the responsible Supplier submitting the third Best Value Proposal and so on to each successive responsible Best Value Supplier until an award is made and accepted.

The University may also conduct concurrent negotiations with responsible Suppliers for the purpose of altering or otherwise changing the conditions, terms and price of the proposed 5 contract unless prohibited. Suppliers shall be accorded fair and equal treatment in conducting negotiations and there shall be no disclosure of any information derived from proposals submitted by competing Suppliers.

Right to Make No Award
The University reserves the right to reject all Proposals and to make no award. Unless stated otherwise in this RFP, the University reserves the right to make multiple awards or to award items separately or in the aggregate as the interests of University may appear.

Minimum Criteria
Proposals will be screened as to whether the following minimum qualifications are met:
• The proposal must be submitted on time.
• The proposal includes all requested documents and has fully answered all required questions.
• Respondents must meet the following minimum criteria:
o DEALERS:
 Previous experience with university/athlete clientele with references o MANUFACTURERS:
 Previous experience with university/athlete clientele with references  Offer a minimum 5 year warranty on parts, services or a combination thereof
Evaluation Criteria
Qualification measurements may include, but are not limited to the following:

Dual Category Weighting (Dealer vs. Manufacturer)
Dealer Questionnaire Weighting
Section Weight
Company Information and Capabilities 10%
Sustainability 15%
Product Overview 35%
Services, Training and Warranties 10%
Pricing – Dealer Specific 30%
6 Manufacturer Questionnaire Weighting
Section Weight
Company Information and Capabilities 10%
Sustainability 15%
Product Overview 20%
Services, Training and Warranties 20%
Pricing –Manufacturer Specific 35%
Proposal Acceptance
Proposal must be complete and comply with all specifications and legal requirements set in this Request for Proposal.

The University reserves the right to reject any submittals which are:
• Incomplete or non-responsive
• Late (late proposals are immediately rejected)
If, at any time, it is found that a person, firm or corporation in their response to this RFP, or to which an Agreement has been awarded, has colluded with any other party or parties, the University reserves the right to reject the proposal(s) and/or terminate any Agreement(s) so awarded and all parties involved in the collusion shall be liable to the University for all loss or damages which the University may have suffered.
7 SECTION IV: RFP SCHEDULE
Event *Date
RFP Issue Date 3/4/2021 at 5:00PM PST
Supplier RFP Zoom Call
Email [email protected] for details 3/18/2021 at 11:00AM PST Supplier RFP Questions Deadline in CalUSource 3/24/2021 by 5:00PM PST UC Response to Supplier Questions (distributed to
all Suppliers without attribution on CalUSource) 3/31/2021 RFP Responses Due 4/15/2021 by 5:00PM PST
Anticipated Award Date 6/15/2021
Anticipated Start Date 6/16/2021
*The University does not guarantee the above schedule and reserves the right to modify this schedule at its discretion. ****Please mark off calendars***
**The UC reserves the right to conduct interviews with some or all of the Supplier’s at any point during the evaluation process. While presentations are anticipated for this project, the UC may determine interviews are not necessary. In the even interviews or presentations are conducted, information provided during the interview/presentation process shall be taken into consideration when evaluating the stated criteria. The UC shall not reimburse the Supplier for the costs associated with the interview process.

SECTION V: SUPPLIER REQUIREMENTS
The requirements shown below are essential to the UC for proposal consideration. Supplier’s failure to provide or be in compliance with any one or more of the following requirements will negatively impact the evaluation of Suppliers proposal and may result in disqualification. All required documents must be accepted before Suppliers can submit proposals on the CalUSource platform.

While this section may reflect the needs and requirements of the UC, OMNIA Partners Participating Public Agencies may have different requirements. The awarded Supplier(s) may enter into a supplemental agreement with Participating Public Agencies (PPAs) and PPAs may elect to negotiate certain terms to conform to their purchasing and contracting requirements.
a) The University of California Terms and Conditions of Purchase, dated 2/27/20, as referenced in Guidelines to this RFP, will be incorporated into any Agreement that may result from this RFP.
8 b) The University of California Appendix – Data Security and Privacy, dated 8/12/19, as referenced in Guidelines to this RFP, will be incorporated into any Agreement that may result from this RFP.
c) HECVAT example documentation and process acknowledgement d) All proposals shall remain available for UC acceptance for a minimum of 180 days following the RFP close date.
e) While Successful Supplier(s) awarded a national contract shall be required to sign the UC’s Master Agreement and OMNIA Partners Administration Agreement, if Respondents have any additional or separate Service Agreements that they would require the UC or Participating Public Agencies to sign, Respondents shall provide those Service Agreements as part of their response. See the referenced question in the Company Information Questionnaire.
f) No late proposals will be accepted. Any proposals received after the specified deadline for submission shall result in automatic disqualification.

SECTION VI: GENERAL INFORMATION
A. Issuing Office and Communications Regarding the RFP
This RFP, and any subsequent addenda to it, is being issued by the System-wide Procurement Services Department on behalf of The University of California Office of the President. The System-wide Procurement Services Department is the sole point of contact regarding all procurement and contractual matters relating to the requirements described in this RFP. System-wide Procurement Services is also the only office authorized to change, modify, clarify, etc., the specifications, terms, and conditions of this RFP and any Agreements(s) awarded as a result of this RFP.

Any requests for clarification concerning this RFP must be submitted via the CalUSource platform, under the Discussion Forum icon .

The submission of RFP response, pricing proposal and attachments must be submitted via the CalUsource e-Sourcing application, as further detailed in the “Instructions for Submitting Proposals” below.

Suppliers are advised that failure to adhere to the above communications requirements may result in disqualification.

B. Supplier RFP Zoom Call
Suppliers are welcome to join a Supplier RFP Zoom call hosted on Thursday, March 18th 2021, at 11:00am PST. Please email [email protected] for details and a log in link. This call will review the function of the CalUSource platform and how to submit proposals. While the purpose of this conference will be to clarify the CalUSource platform utilization, any 9 content questions for this Request for Proposal shall be submitted via the process described below. Oral statements or instructions on the call will not constitute an Addendum to this Request for Proposal.

C. Instructions for Submitting Proposals
Proposals in response to this RFP must be submitted online using the CalUsource e-Sourcing application no later than April 15th, 2021 at 5:00 p.m. (PT).

Please review the CalUSource Resource Guide for any questions regarding operation of the RFP platform and submitting proposals.

Suppliers are to complete the questionnaire sections directly in the CalUSource eSourcing application. ****CalUsource requires significant time for accurate data entry. Suppliers are encouraged to review the Resource Guide and familiarize themselves with the process of responding, leaving adequate time to submit the proposal. General information and support is available by email: [email protected]; or, for CalUsource technical issues, contact GEP Support: 1-732-428-1578 or [email protected]. Please identify yourself as registering in the University of California network.**** Suppliers must provide a complete, straightforward, concise response to all prerequisites, questions and information in the RFP as detailed. Do not reference previous answers as the submission for questions (i.e. “Please see response to question 5a”). Submission of a proposal via the CalUsource e-Sourcing application confirms Supplier’s understanding and acceptance of all requirements, terms, and conditions of the RFP.

Supplier must not provide superfluous materials such as marketing materials or website links in response to, or in lieu of, specific responses to the questions herein, and may be disqualified for providing superfluous materials.

D. Addenda to the Request for Proposal
Any changes, additions, or deletions to this RFP will be in the form of written Addenda issued by the University of California via email or the CalUsource e-Sourcing application. The University will not be responsible for failure of any prospective Supplier to receive such Addenda. All Addenda so issued shall become part of this RFP.

E. Supplier Questions
An opportunity to submit questions will be allowed up to 5pm (PT), March 31st, 2021.

Note: All Supplier questions will be shared with all RFP participants, without attribution, on the CalUSource platform under the Discussion Forum icon . Email responses will not be provided.

F. Proposal Acceptance
The proposal must be completed and submitted via the CalUSource e-Sourcing application on the forms provided or in the format indicated herein.
10 All documents submitted to the UC on behalf of this RFP will become the exclusive property of the UC system and will not be returned.

G. Proposal Format
Proposals should demonstrate a clear understanding of the Scope of Services and contain a comprehensive discussion of how the Supplier will fulfill the requirements of the Scope of Services, including a discussion of the important features and Supplier attributes, highlighting any aspects, which separate it from its competitors. The UC reserves the right to make additional investigations as it deems necessary to establish the competence and financial stability of any Supplier submitting a proposal. Additionally, to comprehensively evaluate the proposals received, the UC may seek additional information or clarification from one or more of the Suppliers. Experience with the UC and entities that evaluation committee members represent may be taken into consideration when evaluating qualifications and experiences.

The proposal should be submitted using the appropriate response templates provided on CalUSource:

1. Company Information Questions

2. Sustainability Questions

3. Product Overview

4. Services, Training and Warranty Offerings

5. Pricing (Dealer or Manufacturer)
H. Proposal Preparation Costs
Supplier will bear all costs incurred in the preparation and submission of the Proposal and related documentation, including Supplier’s presentation to UC. If Supplier is apparent awardee, Supplier will bear its own costs in negotiating and finalizing an agreement with the University.

I. Agreement Term
It is anticipated that the initial term of any Agreement awarded pursuant to this RFP will be for a period of five (5) years. UC may, at its option, extend or renew the Agreement for five additional one-year periods on the same terms and conditions. As previously stated, the successful Supplier(s) shall also have the right to enter local “service” agreements with Participating Public Agencies accessing the contract through OMNIA Partners, so long as the effective date of such agreement is prior to the expiration of the Contract. All local agreements may have a full potential term (any combination of initial and renewal periods) not to exceed ten (10) years. Any purchase orders executed against this Master Agreement during the effective term may survive beyond the expiration of the Master Agreement as established and agreed to by both parties.
11 SECTION VII: SCOPE OF SERVICES
Deliverables: Suppliers are to provide responses in the RFP under the following questionnaire categories. The following categories focus on key points in a partnership between a supplier and the UC around fitness equipment purchases and ownership opportunities.

I. Company Information Questions:

Suppliers shall submit responses with information covering general firm structure, financial records, locations for California and national coverage, previous experience and client references.

As detailed in the Company Information Questionnaire, Respondents are to provide a detailed response to Exhibit A, OMNIA Partners Response for National Cooperative contract which will be utilized in the evaluation process to access the national capabilities of Respondents.

II. Sustainability Questions:

Responses to the sustainability questionnaire should focus on the firm, its processes and products through a sustainability lens. These include employment strategies, business certifications, and operations within the company.

III. Product Overview Questions:

Successful Supplier(s) shall provide products focused on cardio and strength training equipment utilized in recreational and/or high performing athletic gyms. This section covers product offerings, product details, replacement parts and customization.

IV. Services, Training and Warranties Questions:

Suppliers are asked to detail their service, training and warranty options available to the UC or a Participating Public Agency. Questions focus on available resources for service, education, warranty terms and logistics.

V. Pricing:

The successful Supplier(s) shall provide a complete set of pricing information for the products under the categories “Cardio Equipment” and/or “Strength Training Equipment”.

These pricing questions are broken into two modules focused on Dealer or Manufacturer business structures. The pricing schedule supplied shall reflect “National” pricing, regardless of participating campuses or participating Public Agencies. The prices quoted in the proposal response by the successful Supplier(s) shall be the UC net price for the various services/materials. For items in the bid pricing submitted, there shall be no separate or additional charges, fees, handling or other incidental costs following contract 12 award; Participating Public Agencies may make exceptions to this based on their own circumstances.

Special Offers/Promotions
In addition to decreasing prices for the balance of the Contract term due to a change in market conditions, Contractor may conduct sales promotions involving price reductions for a specified lesser period. Contractor may offer Participating Agencies competitive pricing which is lower than the not-to-exceed price set forth herein at any time during the Contract term and such lower pricing shall not be applied as a global price reduction under the Contract.

Product Offering/Balance of Line Pricing
Pricing for complete product offering/balance of line items will be determined by a percentage discount off retail. The pricing percentage discount offered must be entered in the Pricing section of the Supplier’s response.

SECTION VIII: QUESTIONNAIRE(S)
Refer to the CalUsource e-Sourcing application to complete the Questionnaire section(s) of the proposal.

There are five (5) questionnaire categories that need to be completed in total. Dealers and Manufacturers, please select and submit the pricing module questionnaire that best reflects your firm’s designation.

1. Company Information Questions

2. Sustainability Questions

3. Product Overview Questions

4. Services, Training and Warranty Offerings

5. FOR MANUFACTURERS – Pricing
FOR DEALERS – Pricing
All questions must be answered as part of the proposal. If the response requires an attachment (do not submit sales brochures), add the attachments in the question directly or the Attachment Section of the CalUsource eSourcing tool and reference the question number in the title of the document.

Suppliers shall respond to the aforementioned questionnaires in order to be considered for evaluation. Failure to answer the following questions could result in disqualification.
13 SECTION IX: ATTACHMENTS

1. UC Terms and Conditions of Purchase dated 2-27-20

2. UC Required Supplier Information dated 8-5-19

3. UC Appendix Data Security and Privacy dated 4-12-19

4. HECVAT Example Documents

5. Supplier Bidding Guide for CalUSource

6. _Omnia Partners – Exhibit Descriptions for CalUSource

7. Omnia Partners - Exhibit A - Response for National Cooperative Contract

8. Omnia Partners - Exhibit B – Administration Agreement Example

9. Omnia Partners - Exhibits C – Master Intergovernmental Cooperative Purchasing Agreement Example

10. Omnia Partners - Exhibit D – Principal Procurement Agency Certificate Example

11. Omnia Partners - Exhibit E – Contract Sales Reporting Template

12. Omnia Partners - Exhibit F – Federal Funds Certifications Form

13. Omnia Partners - Exhibit G – New Jersey Compliance Form

14. Omnia Partners - Exhibit H – Advertising Compliance Requirement 002295-Dec2020-Fitness Equipment RFP - UC System-wide
Questionnaire Level - Supplier Summary
Questionnaire Name Questionnaire Supplier Name Total Questionnaire My Score Total Questionnaire QuestionCoverage Company Information Commercial Life Fitness, LLC 4.28 - 30 30 100 Sustainability Technical Life Fitness, LLC 2.75 - 18 18 100 Product Overview Technical Life Fitness, LLC 3.74 - 18 18 100 Services, Training and Warranty Offerings Commercial Life Fitness, LLC 3.73 - 19 19 100 FOR MANUFACTURERS- Pricing Commercial Life Fitness, LLC 3.7 - 8 8 100 FOR DEALERS - Pricing Commercial Life Fitness, LLC 1.34 - 8 - 0 Questionnaire Name: *
Questionnaire Type:

Questionnaire Description:

SECTION NAME QUESTION NUMBER QUESTION TITLE QUESTION WEIGHT RESPONSE OPTIONS Life Fitness, LLC General Company
Information 1
* Full name; Legal
and Trade Name - - Life Fitness, LLC
General Company
Information 2
*
AuthorizedNegotiat
or(nameandemail
addressofaperson(s)
inyourorganizationa
uthorizedto
negotiate contract
terms and render
binding decisions on
contract matters)
- - Teresa Linscott [email protected]
General Company
Information 3 * Address - - 10601 Belmont Avenue, Franklin Park, IL 60131 002295-Dec2020 - Fitness Equipment RFP - UC System-wide Company Information
General company information
Commercial
Questionnaire Name: *
Questionnaire Type:

Questionnaire Description:

SECTION NAME QUESTION NUMBER QUESTION TITLE QUESTION WEIGHT RESPONSE OPTIONS Life Fitness, LLC 002295-Dec2020 - Fitness Equipment RFP - UC System-wide Company Information
General company information
Commercial
General Company
Information 7
* Indicate Entity
Type; partnership,
corporation,
individual, etc.
- - C Corp, limited liability company
General Company
Information 8
* Public or Private
Company - - private
General Company
Information 9
* Date Company
Founded - -
1968 under Lifecycle name, then renamed Life Fitness in 1987. Life Fitness grew out of Dr. Keene Dimick's technological marvel. Health club owner Ray Wilson bought the rights to the bike from Dr. Dimick in the early 1970s. Wilson and co-founder Augie Nieto created Lifecycle Inc., which eventually became Life Fitness.

Life Fitness hasn't forgotten Dr. Dimick's innovative spirit. For five decades we've crafted state-of-the art cardio and strength equipment that shares some of the DNA of that original Lifecycle. We've taken Dr. Dimick's vision and continuously evolved. It's hard to gauge just much influence the bike has had on today's fitness industry. But the large cardio areas in health clubs certainly would look a lot different if the Lifecycle never came to be.

In June of 2019, Life Fitness was purchased by KPS and is now a privately held company.

Questionnaire Name: *
Questionnaire Type:

Questionnaire Description:

SECTION NAME QUESTION NUMBER QUESTION TITLE QUESTION WEIGHT RESPONSE OPTIONS Life Fitness, LLC 002295-Dec2020 - Fitness Equipment RFP - UC System-wide Company Information
General company information
Commercial
General Company
Information 10
* State of
Incorporation or
Formation
- - Delaware
General Company
Information 11
* List of branch
offices or other
subordinate
elements that will
perform or assist in
performing work
herein
- -
Our corporate headquarters is located in Franklin Park, IL. Life Fitness has employs field sales and service personnel who remotely nationwide. The Life Fitness Authorized Dealer Network is comprised of 13 dealer locations throughout the US and Canada. These local and regional dealer teams have the capabilities and experience to handle large, complex projects consistently, and ensure complete customer satisfaction. Our dealers bring a wealth of knowledge as many of the upper management have been in the industry for over 20 years an in their respective territories for over 20 years. Since many have been in their geographic locations for so many years, they offer local knowledge, local contacts long standing relationships and other services that may include providing service, preventative maintenance, technical support, and more to satisfy customer projects and high expectations. Our three Platinum Dealers in the US and one in Canada each utilize their own sales and services force. This type of scalability helps our platinum dealers meet the stringent Life Fitness sales quotas required to maintain their preferred status. In fact, the three Platinum Dealers in the US have been so successful in meeting these sales goals that they have been a Life Fitness Family of Brands dealer for over 25 years each, and one of them, Advanced Exercise, covers the UC schools in Southern California. The other 10 dealers maintain a high level of accountability as well– supported closely by Life Fitness – to provide Members with the specific services they require. As experienced business owners, these dealers recognize that they can only be successful by fully meeting our expectation and exceeding their customers’ expectations. The entire Life Fitness dealer network is committed to providing Sourcewell Members exemplary service in their local marketplace. We ensure this high level of customer satisfaction by appointing a team of direct Life Fitness liaisons to thoroughly assesses each candidate, including the principal owner(s) of the business and proposed management team, before appointing them as an Authorized Life Fitness Dealer. Once appointed to be part of our Authorized Dealer Program, the Life Fitness team of liaisons monitors performance throughout the year and dealers must meet year end performance goals in order to maintain their accreditation. The Life Fitness liaison management team conducts annual formal sessions with dealer management to identify any training or resource needs.

With over 100 dealer representatives in their respective territories, our Life Fitness Dealer team in the US and Canada create exceptional value to our company.

They are an integral part of our sales team and play an important role in meeting our sales forecast annually. They also have and will continue to leverage our Sourcewell contract to deliver products and service to its members. Please see attached...

Attached Files : Dealer Distibution and Factory Maps.pdf General Company
Information 12
* Do you intend to
use subcontractors?
If yes, provide the
name, address, and
phone number of
any subcontractor
that you will obtain
via contract to
perform any portion
of work proposed in
this RFP.
- - Life Fitness uses approved subcontractors for our delivery and installation services.

Attached Files : List of LFI providers.xlsx
Questionnaire Name: *
Questionnaire Type:

Questionnaire Description:

SECTION NAME QUESTION NUMBER QUESTION TITLE QUESTION WEIGHT RESPONSE OPTIONS Life Fitness, LLC 002295-Dec2020 - Fitness Equipment RFP - UC System-wide Company Information
General company information
Commercial
General Company
Information 13
Do you require
background checks
of subcontractors?
Whattraining do you
provide to these
subcontractors?
- - We require background checks and drug screening. We provide training to all delivery personnel.

Operational Company
Information 14
* Do you outsource
any administrative
services to a thirdparty provider?If so,
provide details.
- - No
Operational Company
Information 15
* Submit audited
financial statements
for the past two (2)
years in order to
establish financial
viability.
- -
Life Fitness a privately held company, and as such we do not not share our annual sales information or Dunn & Bradstreet report as we consider both to be confidential and proprietary information. The requested information can be provided once we have been notified of contract award and an NDA is in place between Omnia, the University of California and Life Fitness.

Questionnaire Name: *
Questionnaire Type:

Questionnaire Description:

SECTION NAME QUESTION NUMBER QUESTION TITLE QUESTION WEIGHT RESPONSE OPTIONS Life Fitness, LLC 002295-Dec2020 - Fitness Equipment RFP - UC System-wide Company Information
General company information
Commercial
Operational Company
Information 16
* Provide your
organization's Dun
and Bradstreet
(DUNS) number.
- - 11-693-2584
Operational Company
Information 17
* Has your
organization
experienced recent
merger or
acquisition activity,
or has any such
pending activity
been publicly
disclosed? If so,
describe, specifically
addressing any
reorganization or
operational changes
that would affect
your product or
services.
- - No
Operational Company
Information 18
* Are there any
recent or
anticipated changes
in your
organizational
structure (e.g. key
personnel,
consolidation of
operations, new
service centers) that
would impact UC.

Include a project
plan and timeline if
applicable.
- - no
Questionnaire Name: *
Questionnaire Type:

Questionnaire Description:

SECTION NAME QUESTION NUMBER QUESTION TITLE QUESTION WEIGHT RESPONSE OPTIONS Life Fitness, LLC 002295-Dec2020 - Fitness Equipment RFP - UC System-wide Company Information
General company information
Commercial
Operational Company
Information 19
* Is any litigation
pending against your
organization?If so,
give details.
- - No
Operational Company
Information 20
* Has your company
ever filed for
bankruptcy? If so,
when and what is
the current status of
your filing?
- - No
Operational Company
Information 21
* Provide the
following
information relative
to your current
Book of Business:

A.) Total Clients
B.)Total Clients with
similar size as the
UC

25.00% -
A) Over the past 3 years the Life Fitness family of brands have successfully done business with close to 1000 Colleges and Universities spanning all divisions both public and private across the United States. The industries that we serve cover all market segments including but not limited to municipalities, corporations, hospitality, multi housing, military, government, YMCAs, non-profit, and clubs. The client list for all of these markets over the past 50 years would far exceed any of our competitors as we are the largest and most successful fitness manufacture in the industry. B) There are approximately 57 public University Systems across the United states. All of which consist of multiple Universities much like the UC System. Life Fitness has confidently done business with at least one entity in each of the systems throughout the course of our 50 year existence. Some of the systems most similar to the size and scope of the UC system would include but not be limited to The University of Alabama System, The State University System of Florida, The University System of Georgia, University of Illinois System, Indiana University System, Louisiana State University System, University of Michigan, University of North Carolina, University of Texas System, and University of Wisconsin System.

Questionnaire Name: *
Questionnaire Type:

Questionnaire Description:

SECTION NAME QUESTION NUMBER QUESTION TITLE QUESTION WEIGHT RESPONSE OPTIONS Life Fitness, LLC 002295-Dec2020 - Fitness Equipment RFP - UC System-wide Company Information
General company information
Commercial
Operational Company
Information 22
* Describe your
company experience
with customers in
Higher Education
and/or academic
medical centers.

Please also
reference your
experience
withPower 5,
collegiate
athleticsprograms.

25.00% -
Life Fitness is the longest standing commercial fitness equipment provider globally. For over (50) years, we have provided premium fitness equipment and services to our customers around the world, here in the US and more specifically in Higher Education, academic medical centers and athletic programs. Life Fitness has equipment divisions that focus on a variety of needs which include cardiovascular, strength training, group training and functional training for the higher education market. Sci Fit specializes in rehab, active ageing, and the disabled; Cybex focuses on medical wellness; and Hammer Strength, a performance division, which focuses on athletics and training. No other fitness equipment supplier has access to these types of products and divisions under one umbrella which it is key to our education customers, academic medical centers, and athletic programs. We have been able to match that portfolio of brands with a combination of incredible products that resonate with users and operators, along with the largest and most experienced sales, service and manufacturing experts in the industry. On our education & athletics team we have account managers that have been in the industry for a combined tenure of over 100 years with experience outfitting multiple Power 5 Athletic performance facilities, and campus recreation facilities around the country. We believe in doing what we do best and surrounding ourselves with partners and colleagues that bring a fresh perspective to our business. Life Fitness has proven that we are not afraid of change, of adapting and becoming more than just a company that manufactures fitness equipment. We feel our greatest value add comes from the fact that we have a very comprehensive product portfolio of core fitness training products with a very powerful reputation for performance and quality. Life Fitness is innovative in the use technology to support our products, such as the On Demand cardio classes across our premium consoles, the Digital Coach instructional video's for strength and athletic training, connected strength and the Halo Fitness cloud for users and operator's. Life Fitness is dedicated to helping students, athletes, and people in general live healthier lives, no matter where they may be.

Operational Company
Information 23
* Summarize in 500
words or less the
following: why you
are a match for UC,
how are you a
match for other
Participating Public
Agencies,and why
UC should select
your organization
over your
competitors.

Emphasize how you
are different from
your competitors.

25.00% -
Life Fitness is the longest standing commercial fitness equipment provider globally. We have an unrivaled portfolio of products across all 6 brands, namely Life Fitness, Hammer Strength, Cybex, ICG (indoor cycles), SciFit (special population and active aging), and Brunswick (recreation products). Life Fitness is a forward thinking company with a strong focus on connected fitness (eg, Discover premium tablet consoles, Halo fitness cloud, Digital Coach, Life Fitness On Demand, etc.).

Operational Company
Information 24
* If Supplier is a
current or previous
UC Service Provider,
give the agreement
term dates,
agreement number,
contracting
department,
services provided
and agreement
revenue of
agreement(s) for the
prior five (5) years.
- - Participation Agreement for NJPA (Sourcewell), Effective 12/19/2017 though 9/30/2020, Purchase of Fitness Equipment, Commodity Manager, Adrian Ferreira, Volume to be provided upon award of contract.

Questionnaire Name: *
Questionnaire Type:

Questionnaire Description:

SECTION NAME QUESTION NUMBER QUESTION TITLE QUESTION WEIGHT RESPONSE OPTIONS Life Fitness, LLC 002295-Dec2020 - Fitness Equipment RFP - UC System-wide Company Information
General company information
Commercial
Operational Company
Information 25
* Provide the
primary contact
information for the
person responsible
for your proposal.

Include name, title,
address, phone
number, and email
address.
- - Allan Franks, Senior Territory Manager, Northern California (home-office Morgan Hill, CA) 916-205-5378 [email protected] Jeremy Wilson, National Sales Manager, Education/Athletics, 9525 Bryn Mawr Ave, Rosemont, IL, 60018, 813-480-4300, [email protected] Operational Company
Information 26
* Are any of the
members of your
Board of Directors,
officers, employees,
or consultants
affiliated with UC?If
so, describe the
relationship.Are any
of these individuals
responsible, in
whole or in part, for
the preparation of
your proposal or
would they have any
decision-making role
if your company
were awarded the
bid?
- - no
Operational Company
Information 27
* Provide three (3)
current client
references and two
(2) terminated client
references.Provide
the company name,
individual name,
title and contact
information, and the
dates the client
is/was
active.Priority
should be given to
California clients.
- -
1) University of California, Berkeley, 2301 Bancroft Way, Berkeley, CA 94720, Contact: Devin Wicks, Associate Director, 510.643.7158, [email protected]; 2 San Jose State University, 290 South 7th Street, San Jose, CA 95192, Contact: Caryn Collopy, Director, 408.924.6345, [email protected]; 3) Stanford University, 341 Galvez Street, Stanford, CA 94305, Contact: Eric Stein, 650.862.4273, [email protected]; Over the course of 50 years Life Fitness has been fortunate not to have been terminated as a vendor from any of our municipal accounts and we take great pride in that accomplishment. Since we do not have any terminated customers, an additional two references from other parts of the country will be listed as follows 1) Auburn University, 601 Heisman Drive, Auburn, AL 36849, Contact: Scott Harper, Associate Director, 334-740-7723, [email protected]; 2) Arizona State University, 330 N. 1st Ave, Phoenix, AZ 85003, Contact: Courtney Smith, Associate Director, 602-496-7787, [email protected] Questionnaire Name: *
Questionnaire Type:

Questionnaire Description:

SECTION NAME QUESTION NUMBER QUESTION TITLE QUESTION WEIGHT RESPONSE OPTIONS Life Fitness, LLC 002295-Dec2020 - Fitness Equipment RFP - UC System-wide Company Information
General company information
Commercial
Operational Company
Information 28
* Have you provided
a detailed response
to the national
program (Omnia
Exhibit A)?
Responses should
highlight experience,
demonstrate a
strong national
presence, describe
how offeror will
educate its national
sales force about
the contract,
describe how
products and
services will be
distributed
nationwide, include
a plan for marketing
the products and
services nationwide,
and describe how
volume will be
tracked and
reported to OMNIA
Partners.

25.00% Yes; No Yes
Operational Company
Information 29
* Have you
reviewedOmnia
Partners Exhibit
B?The Successful
Supplier(s) will be
required to sign
Exhibit B, OMNIA
Partners
Administration
Agreement.

Suppliers should
have any reviews
required to sign the
document prior to
submitting a
response. Supplier’s
response should
include any
proposed exceptions
to the OMNIA
Partners
Administration
Agreement.
- Yes; No Yes
Operational Company
Information 30
Does your firm have
additional or
separate Service
Agreements that are
required for the UC
or Participating
Public Agencies to
sign? If so, please
attach those
documents for
review.
- - Yes
Attached Files : Securing Strength Product Acknowledgement v6.pdf Questionnaire Name: *
Questionnaire Type:

Questionnaire Description:

SECTION NAME QUESTION NUMBER QUESTION TITLE QUESTION WEIGHT RESPONSE OPTIONSLife Fitness, LLC Company Information 1
Is your company certified in the
State of California or other U.S.

State as a SBE, DBE, WBE, MBE,
VBE, or DVBE? Please submit
requisite certification
documentation.

5.57%
Small Business
Enterprise (SBE);
Disadvantaged
Business
Enterprise (DBE);
Women-owned
Business
Enterprise (WBE);
Minority Business
Enterprise (MBE);
Veteran-owned
Business
Enterprise (VBE);
Disabled VeteranOther
Attached Files : Sustainability Question 1.docx
Company Information 2
Do you have a Corporate Social
Responsibility (CSR)
statement/policy/code of conduct
or equivalent?

5.56% Yes; No; In
Progress Yes
Company Information 2.1 If Yes ,Is it publicly available? N/A - Yes Company Information 2.2
If Yes ,Please provide an
information link. If not publicly
available, please provide a copy
with your response.

N/A - Please see attachment
Attached Files : Life Fitness Corporate Social Responsibility Statement 2021.pdf Company Information 3
How do you monitor/manage your
supply chain to ensure that
suppliers/providers comply with
and support your CSR efforts?

5.56% - All of our suppliers/providers are provided with, and expected to comply with, the Life Fitness Supplier Code of Conduct. This document establishes Life Fit responsibilities. See attached.

Company Information 4
Describe how your company
supports its employees by
providing living wages and
benefits.

5.56% - At Life Fitness, our employees are our most important asset, that’s why we offer employees competitive wages and a package of benefits to promote physica Company Information 5
Describe your employee
healthcare and other benefits
provided to your employees.

5.56% - We offer healthcare benefits which include comprehensive medical, dental, and vision programs, as well as employee assistance programs to ensure our em top priority.

Company Information 6
Does the company engage only
contractors/business partners
which adhere to all applicable
local, state and federal labor and
employment requirements
relating to, e.g., wage payment,
anti-discrimination/harassment,
equal opportunity, family and
medical leave, and other
applicable provisions?

5.56% - We only engage those subcontractors/business partners who meet and adhere to all applicable local, state and federal labor and employment requirements discrimination/harassment, equal opportunity, family and medical leave, and other applicable provisions. We require all of our business partners to adhere t Company Information 7
Does your company maintain clear
diversity goals, such as with regard
to women, veterans, and
minorities, and engage in active
diversity efforts toward
recruitment and retention as well
as development and
advancement? Please provide at
least two examples

5.56% -
It is the policy of Life Fitness and its divisions to employ qualified persons of the greatest ability without discrimination against any employee or applicant fo or mental disability, national origin, age, transgendered, sexual orientation, status as a protected veteran, or any other protected group status and, further, t advance in employment qualified minorities, women, persons with disabilities, or protected veterans. We reaffirm and reemphasize that this policy applies t locations.

The Company has established Affirmative Action Plans by which we undertake that:
(1) We recruit, hire, train, and promote qualified persons in all job titles, without regard to race, color, sex, physical or mental disability, national origin, a protected group status.
(2) We base decisions on employment so as to further the principle of equal employment opportunity. (3) We ensure that employment decisions are in accord with principles of equal employment opportunity by imposing only valid job requirements Company Information 8
Describe in general terms how
your company supports your local
community and regional
businesses and markets. Provide
documents, when available, such
as your company’s economic
policies, specific examples
outlining past activities, or other
information that describes your
company’s commitment to
supporting these economies

5.56% - We make every effort to ensure that all small and local business have an equitable opportunity.

Company Information 9
What percentage products and
services for the company’s
operation do small and diverse
suppliers provide?

5.56% -
Small Business: 76.1%
Small Disadvantaged Business: .5%
Women Owned Small Business: 3.5%
HubZone Small Business: 1.8%
Veteran-Owned Small Business: 1.1%
Company Information 10
Please provide a detailed
description of all small and diverse
business classifications you track
(examples include: Small Business
Enterprises, Disadvantaged
Business Enterprises, Womenowned Business Enterprises, Service Disabled Veteran-owned
Business Enterprises etc )

5.56% - We track all Small Business Enterprises, Disadvantaged Business Enterprises, Women-owned Business Enterprises, Service Disabled Veteran-owned Business Operations 11
Describe specifically how your
company will incorporate
environmentally conscious
business practices into the
delivery of the requested services
of this project. Explain how these
results will be reported to the UC.

5.56% - See attached Life Fitness Environmental Sustainability 2021 Operations 12
Does your company responsibly
dispose of old equipment and
electronics at the end of its useful
life (i.e., through an e-Steward
certified recycling partner, self
performed recycling measures)?

5.56% Yes; No Yes
Operations 13
Describe your company’s ability to
reduce impacts from travel and
meetings as part of service
delivery.

5.56% - See attachment Life Fitness Environmental Sustainability 2021 Operations 14
Does your company have a
sustainable travel policy that
encourages or requires using the
lowest impact transport method
when multiple options are
available?

5.56% Yes; No Yes
Operations 15
Does your company have a
sustainable travel policy that
encourages or requires using
public transportation, bicycling, or
walking for short-distance trips?

5.56% Yes; No Yes
002295-Dec2020 - Fitness Equipment RFP - UC System-wide Sustainability
Technical
Questionnaire Name: *
Questionnaire Type:

Questionnaire Description:

SECTION NAME QUESTION NUMBER QUESTION TITLE QUESTION WEIGHT RESPONSE OPTIONSLife Fitness, LLC 002295-Dec2020 - Fitness Equipment RFP - UC System-wide Sustainability
Technical
Operations 16
Does your company provide
subsidized public transportation
options for all employees, as well
as incentivize and facilitate
employee participation in other
alternative forms of work
commuting such as membership in
bike-shares, free bicycle parking
and shower/locker facilities etc ?

5.56% - Life Fitness has employees who work at our offices, our factories, and from their homes. We allow the latter whenever possible. Responsible decisions are e environmental sustainability as well as cost-savings and physical health.

Operations 17
Is your company an EPA registered
SmartWay Partner or Affiliate
(https://www.epa.gov/smartway/
meet-smartway-partners-andaffiliates), or do you work with companies who are registered?
Provide a link certifying your
affiliation

5.56% - Life Fitness is not EPA SmartWay certified.

Operations 18
The UC has a ban on the
procurement of expanded plastic
foam materials (such as Expanded
Polystyrene (EPS), Expanded
Polyethylene (EPE), Expanded
Polyurethane and expanded
plastic foam hybrids) other than
those used for medical or
laboratory supply, by 2020. Please
describe your company's current
utilization of these materials in its
packaging, and how your company

5.56% -
Life Fitness's packaging is 90% recyclable and our corrugate is 100% recyclable and is done so upon installation. We are currently in the process of redesignin as we look to build our products in a more completed state. This means less waste including corrugate, plastic bags, foam, etc. and also less transportation o above, another initiative in the packaging redesign effort is to develop reusable materials in support of sustainability. This program was launched earlier in 2 Questionnaire Name: *
Questionnaire Type:

Questionnaire Description:

SECTION NAME QUESTION NUMBER QUESTION TITLE QUESTION WEIGHT RESPONSE OPTIONSLife Fitness, LLC - 1
Does your firm's
experience and
offering typically
focus on general
fitness
equipment,high
performing athletes
or both?

7.14%
Recreation/General
Fitness Focus; High
Performing Athlete
Focus; Both
Both
- 2
Provide a count of
equipment models
your firm can offer
focused around
cardio and strength
training for
recreational
gyms,high
performing
collegiate athletes
or both. Please
enter quantities for
model counts under
respective category
columnsor the both

7.15%
Selectorized -
Recreational
Equipment
See product line attachments for Life Fitness, Hammer Strength, Cybex, and SciFit - 2
Provide a count of
equipment models
your firm can offer
focused around
cardio and strength
training for
recreational
gyms,high
performing
collegiate athletes
or both. Please
enter quantities for
model counts under
respective category
columnsor the both

7.15%
Selectorized - High
Performing Athlete
Equipment
See product line attachments for Life Fitness, Hammer Strength, Cybex, and SciFit - 2
Provide a count of
equipment models
your firm can offer
focused around
cardio and strength
training for
recreational
gyms,high
performing
collegiate athletes
or both. Please
enter quantities for
model counts under
respective category
columnsor the both

7.15% Selectorized - Both Family of Brands: LF & Cybex suited for rec, Hammer Strength suited for athletics, over 100 combined - 2
Provide a count of
equipment models
your firm can offer
focused around
cardio and strength
training for
recreational
gyms,high
performing
collegiate athletes
or both. Please
enter quantities for
model counts under
respective category
columnsor the both

7.15%
Plate Loaded -
Recreational
Equipment
See product line attachments for Life Fitness, Hammer Strength, Cybex, and SciFit - 2
Provide a count of
equipment models
your firm can offer
focused around
cardio and strength
training for
recreational
gyms,high
performing
collegiate athletes
or both. Please
enter quantities for
model counts under
respective category
columnsor the both

7.15%
Plate Loaded - High
Performing Athlete
Equipment
See product line attachments for Life Fitness, Hammer Strength, Cybex, and SciFit 002295-Dec2020 - Fitness Equipment RFP - UC System-wide Product Overview
Questions focused on product offering, specifications, as well as pricing.

Technical
Questionnaire Name: *
Questionnaire Type:

Questionnaire Description:

SECTION NAME QUESTION NUMBER QUESTION TITLE QUESTION WEIGHT RESPONSE OPTIONSLife Fitness, LLC 002295-Dec2020 - Fitness Equipment RFP - UC System-wide Product Overview
Questions focused on product offering, specifications, as well as pricing.

Technical
- 2
Provide a count of
equipment models
your firm can offer
focused around
cardio and strength
training for
recreational
gyms,high
performing
collegiate athletes
or both. Please
enter quantities for
model counts under
respective category
columnsor the both

7.15% Plate Loaded - Both Family of Brands: LF & Cybex suited for rec, Hammer Strength suited for athletics, over 50 combined - 2
Provide a count of
equipment models
your firm can offer
focused around
cardio and strength
training for
recreational
gyms,high
performing
collegiate athletes
or both. Please
enter quantities for
model counts under
respective category
columnsor the both

7.15%
Free Weight -
Recreational
Equipment
See product line attachments for Life Fitness, Hammer Strength, Cybex, and SciFit - 2
Provide a count of
equipment models
your firm can offer
focused around
cardio and strength
training for
recreational
gyms,high
performing
collegiate athletes
or both. Please
enter quantities for
model counts under
respective category
columnsor the both

7.15%
Free Weight - High
Performing Athlete
Equipment
See product line attachments for Life Fitness, Hammer Strength, Cybex, and SciFit - 2
Provide a count of
equipment models
your firm can offer
focused around
cardio and strength
training for
recreational
gyms,high
performing
collegiate athletes
or both. Please
enter quantities for
model counts under
respective category
columnsor the both

7.15% Free Weight - Both Hundreds of Hammer Strength branded dumbbells, Olympic standard & bumper plates, fixed barbells, etc
- 2
Provide a count of
equipment models
your firm can offer
focused around
cardio and strength
training for
recreational
gyms,high
performing
collegiate athletes
or both. Please
enter quantities for
model counts under
respective category
columnsor the both

7.15%
Cable -
Recreational
Equipment
See product line attachments for Life Fitness, Hammer Strength, Cybex, and SciFit Questionnaire Name: *
Questionnaire Type:

Questionnaire Description:

7.15%
Cable - High
Performing Athlete
Equipment
See product line attachments for Life Fitness, Hammer Strength, Cybex, and SciFit - 2
Provide a count of
equipment models
your firm can offer
focused around
cardio and strength
training for
recreational
gyms,high
performing
collegiate athletes
or both. Please
enter quantities for
model counts under
respective category
columnsor the both

7.15% Cable - Both Numerous cable motion configurations across DAPs, MJs, Synrgy systems, selectorized, Hammer racks - 2
Provide a count of
equipment models
your firm can offer
focused around
cardio and strength
training for
recreational
gyms,high
performing
collegiate athletes
or both. Please
enter quantities for
model counts under
respective category
columnsor the both

7.15%
Functional Training
Accessories -
Recreational
Equipment
See product line attachments for Life Fitness, Hammer Strength, Cybex, and SciFit - 2
Provide a count of
equipment models
your firm can offer
focused around
cardio and strength
training for
recreational
gyms,high
performing
collegiate athletes
or both. Please
enter quantities for
model counts under
respective category
columnsor the both

7.15%
Functional Training
Accessories - High
Performing Athlete
Equipment
See product line attachments for Life Fitness, Hammer Strength, Cybex, and SciFit - 2
Provide a count of
equipment models
your firm can offer
focused around
cardio and strength
training for
recreational
gyms,high
performing
collegiate athletes
or both. Please
enter quantities for
model counts under
respective category
columnsor the both

7.15% Functional Training
Accessories - Both Hundreds of LF and Hammer branded kettlebells, balls, bands, plyo boxes, ropes, mats, rollers, etc.

