Description
North Dakota’s State Auditor’s Office is seeking a qualified firm to perform three separate SOC 2 Type II examinations (and produce accompanying SOC 3 reports) for the North Dakota Information Technology Department (NDIT) on behalf of the Bank of North Dakota (BND). The work spans three fiscal periods (ending September 30 2026, 2028, 2030) and includes methodology development, on‑site inspections, draft and final report delivery, and briefings to state and BND stakeholders. The contract will be firm‑fixed‑price, with a total ceiling for each fiscal year, and requires the contractor to provide insurance, adhere to strict confidentiality, and transfer all IP to the State.
• Perform SOC 2 Type II audits (Security, Availability, Confidentiality) and issue SOC 3 reports for NDIT’s hybrid on‑premise/cloud environment.
• Deliver draft reports by early January of each engagement year, incorporate State Auditor comments, and submit final reports by mid‑February.
• Provide on‑site presence in Bismarck for physical‑security inspections, manage travel costs within the contract ceiling, and present findings to both the State IT Committee and BND IT Steering Committee.
• Meet all AICPA reporting standards, maintain required professional liability and E&O insurance, and comply with North Dakota conflict‑of‑interest and public‑records statutes.
• Contract term runs roughly July 2026 through February 2031, encompassing three 12‑month audit cycles.