Enterprise Risk Management Software

The New York State Office of the State Comptroller (“OSC”) intends to procure cloud-based Enterprise Risk Management Software-as-a-Service (the “Solution”) pursuant to its discretionary purchasing authority under State Finance Law § 163(6). This procurement opportunity is limited to New York State businesses certified pursuant to Article 15-A of the New York State Executive Law and businesses certified pursuant to Article 3 of the New York State Veterans’ Services Law. Background OSC currently uses Microsoft Excel and Word to perform risk assessments and record testing results. A standard spreadsheet template is used by business units to report risks, corrective actions, and respond to a questionnaire. Additionally, a Word document is used by the business units to certify the results of the risk assessment. OSC uses an Excel spreadsheet to document and rate the business functions. These documents are all maintained and stored by the OSC Internal Control Office. The Internal Control Office uses data from these documents to update risks and corrective actions in an Access database. Also included in this database is the date of each business unit’s certification and its associated risk categories. The information is transferred manually from the Excel spreadsheets and Word documents to the Access database. Reports are generated using Tableau with data pulled from Excel spreadsheets and the Access database. Generating reports involves significant manual work to ensure graphs are correctly portrayed and formatted. OSC is seeking a qualified proposer (the “Contractor”) who will provide and implement the Solution. The Solution will (1) automate the collection of risk assessment data and streamline the reporting of risks to executive management and (2) demonstrate compliance with the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”) Framework. STATEMENT OF WORK The Contractor shall perform the Services as detailed in Attachment A (Statement of Work) posted to OSC’s website at: https://www.osc.state.ny.us/procurement. MINIMUM QUALIFICATIONS A proposal must meet the following minimum qualifications to be considered for contract award: 1. The proposed Solution must be: a) able to perform risk assessments and record testing results; b) able to integrate the most recent COSO Framework within the risk assessment; c) sufficiently customizable to materially meet all of the Solution requirements stated in Attachment A (Statement of Work); and d) a SaaS product. 2. The Proposer must: a) have successfully implemented the proposed Solution in at least two organizations with 2,000 or more employees, within the ten years preceding the proposal due date; and b) assign a Project Manager, as defined in Section VII of the Draft Contract (Staff) that has successfully implemented the proposed Solution within the five years preceding the proposal due date. The Project Manager may be an employee or subcontractor of the Proposer. ADDITIONAL INFORMATION Interviews and Product Demonstrations During the evaluation process, proposers may be required to conduct a virtual product demonstration and participate in an interview. The product demonstration and interview will be an opportunity for the proposer to demonstrate the proposed Solution, and for OSC to interview the proposer, obtain clarification, if needed, and to substantiate the characteristics and attributes claimed within the written response. The interview should confirm the proposer’s ability to provide the required services. The proposed Project Manager should be present and participate in the interview. Proposers will be provided with guidelines for the product demonstration at least two weeks prior to their product demonstration. Proposers who cannot be contacted via telephone or email to arrange the interview after three attempts by OSC may be disqualified. Solution Security Requirements Upon notice of conditional award, the Contractor shall submit a third-party assessment and certification that the Solution complies with an industry- or government-accepted security framework (e.g., FedRAMP, ISO 27000 series, SOC 2 Type 2) and meets the security requirements listed in Section G (Security and Access) of Attachment A (Scope of Work). If the Contractor cannot provide such third-party assessment and certification, the Contractor shall submit a completed Consensus Assessment Initiative Questionnaire (CAIQ), available at: https://cloudsecurityalliance.org. OSC may require the Contractor to 1) address security concerns identified by OSC to ensure data confidentiality, integrity, and availability in both normal and contingency situations; 2) provide additional information regarding the Contractor’s existing security controls, and 3) implement additional controls. OSC may require the Contractor to provide the results of assessments of the selected Proposer’s compliance with an industry- or government-accepted security framework that becomes available after conditional award and throughout the term of this Agreement. OSC may decline to make a final award to any conditionally awarded Contractor that OSC concludes is unable to demonstrate that its security measures, processes, standards, and/or policies sufficiently align with the security requirements stated in this Section G of Attachment A and as required by applicable law or regulation. Upon such determination, OSC may elect to grant the award to the next-highest ranked Proposer. OSC may simultaneously engage in discussions with multiple Proposers regarding their security practices. SERVICE LEVEL AGREEMENT Proposers must include their Service Level Agreement (the “SLA”) for their proposed Solution in their proposals. OSC and the Proposer selected for contract award will negotiate any changes required by OSC to the selected Proposer’s SLA, which will become part of the final agreement. SUBMISSION REQUIREMENTS Proposers responding to this solicitation should submit the following: · Attachment B – Response Form · Attachment C – Cost Response Form · The resume of the proposed Project Manager per Minimum Qualification 2(b) · Proposer’s SLA for the Solution. Interested proposers should submit a response to [email protected] (preferred) or via hard copy mail to: Director of Finance Office of the State Comptroller 110 State Street, Stop 13-2 Albany, NY 12236-0001 All documents related to this procurement, including the Draft Contract, are available on the OSC website at: https://www.osc.state.ny.us/procurement. The proposer must be willing to enter into an agreement substantially in accord with the terms of the Draft Contract posted to the OSC website should the proposer be selected for contract award. All services are to be performed remotely. NOTE: Procurement documents may, from time to time, be amended or addenda issued. It is the proposer’s responsibility to become aware of any such amendments and/or addenda prior to submission of a response. All amendments and/or addenda to procurements will be posted to the OSC website at https://www.osc.state.ny.us/procurement. Proposers should review the OSC website prior to submission of a response to ensure that they have all information required to submit a complete response. This procurement is subject to, and shall be conducted in accordance with, the OSC Executive Order on Procurement Integrity and OSC’s Procurement Integrity Procedures, both of which are available in full on the OSC website noted above, or upon email request. All inquiries concerning this procurement must be addressed to the Contracting Officer or designee(s) at OSC, via email (preferred) to [email protected] or via hard copy mail to: Director of Finance Questions for Contract #C001225 Office of the State Comptroller 110 State Street, Stop 13-2 Albany, NY 12236-0001 Questions regarding this procurement opportunity must be received by OSC by at 4:00 p.m. EST on 11/11/2026. The comprehensive list of questions and responses will be posted to the OSC website on or about 11/25/2026. This listing will not include the identities of the vendors submitting the questions; those vendors will remain anonymous to the extent allowed by law. Business enterprises awarded an identical or substantially similar procurement contract within the past five years: None Service-Disabled Veteran-Owned Business (SDVOB) SDVOB Goal: 0.00% Minority / Women Business Enterprise contracting goals (MWBE) MBE Goal: 0.00% WBE Goal: 0.00% Disadvantaged Business Enterprise contracting goals (DBE) DBE Goal: 0.00%