Questionnaire Name: *
Questionnaire Type:

Questionnaire Description:

7.15%
Cardio -
Recreational
Equipment
See product line attachments for Life Fitness, Hammer Strength, Cybex, and SciFit - 2
Provide a count of
equipment models
your firm can offer
focused around
cardio and strength
training for
recreational
gyms,high
performing
collegiate athletes
or both. Please
enter quantities for
model counts under
respective category
columnsor the both

7.15%
Cardio - High
Performing Athlete
Equipment
See product line attachments for Life Fitness, Hammer Strength, Cybex, and SciFit - 2
Provide a count of
equipment models
your firm can offer
focused around
cardio and strength
training for
recreational
gyms,high
performing
collegiate athletes
or both. Please
enter quantities for
model counts under
respective category
columnsor the both

7.15% Cardio - Both Over 100 across brands (LF, Cybex, SciFit, Hammer) and bases (treads, bikes, etc.) and consoles - 3
Will your firm
provide the UC a
discount off list or
specific pricing per
product? (Please
provide details in
the Pricing
Questionnaire)

7.14%
Percentage
discount off list;
Catalog style,
discounted pricing,
with retail listed
along side; A
mixture of
percentage
discount and
Percentage discount off list
- 4
What gauge steel
do your products
utilize for strength
training equipment?

7.14% - 7-11
- 5
What parts are the
most commonly
replaced pieces on
your equipment?
- - upholstery pads, cables, treadmill belts
- 6
What is the lead
time for the
aforementioned
commonly replaced
parts?
- - days to weeks depending on the part
- 7
Are there any
product lines in
your portfolio that
the University
should be aware of
with upcoming
updates or
- - no
- 8
What specifications
with your product
offeringshave
provided potential
ownership
challenges in the
past (technological,
structural, user
experience)?

7.14% - certain strength products require bolt to concrete which can limit application in certain facilities - 9
Please designate
which ASTM
standards your
company complies
with.

7.14% - all
Questionnaire Name: *
Questionnaire Type:

Questionnaire Description:

Technical
- 10
Dueto varying
campus constraints
in the UC system,
can all of your
equipment offerings
be delivered on a
box style truck with
a lift gate? If not,
which products
would require a
loading dock to be

7.14% - Yes, our installers utilize box trucks with lift gates. Loading docks not required. - 11
For equipment with
padding or
cushions, how often
do those pieces
need to be

7.14% - anywhere from a year to ten years depending on usage and pad type - 12
Are your products
domestically
manufactured?

7.14% - yes, Owatonna, MN and Falmouth, KY
- 13
Which products in
your offering are
your highest selling
units?

7.14% - LF Discover SE3HD cardio, Hammer benches & racks - 14
For those highest
selling units, what
are their respective
life cycles for
ownership (in

7.14% - for cardio most customer refresh every 5-8 years, for strength it's more like 8-12 years - 15
What
recommendations
do you have for UC
when evaluating
similar equipment
that your
competitors may
offer?
- - open vs closed platforms for connected fitness, Hammer Strength prevalence in Pro and D1 athletics - 16
When technology is
present, does your
product offering
have a remote, overthe-air, software
update process? If
so, please list which
products

7.14% - SE3HD premium tablet consoles, Digital Coach
- 17
What types of
ancillary costs have
come up for your
clients in your firm's
experience around
the
installation/utilizati
on of your
products? (i.e. redrilling of slab
connections,
structural

7.14% - infrastructure requirements, namely power and data - 18
What products in
your offering are
customizable to
client needs?
Provide a count of
models and options
that are typically

7.14% - Hammer racks, LF Synrgy90/180/360 systems, and Cybex PowerPlay (ordering guides and 3Ds available) Questionnaire Name: *
Questionnaire Type:

Questionnaire Description:

SECTION NAME QUESTION NUMBER QUESTION TITLE QUESTION WEIGHT RESPONSE OPTIONSLife Fitness, LLC - 1
In confirming a long
term partnership
with the UC, what is
the turnover rate
for employees in
your company or
assigned dealers,
both in the sales
and service areas?

6.68% - Most direct/dealer sales reps and service techs stay for 10+ yrs (A Franks, J Zavala, E Hillestad..)
- 2
What productspecific training is
offered to your
employees or
assigned dealers
when they begin
working with your
organization?
- - 2-weeks at onboarding then routine online/in-person trainings - 3
What productspecific training is
offered to clients for
new product
introductions?
Would
demonstration
periods be included
with this training?

6.67% - Online/on-site with market research, visuals, specs, etc.

Consignments available for most products.
- 4
Describe the on-site
training available to
UC employees upon
delivery of new
equipment.
(Representativeconducted training
sessions, videos, online training,
manufacturer
training, manuals,

6.67% - on-site/online in-service product trainings are standard at no additional cost, unlimited support
- 5
What are your
firm's expectations
of UC employees
who will be
responsible for
operating and
maintaining your
- - safety and proper use are paramount, reach out when uncertain about any operation or maintenance
- 6
Are there any
technological or
structural
requirements of the
buildings your
equipment will be
placed in? Such
requirements could
be reinforced
foundations, high
impact flooring,
high-speed internet
access (please state
hardwire or wifi
requirements), or
others the UC
should be aware of.

Responses do not
have to be model
specific (i.e. "All
equipment requires
- - some strength requires bolt to concrete, some cardio is optimized with high-speed internet
- 7
What is your
company’s process
for coordinating the
repair of equipment
still under

6.67% - call or email LF customer support with serial number and brief description of problem
- 8
What is your
company's process
forrepairs that
occur after the
expiration of a

6.67% - call or email LF customer support with serial number and brief description of problem
- 9
What is the timeline
for replacement
equipment that fails
under normal
operating
conditions? What
factors contribute
to these timelines?

6.67% - production lead times apply to certain products that are made to order
- 10
Does your firm offer
an on site parts
library for all
equipment in your
portfolio, thata self
maintaining
department could
utilize? If yes, please
describe that

6.67% - LFtechsupport.com, register for full access and support 002295-Dec2020 - Fitness Equipment RFP - UC System-wide Services, Training and Warranty Offerings
Questions focused on firm's ability to provide equipment timely, service equipment, offer client training and warranty products.

Commercial
Questionnaire Name: *
Questionnaire Type:

Questionnaire Description:

SECTION NAME QUESTION NUMBER QUESTION TITLE QUESTION WEIGHT RESPONSE OPTIONSLife Fitness, LLC 002295-Dec2020 - Fitness Equipment RFP - UC System-wide Services, Training and Warranty Offerings
Questions focused on firm's ability to provide equipment timely, service equipment, offer client training and warranty products.

Commercial
- 11
It is required that
your firm (either
direct or via
manufacturer)
provide a minimum
5 year warranty on
your
equipment.What
are the
requirements
around that

6.67% - warranties vary by product category, customer may purchase extended warranties
- 12
Is your firm willing
to negotiate at a
department level on
warranty and
servicing options?

6.67% Yes; No Yes
- 13
Does your company
offer a trade-in or
buy back program?

6.67% Yes; No Yes
- 13.1
If Yes ,What is your
process for
determining the
trade-in value given
to customers for the
equipment that is
selected?
N/A - local field sales works with local dealers for trade-in at fair market value at time of transaction
- 14
What is your firm's
process for the takeback and
refurbishment or
recycling of parts at
the end of its useful
life? Please state
whether this is
inclusive of your
sustainability
programs provided
under the
Sustainability
Category or
whether this is a

6.67% - see our attachment in the sustainability section - 15
Do you offer your
entire product line
for quick delivery? If
not, which items are
available for quick
ship?
- - many products are made to order, many standard products are stocked
- 16
Does your company
provide general
quarterly business
reviews? Please
specify what type of
information is
included in your
business reviews

6.67% - Yes, we conduct and issue monthly "Competitive & Industry Intelligence"
- 17
Can your firm
provide certification
for UC employees
on your equipment?
Are the
certificationsfocuse
d on user training or
maintenance
training?

6.67% - Yes for maintenance training. User training is informal and always available.
- 18
Have you had any
warranty contract
cancellations in
the last 3 years? If
so, why?

6.67% - no
- 19
What type of
product delivery
logistics does your
firm utilize?

6.67% - from factory to regional warehouse for scheduling with POC then professional delivery & installation
Questionnaire Name: *
Questionnaire Type:

Questionnaire Description:

SECTION NAME QUESTION NUMBER QUESTION TITLE QUESTION WEIGHT RESPONSE OPTIONSLife Fitness, LLC - 1
If submitting product specific pricing, please provide a listing of retail and discounted pricing offered for each piece of equipment under the scope of this RFP (Cardio
and Strength Training Equipment). Your firm can choose
to offer a contracted price ORacontracted percent
discount.**If preferred, please upload a document
showing listed pricing for each piece of equipment.**

12.50% Model Name /
Number 1.See attached contracted discount percentage table by product category - 1
If submitting product specific pricing, please provide a listing of retail and discounted pricing offered for each piece of equipment under the scope of this RFP (Cardio
and Strength Training Equipment). Your firm can choose
to offer a contracted price ORacontracted percent
discount.**If preferred, please upload a document
showing listed pricing for each piece of equipment.**

12.50% Retail Price 1.See attached contracted discount percentage table by product category - 1
If submitting product specific pricing, please provide a listing of retail and discounted pricing offered for each piece of equipment under the scope of this RFP (Cardio
and Strength Training Equipment). Your firm can choose
to offer a contracted price ORacontracted percent
discount.**If preferred, please upload a document
showing listed pricing for each piece of equipment.**

12.50% UC Discount Price 1.See attached contracted discount percentage table by product category - 1
If submitting product specific pricing, please provide a listing of retail and discounted pricing offered for each piece of equipment under the scope of this RFP (Cardio
and Strength Training Equipment). Your firm can choose
to offer a contracted price ORacontracted percent
discount.**If preferred, please upload a document
showing listed pricing for each piece of equipment.**

12.50% Percentage
Discount 1.See attached contracted discount percentage table by product category - 2
If providing a percent (%) discount off retail, please state the discount in general or by specific category listed
below.

12.50% General Discount 1.See attached contracted discount percentage table by product category - 2
If providing a percent (%) discount off retail, please state the discount in general or by specific category listed
below.

12.50% Equipment
Discount 1.See attached contracted discount percentage table by product category - 2
If providing a percent (%) discount off retail, please state the discount in general or by specific category listed
below.

12.50% Parts Discount 1.N/A
- 2
If providing a percent (%) discount off retail, please state the discount in general or by specific category listed
below.

12.50% Service Discount 1.N/A
002295-Dec2020 - Fitness Equipment RFP - UC System-wide FOR MANUFACTURERS- Pricing
Detailed pricing or simple discount off list for products and services Commercial
Revised 1.2.2020 Page 1 of 28
Sustainable Procurement
Guidelines
Revised 1.2.2020 Page 2 of 28
Table of Contents
Table of Contents 2
Glossary 3

1. Introduction and Document Purpose 6

2. Document Guide 6

3. Reporting 7

4. Green Spend 7
A. Green Spend General Criteria 7
B. Category Specific Criteria 8

5. Economically and Socially Responsible Spend 12

6. Sustainable Spend 13

7. Category Specific Specifications 14
A. Electronics 15
B. Cleaning Supplies 15
C. Office Supplies 16
E. Indoor Furniture 16
F. Compostable Food Service Ware 17
G. Water Appliances/Fixtures 19

8. Best Practices for Procurement Services 19

9. Certification and Standards Definitions 20

10. Packaging Foam Ban Guidance 22

11. Approval procedure updates and changes 23

12. Change Log 23
Appendix I - The “Dollar not Spent” and Green Spend 25
Method 1: Reuse (for example, goods reused from surplus operations) 25 Method 2: Normalized Reduction in Purchase of Commodity Goods 26 Method 3: Replacement of disposables with reusables 27
Revised 1.2.2020 Page 3 of 28
Glossary
The below definitions are copied directly from the UC Sustainable Practices Policy for reference, unless noted otherwise.

Addressable Spend: Spend that can be impacted through sourcing activities. For the purposes of this policy, addressable spend relates to the spend within a specific product or service category.

Catalog: A catalog is representative of a supplier’s product information. A catalog is implemented in one of two formats: 1) through a hosted catalog or 2) through a punch-out catalog. See definitions for Hosted Catalog and Punch Out Catalog for more information. This definition is provided for clarification within the Guidelines and is not defined within the UC Sustainable Practices Policy.

Economically and Socially Responsible (EaSR) Spend: Spend on products or services supplied by a business holding one of the UC-recognized certifications listed the UC Sustainable Procurement Guidelines.

Environmentally preferable products: Designation for those products whose manufacture, use, and disposal results in relatively less environmental harm than comparable products.

Expanded Polystyrene (EPS): As defined by the City of San Francisco, blown polystyrene and expanded and extruded foams which are thermoplastic petrochemical materials utilizing a styrene monomer and processed by any number of techniques including but not limited to, fusion of polymer spheres (expanded bead polystyrene), injection molding, foam molding, and extrusion-blown molding (extruded foam polystyrene).

Full Time Equivalent (FTE): A full-time equivalent employee is the hours worked by one employee on a full-time basis and can be used to convert the hours worked by several part-time employees into the hours worked by full-time employees. A full-time employee is assumed to work 40 hours in a standard week.

Green Spend: Spend on products meeting the UC “Preferred Level” of environmental sustainability criteria as laid out in the UC Sustainable Procurement Guidelines.

Hosted Catalog: As defined in the JAGGAER technical manual, in simplest terms, a hosted catalog is an online version of a supplier’s printed catalog. Hosted catalogs contain product data and details, along with pricing information for each item. When a product search is performed, the products in all of the hosted catalogs are searched. Hosted catalog search results contain product information from all suppliers depending on the search criteria entered by the user. This definition is provided for clarification within the Guidelines and is not defined within the UC Sustainable Practices Policy.

Revised 1.2.2020 Page 4 of 28
LEEDTM: Leadership in Energy and Environmental Design. LEED is a registered trademark of the U.S.

Green Building Council (USGBC). This trademark applies to all occurrences of LEED in this document.

LEED is a green building rating system developed and administered by the non-profit U.S. Green Building Council. The four levels of LEED certification, from lowest to highest, are Certified, Silver, Gold, and Platinum. LEED has several rating systems. This Policy refers to the following rating systems:

LEED for Interior Design and Construction (LEED-ID+C) for renovation projects; LEED for Building Operations and Maintenance (LEED-O+M) for the ongoing operational and maintenance practices in buildings; and,
LEED for Building Design and Construction (LEED-BD+C) for new buildings and major renovations of existing buildings.

Location: As used in this Guidelines document, means any or all campuses. At this time, it does not include UC Health locations or the Lawrence Berkeley National Laboratory. This definition is provided for clarification within the Guidelines and defined differently within the UC Sustainable Practices Policy.

Packaging Foam: Any open or closed cell, solidified, polymeric foam used for cushioning or packaging, including but not limited to: Ethylene-vinyl acetate (EVA) foam, Low-density polyethylene (LDPE) foam, Polychloroprene foam (Neoprene), Polypropylene (PP) foam, Polystyrene (PS) foam (including expanded polystyrene (EPS), extruded polystyrene foam (XPS) and polystyrene paper (PSP)), Polyurethane (PU) foams, Polyethylene foams, Polyvinyl chloride (PVC) foam, and Microcellular foam. Not included is easily biodegradable, plant-based foams such as those derived from corn or mushrooms.

Policy Exception Authority: The responsible authority for granting exceptions to items III.G.5.a. and V.G.7. in the Sustainable Procurement sections of the UC Sustainable Practices Policy will be the Chief Procurement Officer for a non-UC Health systemwide or Office of the President contract and otherwise by the senior procurement officer of the campus.

Punch Out Catalog: Modified from the JAGGAER technical manual, punch-out catalogs are integrated external links to a supplier’s web-based catalog. The user exits the UC’s eprocurement site to search and select products from a supplier’s web catalog, then returns the items to the UC’s eprocurement shopping cart. The selected items are then submitted through the standard requisition/order process.

This definition is provided for clarification within the Guidelines and is not defined within the UC Sustainable Practices Policy.

Required Level Green Spend criteria: The minimum certification standard required for a product or service category. Required Level Green Spend criteria is laid out in the UC Sustainable Procurement Guidelines.

Solicitation: The process of seeking information, bid proposals, and quotations from suppliers.

Revised 1.2.2020 Page 5 of 28
Sustainable Practices Policy: Refers to the University of California Sustainable Practices Policy, Governed by the UC Sustainability Steering Committee.

Sustainable Procurement: [Modified from the UK Government’s Sustainable Procurement Task Force (2012)] Purchasing that takes into account the economic, environmental and socially responsible requirements of an entity’s spending. Sustainable Procurement allows organizations to procure their goods and services in a way that achieves value for money on a whole-life basis in terms of generating benefits not only to the organization, but also to society and the economy, while remaining within the carrying capacity of the environment.

Sustainable Procurement Working Group (SPWG): Is the working group charged with improving the integration of sustainable principles and practices into the UC’s procurement practices. The SPWG recommends changes to this document to the UC Procurement Leadership Council, and changes to the UC Sustainable Practices Policy to both the UC Procurement Leadership Council and UC Sustainability Steering Committee. See definitions for UC Procurement Leadership Council and UC Sustainability Steering Committee for more information. This definition is provided for clarification within the Guidelines and is not defined within the UC Sustainable Practices Policy.

Sustainable Spend: The intersection of Green and Economically and Socially Responsible (EaSR) Spend.

UC Sustainable Spend is defined as spend that meets the criteria and requirements for Green Spend as well as EaSR Spend as laid out in the UC Sustainable Procurement Guidelines.

Total Cost of Ownership (TCO): An analysis of cost that considers not only purchase price, but also any costs associated with the acquisition, use, and disposal of the product. These costs may include some or all of the following: freight, taxes and fees, installation, operation/energy use, maintenance, warranty, collection, end-of-life disposal or recycling, as well as social or environmental costs, such as the cost of purchasing pollution offsets or monitoring labor practices.

UC Procurement Leadership Council (PLC): Is the system wide leadership council, composed of the Chief Procurement Officer (or equivalent) at each UC campus, charged with developing the overall strategic direction for the UC Procurement Services program that enables the organization to align objectives, initiatives, and projects to deliver on system wide procurement and supply chain initiatives. The PLC is ultimately responsible for the approval of changes and updates to this document. This definition is provided for clarification within the Guidelines and is not defined within the UC Sustainable Practices Policy. This definition is provided for clarification within the Guidelines and is not defined within the UC Sustainable Practices Policy.

UC Sustainability Steering Committee: Is the UC system wide committee charged with overseeing updates to and progress against the UC Sustainable Practices Policy. This definition is provided for clarification within the Guidelines and is not defined within the UC Sustainable Practices Policy.

Revised 1.2.2020 Page 6 of 28

1. Introduction and Document Purpose
The University of California’s Sustainable Procurement Guidelines (“Guidelines”) lay out the minimum sustainability requirements for products and services purchased by the University of California and identify those product attributes that are strongly preferred, if not mandatory.

The University of California’s Sustainable Procurement Guidelines act as a companion to the Sustainable Procurement Policy and Procedure Sections of the UC Sustainable Practices Policy.

In general terms, the UC Sustainable Practices Policy outlines the University’s targets for sustainable procurement as well as requirements for UC sustainable procurement practices, that is the activities of University of California buyers as they relate to sustainable procurement. This Guidelines document breaks down what the University considers to be sustainable at the product, product category, service or industry level.

The UC Sustainable Practices Policy prioritizes waste reduction in the following order: reduce, reuse, and then recycle. Accordingly, sustainable procurement should look to reduce unnecessary purchasing first, then prioritize purchase of surplus or multiple use products, before looking at recyclable, compostable, or otherwise sustainable products.

2. Document Guide
These Guidelines are intended to be used by the following parties, for the following purposes:

1. University of California, Office of the President, Strategic Sourcing Centers of Excellence and University Campus Procurement Services Departments (not including UC Health locations or the Lawrence Berkeley National Laboratory)
a. To educate personnel purchasing on behalf of the University on Required and Preferred Green (environmentally) and Economically and Socially Responsible (EaSR) sustainability criteria to be included in solicitation specifications and reporting. b. To negotiate better pricing for products and services meeting the criteria described throughout these Guidelines and the Sustainable Practices Policy over traditional products and services, where opportunities exist.
c. To develop language and specifications for solicitations stating that product and service offerings meeting the criteria described in these Guidelines will be required where they exist.

2. Department Level Buyers
a. To educate personnel purchasing on behalf of the University on Required and Preferred environmental (Green) and Economically and Socially Responsible (EaSR) sustainability criteria when making purchasing decisions.

Revised 1.2.2020 Page 7 of 28

3. Reporting
Reporting will be required in line with the University of California sustainable purchasing targets and reporting requirements as outlined in the Sustainable Practices Policy (see III. Policy Text, G. Sustainable Procurement; V. Procedures, G. Sustainable Procurement). Reporting will be based on the percent spend in each of the following categories out of the total addressable spend. Reporting will commence by product or service category based on instruction in the sections below.

1. Green (environmentally preferable) Spend

2. Economically and Socially Responsible (EaSR) Spend

3. Sustainable Spend (the intersection of Green and EaSR Spend) Clarification on each of these spend categories can be found in the sections below.

4. Green Spend
Green Spend is defined as spend on products meeting the UC Preferred Level of environmental sustainability criteria (see Table 1 below). The percentage of Green Spend is calculated using the following methodology, for a given product category over a particular period of time:

Total spend on items meeting Preferred Level criteria in a given product category x 100 Total Addressable Spend in a given category
For example, the percent Green Spend calculation for computer electronics for Fiscal Year 16/17 is:

Total Spend on EPEAT Gold registered computers during FY 16/17 x 100 Total Addressable Spend on computers during FY 16/17
In addition to the above calculations, campuses may also calculate the “Dollar not Spent” to add to their overall Green Spend percentage. Please note that calculating the “Dollar not Spent” for an individual campus is optional and not required as part of a sites annual Green Spend reporting. Please see Appendix I – The “Dollar not Spent” and Green Spend to find more information on the various allowable methodologies to calculate the “Dollar not Spent.” A. Green Spend General Criteria
Some Green (environmental) sustainability criteria are applicable across all, or a large number of different product or service categories. The following criteria must be applied to all applicable categories, and included in the specifications for all relevant solicitations and contracts.

Revised 1.2.2020 Page 8 of 28

1. ENERGY STAR® and WaterSense® certified products are required across all applicable product categories where price comparable (based on a total cost of ownership assessment) and consistent with the needs of University researchers, faculty, and staff.

2. Products and packaging shall be free of hazardous additives, including those mixed into the product and those used as surface treatments, unless no feasible alternative exists, and it is determined that the benefit outweighs the risk. Products and packaging must meet all eleven of the Kaiser Permanente Chemicals of Concern Criteria, including, but not limited to. a. Cadmium, mercury, lead, hexavalent chromium, polybrominated biphenyls, and polybrominated diphenyl ethers - All homogenous electronic parts are compliant with all European Union Restriction of the Use of Certain Hazardous Substances (EU RoHS) Directive’s restricted limits (excluding exemptions).
b. Polyvinyl chloride (PVC)
c. Prop 65 Chemicals - Does not contain intentionally added chemicals listed by the State of California to cause cancer, birth defects, or reproductive harm that require warning or are prohibited from release to the environment under the California Safe Drinking Water and Toxic Enforcement Act of 1986 (Proposition 65). If contains Prop 65 chemicals, supplier must disclose Chemical Abstracts Service (CAS) #'s. d. Persistent, bioaccumulative and toxic chemicals (PBTs) - All homogeneous materials must contain less than 1000 ppm of PBTs.
e. Organohalogen-based chemicals (bromine, chlorine, fluorine, and iodine) f. Antimicrobial/antibacterial agents1 - Does not contain intentionally added antimicrobial/antibacterial agents to reduce surface pathogens.

B. Category Specific Criteria
Table 1 outlines the environmental sustainability criteria the University uses to define a given product category as “Green,” for purposes of identifying products in hosted and punchout catalogs, and for calculating and reporting on Green and Sustainable Spend.

Recognized Certifications - These are reputable third party certifications the UC recognizes for identifying products that may have a reduced impact on humans and/or the environment. At a location’s discretion, products with these certifications can be flagged as “light green” in hosted and punchout catalogs.

Required Level - These are the minimum mandatory requirements for each product category, which should be included in all relevant bid solicitations. Products and services that fall into these categories but do not meet these minimum requirements will not be listed in UC product catalogs except with the express request of campuses. Products in a given category must meet 1 This includes hand and dish soaps labelled as antibacterial, except where required for use in hospitals and food service settings. Antimicrobials added to raw materials for the sole purpose of preserving the product are exempt, with the exception of triclosan and triclocarban which are explicitly prohibited.

Revised 1.2.2020 Page 9 of 28
all required level criteria listed, unless otherwise noted (e.g. if Energy Star and EPEAT Silver are listed, product must have both certifications).

Preferred Level - The Preferred Level of criteria is used for calculating Green and Sustainable Spend (see Section 6 below). At a location’s discretion products meeting these criteria may be labelled as “dark green” in hosted and punchout catalogs, and shall be given preference during evaluation in all relevant bid opportunities, where price comparable (based on a total cost of ownership assessment) and consistent with the needs of University researchers, faculty, and staff. Products must meet all applicable Required Level criteria to qualify for Preferred Level criteria.

Table 1 - Category Specific Green Spend Criteria
Product or
Service
Category
Recognized Certifications
and Standards
Required Level (minimum
mandatory requirements)
Preferred Level
Electronics ENERGY STAR ® ENERGY STAR ® ENERGY STAR ®
EPEAT EPEAT Bronze EPEAT Gold
Cleaning
Supplies
Green Seal A minimum of 25% of
purchases are certified by
one of the recognized
certifications
At least 75% of
purchases are certified
by of the recognized
certifications UL Ecologo
EPA Safer Choice
FSC (for janitorial paper
products)
Office Supplies
Copy Paper FSC Recycled A minimum of 30% PCRC
or agricultural residue
content (or GS-07
certified)
100% PCRC or
agricultural residue
content, or FSC
Recycled labelled, with
additional preference
for paper that is PCF
Post-consumer recycled
content (PCRC)
Processed Chlorine Free
(PCF)2
Green Seal (GS-07)
2 http://www.calrecycle.ca.gov/paper/chlorinefree/default.htm Revised 1.2.2020 Page 10 of 28
Agricultural residue3
content
Paper Office
Supplies (other
than copy
paper)
FSC - Chain of Custody A minimum of 30% PCRC4 100% recycled content with minimum 50%
PCRC; 90% PCRC wire
components; waterbased or plant-based
adhesives; and
additional preference
for PCF, FSC, and/or SFI
labelled products5
Sustainable Forestry
Initiative (SFI)
Post consumer recycled
content (PCRC)
Total recycled content
Processed Chlorine Free
(PCF)
Green Seal (GS-07)
Non-paper
Office Supplies
Post-consumer recycled
content (PCRC)
Meets the minimum CPG
recycled-content levels
for Non-Paper Office
Products, and a minimum
30% recycled content for
all writing utensils (dryerase markers,
highlighters, markers,
pens, and pencils) or
other plastic-based
accessories
Meets the recycled
content specifications in
the Preferred EPP
Specifications as listed
by the Northeast
Recycling Council
(NERC), and free of
antimicrobial coatings
Total recycled content
Non-antimicrobial
EPA Comprehensive
Procurement Guidelines
(CPG)
Northeast Recycling Council
(NERC) Model EPP
Specifications and
Purchasing Guidelines for
Office Supplies
Toner Remanufactured6 Meets one of the Meets both of the 3 Must come from sustainably grown and harvested, non-GMO sources that do not replace forest stands or food crops
4 Aligns with CA Department of General Services (DGS) Purchasing Standard DGS-441200-A for Paper Product Office Supplies and Northeast Recycling Council (NERC) Model EPP Specifications and Purchasing Guidelines for Office Supplies
5 Modelled from Northeast Recycling Council’s Preferred EPP Specifications for Paper Office Supplies 6 Shall meet the State of California’s Specifications for Remanufactured Toner and Ink Cartridges:
https://www.documents.dgs.ca.gov/pd/epp/goods/officesupplies/inktonercartridges/20140902_Ink_Toner_Engin eering_Spec.pdf
Revised 1.2.2020 Page 11 of 28
High yield recognized standards recognized standards
Indoor
Furniture
GREENGUARD Gold Must meet all of the
following:
● GREENGUARD
Gold or SCS
Indoor Advantage
Gold
● Free of the 6
classes of
chemicals of
concern as
described in
Section 7.E.

Must have at least one
of the following
additional certifications:
● BIFMA Level
certified
(preference for
2 or 3)
● C2C Certified
(preference for
Silver or Gold)
● HHI compliant
with published
product list on
their website
● FSC Certified
wood
● Textiles
certified by one
of the
recognized
certifications
● Complete HPD
● Complete
Declare label
SCS Indoor Advantage Gold
Cradle to Cradle (C2C)
BIFMA Level
Meets the Healthier
Hospitals Initiative (HHI)
Safer Chemicals Challenge
and is listed on the
Healthier Hospitals Healthy
Interiors Goal website
FSC (for products containing
wood)
Textile certifications:
● GOTS
● Standard 100 by
Oeko-Tex
● STeP by Oeko-Tex
● Cradle to Cradle
● Facts
Health Product Declaration
(HPD)
Declare Label
Compostable
Food Service
Ware
Biodegradable Products
Institute (BPI)
Certified Compostable by
BPI or GS-35, or made
100% from uncoated,
unlined, obviously plantbased material, and
appears on the Cedar
Grove Accepted Items List
Meets additional
criteria as described in
the Compostable Food
Service Ware section
below
Green Seal GS-35
Cedar Grove Accepted
Items List for Commercial
Compostability
Water
Appliances/
Fixtures
WaterSense® WaterSense® Certified WaterSense® Certified Revised 1.2.2020 Page 12 of 28

5. Economically and Socially Responsible Spend
Economically and Socially Responsible (“EaSR”) Spend is defined as spend on products or services supplied by a business holding at least one of the UC-recognized classifications or certifications listed below. Recognized Certifications and Standards, listed in Table 2 below, outline the certifications and criteria that the University uses to define “EaSR” spend. Table 2 also includes a category for Preferred Certifications, which are certifications offered by California government agencies and/or of CA-based businesses. Currently there is no goal set for spend with suppliers meeting Preferred Certification standards.

The percentage of EaSR Spend is calculated using the following methodology, for a particular time horizon:

Spend on products or services from a business that holds a UC-recognized EaSR certification x 100 Total Addressable Spend
A. EaSR Spend Criteria
Expenditures on products supplied by businesses holding at least one of the UC-recognized certifications and standards outlined under Recognized Certifications and Standards, see Table 2 below, will be considered EaSR Spend for the purposes of calculating the percent EaSR and Sustainable Spend.

Recognized Certifications and Standards - These are reputable government or nationally recognized certifications and criteria the UC recognizes for identifying suppliers that may have a positive impact on society and/or the economy. Suppliers with these certifications should be flagged as a color or symbol differentiated like ‘green spend’ such as yellow in hosted and punchout catalogs.

Preferred Certifications - These are reputable government or nationally recognized certifications and criteria the UC recognizes for identifying suppliers that may have a positive impact on society and/or the economy within California specifically. Suppliers with these certifications should be flagged as a color or symbol differentiated like ‘green spend’ such as yellow in hosted and punchout catalogs.

Table 2 - EaSR Spend Criteria
Business
Classification
Recognized Certifications and Standards Preferred Certifications Small Business
Enterprise
All government agency certifications and
accepted third party certifiers such as:
● SBA-approved Third Party Certifiers
Note that self-certification in SAM is
CA DGS certification
or California state or local
agency certification
HUBZone certified
Revised 1.2.2020 Page 13 of 28
accepted as well as any other small business
certifications that also certify a businesses
status as socially and economically
disadvantaged such as (WOSB, SDVOSB, DBE,
etc.)
SBA 8(a)
Disadvantaged
Business Enterprise
All government agency certifications All government agency certifications accepted, but
principal office of business
must be located in California
and owners (officers, if a
corporation) domiciled in CA.

Women-owned
Business Enterprise
All government agency certifications All government agency certifications accepted, but
principal office of business
must be located in California
and owners (officers, if a
corporation) domiciled in CA.

Minority Business
Enterprise
All federal, state and local government
agency certifications
● State and Local Government
Certifying Agencies
● Federal includes (SBA 8(a), EPA, etc.)
All government agency
certifications accepted, but
principal office of business
must be located in California
and owners (officers, if a
corporation) domiciled in CA.

Veteran-owned
Business Enterprise
All government agency certifications All government agency certifications accepted, but
principal office of business
must be located in California
and owners (officers, if a
corporation) domiciled in CA.

Service Disabled
Veteran-owned
Business Enterprise
All government agency certifications DGS DVBE

6. Sustainable Spend
Sustainable Spend is the intersection of Green and EaSR Spend. UC Sustainable Spend is defined as spend that meets the criteria and requirements in Section 4 for Green Spend and Section 5 for EaSR Spend (simultaneously). Thus, Sustainable Spend is defined as the expenditures on products in a particular product category that are supplied by a business holding one of the UC-recognized EaSR certifications, in addition to meeting the Preferred Level Green Spend criteria from Table 1.

Revised 1.2.2020 Page 14 of 28
An example of the percentage of Sustainable Spend calculated for computers (Figure 1) over a particular time horizon would be:

Expenditures on EPEAT Gold certified computers from SBE businesses x 100 Total Addressable Spend on computers
Figure 1. Sustainable Spend for Computers

7. Category Specific Specifications
These additional guidelines and specifications should be used during solicitations, contracting and as a reference when making department purchases. Minimum requirements for each product category are outlined in column three of table one. The below items are recommended for inclusion in RFPs. Other than those items referred to in Policy as mandatory, project teams need to determine which of the below items will be mandatory and preferred during the RFP development phase.

Revised 1.2.2020 Page 15 of 28
A. Electronics
Electronics includes any product for which an EPEAT certification is available. EPEAT currently includes product ratings for PCs and Displays (including tablets), Imaging Equipment (which includes printers, copiers, scanners and multifunction devices) and Televisions. Environmental leadership standards are currently under development with the intent to form the basis of future EPEAT categories for Mobile Phones, Servers and other electronic products (https://www.epeat.net/about-epeat/). Registration criteria and a list of all registered equipment are provided on the EPEAT registry.

In addition to the criteria established in Table 1, the University will ensure the following:

1. In accordance with Policy, all recyclers of the University’s electronic equipment must be eSteward certified by the Basel Action Network (BAN) (www.ban.org). In cases where the University has established take-back programs with a manufacturer, the University will require the manufacturer to become a BAN-certified e-Steward Enterprise (e-Stewards for Enterprises).

2. Printers and copiers must have duplex printing capabilities and hold their warranty while using 100% recycled content paper.

3. Suppliers shall be required to deliver items to the University with energy efficiency and duplex printing functions enabled.
a. Departments will work with their IT departments to ensure that features remain enabled for the duration of the product’s use.

B. Cleaning Supplies
Cleaning supplies include general purpose bathroom, glass and carpet cleaners; degreasing agents; biologically-active cleaning products (enzymatic and microbial products); floor-care products (e.g. floor finish and floor finish strippers); hand soaps and hand sanitizers; disinfectants; and metal polish and other specialty cleaning products. Also included are janitorial paper products such as toilet tissue, tissue paper, paper towels, hand towels, and napkins. Other janitorial products and materials (e.g. cleaning devices that use only ionized water or electrolyzed water) are excluded from this category.7 Disinfectants
All disinfectants must be EPA-registered, and contain only the following active ingredients: hydrogen peroxide, citric acid, lactic acid, thymol, or caprylic acid. As there is no sustainability certification for disinfectants, in order to increase your % Green Spend for Cleaning Supplies and follow green cleaning practices, it is recommended that each site assess its current usage and application of disinfectants.

Disinfectant use should be limited to high-risk surfaces [locations where there is a higher risk for blood borne incidents, skin contact (MRSA risk), or contact with feces and body fluids] and where required by regulation. Microbes can be effectively removed from high-touch surfaces touched by multiple people throughout the day (door handles, faucet handles, handrails, drinking fountains etc.) by frequent and proper cleaning with a regular cleaning product.8
7 Based on STARS Technical Manual Version 2.1, Administrative Update Three, July 2017 8 UMass Lowell Toxics Use Reduction Institute’s Guide to Safe and Effective Cleaning and Disinfecting:
https://www.turi.org/Our_Work/Cleaning_Laboratory/Resources_and_Information/Disinfection/Guide_to_Safe_a nd_Effective_Cleaning_and_Disinfecting
Revised 1.2.2020 Page 16 of 28
C. Office Supplies
Copy paper - refers to standard office printing and copy paper.

Paper Office Supplies - includes Writing Paper (pads), Packing Paper, Folders, Letter folders, Expandable Filing Folders, Hanging folders or accessories, binders and indexes, Hanging Folders, Dividers, File Pockets, Standard Envelopes, Packaging Carton, Mailers, Easel Pads, Sticky Note, Storage Boxes, Desk Pad Calendar.

Non-paper Office Supplies - includes binders, clipboards, file folders, clip portfolios, presentation folders, plastic desktop accessories (desk organizers, desk sorters, desk and letter trays, and memo, note and pencil holders etc.), plastic envelopes, and writing utensils (dry-erase markers, highlighters, markers, pens, and pencils).

Toner - Additional recommendations can be found from the State of New York’s Approved Specifications for Monochrome Toner Cartridges: https://www.ogs.ny.gov/greenny/specs/green-specsMonochromeTonerCartridge.asp E. Indoor Furniture
Furniture includes individual (e.g. task chair) and group seating; open-plan and private-office workstations; desks of all types, tables of all types; storage units, credenzas, bookshelves, filing cabinets and other case goods; integrated visual display products (e.g. markerboards and tackboards, excluding electronic display products); hospitality furniture; and miscellaneous items such as mobile carts, freestanding screens, and movable partitions. Movable partitions include office furniture system cubicle panels that are typically integrated with work surfaces, desks, and storage furniture. Furniture does not include office accessories, such as desktop blotters, trays, tape dispensers, waste baskets, all electrical items such as lighting and small appliances, and accessories such as aftermarket keyboard trays, monitor stands and monitor arms.

The University shall prefer furniture meeting specifications for the following hazardous chemical classes:

1. Flame Retardants: All furniture shall be free of flame retardant chemicals at levels above 1,000 parts per million in both standard and optional components, excluding electrical components. a. All upholstered seating subject to TB 117-2013 shall be labeled as not containing flame retardant chemicals consistent with the manner described in Section 19094 of the California Business and Professions Code.
b. A product may contain flame retardants if required to meet code or regulation (e.g., TB 133 or ASTM E 1537), in accordance with the following criteria:
i. No halogenated flame retardant chemical may be used at levels above 1,000 parts per million by weight of the homogeneous material, excluding electrical components.

Revised 1.2.2020 Page 17 of 28
ii. Products that contain flame retardant chemicals that have been fully assessed using GreenScreen v1.2 (or newer) and meet the criteria for benchmark 2, 3, or 4 will be preferred.

2. Formaldehyde and Volatile Organic Compounds (VOCs): All furniture shall comply with ANSI/BIFMA e3-2014 Furniture Sustainability Standard, Sections 7.6.1 and 7.6.2, using either the concentration modeling approach or the emissions factor approach. a. Test results shall be modeled using the open plan, private office, or seating scenario in ANSI/BIFMA M7.1, as appropriate.
b. Furniture products that additionally meet ANSI/BIFMA e3-2014 Section 7.6.3 and/or California Department of Public Health Standard Method v1.1 (emission testing method for California Section 01350) are preferred.
c. Salvaged and refurbished furniture more than one-year old at the time of re-use is considered compliant, provided it meets the requirements for any site-applied paints, coatings, adhesives, and sealants.
d. All composite wood materials, including hardwood plywood, particleboard, or medium density fiberboard, used in office, classroom, or healthcare furniture shall comply with Phase 2 of California’s Code of Regulations, Title 17 §93120.2 – Airborne Toxic Control Measure to Reduce Formaldehyde Emissions from Composite Wood Products.

