Updates to Contract Routing Form

Updates have been made to the College’s Contract Routing Form to address accessibility compliance and data security & privacy documentation.  

Effective immediately, a contract submitted for information technology software or cloud-based software (often referred to as Software as a Service or SaaS), must include the vendor’s current documentation in the following areas:

Accessibility Compliance:

• Accessibility Conformance Report (ACR) or Voluntary Product Accessibility Template (VPAT)

An ACR is a completed version of a VPAT that documents a product’s conformance with accessibility standards.  The College has arranged for a consultant to review ACRs.

Data Security and Privacy Documentation:

• Higher Education Community Vendor Assessment Toolkit (HECVAT)

HECVAT is a standardized vendor self-assessment questionnaire.  Its goal is to provide transparency to College about it data security privacy of data.

• System and Organization Controls 2 (SOC 2)

A SOC 2 is an independent third-party audit report evaluating how a service provider safeguards customer and protects its confidentiality and privacy.

Before proceeding with a vendor, ensure the required documentation is available and can be provided to the College for review.  If a cloud-based or SaaS vendor cannot provide most or all of the requested documentation, the College will likely be unable to move forward with the contract.

Thank you to Donna Simiele for her assistance in guiding and drafting the accessibility compliance and data security & privacy requirements for the Contract Routing Form.

The Contract Routing Form is located on the FYI page under Business Office.

If you have any questions about these requirements, reach out to OIT or e-mail me at jeichner@niagaracc.suny.edu