3. Per and Poly-Fluoroalkyl Substances (PFASs) used as stain/water/oil resistant treatments: All furniture shall be free of any long- and/or short-chain per- and poly-fluorinated alkyl compounds and fluorinated polymers used as stain, water, or oil resistant treatments above 100 ppm by weight of the homogenous material.

4. Antimicrobials: All furniture shall be free of any added or built-in chemical antimicrobials.

Antimicrobials added to raw materials for the sole purpose of preserving the product are exempt, with the exception of triclosan and triclocarban which are explicitly prohibited.

5. Polyvinyl Chloride (PVC): All furniture shall be free of polyvinyl chloride (PVC) greater than 1% of product by weight, excluding electrical components. Electrical components that are free of PVC are preferred.

6. Heavy Metals: All furniture shall be free of any heavy metals, including hexavalent and trivalent chromium, in concentrations greater than 100 ppm.

F. Compostable Food Service Ware
Compostable food service containers and packages that have recycled and/or sustainably harvested content are preferred wherever possible.

1. All products must be certified compostable by the Biodegradable Products Institute (BPI) or Green Seal GS-35, proving that the finished product meets ASTM standards D6400 or D6868 for compostability. BPI-certified products can be accessed at:
http://products.bpiworld.org/. Documentation may be required.

Revised 1.2.2020 Page 18 of 28

2. Products made 100% from paper, wood, bamboo or other obviously plant-based material, that are uncoated, unlined, or clay-coated (such as wooden stir sticks or uncoated paper plates) automatically meet this commercial compostability requirement without certification, so long as they appear on the Cedar Grove Accepted Items list for commercial compostability (https://cedar-grove.com/compostable/accepted-items), and the material type is disclosed.

3. Products with polyethylene liners are not compostable, and therefore do not meet the intent of these specifications.

4. Products shall not contain highly hazardous additives, including but not limited to persistent, bioaccumulative, or toxic chemicals (PBTs); carcinogens; mutagens; reproductive toxins, organohalogen-based chemicals (bromine, chlorine, fluorine or iodine); and endocrine disruptors.

5. Products shall not contain polyvinyl chloride (PVC), acrylonitrile butadiene styrene (ABS), polycarbonate (PC), polyurethane (PU), or any fluorinated chemicals. If product is fiber-based (including paper), ask for identification of the type of grease barrier or coating used.

6. Product is manufactured entirely with chlorine-free processing, meaning that no chlorine or chlorine compounds were used during manufacturing. Products may be unbleached or whitened in a chlorine-free process (if certified process chlorine-free).

7. Paper products are made from 40% post-consumer recycled content or 100% total recycled content (pre- or post- consumer), unless intended for hot beverages, in which case they are made from a minimum of 10% post-consumer recycled content. Bidder should disclose the amount and type of recycled content.

8. Non-cutlery products contain at least 90% biobased carbon content; cutlery products contain at least 70% biobased carbon content. Bidder can provide documentation demonstrating that its biobased carbon content meets the above specifications through one of the following:
a. ASTM Standard D6866 laboratory test data
b. USDA’s BioPreferred Label
c. Products made of 100% uncoated wood, bamboo, paper or other obviously fiber-based material will automatically meet these biobased content requirements. Samples may be requested.

9. Product shall not contain added engineered nanomaterials.

10. Product materials were sustainably produced and are certified as one of the following:
a. Forest Stewardship Council (FSC)
b. Protected Harvest
c. Rainforest Alliance
d. Fair Trade USA

11. Feedstock and final product are produced in North America.

12. Product material grown without genetically modified organisms and certified to be GMO-free by one of the following:
a. Non-GMO Project Verified (www.nongmoproject.org)
b. CERT ID NonGMO
c. ProTerra Certifications (www.geneticid.com/services/certification) Revised 1.2.2020 Page 19 of 28

13. Product is made from sustainably grown, non-food agricultural resources such as perennial biomass crops and sustainably harvested residues (for more information, see the Sustainable Bioplastic Guidelines:
https://healthybuilding.net/uploads/files/sustainable-bioplastic-guidelines.pdf

14. Product is EcoLogo or Green Seal-certified by one of the following:
a. EcoLogo CCD-084 (Table Napkins),
b. EcoLogo CCD-085 (Kitchen Towels),
c. EcoLogo CCD-086 (Hand Towels),
d. Green Seal GS-1 (Sanitary Paper Products),
e. Green Seal GS-9 (Paper Towels and Napkins),
f. Product meets the standard for biodegradability in the marine environment (ASTM D7081-05).

15. Inks for printing and graphics are vegetable-based and approved for use by U.S. Food and Drug Administration, where required.

G. Water Appliances/Fixtures
This category includes all products covered by WaterSense including residential toilets, showerheads, bathroom faucets, commercial toilets, urinals, pre-rinse spray valves, irrigation controllers, and spray sprinkler bodies.

8. Best Practices for Procurement Services9

1. Market basket lists can be used as a tool for increasing the purchase of sustainable products at competitive and affordable prices. By only including products meeting the Required and Preferred Level of sustainability criteria in a market basket list, the University may be able to achieve reduced rates that will in turn direct spend towards sustainable products over conventional products. Allowing for revisions to the market basket beyond traditional changes in volume/spend patterns may allow for more competitive pricing on newly added sustainable items.

2. Through solicitation specifications and contract provisions, suppliers are required to:
a. Clearly identify UC-recognized “light green” and “dark green” sustainable items in product catalogs.
b. Ensure that any additional sustainability symbols/icons/certifications are displayed along with attribute details per product (e.g. a product with a recycled content symbol must also have in its product description details about the % total recycled content and % post consumer recycled content).
c. Offer capabilities to:
9 Modified from: https://nerc.org/documents/EPP/Office%20Supplies/EPP%20Specs%20- %20Office%20Supplies.pdf
Revised 1.2.2020 Page 20 of 28
i. Block and/or restrict pre-identified conventional items from being purchased online so University employees are compelled to purchase products that are in compliance with UC’s Sustainable Procurement Policies and Guidelines. ii. Auto-substitute pre-identified conventional products with sustainable products on the market basket list when end-user places conventional item in online cart. d. Make sustainable items display first in online catalog search results, or make them easily found within online product catalogs through effective search tools, search filters, and related navigational tools.
e. Incentivize consolidated deliveries whenever feasible (e.g. deliveries only on certain days of the week or reduced pricing for consolidated shipping). i. Document or illustrate how the delivery consolidation method reduces the UC and supplier’s carbon footprint (e.g. reduction in fossil fuel use, carbon emissions, packaging materials, or on-site vehicle traffic). f. Use only delivery service companies that are participants in EPA’s Smartway Program.

3. LEED credits should be incorporated into all materials procurement associated with new facility constructions and major renovations.10

9. Certification and Standards Definitions
a. BIFMA Level® - BIFMA Level is a multi-attribute furniture certification based on the ANSI/BIFMA e3 standard, addressing material use, energy, atmosphere, human and ecosystem health, and social responsibility at the product, facility, and organizational level. Certification is based on a points system with three levels of achievement, from Level 1 through Level 3. b. Biodegradable Products Institute (BPI) - BPI is a non-profit organization with the largest certification program for compostable products and packaging in North America. Their singleattribute certification indicates compliance with the ASTM D6400 and/or D6868 standards for commercial compostability.
c. Cradle to Cradle TM - Cradle to Cradle is a multi-attribute standard that evaluates a wide range of products across five categories of human and environmental health, including Material Health, Material Reutilization, Renewable Energy and Carbon Management, Water Stewardship, and Social Fairness. Product certification is awarded at five levels, from Basic to Platinum, with an emphasis on continuous improvement.
d. ENERGY STAR ® - Energy Star is a standard for energy efficient consumer products administered by the U.S. Environmental Protection Agency and the U.S. Department of Energy. e. EPA Safer Choice - Formerly known as Design for the Environment (DfE), the Safer Choice label is the U.S. Environmental Protection Agency’s program to identify products with safer chemical ingredients.11
f. EPEAT ® - The Electronic Product Environmental Assessment Tool is a method for consumers to evaluate the effect of a product on the environment. It ranks products as gold, silver or bronze 10 https://www.phoenix.gov/oepsite/Documents/070520.pdf 11 Definition taken from STARS Technical Manual Version 2.1, Administrative Update Three, July 2017 Revised 1.2.2020 Page 21 of 28
based on a set of environmental performance criteria. It is managed by the Green Electronics Council.
g. FACTS - Facts is a sustainability certification program for commercial textiles, recognizing textiles conforming to the NSF/ANSI 336 multi-attribute standard, evaluating a textile for environmental, economic and social aspects across its life cycle. Facts utilizes four conformance levels from Compliant to Platinum.
h. Forest Stewardship Certification - The Forest Stewardship Council (FSC) is an independent, nonprofit organization that protects forests for future generations. FSC Chain-of-Custody certification traces the path of products from forests through the supply chain, verifying that FSC-certified material is identified or kept separated from non-certified material throughout the chain. FSC Forest Management certification confirms that a specific area of forest is being managed in line with the FSC Principles and Criteria.12 i. FSC Recycled - The FSC Recycled on-product label means all the wood or paper in the product comes from reclaimed (re-used) material.13
i. Global Organic Textile Standard (GOTS) - GOTS is a textile processing standard for organic fibres, which includes both ecological and social criteria, from harvesting of raw materials through manufacturing and labelling.
j. GREENGUARD ® - The GREENGUARD Environmental Institute certifies products and materials for low chemical emissions. Greenguard Gold ensures that a product is safe for use in schools and healthcare facilities, and is referenced by LEED.
k. Green Seal ® - Green Seal is an independent nonprofit organization “dedicated to safeguarding the environment and transforming the marketplace by promoting the manufacture, purchase, and use of environmentally responsible products and services.” The Green Seal certification is based on multi-attribute environmental standards that meet the ISO 14024 standards for ecolabeling.14 l. Healthier Hospitals Healthy Interiors Goal (HHI) - The Healthy Interiors Goal aims to promote public and environmental health, and urge the furnishings market to develop safer products, while reducing disposal costs and liability. Furniture and textiles that meet the Healthy Interiors Goal claim contain no formaldehyde, perfluorinated compounds, polyvinyl chloride, antimicrobials, or flame retardants above the specified minimum levels. Products meeting the Goal must be listed on the website, and are not verified. m. Process Chlorine Free (PCF) - PCF means that no chlorine or chlorine derivatives were used in the recycling process. Paper that was originally bleached with chlorine or chlorine derivatives may be used as feedstock, however. Only paper that is “totally chlorine-free” (TCF) is produced with pulp that has been bleached without any type of chlorine or chlorine derivative, or has not been bleached.15
12 Ibid
13 https://ic.fsc.org/en/choosing-fsc/fsc-labels
14 Definition taken from STARS Technical Manual Version 2.1, Administrative Update Three, July 2017 15 http://www.calrecycle.ca.gov/paper/chlorinefree/default.htm Revised 1.2.2020 Page 22 of 28
n. STANDARD 100 by OEKO-TEX® - Certification for raw, semi-finished, and finished textile products at all processing levels, as well as accessory materials used. Criteria focuses on product safety based on test criteria for numerous harmful chemicals.
o. STeP by OEKO-TEX® - STeP assesses against criteria for sustainable, environmentally and socially responsible textile and apparel production and logistic sites, addressing the reduction of hazards and risks throughout the production chain, with the goal of improving factory resource efficiency.
p. UL Ecologo - The UL Environment ECOLOGO program certifies products, services and packaging for reduced environmental impact. ECOLOGO Certifications are voluntary, multi-attribute, lifecycle based environmental certifications that meet the ISO 14024 standards for ecolabeling.16 q. WaterSense® - WaterSense is a U.S. Environmental Protection Agency program designed to encourage water efficiency in the United States through the use of a special label on consumer products.

10. Packaging Foam Ban Guidance
In accordance with section III.F.5. of the UC Sustainable Practices Policy, the University has prohibited the sale, procurement and/or distribution of packaging foam UC-wide. The following guidance is meant for sourcing and procurement professionals within UC and is intended to leverage large sourcing opportunities to mitigate single use packaging foam waste in support of UC’s Zero Waste goals.

1. Scope
The ban of expanded plastic foam materials in packaging is effective as of January 1st, 2020. The ban applies to all packaging brought onto UC campuses via the purchase of goods on behalf of the University. The only exception to this ban is for the purchase of products utilized in laboratory or medical settings.

2. Enforcement
This ban is a requirement of the UC Sustainable Practices Policy in support of UC’s Zero Waste goal. UC Terms and Conditions include the policy language regarding this ban, which must be addressed when contracting with suppliers for the purchase of goods. When conducting a competitive solicitation for goods, the University must incorporate language into all Requests For Proposals/Quotes/etc. (RFx’s) articulating this ban, including in the qualitative assessment process, and ensure that it is addressed as part of the final award of business.

If a supplier claims to be unable to meet the requirements of the ban, an exemption will need approval in accordance with the instructions provided below. The exemption process is not required for one-time purchases. In the case of one-time purchases, the supplier should be required to take back any non-compliant packaging upon delivery. For existing UC contracts (contracts executed prior to January 1, 2020), enforcement of this ban (including a possible 16 Definition taken from STARS Technical Manual Version 2.1, Administrative Update Three, July 2017 Revised 1.2.2020 Page 23 of 28
exemption request) must be addressed during the next contract amendment, extension or as part of a new award.

3. Exemption Process
If a supplier claims to be unable to meet UC’s ban on expanded plastic foam material in packaging and UC still intends to do business with that supplier under a contract for goods, then the supplier must apply for an exemption to the ban. To do so, they must submit a completed foam packaging ban exemption form including all required documentation to substantiate claims in support of the exemption. Download the Request for Exemption Form from the UC Systemwide Forms & Documents page: https://www.ucop.edu/procurement-services/policiesforms/index.html.

Suppliers are to submit their Foam Packaging Ban Exemption Form to the Commodity Manager, Buyer or other employee authorized to contract for goods on behalf of UC. The designated Policy Exception Authority (see Glossary) must grant approval of all exemption requests. A copy of all submitted (approved and declined) Foam Packaging Ban Exemption Forms must be submitted to the appropriate Sustainability Office for reference.

11. Approval procedure updates and changes
Changes to this document must be approved by the UC Procurement Leadership Council (PLC) on the recommendation of the Sustainable Procurement Working Group.

12. Change Log
Approval
Date
Summary of
Changes
Approved
by
Product/Service
Categories Impacted
Start Date for Reporting
on New or Updated
Categories
1/2/19 Added Packaging
Foam and Policy
Exception Authority
definitions to
Glossary; added new
Section 10. Packaging
Foam Ban Guidance
UC
Procurement
Leadership
Council
All where product
packaging is involved.
n/a
8/10/18 Implementation of UC
Sustainable
Procurement
Guidelines
UC
Procurement
Leadership
Council
Electronics, Cleaning
Supplies, Copy Paper,
Paper Office Supplies
(other than copy paper),
Non-paper Office
Supplies, Toner, Indoor
Furniture, Compostable
7/1/2018
Revised 1.2.2020 Page 24 of 28
Food Service Ware, Water
Appliances/Fixtures
Revised 1.2.2020 Page 25 of 28
Appendix I - The “Dollar not Spent” and Green Spend
As with waste, the hierarchy of environmentally sustainable spend starts with reduce and reuse. As such, in the assessment of Green Spend, the “dollar not spent” can be included in Green spend calculations. This concept is addressed in the following section. Please note that calculating the “Dollar not Spent” for an individual campus is optional and not required as part of a sites annual Green Spend reporting (outlined in section 4. Green Spend above).

How to calculate the dollar not spent:

Items that are not purchased due to education and reduction activities and/or items that are reused on campus may be added to the Green Spend calculation at a location’s discretion. The process for adding these to the Green Spend calculation is as follows:

Green Spend purchase per category + approximate market value of goods not purchased x 100 Addressable spend per category + approximate market value of goods not purchased To determine the approximate value of goods not purchased, locations should use an appropriate combination of the below methodologies:

Method 1: Reuse (for example, goods reused from surplus operations) STEP 1. Determine the current market value of the goods were they to be purchased new.

STEP 2. Sum the product cost (quantity of goods x current market value of goods).

STEP 3. Include the current market value of goods in the numerator and denominator of the Green Spend calculation.

Where:

Current market value of goods is to be determined as the average purchase price of the equivalent good available on system wide contracts (or an average market value of equivalents if no system wide contract exists).

Method 1 Example: 4 desks and 3 desk chairs re-used on campus in surplus operations.

STEP 1: Determine the average cost for the 4 desks and 3 desk chairs from relevant system wide contracts (e.g. average cost of desk is $2000 each, average cost of chair is $1,500 each).

STEP 2. Sum the product cost of the items (4 x $2,000) + (3 x $1,500) = $12,500 STEP 3. Include the market value of the goods in the numerator and denominator for the calculation for green spend;
Green Spend purchase per category + $12,500 x 100
Addressable spend per category + $12,500
Revised 1.2.2020 Page 26 of 28
Method 2: Normalized Reduction in Purchase of Commodity Goods Where:

Product use (goods purchased) is a function of the number of staff/users.

STEP 1. Determine the quantity of goods purchased per driver in a baseline year:

Equation:

Baseline quantity of goods consumed
Baseline quantity of driver
For example:

Baseline # reams of copy paper purchased
Baseline # Full Time Equivalent staff
Baseline # gallons of cleaning products purchased
Baseline # square feet of cleaned space
STEP 2. Determine the quantity of goods purchased per driver in the current year using equations as above:

Equation:

Current quantity of goods purchased
Current quantity of driver
For example:

Current # reams of copy paper purchased
Current # Full Time Equivalent staff
Current # gallons of cleaning products purchased
Current # square feet of cleaned space
STEP 3. Determine the total difference in the quantities of goods purchased between the baseline and current years (savings) using the following equation:

Equation:

Current quantity of driver x (Baseline quantity of goods per driver - Current quantity of goods per driver)
Example:

Paper: Current number of FTEs x (Baseline number of reams of copy paper purchased per FTE - Current number of reams of copy paper purchased per FTE) Cleaning: Current number of sq. ft. cleaned x (Baseline number of gallons of cleaning product purchased per sq. ft. cleaned - Current number of gallons of cleaning product purchased per sq. ft. cleaned)
STEP 4. Determine the value of savings based on the current market value of goods.

STEP 5. Include the current market value of goods in the numerator and denominator of the Green Spend calculation.

Where:

Revised 1.2.2020 Page 27 of 28
Current market value of goods: is to be determined as the average price of the equivalent good available on system wide contracts (or an average market value of equivalents if no system wide contracts product available).

Note that if the purchase of one commodity is replaced with purchase of a different (but similar) commodity, this should not be considered a reduction.

Method 2 Example (Using copy paper as example good):

STEP 1: Determine the quantity of goods purchased per driver in baseline year Baseline year: 2005/06 FY
Quantity of goods purchased: 500 reams of copy paper/year Driver: 800 Full Time Equivalent staff
Number of reams of copy paper purchased per FTE: 500/800 = .625 reams per FTE STEP 2: Determine the quantity of goods purchased per driver in current year Current year: 2017/18 FY
Quantity of goods purchased: 500 reams of copy paper/year Driver: 1500 Full Time Equivalent staff
Number of reams of copy paper purchased per FTE: 500/1500 = .33 reams per FTE STEP 3: Determine savings per driver between baseline and current year Current # FTEs x (reduction in reams per FTE) = 1500 FTEs x (.625 reams per FTE - .33 reams per FTE)
= 421.5 reams of paper
STEP 4: Determine the average value of the savings/reduction Average value of a ream of paper in UC contract:$5
$5 x 421.5 reams of paper = $2,107.5
STEP 5: Add the value of the reduction to both the numerator and the denominator of the Green Spend equation for the product category
Green Spend purchase per category + $2,107.5 x 100
Addressable spend per category + $2,107.5
Method 3: Replacement of disposables with reusables
If successful methods have been found to identify reuse numbers where disposables were the standard business as usual, the market value of these disposables may be used in Green Spend calculations. An example of this might be the use of reusable to-go containers at dining locations where reusables are “checked out,” so specific numbers of reusables are available.

Revised 1.2.2020 Page 28 of 28
In these cases, the value of the disposables displaced may be considered Green Spend and added to the numerator and the denominator for the Green Spend calculation. The process for calculating this is as follows:

STEP 1. Determine number of goods displaced.

STEP 2. Determine value of goods displaced per unit.

STEP 3. Calculate total value of goods displaced (number of goods displaced) x (value of goods displaced per unit)
STEP 4. Include the current market value of goods in the numerator and denominator of the Green Spend Calculation.

Method 3 Example:

For this example, a dining operation uses reusable to-go containers and tracks their usage. 500 reusable to-go containers are used in a year.

STEP 1. Determine number of goods displaced
From the example above, 500 to-go containers are displaced STEP 2. Determine value of goods displaced per unit
Alternative compostable to-go containers cost $0.20 each (on system wide or local contract).

STEP 3. Calculate total value of goods displaced
500 compostable to-go containers x $0.20/container = $100 STEP 4: Add the value of the savings/reduction to both the numerator and the denominator of the Green Spend equation for the product category:

Green Spend purchase per category + $100 x 100
Addressable spend per category + $100
Proceed to the next tab, Instructions.

Shared Assessments Introduction
Campus IT environments are rapidly changing and the speed of cloud service adoption is increasing. Institutions looking for ways to do more with less see cloud services as a good way to save resources. As campuses deploy or identify cloud services, they must ensure the cloud services are appropriately assessed for managing the risks to the confidentiality, integrity and availability of sensitive institutional information and the PII of constituents. Many campuses have established a cloud security assessment methodology and resources to review cloud services for privacy and security controls. Other campuses don’t have sufficient resources to assess their cloud services in this manner. On the vendor side, many cloud services providers spend significant time responding to the individualized security assessment requests made by campus customers, often answering similar questions repeatedly. Both the provider and consumer of cloud services are wasting precious time creating, responding, and reviewing such assessments.

The Higher Education Community Vendor Assessment Toolkit (HECVAT) attempts to generalize higher education information security and data protections and issues for consistency and ease of use. Some institutions may have specific issues that must be addressed in addition to the general questions sets provided in the toolkit. It is anticipated that the HECVAT will be revised over time to account for changes in services provisioning and the information security and data protection needs of higher education institutions.

The Higher Education Community Vendor Assessment Toolkit:
● Helps higher education institutions ensure that vendor services are appropriately assessed for security and privacy needs, including some that are unique to higher education ● Allows a consistent, easily-adopted methodology for campuses wishing to reduce costs through vendor services without increasing risks
● Reduces the burden that service providers face in responding to requests for security assessments from higher education institutions
The Higher Education Community Vendor Assessment Toolkit is a suite of tools built around the original HECVAT (known now as HECVAT - Full) to allow institutions to adopt, implement, and maintain a consistent risk/security assessment program. Tools include:
● HECVAT - Triage: Used to initiate risk/security assessment requests - review to determine assessment requirements ● HECVAT - Full: Robust questionnaire used to assess the most critical data sharing engagements ● HECVAT - Lite: A lightweight questionnaire used to expedite process ● HECVAT - On-Premise: Unique questionnaire used to evaluate on-premise appliances and software The HECVAT (and Toolkit) was created by the Higher Education Information Security Council Shared Assessments Working Group. Its purpose is to provide a starting point for the assessment of vendor provided services and resources. Over time, the Shared Assessments Working Group hopes to create a framework that will establish a community resource where institutions and cloud services providers will share completed Higher Education Cloud Vendor Assessment Tool assessments.
https://www.educause.edu/hecvat
https://www.ren-isac.net/hecvat
(C) EDUCAUSE 2019
This work is licensed under a Creative Commons Attribution-Noncommercial-ShareAlike 4.0 International License (CC BYNC-SA 4.0).

This Higher Education Cloud Vendor Assessment Toolkit is brought to you by the Higher Education Information Security Council, and members from EDUCAUSE, Internet2, and the Research and Education Networking Information Sharing and Analysis Center (REN-ISAC).

General Information This section is self-explanatory; product specifics and contact information. GNRL-01 through GNRL-10 should be populated by the Vendor. GNRL-11 and GNRL-12 are for institution use only.

Qualifiers
Populate this section completely before continuing. Answers in this section can determine which sections will be required for this assessment. By answering "No" to Qualifiers, their matched sections become optional and are highlighted in orange.

Documentation Focused on external documentation, the institution is interested in the frameworks that guide your security strategy and what has been done to certify these implementations.

Company Overview This section is focused on company background, size, and business area experience.

Safeguards The remainder of the document consists of various safeguards, grouped generally by section.

Institution Any school, college, or university using the Higher Education Community Vendor Assessment Tool - Full.

Institution Data Zone The country/region in which an institution is located, including all laws and regulations in-scope within that country/region.

Figure 2:

Figure 1:

Higher Education Community Vendor Assessment Tool - Full - Instructions
Target Audience
These instructions are for vendors interested in providing the institution with a software and/or a service.

This worksheet should not be completed by an institution entity. The purpose of this worksheet is for the vendor to submit robust security safeguard information in regards to the product (software/service) being assessed in the institution's assessment process.

Document Layout
There are five main sections of the Higher Education Community Vendor Assessment Tool - Full, all listed below and outlined in more detail. This document is designed to have the first two sections populated first; after the Qualifiers section is completed it can be populated in any order.

Within each section, answer each question top-to-bottom. Some questions are nested and may be blocked out via formatting based on previous answers. Populating this document in the correct order improves efficiency.

Do not overwrite selection values (data validation) in column C of the HECVAT - Full tab.

In sections where vendor input is required there are only one or two columns that need modification, Vendor Answers and Additional Information, columns C and D respectively (see Figure 1 below). You will see that sometimes C and D are separate and other times are merged. If they are separate, C will be a selectable, drop-down box and any supporting information should be added to column D. If C and D are merged, the question is looking for the answer to be in narrative form. At the far right is a column titled “Guidance”. After answering questions, check this column to ensure you have submitted information/documentation to sufficiently answer the question. Use the “Additional Information” column to provide any requested details.

Optional Safeguards Based on Qualifiers
Not all questions are relevant to all vendors. Qualifiers are used to make whole sections optional to vendors depending on the scope of product usage and the data involved in the engagement being assessed. Sections that become optional have the section titles and questions highlighted in orange (see Figure 2).

Definitions and Data Zones
Vendor Data Zone The country/region in which a vendor is headquartered and/or serves its products/services, including all laws and regulations in-scope within that country/region.

Example A: If vendor ABC is headquartered and stores data in Canada, and provides services to only customers in Canada, ABC should state "Canada" in both Data Zone fields.

Example B: If vendor ABC is headquartered and stores data in Canada, and additionally provides services to customers in the United Kingdom, ABC may want to assure customers in the United Kingdom that their data is handled properly for their region. In that case, ABC should state "Canada" in the Vendor Data Zone and "United Kingdom" in the institution Data Zone.

Example C: If your security strategy is broad and doesn't fit this statement model, provide a brief summary in each field and the institution's Security Analyst can assess your response.

For Institution's Security Analysts

1. Raw vendor answers can be viewed on the HECVAT - Full tab.

2. To begin your assessment, review the Analyst Report tab, ensuring that you select the appropriate security standard used in your institution (cell B7) before you begin.

3. Review the Analyst Reference tab for guidance and question/response interpretation.

4. Select compliance states for the outstanding non-compliant or short-answer questions in column G. Once all subjective questions are evaluated and compliance indicated, move to the Summary Report tab.

5. To update the report's data, select Refresh All in the Data menu. Review details in the Summary Report and based on your assessment, followup with vendor for clarification(s) or add the Summary Report output to your Institution's reporting documents.

Proceed to the next tab, HECVAT - Full.

Data Reporting
To update data in the Report tabs, click Refresh All in the Menu tab. Input provided in the HECVAT tab is assessed a preliminary score pending institution's Security Analyst review.

Customers from different regions may expect vary protections of data (e.g. GDPR), this is the institution Data Zone. Vendors may handle data differently depending on the country or region where data is stored, this is the Vendor Data Zone.

As a vendor, if your security practices vary based on your region of operation, you may want to populate a HECVAT in the context for each security zone (strategy). That said, institutions from different data zones may still use vendor responses from other state Data Zones. If your security practices are the same across all regions of operations, indicate "All" in your Vendor Data Zone.

Version 2.11
DATE-01 Date
GNRL-01 Vendor Name
GNRL-02 Product Name
GNRL-03 Product Description
GNRL-04 Web Link to Product Privacy Notice
GNRL-05 Vendor Contact Name
GNRL-06 Vendor Contact Title
GNRL-07 Vendor Contact Email
GNRL-08 Vendor Contact Phone Number
GNRL-09 Vendor Data Zone
GNRL-10 Institution Data Zone
GNRL-11 Institution's Security Analyst/Engineer
GNRL-12 Assessment Contact
Vendor Answers Additional Information Guidance
QUAL-01 Does your product process protected health information (PHI) or any data covered by the Health Insurance Portability and Accountability Act? QUAL-02 Does the vended product host/support a mobile application? (e.g. app) QUAL-03 Will institution data be shared with or hosted by any third parties? (e.g. any entity not wholly-owned by your company is considered a third-party) QUAL-04 Do you have a Business Continuity Plan (BCP)?
QUAL-05 Do you have a Disaster Recovery Plan (DRP)?
Higher Education Community Vendor Assessment Tool (HECVAT) - Full HEISC Shared Assessments Working Group
General Information
In order to protect the Institution and its systems, vendors whose products and/or services will access and/or host institutional data must complete the Higher Education Community Vendor Assessment Toolkit (HECVAT). Throughout this tool, anywhere where the term data is used, this is an all-encompassing term including at least data and metadata. Answers will be reviewed by Institution security analysts upon submittal. This process will assist the institution in preventing breaches of protected information and comply with Institution policy, state, and federal law. This is intended for use by vendors participating in a Third Party Security Assessment and should be completed by a vendor. Review the Instructions tab for further guidance.

Instructions
mm/dd/yyyy
See Instructions tab for guidance
See Instructions tab for guidance
ticket#@yourdomain.edu
Vendor Name
Brief Description of the Product
http://www.vendor.domain/privacynotice
Vendor Contact Name
Product Name and Version Information
GNRL-01 through GNRL-08; populated by the Vendor
GNRL-11 and GNRL-12; populated by the Institution's Security Office Institution's Security Analyst/Engineer Name
Vendor Contact Title
555-555-5555
Vendor Contact E-mail Address
Step 1: Complete the Qualifiers section first. Step 2: Complete each section answering each set of questions in order from top to bottom; the built-in formatting logic relies on this order. Step 3: Submit the completed Higher Education Community Vendor Assessment Toolkit (HECVAT) to the Institution according to institutional procedures.

Qualifiers
The institution conducts Third Party Security Assessments on a variety of third parties. As such, not all assessment questions are relevant to each party. To alleviate complexity, a "qualifier" strategy is implemented and allows for various parties to utilize this common documentation instrument. Responses to the following questions will determine the need to answer additional questions below. 4 QUAL-06 Will data regulated by PCI DSS reside in the vended product? QUAL-07 Is your company a consulting firm providing only consultation to the Institution?
Vendor Answers Additional Information Guidance
DOCU-01 Have you undergone a SSAE 18 audit?
DOCU-02 Have you completed the Cloud Security Alliance (CSA) self assessment or CAIQ?
DOCU-03 Have you received the Cloud Security Alliance STAR certification? DOCU-04 Do you conform with a specific industry standard security framework? (e.g.

NIST Cybersecurity Framework, ISO 27001, etc.)
DOCU-05 Are you compliant with FISMA standards?
DOCU-06 Does your organization have a data privacy policy? Vendor Answers Additional Information Guidance
COMP-01 Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships.

Include circumstances that may involve
off-shoring or multi-national agreements.

COMP-02 Describe how long your organization has conducted business in this product area.

Include the number of years and in what
capacity.

COMP-03 Do you have existing higher education customers? COMP-04 Have you had a significant breach in the last 5 years? COMP-05 Do you have a dedicated Information Security staff or office? COMP-06 Do you have a dedicated Software and System Development team(s)? (e.g.

Customer Support, Implementation, Product Management, etc.) Documentation
Company Overview
5 COMP-07 Use this area to share information about your environment that will assist those who are assessing your company data security program.

Share any details that would help
information security analysts assess your
product.

Vendor Answers Additional Information Guidance
THRD-01
Describe how you perform security assessments of third party companies with which you share data (i.e. hosting providers, cloud services, PaaS, IaaS, SaaS, etc.). Provide a summary of your practices that assures that the third party will be subject to the appropriate standards regarding security, service recoverability, and confidentiality.

Ensure that all elements of THRD-01 are
clearly stated in your response.

THRD-02 Provide a brief description for why each of these third parties will have access to institution data.

If more space is needed to sufficiently
answer this question, provide reference to
the document or add it as an appendix.

THRD-03 What legal agreements (i.e. contracts) do you have in place with these third parties that address liability in the event of a data breach? Provide sufficient detail for each legal
agreement in place.

THRD-04
Describe or provide references to your third party management strategy or provide additional information that may help analysts better understand your environment and how it relates to third-party solutions.

Robust answers from the vendor improve
the quality and efficiency of the security
assessment process.

Vendor Answers Additional Information Guidance
CONS-01 Will the consulting take place on-premises?
CONS-02 Will the consultant require access to Institution's network resources? CONS-03 Will the consultant require access to hardware in the Institution's data centers?
CONS-04 Will the consultant require an account within the Institution's domain (@*.edu)?
CONS-05 Has the consultant received training on [sensitive, HIPAA, PCI, etc.] data handling?
CONS-06 Will any data be transferred to the consultant's possession? CONS-07 Is it encrypted (at rest) while in the consultant's possession? CONS-08 Will the consultant need remote access to the Institution's network or systems?
CONS-09 Can we restrict that access based on source IP address? Third Parties
Consulting
6 Vendor Answers Additional Information Guidance
APPL-01 Do you support role-based access control (RBAC) for end-users? APPL-02 Do you support role-based access control (RBAC) for system administrators? APPL-03 Can employees access customer data remotely?
APPL-04
Can you provide overall system and/or application architecture diagrams including a full description of the data communications architecture for all components of the system?
APPL-05 Does the system provide data input validation and error messages? APPL-06 Do you employ a single-tenant environment?
APPL-07 What operating system(s) is/are leveraged by the system(s)/application(s) that will have access to institution's data?
List all operating systems and the roles
that are fulfilled by each.

APPL-08 Have you or any third party you contract with that may have access or allow access to the institution's data experienced a breach?
APPL-09
Describe or provide a reference to additional software/products necessary to implement a functional system on either the backend or user-interface side of the system.

Describe the products and how they will
be implemented.

APPL-10
Describe or provide a reference to the overall system and/or application architecture(s), including appropriate diagrams. Include a full description of the data communications architecture for all components of the system.

Ensure that all parts of APPL-10 are
clearly stated in your response. Submit
architecture diagrams along with this fullypopulated HECVAT.

APPL-11 Are databases used in the system segregated from front-end systems? (e.g. web and application servers)
APPL-12 Describe or provide a reference to all web-enabled features and functionality of the system (i.e. accessed via a web-based interface).

Include both end-user and administrative
features and functions.

APPL-13 Are there any OS and/or web-browser combinations that are not currently supported?
APPL-14 Can your system take advantage of mobile and/or GPS enabled mobile devices?
Application/Service Security
7 APPL-15
Describe or provide a reference to the facilities available in the system to provide separation of duties between security administration and system administration functions.

Include a detailed description of how
security administration and system
administration authority is separated,
controls are verified, and logs are
reviewed regularly to ensure appropriate
use
APPL-16 Describe or provide a reference that details how administrator access is handled (e.g. provisioning, principle of least privilege, deprovisioning, etc.) Ensure that all parts of APPL-16 are
clearly stated in your response.

APPL-17 Describe or provide references explaining how tertiary services are redundant (i.e. DNS, ISP, etc.).

Ensure that all parts of APPL-18 are
clearly stated in your response. The
examples given are not exhaustive -
elaborate as necessary.

Vendor Answers Additional Information Guidance
AAAI-01 Can you enforce password/passphrase aging requirements? AAAI-02 Can you enforce password/passphrase complexity requirements [provided by the institution]?
AAAI-03 Does the system have password complexity or length limitations and/or restrictions?
AAAI-04 Do you have documented password/passphrase reset procedures that are currently implemented in the system and/or customer support? AAAI-05 Does your web-based interface support authentication, including standardsbased single-sign-on? (e.g. InCommon) AAAI-06 Are there any passwords/passphrases hard coded into your systems or products?
AAAI-07 Are user account passwords/passphrases visible in administration modules? AAAI-08 Are user account passwords/passphrases stored encrypted? AAAI-09 Does your application and/or user-frontend/portal support multi-factor authentication? (e.g. Duo, Google Authenticator, OTP, etc.) AAAI-10
Does your application support integration with other authentication and authorization systems? List which ones (such as Active Directory, Kerberos and what version) in Additional Info?
AAAI-11 Will any external authentication or authorization system be utilized by an application with access to the institution's data?
AAAI-12 Does the system (servers/infrastructure) support external authentication services (e.g. Active Directory, LDAP) in place of local authentication? AAAI-13 Does the system operate in a mixed authentication mode (i.e. external and local authentication)?
AAAI-14 Will any external authentication or authorization system be utilized by a system with access to institution data?
Authentication, Authorization, and Accounting
8 AAAI-15 Are audit logs available that include AT LEAST all of the following; login, logout, actions performed, and source IP address?
AAAI-16
Describe or provide a reference to the a) system capability to log security/authorization changes as well as user and administrator security events (i.e. physical or electronic)(e.g. login failures, access denied, changes accepted), and b) all requirements necessary to implement logging and monitoring on the system. Include c) information about SIEM/log collector usage.

Ensure that all elements of AAAI-16 are
clearly stated in your response.

AAAI-17
Describe or provide a reference to the retention period for those logs, how logs are protected, and whether they are accessible to the customer (and if so, how).

Ensure that all elements of AAAI-17 are
clearly stated in your response.

Vendor Answers Additional Information Guidance
BCPL-01 Describe or provide a reference to your Business Continuity Plan (BCP).

Provide a valid URL to your current BCP or
submit it along with this fully-populated
HECVAT.

BCPL-02 May the Institution review your BCP and supporting documentation? BCPL-03 Is an owner assigned who is responsible for the maintenance and review of the Business Continuity Plan?
BCPL-04 Is there a defined problem/issue escalation plan in your BCP for impacted clients?
BCPL-05 Is there a documented communication plan in your BCP for impacted clients? BCPL-06 Are all components of the BCP reviewed at least annually and updated as needed to reflect change?
BCPL-07 Has your BCP been tested in the last year?
BCPL-08 Does your organization conduct training and awareness activities to validate its employees understanding of their roles and responsibilities during a crisis? BCPL-09 Are specific crisis management roles and responsibilities defined and documented?
BCPL-10 Does your organization have an alternative business site or a contracted Business Recovery provider?
BCPL-11 Does your organization conduct an annual test of relocating to an alternate site for business recovery purposes?
BCPL-12 Is this product a core service of your organization, and as such, the top priority during business continuity planning?
Vendor Answers Additional Information Guidance
CHNG-01 Do you have a documented and currently followed change management process (CMP)?
Business Continuity Plan
Change Management
9 CHNG-02
Indicate all procedures that are implemented in your CMP. a.) An impact analysis of the upgrade is performed. b.) The change is appropriately authorized. c.) Changes are made first in a test environment. d.) The ability to implement the upgrades/changes in the production environment is limited to appropriate IT personnel.

Ensure that all parts of CHNG-02 are
clearly stated in your response.

CHNG-03 Will the Institution be notified of major changes to your environment that could impact the Institution's security posture?
CHNG-04 Do clients have the option to not participate in or postpone an upgrade to a new release?
CHNG-05
Describe or provide a reference to your solution support strategy in relation to maintaining software currency. (i.e. how many concurrent versions are you willing to run and support?)
Ensure that all relevant details pertaining
to CHNG-05 are clearly stated in your
response.

CHNG-06
Identify the most current version of the software. Detail the percentage of live customers that are utilizing the proposed version of the software as well as each version of the software currently in use.

Ensure that all parts of CHNG-06 are
clearly stated in your response.

CHNG-07 Does the system support client customizations from one release to another? CHNG-08
Does your organization ensure through policy and procedure (that is currently implemented) that only application software verifiable as authorized, tested, and approved for production, and having met all other requirements and reviews necessary for commissioning, is placed into production? CHNG-09 Do you have a release schedule for product updates? CHNG-10 Do you have a technology roadmap, for the next 2 years, for enhancements and bug fixes for the product/service being assessed?
CHNG-11 Is Institution involvement (i.e. technically or organizationally) required during product updates?
CHNG-12 Do you have policy and procedure, currently implemented, managing how critical patches are applied to all systems and applications? CHNG-13 Do you have policy and procedure, currently implemented, guiding how security risks are mitigated until patches can be applied? CHNG-14 Are upgrades or system changes installed during off-peak hours or in a manner that does not impact the customer?
CHNG-15 Do procedures exist to provide that emergency changes are documented and authorized (including after the fact approval)?
Data Vendor Answers Additional Information Guidance
10 DATA-01 Do you physically and logically separate Institution's data from that of other customers?
DATA-02
Will Institution's data be stored on any devices (database servers, file servers, SAN, NAS, …) configured with non-RFC 1918/4193 (i.e. publicly routable) IP addresses?
DATA-03 Is sensitive data encrypted in transport? (e.g. system-to-client) DATA-04 Is sensitive data encrypted in storage (e.g. disk encryption, at-rest)? DATA-05 Do you employ or allow any cryptographic modules that do not conform to the Federal Information Processing Standards (FIPS PUB 140-2)? DATA-06
Does your system employ encryption technologies when transmitting sensitive information over TCP/IP networks (e.g., SSH, SSL/TLS, VPN)? (e.g. system-tosystem and system-to-client) DATA-07 List all locations (i.e. city + datacenter name) where the institution's data will be stored?
Ensure that all parts of DATA-07 are
clearly stated in your response.

DATA-08 At the completion of this contract, will data be returned to the institution? DATA-09 Will the institution's data be available within the system for a period of time at the completion of this contract?
DATA-10 Can the institution extract a full backup of data? DATA-11 Are ownership rights to all data, inputs, outputs, and metadata retained by the institution?
DATA-12 Are these rights retained even through a provider acquisition or bankruptcy event?
DATA-13
In the event of imminent bankruptcy, closing of business, or retirement of service, will you provide 90 days for customers to get their data out of the system and migrate applications?
DATA-14 Describe or provide a reference to the backup processes for the servers on which the service and/or data resides.

If your strategy uses different processes
for services and data, ensure that all
strategies are clearly stated and
supported
DATA-15 Are backup copies made according to pre-defined schedules and securely stored and protected?
DATA-16 How long are data backups stored?
If your backup strategy uses varying
periods, ensure that each strategy is
clearly stated and supported.

DATA-17 Are data backups encrypted?
DATA-18
Do you have a cryptographic key management process (generation, exchange, storage, safeguards, use, vetting, and replacement), that is documented and currently implemented, for all system components? (e.g. database, system, web, etc.)
11 DATA-19 Do current backups include all operating system software, utilities, security software, application software, and data files necessary for recovery? DATA-20 Are you performing off site backups? (i.e. digitally moved off site) DATA-21 Are physical backups taken off site? (i.e. physically moved off site) DATA-22 Do backups containing the institution's data ever leave the Institution's Data Zone either physically or via network routing?
DATA-23
Do you have a media handling process, that is documented and currently implemented, including end-of-life, repurposing, and data sanitization procedures?
DATA-24 Does the process described in DATA-23 adhere to DoD 5220.22-M and/or NIST SP 800-88 standards?
DATA-25 Do procedures exist to ensure that retention and destruction of data meets established business and regulatory requirements?
DATA-26 Is media used for long-term retention of business data and archival purposes stored in a secure, environmentally protected area?
DATA-27 Will you handle data in a FERPA compliant manner? DATA-28 Is any institution data visible in system administration modules/tools? Vendor Answers Additional Information Guidance
DBAS-01 Does the database support encryption of specified data elements in storage? DBAS-02 Do you currently use encryption in your database(s)? Vendor Answers Additional Information Guidance
DCTR-01 Does your company own the physical data center where the Institution's data will reside?
DCTR-02 Does the hosting provider have a SOC 2 Type 2 report available? DCTR-03 Are the data centers staffed 24 hours a day, seven days a week (i.e., 24x7x365)?
DCTR-04 Do any of your servers reside in a co-located data center? DCTR-05 Are your servers separated from other companies via a physical barrier, such as a cage or hardened walls?
Datacenter
Database
12 DCTR-06 Does a physical barrier fully enclose the physical space preventing unauthorized physical contact with any of your devices? DCTR-07 Select the option that best describes the network segment that servers are connected to.

Provide a general summary of the
implemented networking strategy.

DCTR-08 Does this data center operate outside of the Institution's Data Zone? DCTR-09 Will any institution data leave the Institution's Data Zone? DCTR-10 List all datacenters and the cities, states (provinces), and countries where the Institution's data will be stored (including within the Institution's Data Zone).

Ensure that all parts of DCTR-10 are
clearly stated in your response.

DCTR-11 Are your primary and secondary data centers geographically diverse? DCTR-12 If outsourced or co-located, is there a contract in place to prevent data from leaving the Institution's Data Zone?
DCTR-13 What Tier Level is your data center (per levels defined by the Uptime Institute)?
Review the Uptime Institute's level/tier
direction provided on their website if you
need addition information to answer DCTR13.

DCTR-14 Is the service hosted in a high availability environment? DCTR-15 Is redundant power available for all datacenters where institution data will reside?
DCTR-16 Are redundant power strategies tested?
DCTR-17 Describe or provide a reference to the availability of cooling and fire suppression systems in all datacenters where institution data will reside.

Ensure that all parts of DCTR-17 are
clearly stated in your response.

DCTR-18 State how many Internet Service Providers (ISPs) provide connectivity to each datacenter where the institution's data will reside.

State the ISP provider(s) in addition to
the number of ISPs that provide
connectivity.

DCTR-19 Does every datacenter where the Institution's data will reside have multiple telephone company or network provider entrances to the facility? Vendor Answers Additional Information Guidance
DRPL-01 Describe or provide a reference to your Disaster Recovery Plan (DRP).

Provide a valid URL to your current DRP or
submit it along with this fully-populated
HECVAT.

DRPL-02 Is an owner assigned who is responsible for the maintenance and review of the DRP?
DRPL-03 Can the Institution review your DRP and supporting documentation? DRPL-04 Are any disaster recovery locations outside the Institution's Data Zone? Disaster Recovery Plan
13 DRPL-05 Does your organization have a disaster recovery site or a contracted Disaster Recovery provider?
DRPL-06 Does your organization conduct an annual test of relocating to this site for disaster recovery purposes?
DRPL-07 Is there a defined problem/issue escalation plan in your DRP for impacted clients?
DRPL-08 Is there a documented communication plan in your DRP for impacted clients? DRPL-09 Describe or provide a reference to how your disaster recovery plan is tested? (i.e. scope of DR tests, end-to-end testing, etc.)
Ensure that all elements of DRPL-09 are
clearly stated in your response.

DRPL-10
Has the Disaster Recovery Plan been tested in the last year? Please provide a summary of the results in Additional Information (including actual recovery time).

DRPL-11 Do the documented test results identify your organizations actual recovery time capabilities for technology and facilities?
DRPL-12 Are all components of the DRP reviewed at least annually and updated as needed to reflect change?
DRPL-13 Do you carry cyber-risk insurance to protect against unforeseen service outages, data that is lost or stolen, and security incidents? Vendor Answers Additional Information Guidance
FIDP-01 Are you utilizing a web application firewall (WAF)? FIDP-02 Are you utilizing a stateful packet inspection (SPI) firewall? FIDP-03 State and describe who has the authority to change firewall rules? Ensure that all parts of FIDP-03 are clearly stated in your response.

FIDP-04 Do you have a documented policy for firewall change requests? FIDP-05 Have you implemented an Intrusion Detection System (network-based)? FIDP-06 Have you implemented an Intrusion Prevention System (network-based)? FIDP-07 Do you employ host-based intrusion detection?
FIDP-08 Do you employ host-based intrusion prevention?
FIDP-09 Are you employing any next-generation persistent threat (NGPT) monitoring? Firewalls, IDS, IPS, and Networking
14 FIDP-10 Do you monitor for intrusions on a 24x7x365 basis? FIDP-11 Is intrusion monitoring performed internally or by a third-party service? In addition to stating your intrusion
monitoring strategy, provide a brief
summary of its implementation.

FIDP-12 Are audit logs available for all changes to the network, firewall, IDS, and IPS systems?
Vendor Answers Additional Information Guidance
MAPP-01 On which mobile operating systems is your software or service supported? Ensure that all supported operating
systems are listed - be sure to provide
version number, where relevant.

MAPP-02 Describe or provide a reference to the application's architecture and functionality.

Ensure that all elements of MAPP-02 are
clearly stated in your response. (i.e.
(architecture AND functionality are
MAPP-03 Is the application available from a trusted source (e.g., iTunes App Store, Android Market, BB World)?
MAPP-04 Does the application store, process, or transmit critical data? MAPP-05 Is Institution's data encrypted in transport?
MAPP-06 Is Institution's data encrypted in storage? (e.g. disk encryption, at-rest) MAPP-07 Does the mobile application support Kerberos, CAS, or Active Directory authentication?
MAPP-08 Will any of these systems be implemented on systems hosting the Institution's data?
MAPP-09 Does the application adhere to secure coding practices (e.g. OWASP, etc.)? MAPP-10 Has the application been tested for vulnerabilities by a third party? MAPP-11 State the party that performed the vulnerability test and the date it was conducted?
Ensure that all elements of MAPP-11 are
clearly stated in your response.

Vendor Answers Additional Information Guidance
PHYS-01 Does your organization have physical security controls and policies in place? PHYS-02 Are employees allowed to take home Institution's data in any form? PHYS-03 Are video monitoring feeds retained?
PHYS-04 Are video feeds monitored by datacenter staff?
Mobile Applications
Physical Security
15 PHYS-05 Are individuals required to sign in/out for installation and removal of equipment?
Vendor Answers Additional Information Guidance
PPPR-01 Can you share the organization chart, mission statement, and policies for your information security unit?
PPPR-02 Do you have a documented patch management process? PPPR-03 Can you accommodate encryption requirements using open standards? PPPR-04 Have your developers been trained in secure coding techniques? PPPR-05 Was your application developed using secure coding techniques? PPPR-06 Do you subject your code to static code analysis and/or static application security testing prior to release?
PPPR-07 Do you have software testing processes (dynamic or static) that are established and followed?
PPPR-08 Are information security principles designed into the product lifecycle? PPPR-09 Do you have a documented systems development life cycle (SDLC)? PPPR-10 Do you have a formal incident response plan?
PPPR-11 Will you comply with applicable breach notification laws? PPPR-12 Will you comply with the Institution's IT policies with regards to user privacy and data protection?
PPPR-13 Is your company subject to Institution's Data Zone laws and regulations? PPPR-14 Do you perform background screenings or multi-state background checks on all employees prior to their first day of work?
PPPR-15 Do you require new employees to fill out agreements and review policies? Policies, Procedures, and Processes
16 PPPR-16 Do you have documented information security policy? PPPR-17 Do you have an information security awareness program? PPPR-18 Is security awareness training mandatory for all employees? PPPR-19 Do you have process and procedure(s) documented, and currently followed, that require a review and update of the access-list(s) for privileged accounts? PPPR-20 Do you have documented, and currently implemented, internal audit processes and procedures?
Vendor Answers Additional Information Guidance
PROD-01 Do you incorporate customer feedback into security feature requests? PROD-02 Can you provide an evaluation site to the institution for testing? Vendor Answers Additional Information Guidance
QLAS-01 Provide a general summary of your Quality Assurance program.

Provide a valid URL to your Quality
Assurance program or submit it along with
this fully-populated HECVAT.

QLAS-02 Do you comply with ISO 9001?
QLAS-03
Will your company provide quality and performance metrics in relation to the scope of services and performance expectations for the services you are offering?
QLAS-04 Have you supplied products and/or services to the Institution (or its Campuses) in the last five years?
QLAS-05 Do you have a program to keep your customers abreast of higher education and/or industry issues?
Vendor Answers Additional Information Guidance
SYST-01 Are systems that support this service managed via a separate management network?
SYST-02 Do you have an implemented system configuration management process? (e.g. secure "gold" images, etc.)
SYST-03 Are employee mobile devices managed by your company's Mobile Device Management (MDM) platform?
SYST-04
Do you have a systems management and configuration strategy that encompasses servers, appliances, and mobile devices (company and employee owned)?
Quality Assurance
Systems Management & Configuration
Product Evaluation
17 Vendor Answers Additional Information Guidance
VULN-01 Are your applications scanned externally for vulnerabilities? VULN-02 Have your applications had an external vulnerability assessment in the last year?
VULN-03 Are your applications scanned for vulnerabilities prior to new releases? VULN-04 Are your systems scanned externally for vulnerabilities? VULN-05 Have your systems had an external vulnerability assessment in the last year? VULN-06 Describe or provide a reference to the tool(s) used to scan for vulnerabilities in your applications and systems.

Ensure that all elements of VULN-06 are
clearly stated in your response.

VULN-07 Will you provide results of security scans to the Institution? VULN-08
Describe or provide a reference to how you monitor for and protect against common web application security vulnerabilities (e.g. SQL injection, XSS, XSRF, etc.).

Ensure that all elements of VULN-08 are
clearly stated in your response.

VULN-09
Will you allow the institution to perform its own security testing of your systems and/or application provided that testing is performed at a mutually agreed upon time and date?
Vendor Answers Additional Information Guidance
HIPA-01 Do your workforce members receive regular training related to the HIPAA Privacy and Security Rules and the HITECH Act?
Refer to HIPAA regulations documentation
for supplemental guidance in this section.

HIPA-02 Do you monitor or receive information regarding changes in HIPAA regulations?
Refer to HIPAA regulations documentation
for supplemental guidance in this section.

HIPA-03 Has your organization designated HIPAA Privacy and Security officers as required by the Rules?
Refer to HIPAA regulations documentation
for supplemental guidance in this section.

HIPA-04 Do you comply with the requirements of the Health Information Technology for Economic and Clinical Health Act (HITECH)?
Refer to HIPAA regulations documentation
for supplemental guidance in this section.

HIPA-05 Do you have an incident response process and reporting in place to investigate any potential incidents and report actual incidents? Refer to HIPAA regulations documentation
for supplemental guidance in this section.

HIPA-06 Do you have a plan to comply with the Breach Notification requirements if there is a breach of data?
Refer to HIPAA regulations documentation
for supplemental guidance in this section.

HIPA-07 Have you conducted a risk analysis as required under the Security Rule? Refer to HIPAA regulations documentation for supplemental guidance in this section.

Vulnerability Scanning
HIPAA
18 HIPA-08 Have you identified areas of risks? Refer to HIPAA regulations documentation for supplemental guidance in this section.

HIPA-09 Have you taken actions to mitigate the identified risks? Refer to HIPAA regulations documentation for supplemental guidance in this section.

HIPA-10 Does your application require user and system administrator password changes at a frequency no greater than 90 days?
Refer to HIPAA regulations documentation
for supplemental guidance in this section.

HIPA-11 Does your application require a user to set their own password after an administrator reset or on first use of the account?
Refer to HIPAA regulations documentation
for supplemental guidance in this section.

HIPA-12 Does your application lock-out an account after a number of failed login attempts?
Refer to HIPAA regulations documentation
for supplemental guidance in this section.

HIPA-13 Does your application automatically lock or log-out an account after a period of inactivity?
Refer to HIPAA regulations documentation
for supplemental guidance in this section.

HIPA-14 Are passwords visible in plain text, whether when stored or entered, including service level accounts (i.e. database accounts, etc.)?
Refer to HIPAA regulations documentation
for supplemental guidance in this section.

HIPA-15 If the application is institution-hosted, can all service level and administrative account passwords be changed by the institution?
Refer to HIPAA regulations documentation
for supplemental guidance in this section.

HIPA-16 Does your application provide the ability to define user access levels? Refer to HIPAA regulations documentation for supplemental guidance in this section.

HIPA-17 Does your application support varying levels of access to administrative tasks defined individually per user?
Refer to HIPAA regulations documentation
for supplemental guidance in this section.

HIPA-18 Does your application support varying levels of access to records based on user ID?
Refer to HIPAA regulations documentation
for supplemental guidance in this section.

HIPA-19 Is there a limit to the number of groups a user can be assigned? Refer to HIPAA regulations documentation for supplemental guidance in this section.

HIPA-20 Do accounts used for vendor supplied remote support abide by the same authentication policies and access logging as the rest of the system? Refer to HIPAA regulations documentation
for supplemental guidance in this section.

HIPA-21 Does the application log record access including specific user, date/time of access, and originating IP or device?
Refer to HIPAA regulations documentation
for supplemental guidance in this section.

HIPA-22
Does the application log administrative activity, such user account access changes and password changes, including specific user, date/time of changes, and originating IP or device?
Refer to HIPAA regulations documentation
for supplemental guidance in this section.

HIPA-23 How long does the application keep access/change logs? Refer to HIPAA regulations documentation for supplemental guidance in this section.

HIPA-24 Can the application logs be archived? Refer to HIPAA regulations documentation for supplemental guidance in this section.

HIPA-25 Can the application logs be saved externally? Refer to HIPAA regulations documentation for supplemental guidance in this section.

HIPA-26 Does your data backup and retention policies and practices meet HIPAA requirements?
Refer to HIPAA regulations documentation
for supplemental guidance in this section.
19 HIPA-27 Do you have a disaster recovery plan and emergency mode operation plan? Refer to HIPAA regulations documentation for supplemental guidance in this section.

HIPA-28 Have the policies/plans mentioned above been tested? Refer to HIPAA regulations documentation for supplemental guidance in this section.

HIPA-29 Can you provide a HIPAA compliance attestation document? Refer to HIPAA regulations documentation for supplemental guidance in this section.

HIPA-30 Are you willing to enter into a Business Associate Agreement (BAA)? Refer to HIPAA regulations documentation for supplemental guidance in this section.

HIPA-31 Have you entered into a BAA with all subcontractors who may have access to protected health information (PHI)?
Refer to HIPAA regulations documentation
for supplemental guidance in this section.

Vendor Answers Additional Information Guidance
PCID-01 Do your systems or products store, process, or transmit cardholder (payment/credit/debt card) data?
Refer to PCI DSS Security Standards for
supplemental guidance in this section
PCID-02 Are you compliant with the Payment Card Industry Data Security Standard (PCI DSS)?
Refer to PCI DSS Security Standards for
supplemental guidance in this section
PCID-03 Do you have a current, executed within the past year, Attestation of Compliance (AoC) or Report on Compliance (RoC)?
Refer to PCI DSS Security Standards for
supplemental guidance in this section
PCID-04 Are you classified as a service provider? Refer to PCI DSS Security Standards for supplemental guidance in this section
PCID-05 Are you on the list of VISA approved service providers? Refer to PCI DSS Security Standards for supplemental guidance in this section
PCID-06 Are you classified as a merchant? If so, what level (1, 2, 3, 4)? Refer to PCI DSS Security Standards for supplemental guidance in this section
PCID-07 Describe the architecture employed by the system to verify and authorize credit card transactions.

Refer to PCI DSS Security Standards for
supplemental guidance in this section
PCID-08 What payment processors/gateways does the system support? Refer to PCI DSS Security Standards for supplemental guidance in this section
PCID-09 Can the application be installed in a PCI DSS compliant manner ? Refer to PCI DSS Security Standards for supplemental guidance in this section
PCID-10 Is the application listed as an approved PA-DSS application? Refer to PCI DSS Security Standards for supplemental guidance in this section
PCID-11 Does the system or products use a third party to collect, store, process, or transmit cardholder (payment/credit/debt card) data?
PCID-12
Include documentation describing the systems' abilities to comply with the PCI DSS and any features or capabilities of the system that must be added or changed in order to operate in compliance with the standards.

Refer to PCI DSS Security Standards for
supplemental guidance in this section

PCI DSS
20 CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS QUAL-01 Does your product process protected health information (PHI) or any data covered by the Health Insurance Portability and Accountability Act? CSC 13 Discovery 18.1.1 ID.GV-3 ID.GV-3 RA-2 QUAL-02 Does the vended product host/support a mobile application? (e.g. app) CSC 18 IA-2, IA-3, CM-3, SI-2 QUAL-03 Will institution data be shared with or hosted by any third parties? (e.g. any entity not wholly-owned by your company is considered a third-party) CSC 13 ID.AM-6, PR.AT-3 ID.AM-6, PR.AT-3 12.8 QUAL-04 Do you have a Business Continuity Plan (BCP)? CSC 10 17.1.2 PR.IP-9 PR.IP-9 AU-7, AU-9, IR-4 12.1 QUAL-05 Do you have a Disaster Recovery Plan (DRP)? CSC 10 17.1.2 PR.IP-9 PR.IP-9 CA-5, PL-2 12.1 QUAL-06 Will data regulated by PCI DSS reside in the vended product? CSC 13 18.1.1 ID.GV-3 ID.GV-3 RA-2 PCI Scope, Discovery
QUAL-07 Is your company a consulting firm providing only consultation to the Institution? CSC 14 PCI Scope
CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity
Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS
DOCU-01 Have you undergone a SSAE 18 audit? 15.2.1 SA-9 DOCU-02 Have you completed the Cloud Security Alliance (CSA) self assessment or CAIQ? 15.2.1 PE-2, PE-3, PE-5, PE-11, PE-13, PE14, SA-9 DOCU-03 Have you received the Cloud Security Alliance STAR certification? 15.2.1 PE-2, PE-3, PE-5, PE-11, PE-13, PE14, SA-9 DOCU-04 Do you conform with a specific industry standard security framework? (e.g.

NIST Cybersecurity Framework, ISO 27001, etc.) 18.1.1 SA-9 12.1, Scope DOCU-05 Are you compliant with FISMA standards? 18.1.1 SA-9 DOCU-06 Does your organization have a data privacy policy? §164.308(a)(1)(i) 18.1.4 ID.GV-3 ID.GV-3 SA-9 CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS COMP-01 Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships. 12.8 COMP-02 Describe how long your organization has conducted business in this product area.

12.8 COMP-03 Do you have existing higher education customers? 15.2.1 12.8 COMP-04 Have you had a significant breach in the last 5 years? COMP-05 Do you have a dedicated Information Security staff or office? 15.2.1 12.8, 12.5 COMP-06 Do you have a dedicated Software and System Development team(s)? (e.g.

Customer Support, Implementation, Product Management, etc.) 14.2.1 SA-3, SA-15, SC-2, PM-2, PM-10, SI-5,PM-3 12.8 HEISC Shared Assessments Working Group
Higher Education Community Vendor Assessment Tool (HECVAT) - Full - Standards Crosswalk Documentation
Company Overview
Qualifiers
21 COMP-07 Use this area to share information about your environment that will assist those who are assessing your company data security program. 15.2.1 12.8 CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity
Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS
THRD-01
Describe how you perform security assessments of third party companies with which you share data (i.e. hosting providers, cloud services, PaaS, IaaS, SaaS, etc.). Provide a summary of your practices that assures that the third party will be subject to the appropriate standards regarding security, service recoverability, and confidentiality.

CSC 13 15.1.3 ID.AM-6, PR-AT-3 3.8.2 MP-2, RA-3 12.8
THRD-02 Provide a brief description for why each of these third parties will have access to institution data. CSC 13 15.1.3 ID.AM-6, PR-AT-3 3.8.2 12.8 THRD-03 What legal agreements (i.e. contracts) do you have in place with these third parties that address liability in the event of a data breach? CSC 13 15.1.3 ID.GV-3 PS-3 12.8 THRD-04
Describe or provide references to your third party management strategy or provide additional information that may help analysts better understand your environment and how it relates to third-party solutions.

15.1.3 ID.AM-6, PR.AT-3 PS-5 12.8
CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity
Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS
CONS-01 Will the consulting take place on-premises? 15.2.1 ID.AM-6, PR.AT-3 CONS-02 Will the consultant require access to Institution's network resources? CSC 14 9.1.2 ID.AM-6, PR.AT-3 3.1.2, 3.1.3 AC-4 CONS-03 Will the consultant require access to hardware in the Institution's data centers? CSC 14 9.2.6 ID.AM-6, PR.AT-3 3.1.2
CONS-04 Will the consultant require an account within the Institution's domain (@*.edu)? CSC 14 ID.AM-6, PR.AT-3
CONS-05 Has the consultant received training on [sensitive, HIPAA, PCI, etc.] data handling? CSC 13 18.1.1 ID.AM-6, PR.AT-3
CONS-06 Will any data be transferred to the consultant's possession? CSC 13 9 ID.AM-6, PR.AT-3 3.8.2 MP-2 CONS-07 Is it encrypted (at rest) while in the consultant's possession? CSC 13 10 ID.AM-6, PR.AT-3 3.1.2, 3.1.19, 3.8.2 MP-2 CONS-08 Will the consultant need remote access to the Institution's network or systems? CSC 14 9 ID.AM-6, PR.AT-3
CONS-09 Can we restrict that access based on source IP address? 9 ID.AM-6, PR.AT-3 CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity
Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS
APPL-01 Do you support role-based access control (RBAC) for end-users? CSC 18 ID.AM-5 APPL-02 Do you support role-based access control (RBAC) for system administrators? CSC 2, CSC 3 11.2.6 ID.AM-5 APPL-03 Can employees access customer data remotely? CSC 14 6.2 PR.AC-3, PR.MA-2 3.1.2 AC-17; NIST SP 800-46 7.x APPL-04
Can you provide overall system and/or application architecture diagrams including a full description of the data communications architecture for all components of the system?
CSC16 9.1.1 PR.AC-4, PR.PT-3 3.4.9 CM-11 7.x
APPL-05 Does the system provide data input validation and error messages? CSC 18 ID.AM-5 APPL-06 Do you employ a single-tenant environment? CSC 12 6.2 PR.PT-3

3.1.12, 3.1.13, 3.1.14, 3.1.14,

3.1.15, 3.1.8, 3.1.20, 3.7.5,

3.8.2, 3.13.7
AC-3, CM-7; NIST SP 800-46
Application/Service Security
Consulting - Optional based on QUALIFIER response.

Third Parties
22 APPL-07 What operating system(s) is/are leveraged by the system(s)/application(s) that will have access to institution's data? CSC 2 12.5.1 PR.PT-3 AC-17; NIST SP 800-46 APPL-08 Have you or any third party you contract with that may have access or allow access to the institution's data experienced a breach? 16 12.8, 4.2 APPL-09
Describe or provide a reference to additional software/products necessary to implement a functional system on either the backend or user-interface side of the system.

CSC 2 12.5.1 ID.AM-2
APPL-10
Describe or provide a reference to the overall system and/or application architecture(s), including appropriate diagrams. Include a full description of the data communications architecture for all components of the system.

CSC 2 12.1.1 ID.AM-1, ID.AM-2, ID.AM-4 CA-9, SC-4 2.4
APPL-11 Are databases used in the system segregated from front-end systems? (e.g. web and application servers) CSC 13 12.1.4
APPL-12 Describe or provide a reference to all web-enabled features and functionality of the system (i.e. accessed via a web-based interface). CSC 7 12.1.1 APPL-13 Are there any OS and/or web-browser combinations that are not currently supported? CSC 7 12.5.1
APPL-14 Can your system take advantage of mobile and/or GPS enabled mobile devices? CSC 2
APPL-15
Describe or provide a reference to the facilities available in the system to provide separation of duties between security administration and system administration functions.

CSC 14 9.2.3, 12.1.4 PR.AC-4, PR.PT-3 3.1.4 AC-5 12.x
APPL-16 Describe or provide a reference that details how administrator access is handled (e.g. provisioning, principle of least privilege, deprovisioning, etc.) CSC 5 9.2 PR.AC-4, PR.PT-3 3.1.1, 3.1.5, 3.1.6, 3.7.1, 3.7.2 AC-2, AC-3, AC-6, MA-2, MA-3 7.x, 8.x APPL-17 Describe or provide references explaining how tertiary services are redundant (i.e. DNS, ISP, etc.). CSC 14 9.1.1 PR.AC-4 3.1.2
CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity
Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS
AAAI-01 Can you enforce password/passphrase aging requirements? CSC 16 9.2.3, 9.3.1, 9.4.3 PR.AC-1 3.5.6 IA-4 8.x AAAI-02 Can you enforce password/passphrase complexity requirements [provided by the institution]? CSC 16 9.2.3, 9.3.1, 9.4.3 PR.AC-1 3.5.7 IA-5(1) 8.x AAAI-03 Does the system have password complexity or length limitations and/or restrictions? CSC 16 9.2.3, 9.3.1, 9.4.3 PR.AC-1 8.x
AAAI-04 Do you have documented password/passphrase reset procedures that are currently implemented in the system and/or customer support? CSC 16 9.2.3, 9.3.1, 9.4.3 PR.AC-1 3.5.5, 3.5.8 IA-4 2.1, 8.x AAAI-05 Does your web-based interface support authentication, including standardsbased single-sign-on? (e.g. InCommon) CSC 16 9.1.1, 9.2.3, 9.3.1, 9.4.3 PR.AC-1 3.5.1 IA-2, IA-5 8.x AAAI-06 Are there any passwords/passphrases hard coded into your systems or products? CSC 16 9 2.1, 8.x
AAAI-07 Are user account passwords/passphrases visible in administration modules? CSC 16 9 PR.AC-1 8.x AAAI-08 Are user account passwords/passphrases stored encrypted? CSC 16 9 PR.AC-1 3.5.10 IA-5(1) 8.x AAAI-09 Does your application and/or user-frontend/portal support multi-factor authentication? (e.g. Duo, Google Authenticator, OTP, etc.) CSC 16 9 PR.AC-4 3.5.2, 3.5.3 IA-5 8.x AAAI-10
Does your application support integration with other authentication and authorization systems? List which ones (such as Active Directory, Kerberos and what version) in Additional Info?
CSC 16 9.4.3 PR.AC-1, PR.AC-4
Authentication, Authorization, and Accounting
23 AAAI-11 Will any external authentication or authorization system be utilized by an application with access to the institution's data? CSC 16 9 PR.AC-1, PR.AC-4 8.x AAAI-12 Does the system (servers/infrastructure) support external authentication services (e.g. Active Directory, LDAP) in place of local authentication? CSC 16 9.4.3 PR.AC-1, PR.AC-4 AAAI-13 Does the system operate in a mixed authentication mode (i.e. external and local authentication)? CSC 16 PR.AC-1, PR.AC-4
AAAI-14 Will any external authentication or authorization system be utilized by a system with access to institution data? CSC 16 PR.AC-1, PR.AC-4 3.1.1 8.x AAAI-15 Are audit logs available that include AT LEAST all of the following; login, logout, actions performed, and source IP address? CSC 6 12.4 PR.PT-1 3.1.7, 3.3.1 AC-6(1,3,9), AU-2, AU-2(3), AU-3,
AU-7, AU-9(4), AU-12, NIST 800-
92 10.1, 10.2,

10.3, 10.5,

10.6, 10.7
AAAI-16
Describe or provide a reference to the a) system capability to log security/authorization changes as well as user and administrator security events (i.e. physical or electronic)(e.g. login failures, access denied, changes accepted), and b) all requirements necessary to implement logging and monitoring on the system. Include c) information about SIEM/log collector usage.

CSC 6 12.4 PR.PT-1

3.1.7, 3.3.2, 3.3.3, 3.3.4, 3.3.5,

3.4.3, 3.7.1, 3.7.6, 3.10.4,

3.10.5 AU-2(3), AU-6, AU-12, AC-6(9),
CM-3, MA-2, MA-5, PE-3

10.1, 10.2,

10.3, 10.5,

10.6, 10.7, 9.x
AAAI-17
Describe or provide a reference to the retention period for those logs, how logs are protected, and whether they are accessible to the customer (and if so, how).

CSC 6 12.4 PR.PT-1 3.3.8, 3.3.9 AU-9 10.7
CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS BCPL-01 Describe or provide a reference to your Business Continuity Plan (BCP). CSC 10 17.1.1 PR.IP-9 3.12.2 AU-7, AU-9, IR-4, AC-5, CP-4, CP10; NIST SP 800-34 BCPL-02 May the Institution review your BCP and supporting documentation? CSC 10 PR.IP-9 3.12.2 AC-5, CP-4, CP-10; NIST SP 800- 34 BCPL-03 Is an owner assigned who is responsible for the maintenance and review of the Business Continuity Plan? CSC 10 17.1.1 PR.IP-9 3.12.2 AU-7, AU-9, IR-4, AC-5, CP-4, CP10; NIST SP 800-34 BCPL-04 Is there a defined problem/issue escalation plan in your BCP for impacted clients? CSC 10 17 PR.IP-9 3.12.2 AU-7, AU-9, IR-4, AC-5, CP-4, CP10; NIST SP 800-34 BCPL-05 Is there a documented communication plan in your BCP for impacted clients? CSC 10 17.1.2 PR.IP-9 3.12.2 AU-7, AU-9, IR-4, AC-5, CP-4, CP10; NIST SP 800-34 BCPL-06 Are all components of the BCP reviewed at least annually and updated as needed to reflect change? CSC 10 17.1.2 PR.IP-9 3.12.2 AU-7, AU-9, IR-4, AC-5, CP-4, CP10; NIST SP 800-34 BCPL-07 Has your BCP been tested in the last year? CSC 10 17.1.3 PR.IP-9 3.12.2 AU-7, AU-9, IR-4, AC-5, CP-4, CP10; NIST SP 800-34 BCPL-08 Does your organization conduct training and awareness activities to validate its employees understanding of their roles and responsibilities during a crisis? CSC 10 7.2.2, 17.1.3 PR.IP-9 3.2.1, 3.2.2 AT-3, AC-5, CP-4, CP-10; NIST SP 800-34 12.x BCPL-09 Are specific crisis management roles and responsibilities defined and documented? CSC 10 7.2.2, 16.1.1, 17.1.3 PR.IP-9 AC-5, CP-4, CP-10; NIST SP 800-34 12.x BCPL-10 Does your organization have an alternative business site or a contracted Business Recovery provider? CSC 10 17.2.1 PR.IP-9 AC-5, CP-4, CP-10; NIST SP 800-34 12.1 BCPL-11 Does your organization conduct an annual test of relocating to an alternate site for business recovery purposes? CSC 10 17.1.3 PR.IP-9 AC-5, CP-4, CP-10; NIST SP 800-34 12.1 BCPL-12 Is this product a core service of your organization, and as such, the top priority during business continuity planning? CSC 10 PR.IP-9 AC-5, CP-4, CP-10; NIST SP 800-34 12.1 CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS CHNG-01 Do you have a documented and currently followed change management process (CMP)? CSC 10 12.1.2 PR.IP-3 3.4.3, 3.4.4 CM-3, CM-4, CM-5

6.4, 6.4.5,

6.4.5.1,

6.4.5.2 CHNG-02
Indicate all procedures that are implemented in your CMP. a.) An impact analysis of the upgrade is performed. b.) The change is appropriately authorized. c.) Changes are made first in a test environment. d.) The ability to implement the upgrades/changes in the production environment is limited to appropriate IT personnel.

CSC 10 12.1.2 PR.IP-3, PR.DS-7 3.4.3, 3.4.4, 3.4.5 CM-3, CM-4, CM-5

6.4, 6.4.5,

6.4.5.1,

6.4.5.2 CHNG-03 Will the Institution be notified of major changes to your environment that could impact the Institution's security posture? CSC 10 12.1.2 CM-3, CM-4, CM-5 6.4, 12.8, 12.9 Business Continuity Plan
Change Management
24 CHNG-04 Do clients have the option to not participate in or postpone an upgrade to a new release? CSC 10 CM-3, CM-4, CM-5 12.1
CHNG-05
Describe or provide a reference to your solution support strategy in relation to maintaining software currency. (i.e. how many concurrent versions are you willing to run and support?)
CSC 2 CM-3, CM-4, CM-5 12.1, 12.8
CHNG-06
Identify the most current version of the software. Detail the percentage of live customers that are utilizing the proposed version of the software as well as each version of the software currently in use.

CSC 2 CM-3, CM-4, CM-5
CHNG-07 Does the system support client customizations from one release to another? CSC 10 CM-3, CM-4, CM-5 CHNG-08
Does your organization ensure through policy and procedure (that is currently implemented) that only application software verifiable as authorized, tested, and approved for production, and having met all other requirements and reviews necessary for commissioning, is placed into production? CSC 2 12.1.1 PR.DS-6 3.4.4 CM-3, CM-4, CM-5 12.1
CHNG-09 Do you have a release schedule for product updates? CSC 10 3.14.4 CM-3, CM-4, CM-5 CHNG-10 Do you have a technology roadmap, for the next 2 years, for enhancements and bug fixes for the product/service being assessed? CSC 2 CM-3, CM-4, CM-5 CHNG-11 Is Institution involvement (i.e. technically or organizationally) required during product updates? CM-3, CM-4, CM-5
CHNG-12 Do you have policy and procedure, currently implemented, managing how critical patches are applied to all systems and applications? CSC 2 12.6.1 CM-3, CM-4, CM-5 12.1, 12.8, 6.2 CHNG-13 Do you have policy and procedure, currently implemented, guiding how security risks are mitigated until patches can be applied? CSC 13 §164.308(a)(1)(ii)(B) 12.6.1 CM-3, CM-4, CM-5 12.2, 12.8 CHNG-14 Are upgrades or system changes installed during off-peak hours or in a manner that does not impact the customer? CSC 10 CM-3, CM-4, CM-5 12.1, 12.2, 12.8 CHNG-15 Do procedures exist to provide that emergency changes are documented and authorized (including after the fact approval)? CSC 10 12.1.2 PR.IP-3 CM-3, CM-4, CM-5 12.10, 12.8,

6.4 CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity
Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS
DATA-01 Do you physically and logically separate Institution's data from that of other customers? CSC 12 PR.AC-2, PR.IP-5 3.1.3, 3.8.1 AC-4, MP-2, MP-4 12.8 DATA-02
Will Institution's data be stored on any devices (database servers, file servers, SAN, NAS, …) configured with non-RFC 1918/4193 (i.e. publicly routable) IP addresses?
CSC 12 PR.AC-2, PR.IP-5 3.1.22 AC-22 12.8, 9.x
DATA-03 Is sensitive data encrypted in transport? (e.g. system-to-client) CSC 13 10.1.1 PR.DS-2 12.8, 4.1 DATA-04 Is sensitive data encrypted in storage (e.g. disk encryption, at-rest)? CSC 13 8.2.3, 10.1.1 PR.DS-1 3.1.19, 3.8.1 MP-2, AC-19(5) 12.8 DATA-05 Do you employ or allow any cryptographic modules that do not conform to the Federal Information Processing Standards (FIPS PUB 140-2)? CSC 13 8.2.3, 10.1.1 3.8.6, 3.13.11 12.1 DATA-06
Does your system employ encryption technologies when transmitting sensitive information over TCP/IP networks (e.g., SSH, SSL/TLS, VPN)? (e.g. system-tosystem and system-to-client)CSC 13 13.2 PR.DS-2 PE-2, PE-3, PE-5, MP-5 12.8, 4.1 DATA-07 List all locations (i.e. city + datacenter name) where the institution's data will be stored? CSC 1 3.8.1 MP-2 12.8, 9.x
DATA-08 At the completion of this contract, will data be returned to the institution? CSC 13 8.1.4 3.8.1 MP-2 12.8 DATA-09 Will the institution's data be available within the system for a period of time at the completion of this contract? CSC 13 8.1.4 12.8
DATA-10 Can the institution extract a full backup of data? 12.3.1 12.8 Data
25 DATA-11 Are ownership rights to all data, inputs, outputs, and metadata retained by the institution? CSC 13 8.1.2 3.8.1 12.8
DATA-12 Are these rights retained even through a provider acquisition or bankruptcy event? CSC 13 8.1.2 3.8.2 12.8
DATA-13
In the event of imminent bankruptcy, closing of business, or retirement of service, will you provide 90 days for customers to get their data out of the system and migrate applications?
CAC 13 8.1.2 3.8.1 12.8
DATA-14 Describe or provide a reference to the backup processes for the servers on which the service and/or data resides. CSC 10 12.3.1 PR.IP-4 3.8.9 CP-9 9.x DATA-15 Are backup copies made according to pre-defined schedules and securely stored and protected? CSC 10 12.3.1 PR.IP-4 3.8.9 CP-9 12.8 DATA-16 How long are data backups stored? CSC 10 12.3.1 PR.IP-4 3.8.9 CP-9 DATA-17 Are data backups encrypted? CSC 10 12.3.1 PR.DS-1, PR.IP-4 3.8.9 CP-9 DATA-18
Do you have a cryptographic key management process (generation, exchange, storage, safeguards, use, vetting, and replacement), that is documented and currently implemented, for all system components? (e.g. database, system, web, etc.)
CSC 10 10.1.2 3.13.10 SC-28, SC-13, FIPS PUB 140-2
DATA-19 Do current backups include all operating system software, utilities, security software, application software, and data files necessary for recovery? CSC 10 12.3.1 ID.AM-1, ID.AM-2, PR.IP-9 3.8.9 CP-9 DATA-20 Are you performing off site backups? (i.e. digitally moved off site) CSC 10 12.3.1 PR.IP-4 3.8.1, 3.8.9 CP-9 9.x DATA-21 Are physical backups taken off site? (i.e. physically moved off site) CSC 10 12.3.1 PR.IP-4 3.8.1, 3.8.5, 3.8.9 CP-9, MP-5 9.x DATA-22 Do backups containing the institution's data ever leave the Institution's Data Zone either physically or via network routing? CSC 13 12.3.1 3.8.9 CP-9, MP-5 12.8 DATA-23
Do you have a media handling process, that is documented and currently implemented, including end-of-life, repurposing, and data sanitization procedures?
CSC 13 8.3.1 PR.DS-3 3.7.1, 3.7.2, 3.8.3
CP-9 MP-6, NIST SP 800-60, NIST
SP 800-88, AC-2, AC-6, IA-4, PM2, PM-10, SI-5, MA-2, MA-3, MP-69.x DATA-24 Does the process described in DATA-23 adhere to DoD 5220.22-M and/or NIST SP 800-88 standards? CSC 13 8.3.1, 18.1.1 PR.DS-3 3.7.3, 3.8.3, AC-2, AC-6, IA-4, PM-2, PM-10, SI5, MA-2 DATA-25 Do procedures exist to ensure that retention and destruction of data meets established business and regulatory requirements? CSC 13 8.3.1, 18.1.1 PR.DS-3, ID.GV-3 3.7.3, 3.8.3, SI-12, AC-2, AC-6, IA-4, PM-2, PM10, SI-5, MA-2 DATA-26 Is media used for long-term retention of business data and archival purposes stored in a secure, environmentally protected area? CSC 13 8.3.1, 18.1.1 PR.DS-3 3.8.1, 3.8.2 AC-2, AC-6, IA-4, PM-2, PM-10, SI5 12.8, 9.x DATA-27 Will you handle data in a FERPA compliant manner? CSC 13 18.1.1 ID.GV-3 DATA-28 Is any institution data visible in system administration modules/tools? CSC 13, CSC 14 14.2.5 PR.AC-4 CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity
Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS
DBAS-01 Does the database support encryption of specified data elements in storage? CSC 13 10.1.1 PR.DS-1 DBAS-02 Do you currently use encryption in your database(s)? CSC 13 10.1.1 PR.DS-1, PR.DS-2 CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS DCTR-01 Does your company own the physical data center where the Institution's data will reside? CSC 14 11.1.1 PR.AC-2, PR.IP-5 12.8, 9.x
DCTR-02 Does the hosting provider have a SOC 2 Type 2 report available? CSC 13 11.1.1 DCTR-03 Are the data centers staffed 24 hours a day, seven days a week (i.e., 24x7x365)? CSC 3 17.2.1
DCTR-04 Do any of your servers reside in a co-located data center? CSC 3, CSC 14 AC-4 12.8 DCTR-05 Are your servers separated from other companies via a physical barrier, such as a cage or hardened walls? CSC 3, CSC 14 13.1.2 PR.AC-2 9.x DCTR-06 Does a physical barrier fully enclose the physical space preventing unauthorized physical contact with any of your devices? CSC 14 11.1.1, 11.1.2 PR.AC-2 3.8.1, 3.8.2 9.x Database
Datacenter
26 DCTR-07 Select the option that best describes the network segment that servers are connected to. CSC 9 PR.AC-5 3.1.3
DCTR-08 Does this data center operate outside of the Institution's Data Zone? CSC 12 18.1.1 12.8 DCTR-09 Will any institution data leave the Institution's Data Zone? CSC 12 18.1.1 12.9 DCTR-10 List all datacenters and the cities, states (provinces), and countries where the Institution's data will be stored (including within the Institution's Data Zone). CSC 12 11.2.1 12.8 DCTR-11 Are your primary and secondary data centers geographically diverse? CSC 10 11.1.4 12.8 DCTR-12 If outsourced or co-located, is there a contract in place to prevent data from leaving the Institution's Data Zone? CSC 12 18.1.1 12.8 DCTR-13 What Tier Level is your data center (per levels defined by the Uptime Institute)? 17.1.1
DCTR-14 Is the service hosted in a high availability environment? CSC 10 17.1.1 PR.DS-4 DCTR-15 Is redundant power available for all datacenters where institution data will reside? 17.2.1 PR.DS-4
DCTR-16 Are redundant power strategies tested? 17.1.3 PR.DS-4 DCTR-17 Describe or provide a reference to the availability of cooling and fire suppression systems in all datacenters where institution data will reside. 17.2.1 PE-2, PE-3, PE-5, PE-11, PE-13, PE14 DCTR-18 State how many Internet Service Providers (ISPs) provide connectivity to each datacenter where the institution's data will reside. CSC 10 17.2.1 PR.DS-4 PE-2, PE-3, PE-5, PE-11, PE-13, PE14 12.8 DCTR-19 Does every datacenter where the Institution's data will reside have multiple telephone company or network provider entrances to the facility? CSC 13 17.2.1 PR.DS-4 PE-2, PE-3, PE-5, PE-11, PE-13, PE14 12.8 CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity
Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS
DRPL-01 Describe or provide a reference to your Disaster Recovery Plan (DRP). CSC 10 17.1.1 PR.IP-9 3.12.2 AC-5, CP-4, CP-10; NIST SP 800- 34 12.8
DRPL-02 Is an owner assigned who is responsible for the maintenance and review of the DRP? CSC 10 16.1.1, 17.1.1 PR.IP-9 3.12.2 AC-5, CP-4, CP-10; NIST SP 800- 34 12.8
DRPL-03 Can the Institution review your DRP and supporting documentation? CSC 10 PR.IP-9 3.12.2 AC-5, CP-4, CP-10; NIST SP 800- 34 12.8
DRPL-04 Are any disaster recovery locations outside the Institution's Data Zone? CSC 10, CSC 12 17.1.1 PR.IP-9 AC-5, CP-4, CP-10; NIST SP 800- 34 12.8
DRPL-05 Does your organization have a disaster recovery site or a contracted Disaster Recovery provider? CSC 10 17.2.1 PR.IP-9 AC-5, CP-4, CP-10; NIST SP 800- 34 DRPL-06 Does your organization conduct an annual test of relocating to this site for disaster recovery purposes? CSC 10 17.1.3 PR.IP-9 AC-5, CP-4, CP-10; NIST SP 800-34 DRPL-07 Is there a defined problem/issue escalation plan in your DRP for impacted clients? CSC 10 PR.IP-9 3.12.2 AC-5, CP-4, CP-10; NIST SP 800-34 12.8 DRPL-08 Is there a documented communication plan in your DRP for impacted clients? CSC 10 17.1.2 PR.IP-9 3.12.2 AC-5, CP-4, CP-10; NIST SP 800- 34 12.8
DRPL-09 Describe or provide a reference to how your disaster recovery plan is tested? (i.e. scope of DR tests, end-to-end testing, etc.) CSC 10 17.1.3 PR.IP-9 3.12.2 AC-5, CP-4, CP-10; NIST SP 800-34 DRPL-10
Has the Disaster Recovery Plan been tested in the last year? Please provide a summary of the results in Additional Information (including actual recovery time).

CSC 10 17.1.3 PR.IP-9 3.12.2 AC-5, CP-4, CP-10; NIST SP 800- 34 DRPL-11 Do the documented test results identify your organizations actual recovery time capabilities for technology and facilities? CSC 10 7.1.3 PR.IP-9 AC-5, CP-4, CP-10; NIST SP 800-34 12.8 DRPL-12 Are all components of the DRP reviewed at least annually and updated as needed to reflect change? CSC 10 17.1.1 PR.IP-9 3.12.2 AC-5, CP-4, CP-10; NIST SP 800-34 DRPL-13 Do you carry cyber-risk insurance to protect against unforeseen service outages, data that is lost or stolen, and security incidents? 3.6.2 AC-5, CP-4, CP-10; NIST SP 800-34 12.8 Disaster Recovery Plan
27 CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity
Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS
FIDP-01 Are you utilizing a web application firewall (WAF)? CSC 9 13.1.1 PR.DS-5 1.1 FIDP-02 Are you utilizing a stateful packet inspection (SPI) firewall? CSC 9 13.1.1 PR.DS-5 1.1 FIDP-03 State and describe who has the authority to change firewall rules? CSC 9 13 PR.AC-5 1.1 FIDP-04 Do you have a documented policy for firewall change requests? CSC 9 12.1.2 PR.AC-5 1.1 FIDP-05 Have you implemented an Intrusion Detection System (network-based)? CSC 19 13.1.2 DE.CM-1 3.6.1, 3.14.6, 3.14.7 IR-2, IR-4, IR-5 11.4 FIDP-06 Have you implemented an Intrusion Prevention System (network-based)? CSC 19 13.1.2 DE.CM-1 3.6.1, 3.14.6, 3.14.7 IR-2, IR-4, IR-5 11.4 FIDP-07 Do you employ host-based intrusion detection? CSC 19 13.1.2 DE.CM-1 3.6.1, 3.14.6, 3.14.7 IR-2, IR-4, IR-5 11.4 FIDP-08 Do you employ host-based intrusion prevention? CSC 19 13.1.2 DE.CM-1 3.6.1, 3.14.6, 3.14.7 IR-2, IR-4, IR-5 11.4 FIDP-09 Are you employing any next-generation persistent threat (NGPT) monitoring? CSC 19 12.4.1 3.6.1, 3.14.6, 3.14.7 IR-2, IR-4, IR-5 11.5 FIDP-10 Do you monitor for intrusions on a 24x7x365 basis? CSC 19 12.4.1 DE.CM-1, DE.CM-2, DE.CM-7 3.6.1, 3.14.6, 3.14.7 IR-2, IR-4, IR-5 11.4 FIDP-11 Is intrusion monitoring performed internally or by a third-party service? CSC 6, CSC 19 12.4.1 DE.CM-1, DE.CM-2, DE.CM-7 3.6.1, 3.14.6, 3.14.7 IR-2, IR-4, IR-5 11.4, 12.8 FIDP-12 Are audit logs available for all changes to the network, firewall, IDS, and IPS systems? CSC 6 12.4.1 DE.AE-1, DE.CM-1, PR.PT-4 3.3.1 AU-2

1.1, 10.8,

10.6, 10.3,
10 2 11 4
CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity
Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS
MAPP-01 On which mobile operating systems is your software or service supported? CSC 18 MAPP-02 Describe or provide a reference to the application's architecture and functionality. CSC 3 DE.CM-7
MAPP-03 Is the application available from a trusted source (e.g., iTunes App Store, Android Market, BB World)? CSC 18 DE.CM-7
MAPP-04 Does the application store, process, or transmit critical data? CSC 13, CSC 18 8.2.1; 8.2.3 DE.CM-7, PR.DS-2 MAPP-05 Is Institution's data encrypted in transport? CSC 13 8.2.3 DE.CM-7, PR.DS-2 3.1.19 AC-19(5) 4.1 MAPP-06 Is Institution's data encrypted in storage? (e.g. disk encryption, at-rest) CSC 14 8.2.3 DE.CM-7, PR.DS-1 MAPP-07 Does the mobile application support Kerberos, CAS, or Active Directory authentication? CSC 16 9.4.2
MAPP-08 Will any of these systems be implemented on systems hosting the Institution's data? CSC 16
MAPP-09 Does the application adhere to secure coding practices (e.g. OWASP, etc.)? CSC 18 14.2.1 DE.CM-7 MAPP-10 Has the application been tested for vulnerabilities by a third party? CSC 18 12.7.1, 18.2.1 DE.CM-7, DE.CM-8, ID.RA-1 MAPP-11 State the party that performed the vulnerability test and the date it was conducted? CSC 18 12.7.1, 18.2.1 DE.CM-7, DE.CM-8, ID.RA-1 CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS PHYS-01 Does your organization have physical security controls and policies in place? CSC 3 11.1.1 PR.AC-2, PR.AT-5, PR.IP-5, DE.CM-2

3.8.2, 3.10.1, 3.10.2, 3.10.5,

3.10.6, 3.12.1 MP-4, PE-2, PE-5, PE-6, PE-17 9.x
PHYS-02 Are employees allowed to take home Institution's data in any form? CSC 13 8.2.3 PR.AC-2, PR.AC-4, PR.DS-1, PR.DS-3, PR.DS-5 3.8.1, 3.8.5, 3.8.7 MP-2, MP-5, MP-7 12.1, 9.x PHYS-03 Are video monitoring feeds retained? CSC 3 11.1.2, 11.1.3 DE.CM-2 3.10.2 PE-6 9.x PHYS-04 Are video feeds monitored by datacenter staff? CSC 3 11.1.2, 11.1.3 DE.CM-2 3.10.2 PE-6 9.x PHYS-05 Are individuals required to sign in/out for installation and removal of equipment? CSC 14 11.1.2 PR.DS-3 3.7.3, 3.8.1, 3.8.5, 3.8.7,

3.10.3 MP-2, MP-5, MP-7 9.x
Physical Security
Mobile Applications
Firewalls, IDS, IPS, and Networking
28 CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity
Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS
PPPR-01 Can you share the organization chart, mission statement, and policies for your information security unit? 5.1.1 ID.GV-2 3.9.1, 3.9.2 PM-2, PM-10, SI-5, CA-5, PM-1 12.4, 12.5 PPPR-02 Do you have a documented patch management process? CSC 4 12.6.1 PR.IP-12 CA-5, PM-1 6.4.5 PPPR-03 Can you accommodate encryption requirements using open standards? CSC 13 10.1.1, 18.1.5 CA-5, PM-1 PPPR-04 Have your developers been trained in secure coding techniques? CSC 4, CSC 17 14.2.1 CA-5, PM-1 12.6, 6.5 PPPR-05 Was your application developed using secure coding techniques? CSC 4 14.2.1 CA-5, PM-1 6.3 PPPR-06 Do you subject your code to static code analysis and/or static application security testing prior to release? CSC 4 14.2.1, 14.2.5, 14.2.8 DE.CM-8, RS.MI-3 CA-5, PM-1 6.3.2 PPPR-07 Do you have software testing processes (dynamic or static) that are established and followed? CSC 4 14.2.8 PR.DS-7 3.12.2 CA-5, PM-1 6.3.2, 6.4.5.3 PPPR-08 Are information security principles designed into the product lifecycle? CSC 4 14.2.1 3.13.2 CA-5, PM-1 6.3, 6.3.1 PPPR-09 Do you have a documented systems development life cycle (SDLC)? CSC 4 14.2.1 PR.IP-2 CM-3, SA-15, SA-3, SA-8, SC-2, CA-5, PM-1 6.3.2
PPPR-10 Do you have a formal incident response plan? CSC 19 16.1.5 PR.IP-9 3.6.1, 3.12.2 CA-5, PM-1, IR-4, IR-5, IR-7, IR-8 12.10, 12.8,

12.9 PPPR-11 Will you comply with applicable breach notification laws? CSC 19 18.1.1 ID.GV-3 3.6.2, CA-5, PM-1, IR-4, IR-5, IR-6, IR-7, IR-8 12.8
PPPR-12 Will you comply with the Institution's IT policies with regards to user privacy and data protection? CSC 13 18.1.1 3.6.2 CA-2, SA-15, CA-5, PM-1, IR-4, IR5, IR-6, R-7, IR-8 12.8 PPPR-13 Is your company subject to Institution's Data Zone laws and regulations? CSC 19 18.1.1 ID.GV-3 CA-5, PM-1 PPPR-14 Do you perform background screenings or multi-state background checks on all employees prior to their first day of work? CSC 5 7.1.1 PR.IP-11 3.9.1 CA-5, PM-1, PS-3 12.7 PPPR-15 Do you require new employees to fill out agreements and review policies? CSC 17 7.1.2 PR.IP-11 CA-5, PM-1 12.6, 7.x, 8.x,

9.x
PPPR-16 Do you have documented information security policy? CSC 17 §164.308(a)(1)(i) 5.1.1 ID.GV-3 CA-5, PM-1 12.1, 5.4 (?) PPPR-17 Do you have an information security awareness program? CSC 17 §164.308(a)(5)(i) 7.2.2 PR.AT-1 3.2.1 AT-2, CA-5, PM-1 12.6 PPPR-18 Is security awareness training mandatory for all employees? CSC 17 §164.308(a)(5)(i) 7.2.2 PR.AT-1 3.2.1, 3.2.2, 3.2.3 AT-2, AT-3, CA-5, PM-1 12.6 PPPR-19 Do you have process and procedure(s) documented, and currently followed, that require a review and update of the access-list(s) for privileged accounts? CSC 17 9.2.5 PR.AC-4, PR.PT-3 3.1.7 CA-5, PM-1 12.1, 12.5, 12.6 PPPR-20 Do you have documented, and currently implemented, internal audit processes and procedures? 12.7.1
CA-5, PM-1, PS-4, PS-5, PE-2, PE3, PE-5, AC-6, RA-3, SA-8, CA-2, NIST SP 800-37; NIST SP 800-39;
NIST SP 800-115; NIST SP 800-
137
CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS PROD-01 Do you incorporate customer feedback into security feature requests? PROD-02 Can you provide an evaluation site to the institution for testing? PR.DS-7 CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS QLAS-01 Provide a general summary of your Quality Assurance program. CSC 13 QLAS-02 Do you comply with ISO 9001? CSC 13 18.1.1
QLAS-03
Will your company provide quality and performance metrics in relation to the scope of services and performance expectations for the services you are offering?
CSC 13
Quality Assurance
Product Evaluation
Policies, Procedures, and Processes
29 QLAS-04 Have you supplied products and/or services to the Institution (or its Campuses) in the last five years?
QLAS-05 Do you have a program to keep your customers abreast of higher education and/or industry issues? CSC 17
CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity
Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS
SYST-01 Are systems that support this service managed via a separate management network? CSC 12 13.1.1 PR.PT-4 3.1.3 AC-4
SYST-02 Do you have an implemented system configuration management process? (e.g. secure "gold" images, etc.) CSC 3 PR.IP-1 3.4.1, 3.4.2, 3.4.3 CM-2, CM-3, CM-6, CM-8 SYST-03 Are employee mobile devices managed by your company's Mobile Device Management (MDM) platform? CSC 3 6.2.1 3.13.13
SYST-04
Do you have a systems management and configuration strategy that encompasses servers, appliances, and mobile devices (company and employee owned)?
CSC 3 12.1.1 PR.IP-1, PR.IP-2 3.1.18, 3.7.1, 3.13.13 CM-2, CM-6, CM-3, AC-19, MA-2 CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS VULN-01 Are your applications scanned externally for vulnerabilities? CSC 4 12.6.1 DE.CM-8 3.11.1, 3.11.2, 3.11.3 SI-2 11.2 VULN-02 Have your applications had an external vulnerability assessment in the last year? CSC 4 12.6.1 DE.CM-8 3.11.1, 3.11.2, 3.11.3 SI-2 11.2 VULN-03 Are your applications scanned for vulnerabilities prior to new releases? CSC 4 DE.CM-8 3.11.1, 3.11.2, 3.11.3 SI-2 11.2 VULN-04 Are your systems scanned externally for vulnerabilities? CSC 4 DE.CM-8 3.11.1, 3.11.2, 3.11.3 SI-2 11.2 VULN-05 Have your systems had an external vulnerability assessment in the last year? CSC 4 DE.CM-8 SI-2 11.2 VULN-06 Describe or provide a reference to the tool(s) used to scan for vulnerabilities in your applications and systems. CSC 4 DE.CM-8 3.11.1, 3.11.2, 3.11.3 SI-2 11.2 VULN-07 Will you provide results of security scans to the Institution? CSC 4 DE.CM-8 SI-2 11.2 VULN-08
Describe or provide a reference to how you monitor for and protect against common web application security vulnerabilities (e.g. SQL injection, XSS, XSRF, etc.).

CSC 7, CSC 18 12.6.1 ID.RA-1, DE.CM-8, PR.IP-12 3.11.1, 3.11.2, 3.11.3, 3.14.2 SI-2 11.2, 11.3 VULN-09
Will you allow the institution to perform its own security testing of your systems and/or application provided that testing is performed at a mutually agreed upon time and date?
CSC 20 18.2.1 DE.CM-8 3.11.1, 3.11.2, 3.11.3 SI-2 11.2, 12.8 CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS HIPA-01 Do your workforce members receive regular training related to the HIPAA Privacy and Security Rules and the HITECH Act? CSC 17 §164.308(a)(5)(i) 18.1.1, 7.2.2 ID.GV-3 3.2.2 AT-3 HIPA-02 Do you monitor or receive information regarding changes in HIPAA regulations? CSC 13 §164.316(b)(2)(iii) 18.1.1 ID.GV-3
HIPA-03 Has your organization designated HIPAA Privacy and Security officers as required by the Rules? CSC 17 §164.308(a)(2) 18.1.1 ID.GV-3 HIPA-04 Do you comply with the requirements of the Health Information Technology for Economic and Clinical Health Act (HITECH)? CSC 13 18.1.1 ID.GV-3 HIPA-05 Do you have an incident response process and reporting in place to investigate any potential incidents and report actual incidents? CSC 19 §164.308(a)(6)(i) 16.1.1 ID.GV-3 3.6.1, 3.14.1 IR-2, IR-4, IR-5, IR-7 12.10, 10.10 HIPA-06 Do you have a plan to comply with the Breach Notification requirements if there is a breach of data? CSC 19 §164.308(a)(6)(ii) 16.1.2, 16.1.5, 18.1.1 ID.GV-3 3.6.2, 3.12.2 IR-6 12.8 HIPA-07 Have you conducted a risk analysis as required under the Security Rule? CSC 13 §164.308(a)(1)(i) ID.GV-3 12.2 HIPA-08 Have you identified areas of risks? CSC 4 §164.308(a)(1)(i), §164.308(a)(1)(ii)(A) ID.GV-3 12.2
HIPAA
Systems Management & Configuration
Vulnerability Scanning
30 HIPA-09 Have you taken actions to mitigate the identified risks? CSC 4 §164.308(a)(1)(ii)(B) ID.GV-3 12.2 HIPA-10 Does your application require user and system administrator password changes at a frequency no greater than 90 days? CSC 16 §164.308(a)(5)(ii)(D) 9.4.3 ID.GV-3 3.5.6 IA-4 HIPA-11 Does your application require a user to set their own password after an administrator reset or on first use of the account? CSC 16 §164.308(a)(5)(ii)(D) 9.4.3 ID.GV-3 3.5.9 IA-5(1) HIPA-12 Does your application lock-out an account after a number of failed login attempts? CSC 16
§164.308(a)(4),
§164.312(a)(2)(ii),
§164.312(a)(2)(iii)

9.4.3 ID.GV-3 3.1.8 AC-7
HIPA-13 Does your application automatically lock or log-out an account after a period of inactivity? CSC 16
§164.308(a)(4),
§164.312(a)(2)(ii),
§164.312(a)(2)(iii)

9.4.3 ID.GV-3 3.1.10, 3.1.11 AC-11, AC-11(1), AC-12 8.x HIPA-14 Are passwords visible in plain text, whether when stored or entered, including service level accounts (i.e. database accounts, etc.)? CSC 16 §164.308(a)(4), §164.312(d) 9.4.3 ID.GV-3 3.5.10 IA-5(1) 8.x
HIPA-15 If the application is institution-hosted, can all service level and administrative account passwords be changed by the institution? CSC 16 §164.308(a)(4), §164.312(d) ID.GV-3 8.x
HIPA-16 Does your application provide the ability to define user access levels? CSC 16 §164.308(a)(4),
§164.312(a)(1),
§164.312(a)(2)(i),
§164.312(d)
ID.GV-3 3.1.2 8.x
HIPA-17 Does your application support varying levels of access to administrative tasks defined individually per user? CSC 16, 5
§164.308(a)(4),
§164.312(a)(1),
§164.312(a)(2)(i),
§164.312(d)

9.1.1 ID.GV-3 3.1.2, 3.1.5 8.x
HIPA-18 Does your application support varying levels of access to records based on user ID? CSC 16
§164.308(a)(4),
§164.312(a)(1),
§164.312(a)(2)(i),
§164.312(d)

9.2.3 ID.GV-3 3.1.2 8.x
HIPA-19 Is there a limit to the number of groups a user can be assigned? CSC 16 §164.308(a)(4), §164.312(a)(1) 9.2.3 ID.GV-3
HIPA-20 Do accounts used for vendor supplied remote support abide by the same authentication policies and access logging as the rest of the system? CSC 6, CSC 16 §164.308(a)(4), §164.312(a)(1) ID.GV-3 3.3.1 AU-2, AU-6, AU-12 8.x
HIPA-21 Does the application log record access including specific user, date/time of access, and originating IP or device? CSC 6 § 164.308(a)(1)(ii)(D) 12.4.1 ID.GV-3 3.3.2 AU-3 10.7 HIPA-22
Does the application log administrative activity, such user account access changes and password changes, including specific user, date/time of changes, and originating IP or device?
CSC 6 §164.312(b) 12.4.1 ID.GV-3 10.7
HIPA-23 How long does the application keep access/change logs? CSC 6 §164.312(b) 12.4.1 ID.GV-3 10.7 HIPA-24 Can the application logs be archived? CSC 6 §164.312(b) 12.4.1 ID.GV-3 10.7 HIPA-25 Can the application logs be saved externally? CSC 6 §164.312(b) 12.4.1 ID.GV-3 10.7 HIPA-26 Does your data backup and retention policies and practices meet HIPAA requirements? CSC 10 §164.312(a)(2)(ii) 18.1.1 ID.GV-3 10.7 HIPA-27 Do you have a disaster recovery plan and emergency mode operation plan? CSC 10 §164.308(a)(7)(i) 17.1.1 ID.GV-3 3.12.2 12.1 HIPA-28 Have the policies/plans mentioned above been tested? CSC 10 §164.308(a)(7)(i) 17.1.3 ID.GV-3 3.6.3, 3.12.2 12.1 HIPA-29 Can you provide a HIPAA compliance attestation document? CSC 10 §164.308(b)(2) 18.1.1 ID.GV-3 10.7 HIPA-30 Are you willing to enter into a Business Associate Agreement (BAA)? CSC 10 §164.308(b)(1),
§164.308(b)(3),
§164.314(a)(1)(i)

18.1.1 ID.GV-3
HIPA-31 Have you entered into a BAA with all subcontractors who may have access to protected health information (PHI)? CSC 10
§164.308(a)(3)(i),
§164.308(b)(1),
§164.308(b)(3),
§164.314(a)(1)(i)

18.1.1 ID.GV-3 12.8
CIS Critical Security
Controls v6.1 HIPAA ISO 27002:2013 NIST Cybersecurity Framework NIST SP 800-171r1 NIST SP 800-53r4 PCI DSS PCID-01 Do your systems or products store, process, or transmit cardholder (payment/credit/debt card) data? CSC 10 18.1.1 ID.GV-3 12.8 PCID-02 Are you compliant with the Payment Card Industry Data Security Standard (PCI DSS)? CSC 10 18.1.1 ID.GV-3 12.8

PCI DSS
31 PCID-03 Do you have a current, executed within the past year, Attestation of Compliance (AoC) or Report on Compliance (RoC)? CSC 10 18.1.1 ID.GV-3 12.8 PCID-04 Are you classified as a service provider? ID.GV-3 12.8 PCID-05 Are you on the list of VISA approved service providers? ID.GV-3 12.8 PCID-06 Are you classified as a merchant? If so, what level (1, 2, 3, 4)? ID.GV-3 12.8 PCID-07 Describe the architecture employed by the system to verify and authorize credit card transactions. CSC 1, CSC 2 ID.GV-3 PCI Scope PCID-08 What payment processors/gateways does the system support? CSC 18 ID.GV-3 12.8 PCID-09 Can the application be installed in a PCI DSS compliant manner ? CSC 10 ID.GV-3 12.8 PCID-10 Is the application listed as an approved PA-DSS application? ID.GV-3 12.8 PCID-11 Does the system or products use a third party to collect, store, process, or transmit cardholder (payment/credit/debt card) data? CSC 12, CSC 13 ID.GV-3 12.8 PCID-12
Include documentation describing the systems' abilities to comply with the PCI DSS and any features or capabilities of the system that must be added or changed in order to operate in compliance with the standards.

CSC 10 ID.GV-3 12.8
CIS 4
HIPAA 5
ISO 6
NIST 7
NIST SP 8
NIST SP 9
PCI DSS 10
32 Version 2.11
Vendor Name Product Name
Vendor Contact Name Product
Description
Vendor Contact Title HECVAT Version
Vendor Email Address Date Prepared
Institution's Security
Framework
<- Select your security
framework.

Report Sections Max_Score Score Score %
Documentation 105 0 0%
Application Security 375 0 0%
Authentication, Authorization, and
Accounting 365 0 0%
Change Management 275 0 0%
Company 120 0 0%
Data 550 0 0%
Database 50 0 0%
Datacenter , , , 290 0 0%
Networking 245 0 0%
Physical Security , , 100 0 0%
Processes 420 0 0%
Systems Management &
Configuration 70 0 0%
Vulnerability Scanning 170 0 0%
Overall Score F 0 0%
ID Compliant?
COMP-01 Please rate the vendor's
answer
COMP-02 Please rate the vendor's
answer
COMP-07 Please rate the vendor's
answer
APPL-07 Please rate the vendor's
answer
APPL-09 Please rate the vendor's
answer
APPL-10 Please rate the vendor's
answer
APPL-12 Please rate the vendor's
answer
APPL-13 Please rate the vendor's
answer
APPL-15 Please rate the vendor's
answer
APPL-16 Please rate the vendor's
answer
Vendor Contact E-mail Address
Product Name and Version Information
Brief Description of the Product
Full
mm/dd/yyyy
HEISC Shared Assessments Working Group
HECVAT - Full - Analyst Report
Vendor Contact Name
Vendor Name
Vendor Contact Title
Instructions
Step 1: Select the security framework used at your institution in cell B10. Step 2: Convert qualitative vendor responses into quantitative values, starting at cell G37.

Step 3: Review converted values, ensuring full population of report. Step 4: Move to the Summary Report tab.

Qualitative Questions
Vendor Answer
0 0
0 0
Question
What operating system(s) is/are leveraged by the
system(s)/application(s) that will have access to
institution's data?
Describe or provide a reference to additional
software/products necessary to implement a
functional system on either the backend or userDescribe or provide a reference to the overall system and/or application architecture(s),
including appropriate diagrams. Include a full
Describe your organization’s business
background and ownership structure, including all
parent and subsidiary relationships.
0 Describe how long your organization has
conducted business in this product area.
0 Use this area to share information about your
environment that will assist those who are
assessing your company data security program.
0 Describe or provide a reference to all webenabled features and functionality of the system (i.e. accessed via a web-based interface).

Describe or provide a reference to the facilities
available in the system to provide separation of
duties between security administration and
0 Describe or provide a reference that details how
administrator access is handled (e.g.
provisioning, principle of least privilege,
0 Are there any OS and/or web-browser
combinations that are not currently supported?
0 APPL-17 Please rate the vendor's
answer
AAAI-16 Please rate the vendor's
answer
CHNG-02 Please rate the vendor's
answer
CHNG-05 Please rate the vendor's
answer
CHNG-06 Please rate the vendor's
answer
CHNG-07 Please rate the vendor's
answer
DATA-07 Please rate the vendor's
answer
DATA-14 Please rate the vendor's
answer
DATA-16 Please rate the vendor's
answer
DCTR-07 Please rate the vendor's
answer
DCTR-10 Please rate the vendor's
answer
DCTR-13 Please rate the vendor's
answer
DCTR-17 Please rate the vendor's
answer
DCTR-18 Please rate the vendor's
answer
FIDP-03 Please rate the vendor's
answer
FIDP-11 Please rate the vendor's
answer
QLAS-01 Please rate the vendor's
answer
VULN-06 Please rate the vendor's
answer
VULN-08 Please rate the vendor's
answer
HIPAA Section Required 0 Compliant?
HIPA-23
Mobile App Section
Required
0 Compliant?
MAPP-01
MAPP-02
MAPP-08
MAPP-11
Third Party Section
Required
0 Compliant?
THRD-01
THRD-02
THRD-03
On which mobile operating systems is your
software or service supported?
0 0
Describe or provide a reference to the tool(s)
used to scan for vulnerabilities in your
applications and systems.
0 Select the option that best describes the network
segment that servers are connected to.
0 List all datacenters and the cities, states
(provinces), and countries where the Institution's
data will be stored (including within the
0 Describe how you perform security assessments
of third party companies with which you share
data (i.e. hosting providers, cloud services, PaaS,
0 Provide a brief description for why each of these
third parties will have access to institution data.
0 What legal agreements (i.e. contracts) do you
have in place with these third parties that
address liability in the event of a data breach?
0 Describe or provide a reference to the
application's architecture and functionality.
0 State the party that performed the vulnerability
test and the date it was conducted?
0 Will any of these systems be implemented on
systems hosting the Institution's data?
0 Provide a general summary of your Quality
Assurance program.
0 How long does the application keep
access/change logs?
0 Describe or provide a reference to how you
monitor for and protect against common web
application security vulnerabilities (e.g. SQL
0 State and describe who has the authority to
change firewall rules?
0 Is intrusion monitoring performed internally or by
a third-party service?
Describe or provide a reference to the availability
of cooling and fire suppression systems in all
datacenters where institution data will reside.
0 State how many Internet Service Providers (ISPs)
provide connectivity to each datacenter where
the institution's data will reside.
0 What Tier Level is your data center (per levels
defined by the Uptime Institute)?
0 How long are data backups stored? 0
Does the system support client customizations
from one release to another?
0 List all locations (i.e. city + datacenter name)
where the institution's data will be stored?
0 Describe or provide a reference to the backup
processes for the servers on which the service
and/or data resides.
0 Indicate all procedures that are implemented in
your CMP. a.) An impact analysis of the upgrade
is performed. b.) The change is appropriately
0 Describe or provide a reference to your solution
support strategy in relation to maintaining
software currency. (i.e. how many concurrent
0 Identify the most current version of the software.

Detail the percentage of live customers that are
utilizing the proposed version of the software as
0 Describe or provide a reference to the a) system
capability to log security/authorization changes
as well as user and administrator security events
0 Describe or provide references explaining how
tertiary services are redundant (i.e. DNS, ISP,
etc.).
0 THRD-04
Business Continuity
Section Required
0 Compliant?
BCPL-01
Disaster Recovery
Section Required
0 Compliant?
DRPL-01
DRPL-09
PCI DSS Section
Required
0 Compliant?
PCID-06
PCID-07
PCID-08
PCID-12
Describe or provide a reference to how your
disaster recovery plan is tested? (i.e. scope of DR
tests, end-to-end testing, etc.)
0 Include documentation describing the systems'
abilities to comply with the PCI DSS and any
features or capabilities of the system that must
0 Describe the architecture employed by the
system to verify and authorize credit card
transactions.
0 What payment processors/gateways does the
system support?
0 Describe or provide references to your third party
management strategy or provide additional
information that may help analysts better
0 Are you classified as a merchant? If so, what
level (1, 2, 3, 4)?
0 Describe or provide a reference to your Disaster
Recovery Plan (DRP).
0 Describe or provide a reference to your Business
Continuity Plan (BCP).
0 Reason for Question Follow-up Inquiries/Responses
QUAL-01 Does your product process protected health information (PHI) or any data covered by the Health Insurance Portability and Accountability Act? This qualifier determines the presence of PHI in the
solution and sets the HIPAA section as required
appropriately.

Reference the HIPAA section for follow-up review.

QUAL-02 Does the vended product host/support a mobile application? (e.g. app) The use of standalone, mobile applications is the focus of this qualifier and sets the Mobile Application section as required if in use. When a mobile application is
implemented for system communication, data flows,
encryption, and storage strategies on a mobile device
become important.

Reference the Mobile Application section for follow-up
review. Many "applications" run in a web-browser and
vendors incorrectly respond due to this common word
use. Ensure that responses are in the context of true
mobile applications, not just web-based systems.

QUAL-03 Will institution data be shared with or hosted by any third parties? (e.g. any entity not wholly-owned by your company is considered a third-party) Vendors oftentimes use other vendors to supplement
and/or host their infrastructures and it is important to know what, if any, institutional data is shared with
fourth-parties. Responses to this qualifier set the
response requirement for the Third Parties section.

Reference the Third Parties section for follow-up review.

QUAL-04 Do you have a Business Continuity Plan (BCP)?
This qualifier determines the existence of a complete,
fully-populated BCP, maintained by the vendor, and
sets the Business Continuity Plan section as required
appropriately.

Reference the Business Continuity Plan section for
follow-up review.

QUAL-05 Do you have a Disaster Recovery Plan (DRP)?
This qualifier determines the existence of a complete,
fully-populated DRP, maintained by the vendor, and
sets the Business Continuity Plan section as required
appropriately.

Reference the Disaster Recovery Plan section for followup review.

QUAL-06 Will data regulated by PCI DSS reside in the vended product? This qualifier determines the presence of PCI DSS in the solution and sets the PCI DSS section as required
appropriately.

Reference the PCI DSS section for follow-up review.

QUAL-07 Is your company a consulting firm providing only consultation to the Institution?
When consultants are given access to a system
containing institutional data, the "sharing" of data is not in the same context as traditional data sharing (i.e. hosting, etc.) and thus, many of the HECVAT questions
do not apply. When consultants have access to a
system (onsite of via remote affiliate-type accounts),
the Consulting section is most relevant.

Reference the Consulting section for follow-up review.

Reason for Question Follow-up Inquiries/Responses
DOCU-01 Have you undergone a SSAE 18 audit? Standard documentation, relevant to institutions requiring a vendor to undergo SSAE 16 audits.

Follow-up inquiries for SSAE 16 content will be
institution/implementation specific.

DOCU-02 Have you completed the Cloud Security Alliance (CSA) self assessment or CAIQ?
Many vendors have populated a CAIQ or at least a selfassessment. Although lacking in some areas important to Higher Ed, these documents are useful for
supplemental assessment.

Follow-up inquiries for CSA content will be
institution/implementation specific.

DOCU-03 Have you received the Cloud Security Alliance STAR certification? If a vendor is STAR certified, vendor responses can
theoretically be more trusted since CSA has verified
their responses. Trust, but verify for yourself, as
needed.

If STAR certification is important to your institution you may have specific follow-up details for documentation
purposes.

DOCU-04 Do you conform with a specific industry standard security framework? (e.g.

NIST Cybersecurity Framework, ISO 27001, etc.)
The details of the standard are not the focus here, it is the fact that a vendor builds their environment around
a standard and that they continually evaluate and
assess their security programs.

In an ideal world, a vendor will conform to an industry framework that is adopted by an institution. When this
synergy does not exist, the interpretation of the
vendor's responses must be interpreted in the context
of the institution's environment. Follow-up inquires for industry frameworks (and levels of adoption) will be
institution/implementation specific.

DOCU-05 Are you compliant with FISMA standards? For institutions that collaborate with the United States government, FISMA compliance may be required.

Follow-up inquiries for FISMA compliance will be
institution/implementation specific.

DOCU-06 Does your organization have a data privacy policy? Managing and protecting institution data is the reason
organizations perform security and risk assessments.

Privacy policies outline how vendors will obtain, use,
share, and protect institutional data and as such,
should be robust in its language. Beware of vaguely
worded privacy policies.

Inquire about any privacy language the vendor may
have. It may not be ideal but there may be something
available to assess or enough to have your legal
counsel or policy/privacy professionals review.

Reason for Question Follow-up Inquiries/Responses
COMP-01 Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships.

Defining scale of company (support, resources,
skillsets), General information about the organization
that may be concerning.

Follow-up responses to this one are normally unique to
their response. Vague answers here usually result in
some footprinting of a vendor to determine their
"reputation".

COMP-02 Describe how long your organization has conducted business in this product area.

We want to establish longevity of a solution and
whether or not a vendor is new to the HE space.

Normally a vendor will state their overall longevity but not talk about the software/service/product under
evaluation. Follow-up's includes specific questions
about the origins of the software/service/product and
references will be requested.

Higher Education Community Vendor Assessment Tool (HECVAT) - Full - Analyst Reference Instructions
Use this reference guide to assess vendor responses in relation to your institution's environment. The context of HECVAT questions can change, depending on implementation specifics so these recommendations and follow-up response are not exhaustive and are meant to improve assessment and report capabilities within your institution's security/risk assessment program.

Analyst tip #1: For any answer that is deem "non-compliant" by your institution, ask the vendor if there is a timeline for implementation, a sincere commitment to customer development engagement, and/or possible implementation of compensating control(s) that offsite the risks of another component.

Analyst tip #2: If a vendor's response to a follow-up inquiry is vague or seems off-point or dismissive, respond back to the vendor contact with clear expectations for a response. Responses that fail to meet expectations thereafter should be negatively assessed based on your institution's risk tolerance and the criticality of the data involved.

Analyst tip #3: The most important tip - reject a HECVAT from a vendor if; the vendor provides the institution with a insufficiently populated HECVAT; or the vendor responses are vague and/or do not answer questions directly; or significant discrepancies are found, making the HECVAT difficult to assess.

Qualifiers
Qualifier responses are meant to set the response requirements for a vendor and the intended use case. Since responses to these questions can make some question sections optional, vendors often answer sections partially, if they have the proper documentation. Depending on the security program maturity and risk tolerance of your institution, not all vendor responses will be relevant.

HEISC Shared Assessments Working Group
Documentation
Company Overview
COMP-03 Do you have existing higher education customers? Higher Ed is a unique vertical. A vendor's response to
this question can help an analyst set the context for all vendor responses. Established and/or mature
software/product/services are more likely to have
current Higher Ed customers, and therefore understand
the environment that we operate in.

A simple "Yes" without any references or supporting
information should be questioned. Question the size of
institutions that are using the software/product/service and the scope of their implementations.

COMP-04 Have you had a significant breach in the last 5 years? We want transparency from the vendor and an honest
answer to this question, regardless of the response, is a good step in building trust.

If a vendor says "No", it is taken at face value. If you organization is capable of conducting reconnaissance, it is encouraged. If a vendor has experienced a breach,
evaluate the circumstance of the incident and what the
vendor has done in response to the breach.

COMP-05 Do you have a dedicated Information Security staff or office? Understanding the security program size (and
capabilities) of a vendor has a significant impact on
their ability to respond effectively to a security incident.

The size of a vendor will determine their SO size, or
lack thereof. Use the knowledge of this response when
evaluating other vendor statements.

Vague responses to this question should be investigated further. Vendors without dedicated security personnel
commonly have no security or security is embedded or
dual-homed within operations (administrators). Ask
about separation of duties, principle of least privilege, etc. - there are many ways to get additional program
state information from the vendor.

COMP-06 Do you have a dedicated Software and System Development team(s)? (e.g.

Customer Support, Implementation, Product Management, etc.) Understanding the development team size (and
capabilities) of a vendor has a significant impact on
their ability to produce and maintain code, adhering to secure coding best practices. The size of a vendor will determine their use of dedicated development teams,
or lack thereof. Use the knowledge of this response
when evaluating other vendor statements.

Follow-up inquiries for vendor team strategies will be
unique to your institution and may depend on the
underlying infrastructures needed to support a system
for your specific use case.

COMP-07 Use this area to share information about your environment that will assist those who are assessing your company data security program.

For the 20% that HECVAT may not cover, this gives the
vendor a chance to support their other responses.

Beware when this area is populated with sales hype or
other non-relevant information. Thorough
documentation, supporting evidence, and/or robust
responses go a long way in building trust in this
assessment process.

This is a freebie to help the vendor state their "case". If a vendor does not add anything here (or it is just sales stuff), we can assume it was filled out by a sales
engineer and questions will be evaluated with higher
scrutiny.

Reason for Question Follow-up Inquiries/Responses
THRD-01
Describe how you perform security assessments of third party companies with which you share data (i.e. hosting providers, cloud services, PaaS, IaaS, SaaS, etc.). Provide a summary of your practices that assures that the third party will be subject to the appropriate standards regarding security, service recoverability, and confidentiality.

Vendors oftentimes use other vendors to supplement
and/or host their infrastructures and it is important to know what, if any, institutional data is shared with
fourth-parties. This questions has multiple parts,
therefore setting expectations that vendors provide
robust responses.

Vague responses to this question should be investigated further. Vendors without documentation in relation to
how they deal with other vendors is alarming.

THRD-02 Provide a brief description for why each of these third parties will have access to institution data.

Who, what, why - that simple. If a vendor is sharing
institutional data with another party, it is expected that the vendor performs their due diligence when assessing
their vendors.

Vague responses to this question should be investigated further. Vendors without documentation in relation to
how they deal with other vendors is alarming.

THRD-03 What legal agreements (i.e. contracts) do you have in place with these third parties that address liability in the event of a data breach? Insight into legal protections for the institution and its data are the focus of this question. Understanding all
stakeholder's contractual responsibilities should be
clearly stated by the vendor.

Follow-up inquiries in regards to contracts will be
institution/implementation specific.

This is an open-ended question to allow the vendor to
state the actions of their due diligence, as it pertains to safeguarding institutional data.

Vague responses to this question should be investigated further. If the vendor's effort to ensure transparency
falls short, there may be a reason.

Reason for Question Follow-up Inquiries/Responses
CONS-01 Will the consulting take place on-premises?
This question sets the stage for what the institution
must do to accommodate the consultant(s). The
question is important because it gives the institution
the knowledge necessary to enact appropriate controls.

For example, if the answer is "Yes", then access to
appropriate locations can be granted, and equipment
can be provisioned if needed. Whereas a "No" answer
may require remote access control measures, such as
the provisioning of VPN access for the consultant
Follow-up inquiries for on-premise consulting details
will be institution/implementation specific.

CONS-02 Will the consultant require access to Institution's network resources? This question is very much about what level of network
access is needed by these external consultants as it is anything else. If all that is needed is a web connection, then even simple, on-premise access to a guest
network can be considered. But if it requires
connectivity to a highly protected resource (for
example: A database server on an isolated VLAN and
only accepting traffic from a specific front end), then the consultant may need to be given access to a data
center's network. Again, the purpose here is to
determine what level of access is enough and what
controls to put in place to secure that access
Follow-up inquiries for on-premise consultant resource
requirements will be institution/implementation
specific.

CONS-03 Will the consultant require access to hardware in the Institution's data centers?
This normally is interpreted as "Does the consultant
need to connect to our servers in our machine
room(s)?". But, it can mean other things too. The real
deeper question is, what protected resources does this
consultant need to access? And why? For example: It
would be unusual for an application developer to need
access to a router or switch, so if that is requested, it should be questioned to see if it's reasonable.

The consultant(s) should be asked for specifics.

Example: Do you need access to only the database, or
also the front-end? Do you need firewall adjustments?
The goal is to ask questions designed around
determining what the least level of access is that will allow the consultants to complete their work.

CONS-04 Will the consultant require an account within the Institution's domain (@*.edu)?
There are occasions where a consultant needs to access
a system in the same way the institution's users access it. This is most often seen in cases where code is being developed, but other scenarios exist. The answer to this question lets the institution know whether they need to alert their identity management team to provision an
account for this consultant.

Ask the vendor for the reasoning for this requirement.

Establish the length (time) of account use. Establish
clear expectations for account use. Confirm the sponsor arrangement and ensure protections are in-place for
this authorization.

CONS-05 Has the consultant received training on [sensitive, HIPAA, PCI, etc.] data handling?
Certain types of data are subject to either industry or regulatory standards. This question is designed to
ensure that the contracted consultants do understand
the requirements for handling those classes of data. Or, if they do not, then to give the institution time to
implement another control or mitigation (for example:

A training course assembled by the institution. Or
contract terms designed to protect the institution by
requiring that a contractor follow a specific standard) Follow-up inquiries for consultant training will be
institution/implementation specific.

Third Parties
Consulting - Optional based on QUALIFIER response.

CONS-06 Will any data be transferred to the consultant's possession? This question is designed to get outright confirmation
on whether your institution's data will transfer out and possibly reside, even temporarily, on the contractors'
infrastructure. It is also designed to allow you to ask whether it transfers to the *company*, or to the
*individual consultant*. That way, you will know what
terms or controls to require (for example: 'Our
institution's data can be stored and accessed on
company owned equipment, but never on personally
owned devices ')
Where will this be stored? Who will have access to it?
How long will you retain it? Will you use secure, multipass erase methods to dispose of the data once the job is complete? Basically, use this as an opportunity to
track what will happen to the data once it's in the
contractors' hands, and also to set the expectations
with the contractor on how your institution's data
should be handled, stored, erased, etc.

CONS-07 Is it encrypted (at rest) while in the consultant's possession? The need for encryption at-rest is unique to your
institution's implementation of a system. In particular, system components, architectures, and data flows, all
factor into the need for this control.

Follow-up inquiries for consultant possessed data
encryption at-rest will be institution/implementation
specific.

CONS-08 Will the consultant need remote access to the Institution's network or systems?
Telecommuting in the IT world is common - an
institution should know that proper safeguards are in
place, if remote access is allowed. Vendor responses
vary greatly on this so confirm the context of the
response if it is not clear. Many cloud services can only be managed remotely so there is often a gray area to
interpret for this response.

Ask the vendor to summarize the reasoning behind this
business process and request additional documentation
that outlines the security controls implemented to
safeguard institutional data.

CONS-09 Can we restrict that access based on source IP address? Restricting access to the least number of sources is a
best-practice at the focus of this question. If
consultants will access institution's data from a static location, ideally the access is restricted to that static location. Based on the institution's environment, data
sensitivity, and detective/preventive capabilities, the response to this question may or may not be relevant.

Follow-up inquiries for firewall rules and access control lists will be institution/implementation specific.

Reason for Question Follow-up Inquiries/Responses
APPL-01 Do you support role-based access control (RBAC) for end-users? Understanding access control capabilities allows an
institution to estimate the type of maintenance efforts will be involved to manage a system. Depending on the
users, concerns may or not be elevated. The value of
this question is largely determined by the deployment
strategy and use case of the software/product/service
under review. This question is specific to end-users.

Ask the vendor to summarize the best practices to
restrict/control the access given to the institution's endusers without the use of RBAC. Make sure to understand the administrative requirements/overhead
introduced in the vendor's environment.

APPL-02 Do you support role-based access control (RBAC) for system administrators? Managing a software/product/service may rely on
various professionals to administrate a system. This
question is focused on how administration, and the
segregation of functions, can be implemented within
the system. Securing the administration portion of a
system has additional implications (e.g., logging,
administration, etc.) beyond that of end-users.

Ask the vendor to summarize the best practices for
securing their system(s) administratively without the
use of RBAC. Make sure to understand the
administrative requirements/overhead introduced in the
vendor's environment.

APPL-03 Can employees access customer data remotely?
Telecommuting in the IT world is common - an
institution should know that proper safeguards are in
place, if remote access is allowed. Vendor responses
vary greatly on this so confirm the context of the
response if it is not clear. Many cloud services can only be managed remotely so there is often a gray area to
interpret for this response.

Ask the vendor to summarize the reasoning behind this
business process and request additional documentation
that outlines the security controls implemented to
safeguard institutional data.

APPL-04
Can you provide overall system and/or application architecture diagrams including a full description of the data communications architecture for all components of the system?
Many systems can be used a variety of ways. We want
these implementation type diagrams so that we can
understand the "real" use of the product.

Additional requests for documentation are made when
other parts of the HECVAT are insufficient. Although
helpful, many vendors do not provide supporting
documentation. We try to be specific with our follow-up questions so that vendors understand we are not
looking for 20-50 page whitepapers (sales
documentation).

APPL-05 Does the system provide data input validation and error messages? Input validation is a secure coding best practices so
confirming its implementation is normally a high
priority. Error messages (to the system and user) can
be used to detect abnormal use and to better protect
institutional data. Depending on the criticality of data and the flow of said data, an institution's risk tolerance will be unique to their environment.

Inquire about any planned improvements to these
capabilities. Ask about their product(s) roadmap and
try to understand how they prioritize security concerns in their environment.

APPL-06 Do you employ a single-tenant environment?
A vendor's response to this question can reveal a
system's infrastructure quickly. Off-point responses are common here so general follow-up is often needed.

Understanding how a vendor segments its customers
data (or doesn't) affects various other controls,
including network settings, use of encryption, access,
etc.). A vendor's response here will influence potential follow-up inquiries for other HECVAT questions.

Ask the vendor to summarize why a multi-tenant (or
other) environment/strategy is implemented and what
compensating controls they have in place to ensure
appropriate levels of confidentiality and integrity.

APPL-07 What operating system(s) is/are leveraged by the system(s)/application(s) that will have access to institution's data?
Vendor responses to this question provides clarity on
environment constraints that may exist and/or
influence future development, configurations,
infrastructure, etc. Although the vendor response may
not directly affect end-users, the risks of the underlying infrastructure is better understood.

Follow-up inquiries for operating systems leveraged by
the vendor will be institution/implementation specific.

APPL-08 Have you or any third party you contract with that may have access or allow access to the institution's data experienced a breach?
We want transparency from the vendor and an honest
answer to this question, regardless of the response, is a good step in building trust.

APPL-09
Describe or provide a reference to additional software/products necessary to implement a functional system on either the backend or user-interface side of the system.

Understanding system requirements and/or
dependencies (e.g., frameworks, libraries, toolkits,
modules, etc.) can reveal infrastructure risks that may not be apparent by other means. In some cases, the
use of trusted components may be favorable. In others,
it may initiate the assessment the vendor's
environment in more detail and/or expand the scope of
the institution's assessment.

Follow-up inquiries concerning supplemental
software/products will be institution/implementation
specific.

A picture is worth a thousand words. Diagrams improve
transparency of the vendor's infrastructure and allows
the institution to more accurately assess potential risks in a vendor's environment. Vendor's with mature
infrastructures are expected to have detailed diagrams
for all components of their system(s).

Refusal to share diagrams (even sanitized ones) should
be met with increased concern.

Ask for systems architecture diagrams (e.g., Visio,
OmniGraffle, etc.).

Ask for detailed data flow diagrams.

APPL-11 Are databases used in the system segregated from front-end systems? (e.g. web and application servers)
The use of n-tier architectures is best-practice,
providing additional options to strength security
controls. Segregating institutional data from front-end (public) systems in expected.

Follow-up inquiries for n-tier infrastructure details will be institution/implementation specific.

Application/Service Security
APPL-12 Describe or provide a reference to all web-enabled features and functionality of the system (i.e. accessed via a web-based interface).

This open-ended question allows a vendor to describe
the software/product/service from the perspective of an end-user (e.g., customer). Use the vendor's response to this question to confirm the use of mobile applications or web applications. This is oftentimes misinterpreted
by vendor parties [that populate the HECVAT] that do
not come from a technical background.

The vendor's response to this question may reveal the
need to ask additional follow-up questions to other
responses.

APPL-13 Are there any OS and/or web-browser combinations that are not currently supported?
This question allows a vendor to describe situations in which their software/product/service cannot operate or
be supported. The value of this question is relative,
depending on the institution's operating environment.

Verify if the vendor's infrastructure is constrained by a technology or if it is a best practice that is not adopted.

Ask about the vendor's future support roadmap.

APPL-14 Can your system take advantage of mobile and/or GPS enabled mobile devices?
User location data is a significant privacy and safety
concern for individuals. Understanding a systems use
and storage of user geolocation data is important.

Vague responses to this question should be met with
concern. Repeat the question if first answer
insufficiently - ask pointedly to ensure the vendor is not misunderstood.

APPL-15
Describe or provide a reference to the facilities available in the system to provide separation of duties between security administration and system administration functions.

Managing a software/product/service may rely on
various teams to administrate a system, in this
question, it is security operations and systems
administration. This question is focused on how
system(s) administration, and the segregation of
duties, are implemented in the vendor's organization,
so that system administrators do not also have security responsibilities (e.g., monitoring, mitigating, reporting, etc )
Ask the vendor to summarize the best practices for
securing their system(s) administratively without the
use of RBAC. Make sure to understand the
administrative requirements/overhead introduced in the
vendor's environment.

APPL-16 Describe or provide a reference that details how administrator access is handled (e.g. provisioning, principle of least privilege, deprovisioning, etc.) The focus of this question is privilege creep, a situation where employees gain access privileges as they move
within an organization, but privileges that they were
given in previous roles are not removed. This can lead
to situations were an individual has concurrent access
to systems that should not be allowed.

Ask the vendor how administrator accounts are
protected. Ask for documentation for their onboarding
and offboarding procedures for new staff.

APPL-17 Describe or provide references explaining how tertiary services are redundant (i.e. DNS, ISP, etc.).

The focus of this question is availability. When moving to off-premise solutions, many controls and strategies
implemented on-site are no longer relevant to the
security of the solution.

Follow-up inquiries for tertiary services will be
institution/implementation specific.

Reason for Question Follow-up Inquiries/Responses
AAAI-01 Can you enforce password/passphrase aging requirements? This question is primarily focused on account
management capabilities that are built into a system.

Although aging is not always required, a system that
lacks commodity functionality may be lacking in other
areas as well. Use the vendor's response to this
question as a way to pivot to other questions, as
needed.

The value of this question depends on your institution's policy on passwords, its use of 2FA, or any number of
factors. Follow-ups for this question are unique to the institution.

AAAI-02 Can you enforce password/passphrase complexity requirements [provided by the institution]?
Many institutions have policy focused on
passwords/passphrases and this question confirms the
capacity of a vendor's software/product/service to
comply.

Follow-up inquiries for password/passphrase
complexity requirements will be
institution/implementation specific.

AAAI-03 Does the system have password complexity or length limitations and/or restrictions?
Many institutions have policy focused on
passwords/passphrases and this question confirms the
capacity of a vendor's software/product/service to
comply.

Follow-up inquiries for password/passphrase limitations and/or restrictions will be institution/implementation
specific.

AAAI-04 Do you have documented password/passphrase reset procedures that are currently implemented in the system and/or customer support? Account management can be a time-consuming part of
an information system. Account reset capabilities, built into a system, can reduce burden on institutional
support services.

Ask the vendor how end-users will be supported. Ask
for training documentation or knowledgebase content.

Confirm vendor and institution responsibilities in this support area (and others).

AAAI-05 Does your web-based interface support authentication, including standardsbased single-sign-on? (e.g. InCommon) This question is to set account management
expectations for the institution. A system that can
integrate with existing, vetted solutions, has its
advantages and may have less administrative
overhead. Also, adherence to standards here gives
credit to other standards-oriented questions/responses.

If a vendor indicates that a system is standalone and
cannot integrate with community standards, follow-up
with maturity questions and ask about other commodity
type functions or other system requirements your
institution may have.

AAAI-06 Are there any passwords/passphrases hard coded into your systems or products?
The response to this question can reveal the use (or
not) of coding best-practices. If passwords/passphrases are hard coded into systems/productions, the vendor
should provide robust details supporting why this is
required.

Vague responses to this question should be met with
concern. Repeat the question if first answer
insufficiently - ask pointedly to ensure the vendor is not misunderstood.

AAAI-07 Are user account passwords/passphrases visible in administration modules? Vendor responses to this question provides insight into account management, authorization scope, data
integrity, etc. of system administrators. Use the
vendor's response to provide context for other
responses.

Follow-up inquiries for administration module
authorization will be institution/implementation
specific.

AAAI-08 Are user account passwords/passphrases stored encrypted? The focus of this question is confidentiality. Straightforward question confirming the encryption of user authentication details.

Follow-up inquiries for password/passphrase encrypted
storage will be institution/implementation specific.

AAAI-09 Does your application and/or user-frontend/portal support multi-factor authentication? (e.g. Duo, Google Authenticator, OTP, etc.) 2FA/MFA, implemented correctly, strengthens the
security state of a system. 2FA/MFA is commonly
implemented and in many use cases, a requirement for
account protection purposes.

Ask the vendor about hardware and software options,
future roadmap for implementations and support, etc.

AAAI-10
Does your application support integration with other authentication and authorization systems? List which ones (such as Active Directory, Kerberos and what version) in Additional Info?
This question is to set account management
expectations for the institution. A system that can
integrate with existing, vetted solutions, has its
advantages and may have less administrative
overhead. Also, adherence to standards here gives
credit to other standards-oriented questions/responses.

If a vendor indicates that a system is standalone and
cannot integrate with the institution's infrastructure, follow-up with maturity questions and ask about other
commodity type functions or other system requirements
your institution may have.

AAAI-11 Will any external authentication or authorization system be utilized by an application with access to the institution's data?
This is a follow-up to the questions above. Although a
system may support authentication integrations, they
may or may not be used on systems that store
institutional data. Verify the use of authentication
methods/functions in all parts of a system.

Ask for diagrams or other documentation that clearly
shows what protections/systems are used and where
and when they are used. The detail of inquiry will be
based on the institutions risk tolerance and criticality of data.

AAAI-12 Does the system (servers/infrastructure) support external authentication services (e.g. Active Directory, LDAP) in place of local authentication? System (technical and security) administration is
complex and it is important to understand a system's
capabilities to integrate with existing security and
access systems. Having to maintain additional accounts
increases overhead and may impact your institution's
risk footprint.

Follow-up inquiries for system authentication will be
unique to your institution (e.g., policy, infrastructure, etc.)
AAAI-13 Does the system operate in a mixed authentication mode (i.e. external and local authentication)?
The purpose of this question is understand the vendor's authentication infrastructure so that additional
questions can be formulated for the institution's use
case.

The content of this response may or may not have
value for the type of use case on the institution. Followup inquiries for authentication modes will be institution/implementation specific.

AAAI-14 Will any external authentication or authorization system be utilized by a system with access to institution data?
The purpose of this question is understand the vendor's authentication infrastructure so that additional
questions can be formulated for the institution's use
case.

The content of this response may or may not have
value for the type of use case on the institution. Followup inquiries for authentication modes will be institution/implementation specific.

Authentication, Authorization, and Accounting
AAAI-15 Are audit logs available that include AT LEAST all of the following; login, logout, actions performed, and source IP address?
Strong logging capabilities are vital to the proper
management of a system. Implementing an immature
system that lacks sufficient logging capabilities exposes an institution to great risk. Depending on your risk
tolerance and the use case, your institution may or may not be concerned. The focus of this question is end-user logs
If a weak response is given to this answer, it is
appropriate to ask directed answers to get specific
information. Ensure that questions are targeted to
ensure responses will come from the appropriate party
within the vendor.

AAAI-16
Describe or provide a reference to the a) system capability to log security/authorization changes as well as user and administrator security events (i.e. physical or electronic)(e.g. login failures, access denied, changes accepted), and b) all requirements necessary to implement logging and monitoring on the system. Include c) information about SIEM/log collector usage.

Strong logging capabilities are vital to the proper
management of a system. Implementing an immature
system that lacks sufficient logging capabilities exposes an institution to great risk. Depending on your risk
tolerance and the use case, your institution may or may not be concerned. The focus of this question is systemrelated logs (e.g., including but not limited to - events, state changes control modification etc )
If a weak response is given to this answer, it is
appropriate to ask directed answers to get specific
information. Ensure that questions are targeted to
ensure responses will come from the appropriate party
within the vendor.

AAAI-17
Describe or provide a reference to the retention period for those logs, how logs are protected, and whether they are accessible to the customer (and if so, how).

There are multiple components of this question - when
assessing, ensure that the vendor responds to them all.

Logs that are not properly managed may not be
available when needed. The purpose of this question is
to ensure that the vendor has a proper security mindset to ensure proper monitoring practices.

Follow-up inquiries for logging details will be
institution/implementation specific.

Reason for Question Follow-up Inquiries/Responses
BCPL-01 Describe or provide a reference to your Business Continuity Plan (BCP).

In the context of the CIA triad, this question is focused on availability and is often in need of a follow-up.

Understanding the maturing of a vendor's BCP can shed
light on many other aspects of a vendor's overall
security state.

A vendor may have a number of BCP elements defined
so the vendor's response may not be binary. Assess the
components of the plan and ask about timelines, followup commitments, etc.

If the vendor does not have a BCP, point them to
https://www.sans.org/readingroom/whitepapers/recovery/business-continuityplanning-concept-operations-1653 BCPL-02 May the Institution review your BCP and supporting documentation? General inquiry for documentation. As BCPs may
contain some sensitive data, a robust summary is
appropriate in lieu of a full BCPP.

If the vendor states "No", you can ask for a summary,
white paper, or blog. If unable to review the full plan, infer what you can from other BCP question responses.

BCPL-03 Is an owner assigned who is responsible for the maintenance and review of the Business Continuity Plan?
Having a BCP and maintaining/updating/testing a BCP
are very different. Establishing a responsible party is fundamental to this process and this question looks to
verify that within the vendor.

Follow-up inquiries for BCP responsible parties will be institution/implementation specific.

BCPL-04 Is there a defined problem/issue escalation plan in your BCP for impacted clients?
Notification expectations should be set early in the
contract/assessment process. Timelines,
correspondence medium, and playbook details are all
aspects to keep in mind when assessing this response.

If the vendor's response does not cover the details
outlined in the reasoning, follow-up and get specific
responses for each, as needed.

BCPL-05 Is there a documented communication plan in your BCP for impacted clients? Notification expectations should be set early in the
contract/assessment process. Timelines,
correspondence medium, and playbook details are all
aspects to keep in mind when assessing this response.

If the vendor's response does not cover the details
outlined in the reasoning, follow-up and get specific
responses for each, as needed.

BCPL-06 Are all components of the BCP reviewed at least annually and updated as needed to reflect change?
It is expected that a vendor will maintain an accurate
BCP to be tested at a regular interval. Any variance to this should be clearly explained. A vendor's response to this question can reveal the value that they place on
testing their BCP (and possibly other aspects of their
programs).

If the vendor does not have a BCP, point them to
https://www.sans.org/readingroom/whitepapers/recovery/business-continuityplanning-concept-operations-1653 BCPL-07 Has your BCP been tested in the last year?
Testing a BCP is an important action that improves the
efficiency and accuracy of a vendor's continuity plans.

Annual updates are generally expected.

If the vendor does not have a BCP, point them to
https://www.sans.org/readingroom/whitepapers/recovery/business-continuityplanning-concept-operations-1653 BCPL-08 Does your organization conduct training and awareness activities to validate its employees understanding of their roles and responsibilities during a crisis? Understanding the maturity of a vendor's training and
awareness program will indicate the value they place
on protecting institutional data. BCP related awareness training should be prevalent, continuous, and welldocumented.

If a vendor's BCP training and awareness activities are insufficient, inquire about other mandatory training,
verify its scope, and confirm the training cycles.

BCPL-09 Are specific crisis management roles and responsibilities defined and documented?
As it relates to BCPs, a vendor's response will provide insight into their ability to properly response to
business threats. A vendor that has not previously
defined responsible parties and outlined realistic plans may not maintain the availability needed for the
institution's use case or business requirement.

Follow-up inquiries for BCP roles and responsibility
details will be institution/implementation specific.

BCPL-10 Does your organization have an alternative business site or a contracted Business Recovery provider?
In the event that a vendor's headquarters (primary
location of operation) is no longer usable, an
alternative business site may be needed to support
business operations. Having an established (planned)
alternative business site show maturity in a vendor's
BCP.

Follow-up inquiries for alternative business site
practices will be institution/implementation specific.

BCPL-11 Does your organization conduct an annual test of relocating to an alternate site for business recovery purposes?
Testing a BCP is an important action that improves the
efficiency and accuracy of a vendor's continuity plans.

Vague responses to this question should be met with
concern and appropriate follow-up, based on your
institutions risk tolerance.

If the vendor does not have a BCP, point them to
https://www.sans.org/readingroom/whitepapers/recovery/business-continuityplanning-concept-operations-1653 BCPL-12 Is this product a core service of your organization, and as such, the top priority during business continuity planning?
The purpose of this question is understand the vendor's order of response if affected by a unplanned business
disruption. If the software/product/service being
assessed is a vendor's core moneymaker, the
probability that restoration of the
software/product/service will be top priority.

If it is not a core service, follow-up questions should be availability focused and institution/implementation
specific.

Reason for Question Follow-up Inquiries/Responses
CHNG-01 Do you have a documented and currently followed change management process (CMP)?
The lack of a Change Management program is
indicative of immature program processes - answers to
this question can provide insight into how well their
responses (on the HECVAT) represent their actual
environment(s).

If a weak response is given to this answer, response
scrutiny should be increased. Questions about
configuration management, system authority, and
documentation are appropriate.

CHNG-02
Indicate all procedures that are implemented in your CMP. a.) An impact analysis of the upgrade is performed. b.) The change is appropriately authorized. c.) Changes are made first in a test environment. d.) The ability to implement the upgrades/changes in the production environment is limited to appropriate IT personnel.

This question outlines a mature Change Management
process. Changes should be analyzed for impact,
officially approved, tested, and performed by
authorized users.

If the vendor's response does not cover the details
outlined in the reasoning, follow-up and get specific
responses, as needed.

CHNG-03 Will the Institution be notified of major changes to your environment that could impact the Institution's security posture?
Notification expectations should be set earlier in the
contract/assessment process. Timelines,
correspondence medium, and playbook details are all
aspects to keep in mind when assessing this response.

If the vendor's response does not cover the details
outlined in the reasoning, follow-up and get specific
responses for each, as needed.

CHNG-04 Do clients have the option to not participate in or postpone an upgrade to a new release?
Unplanned and/or unexpected changes in a complex
environment can introduce intolerable risks to the
institution. Based on the operating environment of the
institution, it may be necessary to postpone (or
properly plan) the change to a system. The vendor's
response should clarify their use of a "one code base"
method or the ability to run multiple version
concurrently
Follow-up inquiries for software/product/service version releases will be institution/implementation specific.

Business Continuity Plan
Change Management
CHNG-05
Describe or provide a reference to your solution support strategy in relation to maintaining software currency. (i.e. how many concurrent versions are you willing to run and support?)
Supporting multiple versions of a product is
challenging. Understanding the vendor’s strategy and
resources will provide insight into their ability to
adequately support their customers.

Follow-up inquiries for the vendor’s support of
concurrent versions will be institution/implementation
specific.

This question shows how easy it is for customers to
upgrade from one version of the software to the next. If the software has many interdependencies, it will be
difficult for customers to transition to the next version, and the software will be more difficult to support.

Follow-up inquiries for the vendor’s support of
concurrent versions will be institution/implementation
specific.

CHNG-07 Does the system support client customizations from one release to another? The vendor's software/product/service characteristics
and the institution's use case will determine the
relevancy of this question. The purpose of this question is to understand the underlying infrastructure and how
it is maintained across all customers.

In cases where the software/product/service is
customized for customer use cases, ensure the vendor's
response covers all aspects of code migration, including backups, data conversions, local resources from the
institution, etc., as it relates to code upgrades and/or version adoptions.

CHNG-08
Does your organization ensure through policy and procedure (that is currently implemented) that only application software verifiable as authorized, tested, and approved for production, and having met all other requirements and reviews necessary for commissioning, is placed into production? Understanding the vendor’s approach to approving
software for production will indicate the value they
place on quality assurance.

If a weak response is given to this answer, response
scrutiny should be increased. Questions about software
testing and reviews are appropriate.

CHNG-09 Do you have a release schedule for product updates? Answers to this question will reveal the vendor’s ability to plan in the short term. This is valuable information for customers so they can anticipate updates and
potential bug fixes.

Follow-up inquiries for the vendor’s product update
practices will be institution/implementation specific.

CHNG-10 Do you have a technology roadmap, for the next 2 years, for enhancements and bug fixes for the product/service being assessed?
Answers to this question will reveal the vendor’s ability to plan for the future of their product.

Follow-up inquiries for the vendor’s technology
planning practices will be institution/implementation
specific.

CHNG-11 Is Institution involvement (i.e. technically or organizationally) required during product updates?
The response to this question allows the institution to understand the information technology resources
required to properly maintain the vendor's system.

Initial acquisition and setup is important to assess, but the long-term maintenance (and the risks that come
with it), should be clearly defined. Use the response to this question to pivot to other questions and/or verify other vendor responses.

Vague responses to this question should be investigated further. Ask for additional documentation for customer
responsibilities (in the context of information
technology/security).

CHNG-12 Do you have policy and procedure, currently implemented, managing how critical patches are applied to all systems and applications? Answers to this question will reveal the vendor’s
knowledge of their IT assets and their ability to respond to notifications about their systems and software.

Follow-up inquiries for the vendor’s patching practices will be institution/implementation specific.

CHNG-13 Do you have policy and procedure, currently implemented, guiding how security risks are mitigated until patches can be applied? New vulnerabilities are published every day and
vendors have a responsibility to maintain their
software(s). The fundamental nature of operation will
expose some risks to the system but it is crucial that a vendor recognize their responsibilities and have a plan to implement them, when this time arrives.

Follow-up inquiries for the vendors patching practices
will be institution/implementation specific.

CHNG-14 Are upgrades or system changes installed during off-peak hours or in a manner that does not impact the customer?
Restricting system updates to a standard maintenance
timeframe is important for ensuring that changes to
production systems do not impact operations. It’s also
important for troubleshooting any problems that may
occur as a result of the changes.

If the vendor's response does not cover the details
outlined in the reasoning, follow-up and get specific
responses, as needed.

CHNG-15 Do procedures exist to provide that emergency changes are documented and authorized (including after the fact approval)?
In the context of the CIA triad, this question is focused on system integrity, ensuring that system changes are
only executed by authorized users. In the event of
emergency changes, accountability and post-action
review is expected.

Follow-up with a robust question set if a vendor cannot clearly state full-control of the integrity of their
system(s).

Reason for Question Follow-up Inquiries/Responses
DATA-01 Do you physically and logically separate Institution's data from that of other customers?
A vendor's response to this question can reveal a
system's infrastructure quickly. Off-point responses are common here so general follow-up is often needed.

Follow-up inquiries for the vendors infrastructure will be institution/implementation specific.

DATA-02
Will Institution's data be stored on any devices (database servers, file servers, SAN, NAS, …) configured with non-RFC 1918/4193 (i.e. publicly routable) IP addresses?
Systems that are directly exposed to public internet
resources are at great risk than those that are not.

Understanding the requirements for this configuration is important, particularly when assessing compensating
controls.

Ask the vendor about their infrastructure and if there is a solution that eliminates the need for this
environment.

DATA-03 Is sensitive data encrypted in transport? (e.g. system-to-client) The need for encryption in transport is unique to your
institution's implementation of a system. In particular, the data flow between the system and the end-users of
the software/product/service.

Follow-up inquiries for data encryption between the
system and end-users will be
institution/implementation specific.

DATA-04 Is sensitive data encrypted in storage (e.g. disk encryption, at-rest)? The need for encryption at-rest is unique to your
institution's implementation of a system. In particular, system components, architectures, and data flows, all
factor into the need for this control.

Follow-up inquiries for data encryption at-rest will be institution/implementation specific.

DATA-05 Do you employ or allow any cryptographic modules that do not conform to the Federal Information Processing Standards (FIPS PUB 140-2)? Beware the use of proprietary encryption
implementations. Open standard encryption, preferably
mature, is often preferred. Although there may be
cases if which that is not the case, be sure to
understand the vendor's infrastructure and the true
security of a vendor's solution.

If the vendor cannot accommodate open standards
encryption requirements, direct them to NIST's
Cryptographic Standards and Guidelines document at
https://csrc.nist.gov/Projects/Cryptographic-Standardsand-Guidelines DATA-06
Does your system employ encryption technologies when transmitting sensitive information over TCP/IP networks (e.g., SSH, SSL/TLS, VPN)? (e.g. system-tosystem and system-to-client) The need for encryption in transport is unique to your
institution's implementation of a system. In particular, system components, architectures, and data flows, all
factor into the need for this control. Ensure that vendor responses cover encryption between the hosts within
their system - this is the important piece that followsup on DATA-03.

Follow-up inquiries for data encryption within the
system components (and end-users) will be
institution/implementation specific.

DATA-07 List all locations (i.e. city + datacenter name) where the institution's data will be stored?
Data exposure is a risk if sensitive data is in any way transported (physically or electronically) into a Data
Zone that is not authorized by the institution.

Depending on the criticality of data and institution
policy, full control of data confidentiality may be highly valued.

Follow-up inquiries for data location details will be
institution/implementation specific.

DATA-08 At the completion of this contract, will data be returned to the institution? When cancelling a software/product/service, an
institution will commonly want all institutional data that was provided to a vendor. This questions allows the
vendor to state their general practices when a customer leaves their environment.

A vendor's response should be clear and concise. Be
wary of vague responses to this questions and inquire
about export specifics, as needed.

Data
DATA-09 Will the institution's data be available within the system for a period of time at the completion of this contract?
When cancelling a software/product/service, an
institution will commonly want all institutional data that was provided to a vendor. This questions allows the
vendor to state their general practices when a customer leaves their environment.

A vendor's response should be clear and concise. Be
wary of vague responses to this questions and inquire
about export specifics, as needed.

DATA-10 Can the institution extract a full backup of data? When cancelling a software/product/service, an
institution will commonly want all institutional data that was provided to a vendor. The vendor's response
should verify if the institution can extract data or if it is a manual extraction by vendor staff.

A vendor's response should be clear and concise. Be
wary of vague responses to this questions and inquire
about export specifics, as needed.

DATA-11 Are ownership rights to all data, inputs, outputs, and metadata retained by the institution?
This question clarifies the operating model of a vendor and provides insight into the vendor-customer
paradigm of a company. Knowing if the institution is of value to a vendor or if the institution's data is of value to a vendor should weigh heavily in the decisionmaking process.

If a vendor's response is unsatisfactory, engage
institutional counsel to appropriately address any
ownership concerns.

DATA-12 Are these rights retained even through a provider acquisition or bankruptcy event?
This question clarifies the position of the institution in the case of acquisition or bankruptcy. Expect clear
responses to this question - if vague, be sure to followup based on institutional counsel guidance.

If a vendor's response is unsatisfactory, engage
institutional counsel to appropriately address any
ownership concerns.

DATA-13
In the event of imminent bankruptcy, closing of business, or retirement of service, will you provide 90 days for customers to get their data out of the system and migrate applications?
This question clarifies the position of the institution in the case of acquisition or bankruptcy. Expect clear
responses to this question - if vague, be sure to followup based on institutional counsel guidance.

If a vendor's response is unsatisfactory, engage
institutional counsel to appropriately address any
ownership concerns.

DATA-14 Describe or provide a reference to the backup processes for the servers on which the service and/or data resides.

This is a general inquiry about backup processes. There may be some overlap with other vendor responses -
this is a good place to crosscheck consistency and valid any issues that are not clear.

Follow-up inquiries for server backup process details
will be institution/implementation specific.

DATA-15 Are backup copies made according to pre-defined schedules and securely stored and protected?
Restricting system updates to a standard maintenance
timeframe is important for ensuring that changes to
production systems do not impact operations. It’s also
important for troubleshooting any problems that may
occur as a result of the changes. Availability is the focus of this question
An institution's use case will drive the requirements for backup strategy. Ensure that the institution's use case and risk tolerance can be met by vendor systems.

DATA-16 How long are data backups stored?
Confidentiality of data and lifecycle media/data
maintenance maturity are the focus of this question.

Data retention requirements vary greatly and this
question seeks clarity of vendor practices.

Follow-up inquiries for data backup (and retention)
details will be institution/implementation specific.

DATA-17 Are data backups encrypted?
The need for encryption at-rest (for backups) is unique to your institution's implementation of a system. In
particular, system components, architectures, and data
flows, all factor into the need for this control.

Follow-up inquiries for data backup encryption at-rest
will be institution/implementation specific.

DATA-18
Do you have a cryptographic key management process (generation, exchange, storage, safeguards, use, vetting, and replacement), that is documented and currently implemented, for all system components? (e.g. database, system, web, etc.)
Understanding how key management is handled and
the safeguards implemented by the vendor to ensure
key confidentiality in all components of a system(s) can provide insight into other complex details of a vendor's infrastructure. Use vendor responses to this question as a way to pivot to other infrastructure specifics, as
needed to clarify potential risks.

Follow-up with the vendor to ensure that all
components of the system are consider. This includes,
system-to-system, system-to-client, applications,
system accounts, etc.

DATA-19 Do current backups include all operating system software, utilities, security software, application software, and data files necessary for recovery? The purpose of this question is to define the scope of
backup operations and the scope at which a vendor
may readily recover when backup restoration is
required.

Follow-up inquiries for backup content scope will be
institution/implementation specific.

DATA-20 Are you performing off site backups? (i.e. digitally moved off site) When data is moved digitally (e.g., cloud provider,
vendor-owned facility, etc.) offsite, the policies and
implemented procedures are important to know. The
protections implemented to prevent compromise will be
technical in nature and should be well-documented.

Follow-up inquiries for offsite, digital backups will be institution/implementation specific.

DATA-21 Are physical backups taken off site? (i.e. physically moved off site) When data is moved physically (e.g. HDD, print, etc.)
offsite, the policies and implemented procedures are
important to know. Unencrypted data taken outside
secured areas introduces unnecessary risks.

Follow-up inquiries for offsite, physical backups will be institution/implementation specific.

DATA-22 Do backups containing the institution's data ever leave the Institution's Data Zone either physically or via network routing?
Data exposure is a risk if sensitive data is in any way transported (physically or electronically) into a data
zone that is not authorized by the institution.

Depending on the criticality of data and institution
policy, full control of data confidentiality may be highly valued.

Follow-up inquiries for data backup
procedures/practices will be institution/implementation specific.

DATA-23
Do you have a media handling process, that is documented and currently implemented, including end-of-life, repurposing, and data sanitization procedures?
Managing media (and the data within) throughout its
lifecycle is crucial to the protection of institutional data.

The focus of this question is confidentiality, ensuring that media that may store institutional data is protected by well-established policy and procedure.

Vague responses to this question should be investigated further. Ask for additional documentation and verify
that procedure (and possibly training) exists to ensure proper media handling activity.

DATA-24 Does the process described in DATA-23 adhere to DoD 5220.22-M and/or NIST SP 800-88 standards?
Managing media (and the data within) throughout its
lifecycle is crucial to the protection of institutional data.

The focus of this question is confidentiality, ensuring that media that may store institutional data is protected by well-established policy and procedure.

Follow-up inquiries for DoD 5220.22-M and/or SP800-
88 standards will be institution specific.

DATA-25 Do procedures exist to ensure that retention and destruction of data meets established business and regulatory requirements?
Confidentiality of data and lifecycle media/data
maintenance maturity are the focus of this question.

Data retention requirements vary greatly and this
question seeks clarity of vendor practices.

Follow-up inquiries for data retention details will be
institution/implementation specific.

DATA-26 Is media used for long-term retention of business data and archival purposes stored in a secure, environmentally protected area?
Managing media (and the data within) throughout its
lifecycle is crucial to the protection of institutional data.

The focus of this question is confidentiality, ensuring that media that may store institutional data is protected by well-established policy and procedure.

Vague responses to this question should be investigated further. Ask for additional documentation and verify
that procedure (and possibly training) exists to ensure proper media handling activity.

DATA-27 Will you handle data in a FERPA compliant manner? Standard documentation, relevant to institution implementations requiring FERPA compliance.

Follow-up inquiries for FERPA compliance details will be institution/implementation specific.

DATA-28 Is any institution data visible in system administration modules/tools? Confidentiality is the focus of this question. Based on the capabilities of administrators (vendor), the
institution may require additional safeguards to protect the confidentiality of data stored by/shared with a
vendor (e.g., additional layer of encryption, etc.).

If institutional data is visible by [vendor] system
administrators, follow-up with the vendor to
understand the scope of visibility, process/procedure
that administrators follow, and use cases when
administrators are allowed to access (view) institutional data.

Reason for Question Follow-up Inquiries/Responses
DBAS-01 Does the database support encryption of specified data elements in storage? Depending on the use case, full database encryption
may not always be required, or ideal. The ability to
encrypt specific fields (data elements) can be
advantageous to a system. Performance is sometimes
an issue, based on the use case, and this granular
approach to encryption provides an institution more
options.

Follow-up inquiries for database field encryption will be institution/implementation specific. Questions may
include a timeline for this capability, performance
metrics, and/or architectures that compensate for this
level of encryption granularity.

Database
DBAS-02 Do you currently use encryption in your database(s)? Confidentiality is the focus of this question. Vendor
responses to this question should be well-supported.

Ensure that the vendor provides sufficient supporting
documentation, as needed, to ensure that the vendor
properly implements encryption in their database(s).

Dismissive or vague responses should be met with
concern. Follow-up questions can include the reasoning
behind not using encryption, recommendations for bestpractice implementation (i.e. think diagrams), and/or any timeline for implementing this capability in the
software/product/service.

Reason for Question Follow-up Inquiries/Responses
DCTR-01 Does your company own the physical data center where the Institution's data will reside?
Data ownership, availability, and the use of thirdparties are all somewhat connected to the response of this question.

Simple responses without supporting documentation
should be me with concern. Follow-up with a vendor
and request supporting documentation if the answer is
in any way dismissive or off-point.

DCTR-02 Does the hosting provider have a SOC 2 Type 2 report available? This question is relative to the response above.

Understanding the ownership structure of the facility
that will host institutional data is important for setting availability expectations and ensure proper contract
terms are in place to protect the institution due to use of third-parties. If a vendor uses a third-party vendor to provide datacenter solutions, having that vendor's
SOC 2 Type 2 provides additional insight. The ability to assess these "forth-party" vendors is based on your
institution's resources. The vendor is responsible for
providing this information - ensure that they handle
their vendors properly
Follow-up inquiries for additional vendor's SOC 2 Type
2 reports will be institution/implementation specific.

DCTR-03 Are the data centers staffed 24 hours a day, seven days a week (i.e., 24x7x365)?
Vendors that operate their own datacenter(s) can
implement their own monitoring strategy. Use the
vendor's response to this questions to verify/validate
other responses related to ownership/colocation/physical security.

Follow-up inquiries for data center staffing will be
institution/implementation specific.

DCTR-04 Do any of your servers reside in a co-located data center? The purpose of this question is to confirm ownership
and physical characteristics of the infrastructure
responsible for storing/hosting institutional data.

Ask about sharing agreements. Ask about vetting of
individuals with access to the co-location space. Ask
about access controls, policies, physical environments, etc.

DCTR-05 Are your servers separated from other companies via a physical barrier, such as a cage or hardened walls?
This question is primarily focused on system integrity.

If institutional data is stored in a system that is not physically secured from unauthorized access, the need
for compensating controls is often higher. Depending
on the use case or vendor infrastructure, this may not
be relevant.

Follow-up inquiries for system physical security will be institution/implementation specific.

DCTR-06 Does a physical barrier fully enclose the physical space preventing unauthorized physical contact with any of your devices? This question is primarily focused on system integrity.

Follow-up inquiries for system physical security will be institution/implementation specific.

DCTR-07 Select the option that best describes the network segment that servers are connected to.

Network configuration requirements vary greatly and
this question give vendor's the chance to summarize
their system's network infrastructure. Review the
vendor's response to this question and then reassess
other infrastructure components or other vendor
response's that may be affected by the network
infrastructure described in this response.

Standalone solutions will require follow-up questions
similar to onsite consulting. SaaS solutions that are
hosted in IaaS environments will have network
segments and configurations appropriate for that
environment. Follow-up questions will be
platform/environment specific.

DCTR-08 Does this data center operate outside of the Institution's Data Zone? Data exposure is a risk if sensitive data is in any way transported (physically or electronically) into a data
zone that is not authorized by the institution.

Depending on the criticality of data and institution
policy, full control of data confidentiality may be highly valued.

Follow-up inquiries for datacenter location details will be institution/implementation specific.

DCTR-09 Will any institution data leave the Institution's Data Zone? Data exposure is a risk if sensitive data is in any way transported (physically or electronically) into a data
zone that is not authorized by the institution.

Depending on the criticality of data and institution
policy, full control of data confidentiality may be highly valued.

Follow-up inquiries for data backup
procedures/practices will be institution/implementation specific.

DCTR-10 List all datacenters and the cities, states (provinces), and countries where the Institution's data will be stored (including within the Institution's Data Zone).

Data exposure is a risk if sensitive data is in any way transported (physically or electronically) into a data
zone that is not authorized by the institution.

Depending on the criticality of data and institution
policy, full control of data confidentiality may be highly valued.

Follow-up inquiries for datacenter location details will be institution/implementation specific.

DCTR-11 Are your primary and secondary data centers geographically diverse? Geographic diversity is ideal when planning primary
and secondary datacenters. The focus of this question is to determine appropriate geographic diversity to meet
the availability requirements of the institution.

Inquire about future plans, backup plans for the backup plan, etc. Availability is the name of the game - focus on the needs of the institution, especially BCP and DRP elements.

DCTR-12 If outsourced or co-located, is there a contract in place to prevent data from leaving the Institution's Data Zone?
Data exposure is a risk if sensitive data is in any way transported (physically or electronically) into a data
zone that is not authorized by the institution.

Depending on the criticality of data and institution
policy, full control of data confidentiality may be highly valued.

Follow-up inquiries for co-location contracts will be
institution/implementation specific.

DCTR-13 What Tier Level is your data center (per levels defined by the Uptime Institute)?
Standard documentation, relevant to institutions
requiring a vendor to maintain a specific Uptime
Institute Tier Level.

Follow-up inquiries for Uptime Institute Tier Level
details will be institution/implementation specific.

DCTR-14 Is the service hosted in a high availability environment? In the context of the CIA triad, this question is focused on the availability of a system (or set of systems).

The weight placed on the vendor's response will be
specific to the institution's use case and
software/product/service requirements.

DCTR-15 Is redundant power available for all datacenters where institution data will reside?
In the context of the CIA triad, this question is focused on the availability of a system (or set of systems).

The weight placed on the vendor's response will be
specific to the institution's use case and
software/product/service requirements.

DCTR-16 Are redundant power strategies tested?
Installing [potential] redundant power and regularly
testing strategies to ensure they will work when needed are very different. Vague responses to this question
should be met with concern and appropriate follow-up,
based on your institutions risk tolerance.

Follow-up inquiries for redundant power testing details will be institution/implementation specific.

DCTR-17 Describe or provide a reference to the availability of cooling and fire suppression systems in all datacenters where institution data will reside.

Vendor responses will indicate the environment of the
vendor's datacenter. If a vendor's "datacenter" is the
spare closet at the office, additional risks are
introduced to the CIA triad, and should be followed-up
on appropriately.

Follow-up inquiries for cooling and fire suppression
details will be institution/implementation specific.

DCTR-18 State how many Internet Service Providers (ISPs) provide connectivity to each datacenter where the institution's data will reside.

In the context of the CIA triad, this question is focused on the availability of a system (or set of systems).

The weight placed on the vendor's response will be
specific to the institution's use case and
software/product/service requirements.

DCTR-19 Does every datacenter where the Institution's data will reside have multiple telephone company or network provider entrances to the facility? In the context of the CIA triad, this question is focused on the availability of a system (or set of systems).

The weight placed on the vendor's response will be
specific to the institution's use case and
software/product/service requirements.

Reason for Question Follow-up Inquiries/Responses
Datacenter
Disaster Recovery Plan
DRPL-01 Describe or provide a reference to your Disaster Recovery Plan (DRP).

In the context of the CIA triad, this question is focused on availability and is often in need of a follow-up.

Understanding the maturing of a vendor's DRP can shed
light on many other aspects of a vendor's overall
security state.

A vendor may have a number of BCP elements defined
so the vendor's response may not be binary. Assess the
components of the plan and ask about timelines, followup commitments, etc. If the vendor does not have a DRP, point them to https://www.sans.org/readingroom/whitepapers/recovery/disaster-recovery-plan1164 DRPL-02 Is an owner assigned who is responsible for the maintenance and review of the DRP?
Having a DRP and maintaining/updating/testing a DRP
are very different. Establishing a responsible party is fundamental to this process and this question looks to
verify that within the vendor.

Follow-up inquiries for DRP responsible parties will be institution/implementation specific.

DRPL-03 Can the Institution review your DRP and supporting documentation? General inquiry for documentation. As DRPs may
contain some sensitive data, a robust summary is
appropriate in lieu of a full DRP.

If the vendor states "No", you can ask for a summary,
white paper, or blog. If unable to review the full plan, infer what you can from other DRP question responses.

DRPL-04 Are any disaster recovery locations outside the Institution's Data Zone? Data exposure is a risk if sensitive data is in any way transported (physically or electronically) into a data
zone that is not authorized by the institution.

Depending on the criticality of data and institution
policy, full control of data confidentiality may be highly valued.

Follow-up inquiries for data backup
procedures/practices will be institution/implementation specific.

DRPL-05 Does your organization have a disaster recovery site or a contracted Disaster Recovery provider?
In the event that a vendor's headquarters (primary
location of operation) is no longer usable, a recovery
site may be needed to support business operations.

Having an established (planned) recovery site show
maturity in a vendor's DRP.

Follow-up inquiries for disaster recovery site practices will be institution/implementation specific.

DRPL-06 Does your organization conduct an annual test of relocating to this site for disaster recovery purposes?
Testing a DRP is an important action that improves the
efficiency and accuracy of a vendor's recovery plans.

Vague responses to this question should be met with
concern and appropriate follow-up, based on your
institutions risk tolerance.

If the vendor does not have a DRP, point them to
https://www.sans.org/readingroom/whitepapers/recovery/disaster-recovery-plan1164 DRPL-07 Is there a defined problem/issue escalation plan in your DRP for impacted clients?
Notification expectations should be set early in the
contract/assessment process. Timelines,
correspondence medium, and playbook details are all
aspects to keep in mind when assessing this response.

If the vendor's response does not cover the details
outlined in the reasoning, follow-up and get specific
responses for each, as needed.

DRPL-08 Is there a documented communication plan in your DRP for impacted clients? Notification expectations should be set early in the
contract/assessment process. Timelines,
correspondence medium, and playbook details are all
aspects to keep in mind when assessing this response.

If the vendor's response does not cover the details
outlined in the reasoning, follow-up and get specific
responses for each, as needed.

DRPL-09 Describe or provide a reference to how your disaster recovery plan is tested? (i.e. scope of DR tests, end-to-end testing, etc.)
Testing a DRP is an important action that improves the
efficiency and accuracy of a vendor's recovery plans.

Vague responses to this question should be met with
concern and appropriate follow-up, based on your
institutions risk tolerance.

If the vendor does not have a DRP, point them to
https://www.sans.org/readingroom/whitepapers/recovery/disaster-recovery-plan1164 DRPL-10
Has the Disaster Recovery Plan been tested in the last year? Please provide a summary of the results in Additional Information (including actual recovery time).

Testing a DRP is an important action that improves the
efficiency and accuracy of a vendor's recovery plans.

Vague responses to this question should be met with
concern and appropriate follow-up, based on your
institutions risk tolerance.

If the vendor does not have a DRP, point them to
https://www.sans.org/readingroom/whitepapers/recovery/disaster-recovery-plan1164 DRPL-11 Do the documented test results identify your organizations actual recovery time capabilities for technology and facilities?
The vendor's response to this question will verify other responses related to planning, testing, and metrics. Use the response to infer the maturity of the vendor's DRP
efforts.

Follow-up inquiries for recovery time capabilities will be institution/implementation specific.

DRPL-12 Are all components of the DRP reviewed at least annually and updated as needed to reflect change?
Testing a DRP is an important action that improves the
efficiency and accuracy of a vendor's recovery plans.

Vague responses to this question should be met with
concern and appropriate follow-up, based on your
institutions risk tolerance.

If the vendor does not have a DRP, point them to
https://www.sans.org/readingroom/whitepapers/recovery/disaster-recovery-plan1164 DRPL-13 Do you carry cyber-risk insurance to protect against unforeseen service outages, data that is lost or stolen, and security incidents? Vendor responses to this questions need to be
evaluated in the context of use case, data criticality, institutional risk tolerance, and value of the
software/product/service to the institution's mission.

Follow-up inquiries for cyber-risk insurance will be
institution/implementation specific.

Reason for Question Follow-up Inquiries/Responses
FIDP-01 Are you utilizing a web application firewall (WAF)? The use case, vendor infrastructure, and types of
services offered will greatly affect the need for various firewalling devices. The focus of this question is
integrity, ensuring that the systems hosting
institutional data are limited in need-only
communications. The use of a WAF is important in
systems in which a vendor has limited access to the to
code infrastructure.

If a vendors states that they outsource their code
development and do not run a WAF, there is elevated
reason for concern. Verify how code is tested,
monitored, and controlled in production environments.

FIDP-02 Are you utilizing a stateful packet inspection (SPI) firewall? The use case, vendor infrastructure, and types of
services offered will greatly affect the need for various firewalling devices. The focus of this question is
integrity, ensuring that the systems hosting
institutional data are limited in need-only
communications. The use of a WAF is important in
systems in which a vendor has limited access to the to
code infrastructure
If a vendors states that they outsource their code
development and do not run a WAF, there is elevated
reason for concern. Verify how code is tested,
monitored, and controlled in production environments.

FIDP-03 State and describe who has the authority to change firewall rules? Modifications to firewall rulesets can have significant repercussions. To ensure the integrity of the ruleset,
this question targets the individual (or responsible
party) for changes and the reasoning behind their
authority.

Ensure that a separation of duties exists in network
security configurations. Pay close attention to
responsibility overlap in small organizations, where
staff often fill multiple roles.

FIDP-04 Do you have a documented policy for firewall change requests? In the context of the CIA triad, this question is focused on system integrity, ensuring that system changes are
only executed by authorized users. Any change to a
verified, known, secure environment should be carefully evaluated by stakeholders in a structured manner.

Follow-up inquiries for firewall change requests will be institution/implementation specific.

FIDP-05 Have you implemented an Intrusion Detection System (network-based)? It is important to have detective capabilities in an
information system to protect institutional data.

Somewhat expected in information systems, vendors
without IDSs implemented should raise concerns.

Compensating controls need future evaluation, if
provided by the vendor.

A security program with limited resources for event
detection is not effective. Inquiries should include
training for staff, reasoning behind not using IDS
technologies, and how systems are monitored.

Additional questions about a SIEM and other tool may
be appropriate.

FIDP-06 Have you implemented an Intrusion Prevention System (network-based)? It is important to have preventive capabilities in an
information system to protect institutional data.

Somewhat expected in information systems, vendors
without IPSs implemented should raise concerns.

Compensating controls need future evaluation, if
provided by the vendor.

A security program with limited resources for active
prevent is inefficient. Inquiries should include training for staff, reasoning behind not using IPS technologies, and how systems are actively protected and how
malicious activity is stopped.

Firewalls, IDS, IPS, and Networking
FIDP-07 Do you employ host-based intrusion detection?
It is important to have detective capabilities in an
information system to protect institutional data.

Somewhat expected in information systems, vendors
without IDSs implemented should raise concerns.

Compensating controls need future evaluation, if
provided by the vendor.

Ask the vendor to summarize why host-based intrusion
detection tools are not implemented in their
environment. What compensating controls are in place
to detect configuration changes and/or failures of
integrity?
FIDP-08 Do you employ host-based intrusion prevention?
It is important to have preventive capabilities in an
information system to protect institutional data.

Somewhat expected in information systems, vendors
without IPSs implemented should raise concerns.

Compensating controls need future evaluation, if
provided by the vendor.

Ask the vendor to summarize why host-based intrusion
prevention tools are not implemented in their
environment. What compensating controls are in place
to detect malicious activity and to actively prevent its function.

FIDP-09 Are you employing any next-generation persistent threat (NGPT) monitoring? This question is primarily focused on the maturity of a vendor's security program. Technologies are rapidly
introduced and the toolsets needed to monitor,
manage, and secure them need to keep up. Vendor
responses to this question can give an institution
insight into the maturity and overall state of a vendor's security.

Follow-up inquiries for NGPT monitoring will be
institution/implementation specific.

FIDP-10 Do you monitor for intrusions on a 24x7x365 basis? This question is primarily focused on system(s)
integrity. If institutional data is stored in a system that is not physically secured from unauthorized access, the need for compensating controls is often higher.

Depending on the use case or vendor infrastructure,
this may not be relevant.

Follow-up inquiries for 24x7x365 monitoring will be
institution/implementation specific.

FIDP-11 Is intrusion monitoring performed internally or by a third-party service? This question is primarily focused on the capability of a vendor's security program. Understanding the size and
skillsets of a vendor (taken from other responses) is
needed to determine the appropriateness of the
vendor's response to this question.

Follow-up inquiries for intrusion monitoring will be
institution/implementation specific.

FIDP-12 Are audit logs available for all changes to the network, firewall, IDS, and IPS systems?
Strong logging capabilities are vital to the proper
management of a network. Implementing an immature
system that lacks sufficient logging capabilities exposes an institution to great risk.

If a weak response is given to this answer, it is an
indicator that a non-technical representative populated the document and response scrutiny should be
increased.

If a vendor does not answer appropriately, a follow-up
request to have the question fully-answered is
appropriate.

Reason for Question Follow-up Inquiries/Responses
MAPP-01 On which mobile operating systems is your software or service supported? The purpose of this question is to highlight any
concerning restrictions in the software/product/service that may cause support (or other) risks when deployed.

Follow-up inquiries for mobile application compatibility will be institution/implementation specific.

MAPP-02 Describe or provide a reference to the application's architecture and functionality.

Languages, platforms, libraries, coding style - anything along these lines is what this question is after. Layers of architecture, number of systems, complexity of
configuration, and commonality of hardware/software
are all points of interest in this question.

Vague responses to this question should be investigated further. Ask for additional documentation and verify
that appropriate documentation exists to clearly
understand the vendor's environment.

MAPP-03 Is the application available from a trusted source (e.g., iTunes App Store, Android Market, BB World)?
Distributing application via known, moderately vetted
application platform decreases the chances of malicious code distribution. Standalone deployments (non-trusted
sources) should be looked at more closely.

Ask the vendor why this deployment strategy is used.

Ask if it is a restriction of the app store platform or some other environment restriction.

MAPP-04 Does the application store, process, or transmit critical data? The purpose of this question is to understand the flow
of data, specifically critical data, so that the proper follow-up questions can be asked.

Ask the vendor for data flow diagrams. Communication
trusts between nodes is important - ask how data is
handled at the application (device end), not just the
servers.

MAPP-05 Is Institution's data encrypted in transport?
The need for encryption in transport is unique to your
institution's implementation of a system. In particular, system components, architectures, and data flows, all
factor into the need for this control.

Follow-up inquiries for data encryption in transport will be institution/implementation specific.

MAPP-06 Is Institution's data encrypted in storage? (e.g. disk encryption, at-rest) The need for encryption at-rest is unique to your
institution's implementation of a system. In particular, system components, architectures, and data flows, all
factor into the need for this control.

Follow-up inquiries for data encryption at-rest will be institution/implementation specific.

MAPP-07 Does the mobile application support Kerberos, CAS, or Active Directory authentication?
This question is to set account management
expectations for the institution. A system that can
integrate with existing, vetted solutions, has its
advantages and may have less administrative
overhead. Also, adherence to standards here gives
credit to other standards-oriented questions/responses.

MAPP-08 Will any of these systems be implemented on systems hosting the Institution's data?
This is a follow-up to the questions above. Although a
system may support authentication integrations, they
may or may not be used on systems that store
institutional data. Verify the use of authentication
methods/functions in all parts of a system.

MAPP-09 Does the application adhere to secure coding practices (e.g. OWASP, etc.)? The adherence to secure coding best practices better
positions a vendor to maintain the CIA triad. Use the
knowledge of this response when evaluating other
vendor statements, particularly those focused on
development and the protection of communications.

If information security principles are not designed into the product lifecycle, point the vendor to OWASP's
Secure Coding Practices - Quick Reference Guide at
https://www.owasp.org/index.php/OWASP_Secure_Cod
ing_Practices_-_Quick_Reference_Guide
MAPP-10 Has the application been tested for vulnerabilities by a third party? External verification of application security controls in important when managing a system. Trust, but verify,
is the focus of this question. HECVAT responses are
taken at face-value, and verified within reason, in most cases. When a vendor can attest to, and provide
externally-provided evidence supporting that
attestation, it goes a long way in building trust that the vendor will appropriately protect institutional data
If "No", inquire if there has ever been a vulnerability scan. A short lapse in external assessment validity can be understood (if there is a planned assessment) but a
significant time lapse or none whatsoever is cause for
elevated levels of concern.

MAPP-11 State the party that performed the vulnerability test and the date it was conducted?
External verification of application security controls in important when managing a system. Trust, but verify,
is the focus of this question. HECVAT responses are
taken at face-value, and verified within reason, in most cases. When a vendor can attest to, and provide
externally-provided evidence supporting that
attestation, it goes a long way in building trust that the vendor will appropriately protect institutional data.

If "No", inquiry is there has ever been a vulnerability scan. A short lapse in external assessment validity can be understood (if there is a planned assessment) but a
significant time lapse or none whatsoever is cause for
elevated levels of concern.

Reason for Question Follow-up Inquiries/Responses
PHYS-01 Does your organization have physical security controls and policies in place? This question is primarily focused on system(s)
integrity. If institutional data is stored in a system that is not physically secured from unauthorized access, the need for compensating controls is often higher. This
question also encompasses office (and other) spaces
used by the vendor to conduct operations.

If a weak response is given to this answer, response
scrutiny should be increased. Inquire about the size of an organization, how it is physically deployed, how
employees interact with each other and verify each
others credibility. Any follow-up question related to
physical integrity of institutional data is relevant here.

Mobile Applications
Physical Security
PHYS-02 Are employees allowed to take home Institution's data in any form? In the context of the CIA triad, this question is focused on confidentiality. Printed documents, mobile device
use, and remote access are all relevant to this question.

A vendor's response to this question will provide insight into their overall business process. Vendor business
activity that pose additional security risks should be
met with increased concern.

Vague responses to this question should be investigated further. Ask for additional documentation and verify
that procedure (and possibly training) exists to ensure proper customer data handling activity.

PHYS-03 Are video monitoring feeds retained?
The focus of this question is the detective capabilities in the event an incident occurs in regards to institutional data.

Follow-up inquiries for video data storage will be
institution/implementation specific.

PHYS-04 Are video feeds monitored by datacenter staff?
The focus of this question is the detective capabilities in the event an incident occurs in regards to institutional data.

Follow-up inquiries for video monitoring will be
institution/implementation specific.

PHYS-05 Are individuals required to sign in/out for installation and removal of equipment?
Managing media (and the data within) throughout its
lifecycle is crucial to the protection of institutional data.

The focus of this question is confidentiality, ensuring that equipment used to store institutional data is
appropriately protected.

Vague responses to this question should be investigated further. Ask for additional documentation and verify
that procedure (and possibly training) exists to ensure proper media handling activity.

Reason for Question Follow-up Inquiries/Responses
PPPR-01 Can you share the organization chart, mission statement, and policies for your information security unit?
Understanding the security program size (and
capabilities) of a vendor has a significant impact on
their ability to respond effectively to a security incident.

Vendor's will share organizational charts and additional documentation of their security program, if needed. The point of this question is to verify vendor security
program maturity or confirm other findings and/or
assessments
Vague responses to this question should be investigated further. Vendors unwilling to share additional
supporting documentation decrease the trust
established with other responses.

PPPR-02 Do you have a documented patch management process? In the context of the CIA triad, this question is focused on system integrity, ensuring that system changes are
only executed according to policy. Additionally, it is
expected that devices used to access the vendor's
systems are properly managed and secured.

Follow-up with a robust question set if the vendor
cannot clearly state full-control of their system patching strategy. Questions about patch testing, testing
environments, threat mitigation, incident remediation,
etc. are appropriate.

PPPR-03 Can you accommodate encryption requirements using open standards? Beware the use of proprietary encryption
implementations. Open standard encryption, preferably
mature, is often preferred. Although there may be
cases if which that is not the case, be sure to
understand the vendor's infrastructure and the true
security of a vendor's solution.

If the vendor cannot accommodate open standards
encryption requirements, direct them to NIST's
Cryptographic Standards and Guidelines document at
https://csrc.nist.gov/Projects/Cryptographic-Standardsand-Guidelines PPPR-04 Have your developers been trained in secure coding techniques? The adherence to secure coding best practices better
positions a vendor to maintain the CIA triad. Use the
knowledge of this response when evaluating other
vendor statements, particularly those focused on
development and the protection of communications.

Depending on the insight a vendor has into their code,
code testing should be expected. When a vendor
outsources their coding efforts, the use of a web
application firewall may be appropriate. In this case,
reference the vendor's response to their use of a WAF.

Ask the vendor what types of tools they use in testing.

And who performs the testing of the code. Are
developers the ones running the security tests? If static code analysis and/or static application security testing is not conducted, point the vendor to OWASP's Testing
Guide at
https://www.owasp.org/index.php/OWASP_Testing_Gui
de_v4_Table_of_Contents
PPPR-07 Do you have software testing processes (dynamic or static) that are established and followed?
Code analysis (prior to implementation) can decrease
the number of vulnerabilities within a system.

Depending on the insight a vendor has into their code,
code testing should be expected.

If software testing processes are not established and
followed, point the vendor to OWASP's Testing Guide at
https://www.owasp.org/index.php/OWASP_Testing_Gui
de_v4_Table_of_Contents
PPPR-08 Are information security principles designed into the product lifecycle? The adherence to secure coding best practices better
positions a vendor to maintain the CIA triad. Use the
knowledge of this response when evaluating other
vendor statements, particularly those focused on
development and the protection of communications.

Although withdrawn by NIST, the Security
Considerations in the Systems Development Life Cycle
(SP 800-64r2) document is an excellent resource to
provide guidance to vendors (i.e. set expectations.)
Follow-up questions to SDLC use will be
institution/implementation specific.

PPPR-10 Do you have a formal incident response plan?
The ability for the vendor to respond effectively (and
quickly) to a security incident is of the utmost
importance. The size of a vendor's security office will determine their capabilities during a security incident but the incident response plan will oftentimes
determine their effectiveness. Use the knowledge of this response when evaluating other vendor statements,
particularly when discussing degraded operation states.

If the vendor does not have an incident response plan,
point them to the NIST Computer Security Incident
Handling Guide at
https://csrc.nist.gov/publications/detail/sp/800-61/rev2/final PPPR-11 Will you comply with applicable breach notification laws? This is a general inquiry to determine if the vendor is well-versed in applicable laws and regulations that
apply in the institution's region of business operation.

If a vendor is vague in their response, follow-up with
direct questions about doing business in your
state/region/country and any laws that are pertinent to the institution.

PPPR-12 Will you comply with the Institution's IT policies with regards to user privacy and data protection?
This is a general inquiry to determine if the vendor has reviewed the institution's policies and are committed to complying with them.

If a vendor is vague in their response, follow-up with
direct questions about the institution's policies and
ensure the expectation of compliance is clear with the
vendor.

PPPR-13 Is your company subject to Institution's Data Zone laws and regulations? This is a general inquiry to determine if the vendor is well-versed in applicable laws and regulations that
apply in the institution's region of business operation.

If a vendor is vague in their response, follow-up with
direct questions about doing business in your
state/region/country and any laws that are pertinent to the institution.

PPPR-14 Do you perform background screenings or multi-state background checks on all employees prior to their first day of work?
The use of detective and preventive controls in the
hiring process serve a valuable role in protecting
institutional data. As these are often HR documented
policies, a vendor should have their practices welldocumented and ready for review, upon request.

Ask the vendor is background checks and/or screening
are conducted in any capacity, at any time during the
employment period. Ask about the precautions they
take to ensure the intellectual property is secured and inquire if user data is treated in an appropriate manner.

PPPR-15 Do you require new employees to fill out agreements and review policies? Setting the expectation of performance and increase
awareness of security-related responsibilities are part of these initial-hiring documents. Oftentimes these
agreements and reviews are conducted during
orientation for new employees.

If a vendor's practices are not clear, inquire about
training requirements for employees, especially the
frequency and scope of content.

Policies, Procedures, and Processes
PPPR-16 Do you have documented information security policy? A shared security [responsibility] environment is
expected of vendors in today's world. Security office's cannot solely protect an institution's data. Information security, engrained in an organization, is the best case scenario for the protection of institutional data. Security awareness and practice start in a vendor's policies.

If the vendor does not have document information
security policy, follow-up questions about training,
company practices, awareness efforts, auditing, and
system protection practices are appropriate.

PPPR-17 Do you have an information security awareness program? Understanding the maturity of a vendor's awareness
program will indicate the value they place on protecting institutional data. Security involves all parts of an
organization, end-user staff included. Awareness
training should be prevalent, continuous, and welldocumented.

If a vendor's awareness training is not prevalent,
continuous, and well-documented, it is cause for
concern. Inquire about other mandatory training, verify its scope, and confirm the training cycles.

PPPR-18 Is security awareness training mandatory for all employees? Understanding the maturity of a vendor's awareness
program will indicate the value they place on protecting institutional data. Security involves all parts of an
organization, end-user staff included. Awareness
training should be prevalent, continuous, and welldocumented.

If a vendor's awareness training is not prevalent,
continuous, and well-documented, it is cause for
concern. Inquire about other mandatory training, verify its scope, and confirm the training cycles.

PPPR-19 Do you have process and procedure(s) documented, and currently followed, that require a review and update of the access-list(s) for privileged accounts? The focus of this question is privilege creep, a situation where employees gain access privileges as they move
within an organization, but privileges that they were
given in previous roles are not removed. This can lead
to situations were an individual has concurrent access
to systems that should not be allowed.

Ask the vendor how administrator accounts are
protected. Ask for documentation for their onboarding
and offboarding procedures for new staff.

PPPR-20 Do you have documented, and currently implemented, internal audit processes and procedures?
The focus of this question is if they audit, how they
audit, what they audit, and how it is properly
documented and consistently conducted.

Follow-up inquiries for internal audit strategies will be institution/implementation specific.

Reason for Question Follow-up Inquiries/Responses
PROD-01 Do you incorporate customer feedback into security feature requests? Not every software/product/service will have everything an institution will need, at all times, during the lifecycle of a system. The ability to influence development efforts is a valuable position for a higher ed institution.

Knowing that a vendor is listening and wants to deliver viable solutions builds trust in the implementation.

Ask how requests should be submitted, how requests
are prioritized, and by whom. Ask about product
roadmaps (1yr, 2yr, 5yr, depending on use case).

PROD-02 Can you provide an evaluation site to the institution for testing? Oftentimes an institution will want to evaluate a
solution before committing to purchase or deploying
future functionality. Based on the use case, flexibility in product evaluation may be a requirement.

Follow-up inquiries for evaluations sites will be
institution/implementation specific.

Reason for Question Follow-up Inquiries/Responses
QLAS-01 Provide a general summary of your Quality Assurance program.

Integrity and availability are the focus of this question.

The existence of a well-documented quality assurance
program, with demonstrated and published metrics,
may provide insight into the inner workings (mindset)
of a vendor.

Institutions vary broadly on how QA is handled so any
follow-up questions will be
contract/institution/implementation specific.

QLAS-02 Do you comply with ISO 9001? Standard documentation, relevant to institutions requiring a vendor to comply with ISO 9001.

Follow-up inquiries for ISO 9001 content will be
institution/implementation specific.

QLAS-03
Will your company provide quality and performance metrics in relation to the scope of services and performance expectations for the services you are offering?
This question is for institutions that tie metrics and
service level agreements (SLAs) or expectations (SLEs)
to security reviews. The implementation strategy and
use case will indicate the relevancy of this question for security/risk assessment.

Follow-up inquiries for quality and performance metrics will be contract/institution/implementation specific.

QLAS-04 Have you supplied products and/or services to the Institution (or its Campuses) in the last five years?
This is a general inquiry to determine if the vendor
being assessed has done or is doing business with the
institution as the time of assessment. Existing
relationships, if present, can be reviewed for insights into a vendor and/or to verify other responses.

Many Higher Ed institutions are large enough that
existing/former contracts exist with one entity of the
college/university (e.g. School of X) but it is unknown to another. Question the vendor in-depth if you get a
vague response to this question - combining
licenses/purchases increases buying power.

QLAS-05 Do you have a program to keep your customers abreast of higher education and/or industry issues?
This question is used to gauge the importance of our
industry (higher education) to the vendor.

This is a general information question - any follow-up
will be institution/implementation specific.

Reason for Question Follow-up Inquiries/Responses
SYST-01 Are systems that support this service managed via a separate management network?
Management networks and end-user networks are often
exclusive, with the intent of limiting access to elevated authorization tools. When a vendor states these
networks are merged in operation, it should be met
with elevated levels of concern. The focus of this
question is to verify a common best practice in system
management, allowing an institution to gain insight into a vendor's operating environment.

Verify if the vendor's practice is constrained by a
technology or if it is just a best practice that is not adopted. In the case of constraints, ask for additional best practice implementation strategies that may
compensate for the elevated risk(s).

SYST-02 Do you have an implemented system configuration management process? (e.g. secure "gold" images, etc.)
Hardware lifecycles and continuous software updates
creates an always-changing landscape in information
technology. The focus of this question is the integrity of a vendor's infrastructure. Mismanagement of system
configurations can lead to breakdowns in layers of
security.

It is expected that vendors should have robust
documentation when it comes to configuration
management. Vague answers to this question should be
met with concern. Inquire about the device
management tools in use, system lifecycles, complexity
of systems, etc. and evaluate the response in the
context of company capabilities (see Company
Background section).

SYST-03 Are employee mobile devices managed by your company's Mobile Device Management (MDM) platform?
The focus of this question is confidentiality. Vendor
employees accessing institutional data from personal,
unmanaged (by vendor) devices pose a risk of loss of
confidentiality.

Follow-up inquiries for mobile device management
procedures/practices will be institution/implementation specific. Increased scrutiny should be placed on
compensating controls, data loss prevention, access
controls, auditing, etc.

SYST-04
Do you have a systems management and configuration strategy that encompasses servers, appliances, and mobile devices (company and employee owned)?
In the context of the CIA triad, this question is focused on system integrity, ensuring that system changes are
only executed by authorized users. Additionally, it is
expected that devices (for administrators, vendor staff, and affiliates)that are used to access the vendor's
systems are properly managed and secured.

Follow-up with a robust question set if the vendor
cannot clearly state full-control of the integrity of their system(s). Questions about administrator access on
end-user devices and other maintenance and patching
type questions are appropriate.

Reason for Question Follow-up Inquiries/Responses
VULN-01 Are your applications scanned externally for vulnerabilities? External verification of application security controls in important when managing a system. Trust, but verify,
is the focus of this question. HECVAT responses are
taken at face-value, and verified within reason, in most cases. When a vendor can attest to, and provide
externally-provided evidence supporting that
attestation, it goes a long way in building trust that the vendor will appropriately protect institutional data.

If "No", inquire if there has ever been a vulnerability scan. A short lapse in external assessment validity can be understood (if there is a planned assessment) but a
significant time lapse or none whatsoever is cause for
elevated levels of concern.

Product Evaluation
Quality Assurance
Systems Management & Configuration
Vulnerability Scanning
VULN-02 Have your applications had an external vulnerability assessment in the last year?
External verification of application security controls in important when managing a system. Trust, but verify,
is the focus of this question. HECVAT responses are
taken at face-value, and verified within reason, in most cases. When a vendor can attest to, and provide
externally-provided evidence supporting that
attestation, it goes a long way in building trust that the vendor will appropriately protect institutional data
If "No", inquiry is there has ever been a vulnerability scan. A short lapse in external assessment validity can be understood (if there is a planned assessment) but a
significant time lapse or none whatsoever is cause for
elevated levels of concern.

VULN-03 Are your applications scanned for vulnerabilities prior to new releases? Modern technologies allow for rapid deployment of
features and with them, come changes to an
established code environment. The focus of this
question is to verify a vendor's practice of regression testing their code and verifying that previously nonexistent risks are introduced into a known, secured environment.

If "No", inquiry if there are plans to implement these
processes. Ask the vendor to summarize their decision
behind not scanning their applications for
vulnerabilities. Prior to release.

VULN-04 Are your systems scanned externally for vulnerabilities? External verification of system security controls in
important when managing a system. Trust, but verify,
is the focus of this question. HECVAT responses are
taken at face-value, and verified within reason, in most cases. When a vendor can attest to, and provide
externally-provided evidence supporting that
attestation, it goes a long way in building trust that the vendor will appropriately protect institutional data.

VULN-05 Have your systems had an external vulnerability assessment in the last year? External verification of system security controls in
important when managing a system. Trust, but verify,
is the focus of this question. HECVAT responses are
taken at face-value, and verified within reason, in most cases. When a vendor can attest to, and provide
externally-provided evidence supporting that
attestation, it goes a long way in building trust that the vendor will appropriately protect institutional data.

VULN-06 Describe or provide a reference to the tool(s) used to scan for vulnerabilities in your applications and systems.

Every infrastructure has a set of tools best suited to
evaluate and protect it from vulnerability. Regardless of focus (i.e. code, hardware systems, etc.), professional, well-established tools are ideal when performing
vulnerability assessment. In addition, the talent/skillset of a vulnerability assessor is also important.

Inquiries should be focused on matching tools to
policy/procedures and ensuring that a vendor has the
skillset/knowledge to properly scan their environments
for vulnerabilities and address them adequately, when
discovered.

VULN-07 Will you provide results of security scans to the Institution? If a vendor is scanning their applications and/or
systems, oftentimes an institution will want to review
the report, if possible. Preferably, any finding on the reports will have a matching mitigation action.

If a vendor is hesitant to share the report, ask for a
summarized version - some insight is better than none.

VULN-08
Describe or provide a reference to how you monitor for and protect against common web application security vulnerabilities (e.g. SQL injection, XSS, XSRF, etc.).

The adherence to secure coding best practices better
positions a vendor to maintain the CIA triad. Use the
knowledge of this response when evaluating other
vendor statements, particularly those focused on
development and the protection of communications.

Vendors should be monitoring for and addressing these
issues in their products.

If information security principles are not designed into the product lifecycle, point the vendor to OWASP's
Secure Coding Practices - Quick Reference Guide at
https://www.owasp.org/index.php/OWASP_Secure_Cod
ing_Practices_-_Quick_Reference_Guide
Inquire about the tools a vendor uses, the interval at
which systems are monitored/mitigated, and who is
responsible for the process/procedure in place for this monitoring
VULN-09
Will you allow the institution to perform its own security testing of your systems and/or application provided that testing is performed at a mutually agreed upon time and date?
Many Higher Ed institutions are capable of performing
vulnerability assessments and/or penetration testing on their vendor's infrastructures. This question confirms
the possibility of conducting these actions against the vendor's infrastructure.

Follow-up inquiries for vulnerability scanning and
penetration testing will be institution/implementation
specific.

Reason for Question Follow-up Inquiries/Responses
HIPA-01 Do your workforce members receive regular training related to the HIPAA Privacy and Security Rules and the HITECH Act? §164.308(a)(5)(i) Follow-up inquiries for HIPAA requirements will be institution/implementation specific.

HIPA-02 Do you monitor or receive information regarding changes in HIPAA regulations? §164.316(b)(2)(iii) Follow-up inquiries for HIPAA requirements will be institution/implementation specific.

HIPA-03 Has your organization designated HIPAA Privacy and Security officers as required by the Rules? §164.308(a)(2) Follow-up inquiries for HIPAA requirements will be institution/implementation specific.

HIPA-04 Do you comply with the requirements of the Health Information Technology for Economic and Clinical Health Act (HITECH)?
Inquiry into a vendor's use of electronic health records (EHRs).

Follow-up inquiries for HIPAA requirements will be
institution/implementation specific.

HIPA-05 Do you have an incident response process and reporting in place to investigate any potential incidents and report actual incidents? §164.308(a)(6)(i) Follow-up inquiries for HIPAA requirements will be institution/implementation specific.

HIPA-06 Do you have a plan to comply with the Breach Notification requirements if there is a breach of data? §164.308(a)(6)(ii) Follow-up inquiries for HIPAA requirements will be institution/implementation specific.

HIPA-07 Have you conducted a risk analysis as required under the Security Rule? §164.308(a)(1)(i) Follow-up inquiries for HIPAA requirements will be institution/implementation specific.

HIPA-08 Have you identified areas of risks? §164.308(a)(1)(i), §164.308(a)(1)(ii)(A) Follow-up inquiries for HIPAA requirements will be institution/implementation specific.

HIPA-09 Have you taken actions to mitigate the identified risks? §164.308(a)(1)(ii)(B) Follow-up inquiries for HIPAA requirements will be institution/implementation specific.

HIPA-10 Does your application require user and system administrator password changes at a frequency no greater than 90 days? §164.308(a)(5)(ii)(D) Follow-up inquiries for HIPAA requirements will be institution/implementation specific.

HIPA-11 Does your application require a user to set their own password after an administrator reset or on first use of the account? §164.308(a)(5)(ii)(D) Follow-up inquiries for HIPAA requirements will be institution/implementation specific.

HIPA-12 Does your application lock-out an account after a number of failed login attempts?
§164.308(a)(4), §164.312(a)(2)(ii),
§164.312(a)(2)(iii)
Follow-up inquiries for HIPAA requirements will be
institution/implementation specific.

HIPA-13 Does your application automatically lock or log-out an account after a period of inactivity?
§164.308(a)(4),
§164.312(a)(2)(ii), §164.312(a)(2)(iii)
Follow-up inquiries for HIPAA requirements will be
institution/implementation specific.

HIPA-14 Are passwords visible in plain text, whether when stored or entered, including service level accounts (i.e. database accounts, etc.)?
§164.308(a)(4),
§164.312(d)
Follow-up inquiries for HIPAA requirements will be
institution/implementation specific.

HIPA-15 If the application is institution-hosted, can all service level and administrative account passwords be changed by the institution?
§164.308(a)(4),
§164.312(d)
Follow-up inquiries for HIPAA requirements will be
institution/implementation specific.

HIPA-16 Does your application provide the ability to define user access levels? §164.308(a)(4),
§164.312(a)(1), §164.312(a)(2)(i),
§164.312(d)
Follow-up inquiries for HIPAA requirements will be
institution/implementation specific.

HIPAA
HIPA-17 Does your application support varying levels of access to administrative tasks defined individually per user?
§164.308(a)(4),
§164.312(a)(1), §164.312(a)(2)(i),
§164.312(d)
Follow-up inquiries for HIPAA requirements will be
institution/implementation specific.

HIPA-18 Does your application support varying levels of access to records based on user ID?
§164.308(a)(4),
§164.312(a)(1), §164.312(a)(2)(i),
§164.312(d)
Follow-up inquiries for HIPAA requirements will be
institution/implementation specific.

HIPA-19 Is there a limit to the number of groups a user can be assigned? §164.308(a)(4), §164.312(a)(1)
Follow-up inquiries for HIPAA requirements will be
institution/implementation specific.

HIPA-20 Do accounts used for vendor supplied remote support abide by the same authentication policies and access logging as the rest of the system? §164.308(a)(4),
§164.312(a)(1)
Follow-up inquiries for HIPAA requirements will be
institution/implementation specific.

HIPA-21 Does the application log record access including specific user, date/time of access, and originating IP or device? §164.308(a)(1)(ii)(D) Follow-up inquiries for HIPAA requirements will be institution/implementation specific.

HIPA-22
Does the application log administrative activity, such user account access changes and password changes, including specific user, date/time of changes, and originating IP or device?
§164.312(b) Follow-up inquiries for HIPAA requirements will be institution/implementation specific.

HIPA-23 How long does the application keep access/change logs? §164.312(b) Follow-up inquiries for HIPAA requirements will be institution/implementation specific.

HIPA-24 Can the application logs be archived? §164.312(b) Follow-up inquiries for HIPAA requirements will be institution/implementation specific.

HIPA-25 Can the application logs be saved externally? §164.312(b) Follow-up inquiries for HIPAA requirements will be institution/implementation specific.

HIPA-26 Does your data backup and retention policies and practices meet HIPAA requirements? §164.312(a)(2)(ii) Follow-up inquiries for HIPAA requirements will be institution/implementation specific.

HIPA-27 Do you have a disaster recovery plan and emergency mode operation plan? §164.308(a)(7)(i) Follow-up inquiries for HIPAA requirements will be institution/implementation specific.

HIPA-28 Have the policies/plans mentioned above been tested? §164.308(a)(7)(i) Follow-up inquiries for HIPAA requirements will be institution/implementation specific.

HIPA-29 Can you provide a HIPAA compliance attestation document? §164.308(b)(2) Follow-up inquiries for HIPAA requirements will be institution/implementation specific.

HIPA-30 Are you willing to enter into a Business Associate Agreement (BAA)? §164.308(b)(1), §164.308(b)(3), §164.314(a)(1)(i)
Follow-up inquiries for HIPAA requirements will be
institution/implementation specific.

HIPA-31 Have you entered into a BAA with all subcontractors who may have access to protected health information (PHI)?
§164.308(a)(3)(i), §164.308(b)(1),
§164.308(b)(3), §164.314(a)(1)(i)
Follow-up inquiries for HIPAA requirements will be
institution/implementation specific.

Reason for Question Follow-up Inquiries/Responses
PCID-01 Do your systems or products store, process, or transmit cardholder (payment/credit/debt card) data? 12.8 Follow-up inquiries for PCI DSS requirements will be institution/implementation specific.

PCID-02 Are you compliant with the Payment Card Industry Data Security Standard (PCI DSS)? 12.8 Follow-up inquiries for PCI DSS requirements will be institution/implementation specific.

PCID-03 Do you have a current, executed within the past year, Attestation of Compliance (AoC) or Report on Compliance (RoC)? 12.8 Follow-up inquiries for PCI DSS requirements will be institution/implementation specific.

PCID-04 Are you classified as a service provider? 12.8 Follow-up inquiries for PCI DSS requirements will be institution/implementation specific.

PCID-05 Are you on the list of VISA approved service providers? 12.8 Follow-up inquiries for PCI DSS requirements will be institution/implementation specific.

PCID-06 Are you classified as a merchant? If so, what level (1, 2, 3, 4)? 12.8 Follow-up inquiries for PCI DSS requirements will be institution/implementation specific.

PCID-07 Describe the architecture employed by the system to verify and authorize credit card transactions. PCI Scope Follow-up inquiries for PCI DSS requirements will be institution/implementation specific.

PCID-08 What payment processors/gateways does the system support? 12.8 Follow-up inquiries for PCI DSS requirements will be institution/implementation specific.

PCID-09 Can the application be installed in a PCI DSS compliant manner ? 12.8 Follow-up inquiries for PCI DSS requirements will be institution/implementation specific.

PCID-10 Is the application listed as an approved PA-DSS application? 12.8 Follow-up inquiries for PCI DSS requirements will be institution/implementation specific.

PCID-11 Does the system or products use a third party to collect, store, process, or transmit cardholder (payment/credit/debt card) data? 12.8 Follow-up inquiries for PCI DSS requirements will be institution/implementation specific.

PCID-12
Include documentation describing the systems' abilities to comply with the PCI DSS and any features or capabilities of the system that must be added or changed in order to operate in compliance with the standards.

12.8 Follow-up inquiries for PCI DSS requirements will be institution/implementation specific.

PCI DSS
Version 2.11
Vendor Product
Description
0% F
ID 0 #N/A
DOCU-04 #REF! #REF!
DOCU-06 #REF! #REF!
Overall Score:

Non-Compliant Responses
Institution's Security Framework
HECVAT - Full - Summary Report
Brief Description of the Product
Vendor Name Product Name and Version Information
Question Additional Info
Do you conform with a specific industry standard security framework? (e.g. NIST Cybersecurity Framework, ISO
27001, etc.)
Does your organization have a data privacy policy?
Documentation

0.00% 10.00% 20.00% 30.00% 40.00% 50.00% 60.00% 70.00% 80.00% 90.00% 100.00% Application Security
Authentication, Authorization, and Accounting
Change Management
Company
Data
Database
Datacenter
Firewalls, IDS, IPS, and Networking
Physical Security
Policies, Procedures, and Processes
Systems Management & Configuration
Vulnerability Scanning
Subsection Scores
THRD-01 #REF! #REF!
THRD-02 #REF! #REF!
THRD-03 #REF! #REF!
THRD-04 #REF! #REF!
CONS-03 #REF! #REF!
CONS-06 #REF! #REF!
CONS-08 #REF! #REF!
APPL-01 #REF! #REF!
APPL-02 #REF! #REF!
Do you support role-based access control (RBAC) for endusers? Do you support role-based access control (RBAC) for
system administrators?
Will the consultant require access to hardware in the
Institution's data centers?
Will any data be transferred to the consultant's
possession?
Will the consultant need remote access to the Institution's network or systems?
Provide a brief description for why each of these third parties will have access to institution data.

What legal agreements (i.e. contracts) do you have in
place with these third parties that address liability in the event of a data breach?
Describe or provide references to your third party
management strategy or provide additional information
that may help analysts better understand your
environment and how it relates to third-party solutions.

Describe how you perform security assessments of third
party companies with which you share data (i.e. hosting providers, cloud services, PaaS, IaaS, SaaS, etc.). Provide a summary of your practices that assures that the third party will be subject to the appropriate standards
regarding security, service recoverability, and
confidentiality.

APPL-06 #REF! #REF!
APPL-08 #REF! #REF!
APPL-10 #REF! #REF!
APPL-11 #REF! #REF!
APPL-14 #REF! #REF!
APPL-15 #REF! #REF!
APPL-16 #REF! #REF!
AAAI-01 #REF! #REF!
AAAI-02 #REF! #REF!
Can you enforce password/passphrase aging
requirements?
Can you enforce password/passphrase complexity
requirements [provided by the institution]?
Can your system take advantage of mobile and/or GPS
enabled mobile devices?
Describe or provide a reference to the facilities available in the system to provide separation of duties between
security administration and system administration
functions.

Describe or provide a reference that details how
administrator access is handled (e.g. provisioning, principle of least privilege, deprovisioning, etc.)
Have you or any third party you contract with that may
have access or allow access to the institution's data
experienced a breach?
Describe or provide a reference to the overall system
and/or application architecture(s), including appropriate diagrams. Include a full description of the data
communications architecture for all components of the
system.

Are databases used in the system segregated from frontend systems? (e.g. web and application servers) Do you employ a single-tenant environment?
AAAI-03 #REF! #REF!
AAAI-05 #REF! #REF!
AAAI-06 #REF! #REF!
AAAI-07 #REF! #REF!
AAAI-08 #REF! #REF!
AAAI-11 #REF! #REF!
AAAI-13 #REF! #REF!
AAAI-14 #REF! #REF!
AAAI-15 #REF! #REF!
Will any external authentication or authorization system be utilized by a system with access to institution data? Are audit logs available that include AT LEAST all of the following; login, logout, actions performed, and source IP address?
Are user account passwords/passphrases stored
encrypted?
Will any external authentication or authorization system be utilized by an application with access to the institution's data?
Does the system operate in a mixed authentication mode
(i.e. external and local authentication)?
Does your web-based interface support authentication,
including standards-based single-sign-on? (e.g.

InCommon)
Are there any passwords/passphrases hard coded into your systems or products?
Are user account passwords/passphrases visible in
administration modules?
Does the system have password complexity or length
limitations and/or restrictions?
AAAI-16 #REF! #REF!
BCPL-01 #REF! #REF!
BCPL-06 #REF! #REF!
BCPL-07 #REF! #REF!
CHNG-01 #REF! #REF!
CHNG-05 #REF! #REF!
CHNG-08 #REF! #REF!
DATA-01 #REF! #REF!
DATA-03 #REF! #REF!
Do you physically and logically separate Institution's data from that of other customers?
Is sensitive data encrypted in transport? (e.g. system-toclient) Do you have a documented and currently followed change
management process (CMP)?
Describe or provide a reference to your solution support strategy in relation to maintaining software currency. (i.e. how many concurrent versions are you willing to run and support?)
Does your organization ensure through policy and
procedure (that is currently implemented) that only
application software verifiable as authorized, tested, and approved for production, and having met all other
requirements and reviews necessary for commissioning, is placed into production?
Describe or provide a reference to your Business
Continuity Plan (BCP).

Are all components of the BCP reviewed at least annually and updated as needed to reflect change?
Has your BCP been tested in the last year?
Describe or provide a reference to the a) system capability to log security/authorization changes as well as user and administrator security events (i.e. physical or
electronic)(e.g. login failures, access denied, changes accepted), and b) all requirements necessary to implement logging and monitoring on the system. Include c)
information about SIEM/log collector usage.

DATA-04 #REF! #REF!
DATA-05 #REF! #REF!
DATA-06 #REF! #REF!
DATA-08 #REF! #REF!
DATA-11 #REF! #REF!
DATA-17 #REF! #REF!
DATA-23 #REF! #REF!
DATA-28 #REF! #REF!
DBAS-01 #REF! #REF!
Is any institution data visible in system administration modules/tools?
Does the database support encryption of specified data
elements in storage?
Are ownership rights to all data, inputs, outputs, and
metadata retained by the institution?
Are data backups encrypted?
Do you have a media handling process, that is
documented and currently implemented, including end-oflife, repurposing, and data sanitization procedures? Do you employ or allow any cryptographic modules that do not conform to the Federal Information Processing
Standards (FIPS PUB 140-2)?
Does your system employ encryption technologies when
transmitting sensitive information over TCP/IP networks (e.g., SSH, SSL/TLS, VPN)? (e.g. system-to-system and
system-to-client)
At the completion of this contract, will data be returned to the institution?
Is sensitive data encrypted in storage (e.g. disk
encryption, at-rest)?
DBAS-02 #REF! #REF!
DCTR-04 #REF! #REF!
DCTR-09 #REF! #REF!
DRPL-01 #REF! #REF!
DRPL-07 #REF! #REF!
FIDP-01 #REF! #REF!
FIDP-02 #REF! #REF!
FIDP-04 #REF! #REF!
FIDP-05 #REF! #REF!
Do you have a documented policy for firewall change
requests?
Have you implemented an Intrusion Detection System
(network-based)?
Is there a defined problem/issue escalation plan in your DRP for impacted clients?
Are you utilizing a web application firewall (WAF)?
Are you utilizing a stateful packet inspection (SPI) firewall? Do any of your servers reside in a co-located data center? Will any institution data leave the Institution's Data Zone? Describe or provide a reference to your Disaster Recovery Plan (DRP).

Do you currently use encryption in your database(s)?
FIDP-07 #REF! #REF!
FIDP-12 #REF! #REF!
MAPP-03 #REF! #REF!
MAPP-05 #REF! #REF!
MAPP-06 #REF! #REF!
MAPP-07 #REF! #REF!
MAPP-09 #REF! #REF!
MAPP-10 #REF! #REF!
MAPP-11 #REF! #REF!
Has the application been tested for vulnerabilities by a third party?
State the party that performed the vulnerability test and the date it was conducted?
Is Institution's data encrypted in storage? (e.g. disk
encryption, at-rest)
Does the mobile application support Kerberos, CAS, or
Active Directory authentication?
Does the application adhere to secure coding practices
(e.g. OWASP, etc.)?
Are audit logs available for all changes to the network, firewall, IDS, and IPS systems?
Is the application available from a trusted source (e.g., iTunes App Store, Android Market, BB World)?
Is Institution's data encrypted in transport?
Do you employ host-based intrusion detection?
PHYS-02 #REF! #REF!
PPPR-02 #REF! #REF!
PPPR-04 #REF! #REF!
PPPR-06 #REF! #REF!
PPPR-10 #REF! #REF!
PPPR-11 #REF! #REF!
PPPR-16 #REF! #REF!
PPPR-17 #REF! #REF!
SYST-01 #REF! #REF!
Do you have an information security awareness program?
Are systems that support this service managed via a
separate management network?
Do you have a formal incident response plan?
Will you comply with applicable breach notification laws? Do you have documented information security policy?
Do you have a documented patch management process?
Have your developers been trained in secure coding
techniques?
Do you subject your code to static code analysis and/or static application security testing prior to release?
Are employees allowed to take home Institution's data in any form?
VULN-01 #REF! #REF!
VULN-04 #REF! #REF!
VULN-05 #REF! #REF!
VULN-09 #REF! #REF!
HIPA-03 #REF! #REF!
HIPA-04 #REF! #REF!
HIPA-06 #REF! #REF!
HIPA-07 #REF! #REF!
HIPA-14 #REF! #REF!
Have you conducted a risk analysis as required under the Security Rule?
Are passwords visible in plain text, whether when stored or entered, including service level accounts (i.e. database accounts, etc.)?
Has your organization designated HIPAA Privacy and
Security officers as required by the Rules?
Do you comply with the requirements of the Health
Information Technology for Economic and Clinical Health Act (HITECH)?
Do you have a plan to comply with the Breach Notification requirements if there is a breach of data?
Are your systems scanned externally for vulnerabilities? Have your systems had an external vulnerability
assessment in the last year?
Will you allow the institution to perform its own security testing of your systems and/or application provided that testing is performed at a mutually agreed upon time and date?
Are your applications scanned externally for
vulnerabilities?
PCID-03 #REF! #REF!
PCID-06 #REF! #REF!
PCID-09 #REF! #REF!
COMP-04 #REF! #REF!
COMP-05 #REF! #REF!
COMP-07 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 0
Do you have a dedicated Information Security staff or
office?
Use this area to share information about your environment that will assist those who are assessing your company data security program.
0 Are you classified as a merchant? If so, what level (1, 2, 3, 4)?
Can the application be installed in a PCI DSS compliant manner ?
Have you had a significant breach in the last 5 years?
Do you have a current, executed within the past year,
Attestation of Compliance (AoC) or Report on Compliance (RoC)?
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 0
0 0
0 0
0 0
0 0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 0
0 0
0 0
0 0
0 0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 0
0 0
0 0
0 0
0 0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 0
0 0
0 0
0 0
0 0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 0
0 0
0 0
0 0
0 0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 0
0 0
0 0
0 0
0 0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 0
0 0
0 0
0 0
0 0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 0
0 0
0 0
0 0
0 0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
0 #REF! #REF!
#REF! #REF!
#REF! #REF!
#REF! #REF!
#REF! #REF!
#REF! #REF!
0 0
0 0
#REF! #REF!
#REF! #REF!
#REF! #REF!
#REF! #REF!

Acknowledgments
The Higher Education Information Security Council Shared Assessments Working Group contributed their vision and significant talents to the conception, creation, and completion of this resource.

Members that contributed to Phase IV (2019) of this effort are:
• Jon Allen, Baylor University (working group chair)
• Matthew Buss, Internet2
• Josh Callahan, Humboldt State University
• Andrea Childress, University of Nebraska
• Tom Coffy, University of Tennessee
• Susan Coleman, REN-ISAC
• Susan Cullen, CSU Office of the Chancellor
• Michael Cyr, University of Maine System
• Debra Dandridge, Texas A&M University
• Niranjan Davray, Colgate University
• Charles Escue, Indiana University
• Carl Flynn, Baylor University
• Ruth Ginzberg, University of Wisconsin System
• Sean Hagan, Yavapai College
• Daphne Ireland, Princeton
• Brian Kelly, EDUCAUSE
• Amy Kobezak, Virginia Tech
• Nick Lewis, Internet2
• Sue McGlashan, University of Toronto
• Hector Molina, East Carolina University
• Mark Nichols, Virginia Tech
• Laura Raderman, Carnegie Mellon University
• Kyle Shachmut, Harvard University
• Bob Smith, Longwood University
• Kyle Smith, Georgia Tech
• Christian Vinten-Johansen, Penn State University
• Valerie Vogel, EDUCAUSE
Members that contributed to Phase III (2018) of this effort are:
• Jon Allen, Baylor University
• Josh Callahan, Humboldt State University
• Susan Coleman, REN-ISAC
• Charles Escue, Indiana University
• Joanna Grama, EDUCAUSE
• Todd Herring, REN-ISAC
• Jefferson Hopkins, Purdue University
• Alex Jalso, West Virginia University
• Nick Lewis, Internet2
• Kim Milford, REN-ISAC
• Amanda Sarratore, University of Notre Dame
• Gary Taylor, York University
• Valerie Vogel, EDUCAUSE
• Gene Willacker, Michigan State University
• David Zeichick, California State University, Chico
Members that contributed to Phase II (2017) of this effort are:
• Jon Allen, Baylor University
• Samantha Birk, IMS Global Learning Consortium
• Jeff Bohrer, IMS Global Learning Consortium
• Sarah Braun, University of Colorado - Denver
• David Cassada, University of California - Davis
• Matthew Dalton, University of Massachusetts Amherst

Matthew Dalton, University of Massachusetts Amherst
• Charles Escue, Indiana University
• Joanna Grama, EDUCAUSE
• Todd Herring, REN-ISAC
• Kolin Hodgson, University of Notre Dame
• Tom Horton, Cornell University
• Leo Howell, North Carolina State University
• Alex Jalso, West Virginia University
• Nick Lewis, Internet2
• Wyman Miles, Cornell University
• Kim Milford, REN-ISAC
• Valerie Vogel, EDUCAUSE
Members that contributed to Phase I (2016) of this effort are:
• Jon Allen, Baylor University
• John Bruggeman, Hebrew Union College, Jewish Institute of Religion • Charles Escue, Indiana University
• Joanna Grama, EDUCAUSE
• Karl Hassler, University of Delaware
• Todd Herring, REN-ISAC
• Nick Lewis, Internet2
• Kim Milford, REN-ISAC
• Craig Munson, Minnesota State Colleges & Universities • Mitch Parks, University of Idaho
• Laura Raderman, Carnegie Mellon University
• Valerie Vogel, EDUCAUSE
Version Date
v0.6 8/4/2016
v0.7 8/14/2016
v0.8 8/15/2016
v0.9 8/16/2016
v0.91 8/24/2016
v0.92 8/25/2016
v0.93 8/26/2016
v0.94 8/26/2016
v0.95 9/21/2016
v0.96 9/23/2016
v0.97 9/26/2016
v0.98 10/6/2016
v1.00 10/17/2016
v1.01 11/16/2016
v1.02 11/21/2016
v1.03 11/23/2016
v1.04 4/22/2017
v1.05 4/28/2017
v1.06 10/24/2017
v2.00 10/13/2018
v2.01 11/1/2018
v2.02 1/25/2019
v2.03 3/19/2019
Higher Educati
HEISC Shared Assess
v2.04 4/29/2019
v2.10 10/4/2019
v2.11 11/21/2019
Description of Change
Merged initial comments and suggestions of sub-group members.

Completed base formulas for all Guidance fields. Changed Qualifier formatting to make questions readable (and optional).

Added SOC2T2 question to datacenter section.

Added Systems and Configuration Management section, added MDM, sep. management networks, system configuration images, Internal audit processes and procedures.

Added input from WG meeting on 8/22, removed RiskMgmt section, added question ID's, and removed dup network question.

Added Introduction, Sharing Read Me, and Acknowledgements tabs and content. Also updated report specifics in Documentation.

Integrated grammatical corrections set by Karl, fixed a minor formula error in a guidance cell.

Added Instructions tab, adjusted question ID background color, updated DRP/BCP copy error.

Changed document title to HECVAT. Integrated KDH input.

Added input from NL, 36 modifications across all sections.

Updated Sharing Read Me tab with final language and options table.

Sharing Confirmation section added, updated instructions, updated Sharing Read Me tab, fixed a ton of conditional formatting issues.

Finalized for distribution.

Corrections for grammar, conditional formatting, and question clarification.

Added tertiary services narrative question (DNS, ISP, etc.).

Grammar and spelling cleanup.

Minor layout change in preparation for HECVAT-Lite split Changed University mentions to Institution; final version before SPC 2017 Added standards crosswalk and Cloud Broker Index (CBI) information Major revision. Visit https://www.educause.edu/hecvat for details.

Minor calculation revision in Summary Report scoring.

Cleaned up old question references, added Excel backwards compatibility through named ranges, and fixed analyst report view.

Summary Report scoring issues fixed (calculation ranges in the Questions tab, synchronized calculation steps for reporting in both the Full and Lite versions of the HECVAT); Analyst and Summary Report question

ion Community Vendor Assessment Toolkit - Change Log
sments Working Group
Repaired versioning issues
Updated name, converted question text on Standards Crosswalk tab to vlookups, added Analyst Reference, fixed external links
Updated SSAE 16 to 18. Fixed reference to Standards crosswalk on Summary Report.

CARDIOVASCULAR WARRANTIES
Treadmills
7-year limited warranty on Lifespring shock absorbers; 2-year limited warranty on all electrical components; 1-year limited warranty on mechanical components and labor. 7-year limited warranty on motor and frame (97Te, 97Ti, Elevation and Integrity models). 2-year limited warranty on motor (91Ti and 90T models).

Optional Attachable TV: 2-year limited warranty / electrical and mechanical parts; 90 days / labor (97TEZ, 97Ti, Elevation, Integrity, 91Ti and 90T models).

Elliptical Cross-Trainers
2-year limited warranty on all mechanical and electrical components, 1-year limited warranty on labor. Optional Attachable TV: 2-year limited warranty / electrical and mechanical parts; 90 days / labor.

Recumbent and Upright Lifecycles
2-year limited warranty on all mechanical and electrical components, 1-year limited warranty on labor (Elevation models). Optional Attachable TV: 2-year limited warranty / electrical and mechanical parts; 90 days / labor.

PowerMill Climber / Stairclimbers
2-year limited warranty on all mechanical and electrical components, 1-year limited warranty on labor. Optional Attachable TV: 2-year limited warranty / electrical and mechanical parts; 90 days / labor.

Lifecycle GX
5-year limited warranty on the structural frame (coatings excluded); 3-year on the mechanical components (cranks, flywheel, handlebar, handlebar post, seat post, bearings, seat and handlebar adjustments mechanisms, drive mechanisms, resistance mechanism); 1-year on the saddle, pedals, console; 90-day pulleys, weight plates, and guide rods; 1-year on the saddle, pedals, and console; 90-day on the upholstery and pedal straps; 90 days / labor.

Arc Trainer
For full commercial Arc Trainer products (770AT, 770A, 625AT, 625A), standard warranty is as follows: 3-years Parts, 1-year Labor, and 10-years for Structural Frame (main supporting frame). Additional warranties apply: Touch Screen 3 - years and 1 year labor. E3 Monitor or Cybex Go. Touch Screen Monitor - 2 years parts and 1 year labor. Embedded Receiver - 3 years and 1 year labor. Power cords, Power Inlets, and Headphone Jack - 90 days.

SPARC
For SPARC (501A) standard warranty is as follows: 3-years Parts, 1-year Labor, and 10-years for Structural Frame (main supporting frame).

Indoor Cycles Powered by ICG® IC7, IC6, IC5, IC4
For all Indoor Cycles Powered by ICG® products (IC7, IC6, IC5, IC4), standard warranty is as follows: 5-years for frame construction and welding; 3-years Powder coating, handlebar & seat post assembly (aluminum parts & PVC coating), belt drive system, bottom bracket, flywheel, hub, cranks, pedals, insert sleeves, bowden cables, brake system, gas spring, lever assembly, levelling feet, shroud & top covers; 1-year labor and saddle construction (stitching & saddle deck not included), electronics (console, cable harness, PCBs & sensors, generator), lithium polymer battery. Wear items excluded from warranty: pedal straps, pedal binding system, saddle surface.

Indoor Cycles Powered by ICG® 500IC, 600IC
For all Indoor Cycles Powered by ICG® products (IC7, IC6, IC5, IC4), standard warranty is as follows: 10-years for frame construction and welding; 3-years Handlebar and saddle assembly, brake system (excluding brake pad), lever handles and knobs, cranks, belt drive system, bottom bracket assembly, flywheel and hub assembly, powder coating of frame parts; 1-year labor and saddle construction.

Wear items excluded from warranty: pedal straps, pedal binding system, brake pad and saddle surface.

LIFE FITNESS STRENGTH WARRANTIES
Insignia Series Single Stations
10-year limited warranty on the structural frame (coatings excluded); 5-year on the pulleys, weight plates, and guide rods; 1-year on the bearings, cables and grips; and 90-day on the upholstery, springs and any items not specified.

Signature Series Plate-Loaded / Cable Motion /
Benches and Racks
10-year limited warranty on the structural frame (coatings excluded); 5-year on the pulleys, weight plates, and guide rods; 1-year on the bearings, cables and grips; and 90-day on the upholstery, springs and any items not specified.

Optima Series
10-year limited warranty on the structural frame (coatings excluded); 1-year on guide rods, cables, pulleys and weight plates; 90-day on grips, upholstery and any items not specified.

Fit Series
10-year limited warranty on the structural frame (coatings excluded); 1-year on guide rods, cables, pulleys and weight plates; 90-day on grips, upholstery and any items not specified.

Circuit Series
7-year limited warranty on the structural frame (coatings excluded); 3-year on the bearings, guide rods, pulleys and belts; 1-year on cables, grips, push buttons and Lifebands; 90-day on the upholstery and any items not specified.

LIFE FITNESS SMALL GROUP TRAINING WARRANTIES
SYNRGY360
10-year limited warranty on the structural frame (coatings excluded); 5-year on the pulleys, weight plates, and guide rods; 1-year on the bearings, cables and grips; and 90-day on the upholstery, hardware, springs and any items not specified.

HAMMER STRENGTH WARRANTIES
Select
10-year limited warranty on the structural frame (coatings excluded); 5-year on the pillow blocks, pulleys, weight plates and guide rods; 1-year on the bearings, cables and grips; and 90-day on the upholstery, springs and any items not specified.

Plate-Loaded / Benches and Racks
10-year limited warranty on the structural frame (coatings excluded); 5-year on the pillow blocks; 1-year on hardware; and 90-day on the upholstery, springs, belts and any items not specified.

MTS
10-year limited warranty on the structural frame (coatings excluded); 5-year on the pillow blocks, pulleys, weight plates and guide rods; 1-year on belts and grips; and 90-day on the upholstery, springs, belts and any items not specified.

HD Elite
10-year limited warranty on the structural frame (coatings excluded); 5-year on the pillow blocks, pulleys, weight plates and guide rods; 1-year on the bearings, cables and grips; and 90-day on the upholstery and any items not specified. Platforms and inserts: 1-year warranty on structural foundation and frame (excluding surface finish) and 90-day on rubber mats, hardware and items not specified.

CYBEX CARDIO WARRANTIES
Arc Trainer
For full commercial Arc Trainer products (770AT, 770A, 625AT, 625A), standard warranty is as follows: 3-years Parts, 1-year Labor, and 10-years for Structural Frame (main supporting frame). Additional warranties apply: Touch Screen 3 - years and 1 year labor. E3 Monitor or Cybex Go. Touch Screen Monitor - 2 years parts and 1 year labor. Embedded Receiver - 3 years and 1 year labor. Power cords, Power Inlets, and Headphone Jack - 90 days.

SPARC
For SPARC (501A) standard warranty is as follows: 3-years Parts, 1-year Labor, and 10-years for Structural Frame (main supporting frame).

CYBEX STRENGTH WARRANTIES
Eagle NX SERIES
For Prestige Series standard warranty is as follows: 2-years Parts, 1-year Labor, and 10-years for Structural Frame (main supporting frame).

BRAVO SERIES
For Bravo Series standard warranty is as follows: 2-years Parts, 1-year Labor, and 10-years for Structural Frame (main supporting frame).

PRESTIGE SERIES
For Prestige Series standard warranty is as follows: 2-years Parts, 1-year Labor, and 10-years for Structural Frame (main supporting frame).

Benches and Racks
10-year limited warranty on the structural frame (coatings excluded); 5-year on the pillow blocks; 1-year on hardware; and 90-day on the upholstery, springs, belts and any items not specified.

SCIFIT WARRANTIES
Pro and Pro Sport Series
3-year parts; 1-year labor. Exceptions: 1-year warranty on pedals and seats. Wear items (rubber hand grips and pedal straps) are excluded from the warranty.

Recumbent Stepper
3-year parts; 1-year labor; 10 years frame. Exceptions: 1-year warranty on footbeds and seats. Wear items (rubber hand grips) are excluded from the warranty.

Climber
3-year parts; 1-year labor. Exceptions: 1-year warranty on footbeds. Wear items (rubber hand grips) are excluded from warranty.

Securing Strength Product Acknowledgment - Revision 7 Page 1 of 4 Securing Strength Product Acknowledgment
Pursuant to P.O./Quote _________________, you have purchased certain pieces of our strength training equipment (the “Order”).

Please respond to Sections 1 and 2 as appropriate.

1. We recommend that all strength training equipment be secured to the floor in order to prevent any tipping, rocking or displacement of the equipment which may occur during the use or misuse of the equipment.

Does your order include strength training equipment in this category? Please acknowledge below:
 Yes
 No (Continue to Section 2).

You acknowledge that we offer a secure-to-floor service for a minimal additional charge. Please acknowledge below:
 You are electing the secure-to-floor add-on service. (Continue to Section 2 and see conditions contained in Section 3).
 You are declining the secure to floor add-on service. (Continue to Section 2).

2. We REQUIRE that certain units of strength training equipment be secured to the floor (see Appendix 1 attached hereto) in accordance with Life Fitness’s specifications.

Does your order include strength training equipment in this category? Please acknowledge below:
 Yes
 No (Continue to Section 3).

Delivery and installation options. Please acknowledge below:
 LIFE FITNESS (see conditions contained in Section 3).  WILL CALL pick up (FOB origin), delivery and installation by your chosen freight team. • You agree that you will be entirely responsible for all of the actions or inactions of your freight and installation designate from the date and place of the Will Call pick up. You agree that you will indemnify, defend and hold Life Fitness entirely harmless from any and all injuries or losses arising from or due to (a) freight damage, (b) damage to property, (c) any personal injuries (up to and including death), and (d) any economic losses (including lost profits or other incidental damages) which may arise due to any transportation mishap, any faulty installation, any failure to secure the equipment to the floor, use of a bolt different from the one Life Fitness recommends or any other action of your freight and installation designate.

Securing Strength Product Acknowledgment - Revision 7 Page 2 of 4  ALTERNATIVE INSTALLATION designed by a licensed structural engineering firm (specify below) and installed by a licensed contractor, both selected by you. (insert name of licensed structural engineering firm).
• You represent and warrant that all Life Fitness equipment will be installed in accordance with manufacturer’s specifications and in accordance with approved drawings by a licensed engineer. You agree that you will be entirely responsible for all of the actions or inactions of your design and installation teams. You agree that you will indemnify, defend and hold Life Fitness entirely harmless from any and all injuries or losses arising from or due to (a) damage to property, (b) any personal injuries (up to and including death), and (c) any economic losses (including lost profits or other incidental damages) which may arise due to any faulty design, any faulty installation, or any failure to secure the equipment in accordance with Life Fitness specifications.

3. You understand that securing the equipment to the floor will result in holes in, and alterations to, the flooring and subflooring materials and:
(a) You have determined the proper placement of the equipment to be secured; (b) You have informed us of the placement of utility and service lines in the floor; (c) You have informed us of the substance of the flooring; (d) You have confirmed that subflooring consists of no less than 4.75 inches of concrete; (e) You have obtained any and all necessary consents to the drilling of holes in the flooring and subflooring; and
(f) Any failure of the foregoing, which prevents Life Fitness from installing the equipment in accordance with our installation requirements, will incur a restocking fee of twenty percent (20%) of the equipment’s purchase price.

4. Please acknowledge acceptance of the terms set forth in this Acknowledgment by signing in the space below and returning it to us for our files. By signing below, you represent that you have all power and authority necessary to enter into this Acknowledgment on behalf of the named “BILL TO” and “SHIP TO” Customer.

ACKNOWLEDGED BY CUSTOMER:

Date:

Signature
Printed Name: Title:

Securing Strength Product Acknowledgment - Revision 7 Page 3 of 4 Appendix 1
Required Bolt-to-Floor Strength Products:

Life Fitness strength products:

1. All Synrgy360 units.
a. Exceptions:
i. Synrgy360 XL.
ii. Synrgy360 XM with at least 2 Cable Columns per unit. iii. Synrgy360 XS with 4 Cables Columns (FXTX-CCCC).
iv. Synrgy360 T when connected to the Multi Jungle Core (MJ-CORE) with a Synrgy360TMulti Jungle Storage Connector (FXTT-MJ) and at least 1 Multi-Jungle Station (MJ__ - STA) containing a weight stack.
v. Any combination of 4 Synrgy90/Synrgy360/Multi-Jungle Core units connected with 4 Synrgy Cable Crossover Connectors (FXT-BM) in a square configuration.

2. All Synrgy90 units.
a. Exceptions: (See line 1.a.v. listed above.)

3. All Multi-Jungle units with fewer than 3 stations containing a weight stack per Core (MJ-CORE). a. Exceptions: (See line 1.a.v. listed above.)

4. All Life Fitness S3 units (SYN-S3CORE, SYN-S3ADD).

5. All Synrgy180 & Synrgy180P units (S180-CORE, S180-ADD, S180P) a. Exceptions:
i. Synrgy180 with the addition of the Synrgy180 Freestanding System (S180-AFSA, S180- AFSAQ, S180-AFSC, S180-AFSCQ)
ii. Synrgy180P with the addition of the Synrgy180 Freestanding System (S180P-AFS).

Cybex strength products:

6. All PWR Play units that included the Boxing with Suspension Training Station (PP-BX).

7. All PWR Play units with fewer than 3 stations containing a weight stack per Core (PP-CORE). a. Exceptions:
i. A PWR Play unit comprising of 2 PWR Play Cores connected with the Storage Connector (PP-SX) and having 1 PWR Play station (PP-___) containing a weight stack.

8. All Structure Racks with a WING attachment (ST-WING42, ST-WING72).

9. Structure Half Rack (ST-HR) for use with more than 315 pounds (140 kilograms) of training weight.

Hammer Strength products:

10. All HD Athletic Rig units.

11. All HD Athletic Perimeter units.

12. All HD Athletic Racks with a WING attachment (HDT-WING42, HDT-WING72).

13. HD Athletic Half Rack (HDT-HR) for use with more than 315 pounds (140 kilograms) of training weight.

14. All HD Athletic Single Bridge units (HDT-BR4).

15. All HD Elite Power Racks (HDLPR) with a WING attachment (HDLWING-PR).

16. All HD Elite Half Rack Short Base units (HLDHRS).
a. Exceptions:
i. HD Elite Half Rack Short Base Combo units with corresponding unit on the backside that contains a combined total weight stack of at least 600 pounds (300 kilograms).

General strength products:

17. All other strength products to be used for body weight suspension training (not listed above). (Note, these products have not been designed for use with Suspension Training Devices or any other devices not provided with the product, for pulling or pushing on the equipment. The use of those devices may compromise the stability of these units.)
a. Exceptions:
i. Hammer Strength HD Athletic Double Bridge units (HDT-BR14). ii. Hammer Strength HD Athletic Triple Bridge units (HDT-BR24).

Securing Strength Product Acknowledgment - Revision 7 Page 4 of 4 The above “Exceptions” provide sufficient mass, footprint and/or stabilization to permit the full utilization (which may include body weight suspension training) without the requirement of being secured to the floor.

WARNING:

YOU UNDERSTAND THAT IF THESE UNITS ARE SEPARATED AND/OR RECONFIGURED, THEIR

STABILITY WILL BE COMPROMISED AND THE SEPARATED UNITS WILL CREATE A

SIGNIFICANT RISK OF SERIOUS INJURY UNLESS THE UNITS ARE SECURELY FASTENED TO THE FLOOR.

Item D. 6.

DATE 09/24/2026
TO Honorable Mayor and City Council Members
FROM Michelle Griese, Lieutenant
SUBJECT Adopt a resolution approving and authorizing the acceptance of the 2026-2027 Selective Traffic Enforcement Program (STEP) federal grant through the State of California Office of Traffic Safety (OTS) and amending the 2026-2028 Biennial Budget
SUMMARY AND RECOMMENDATION
The City of Newark has a longstanding history of receiving annual Selective Traffic Enforcement Program (STEP) grants from the California Office of Traffic Safety (OTS), with prior grants awarded since at least 2018. The most recent grant, for the 2025-2026 cycle (Grant No. PT26056) in the amount of $85,000, was approved by the City Council on November 13, 2025. The City now seeks to accept the 2026-2027 STEP grant (Grant No. PT27107) in the amount of $74,000 in fully federally funded resources, requiring no City match, to support selective traffic enforcement operations aimed at improving roadway safety during the project period of October 1, 2026 through September 30, 2027.

Acceptance of the grant also requires an amendment to the 2026-2028 Biennial Budget to appropriate the grant funds.

Staff recommends the City Council adopt a resolution approving and authorizing the acceptance of the 2026-2027 Selective Traffic Enforcement Program (STEP) federal grant through the State of California Office of Traffic Safety (OTS) in the amount of $74,000, authorizing the City Manager or designee to execute the OTS Grant Agreement (Grant No. PT27107), and approving a budget amendment to appropriate $74,000 in revenue and $74,000 in expenditures in the Police Department grant fund.

BACKGROUND
The State of California Office of Traffic Safety annually awards federal grant funding to local law enforcement agencies through the Selective Traffic Enforcement Program (STEP) to support traffic safety enforcement operations aimed at reducing traffic-related fatalities and injuries. The City of Newark has a longstanding history of successfully applying for and receiving STEP grant funding from OTS, with grant awards dating back to at least Fiscal Year 2018-2019.

On July 26, 2018, the City Council adopted Resolution No. 10830 approving and authorizing the acceptance of a STEP grant from OTS for Fiscal Year 2018-2019. Subsequently, the City Council has continued to accept annual STEP grant awards in successive years. On September 10, 2020, the City Council adopted Resolution No. 10983 accepting OTS STEP grant funding. On September 9, 2021, the City Council adopted Resolution No. 11118 accepting and appropriating OTS STEP grant funding. On September 28, 2023, the City Council adopted Resolution No. 11406 accepting OTS STEP grand funding. On November 14, 2024, the City Council adopted Resolution No. 11700 accepting the 2024-2025 STEP federal grant. Most recently, on November 13, 2025, the City Council adopted Resolution No. 11784 approving and authorizing the acceptance of the 2025-2026 STEP grant (Grant No. PT26056) in the amount of $85,000 and amending the Biennial Budget accordingly.

Newark City CouncilSeptember 24, 2026

Newark City Council
September 24, 2026