Cybersecurity and Data Compliance Management

The contract requires strict adherence to HIPAA, HECVAT, and California State University data security standards to safeguard sensitive information. The contractor must implement and maintain robust cybersecurity protocols that align with these regulations, ensuring data integrity, confidentiality, and availability across all systems and processes. A critical component involves establishing a responsive breach management framework to detect, contain, investigate, and report any data incidents promptly and in full compliance with applicable legal and institutional requirements. Additionally, the contractor is obligated to enforce stringent data use restrictions, specifically prohibiting the use of protected data for artificial intelligence or machine learning training purposes. This restriction extends to all forms of data ingestion, processing, or model development that could compromise privacy or violate compliance frameworks. Compliance monitoring, documentation, and audit readiness are ongoing responsibilities, with all activities governed by the California State University Office of the Chancellor’s standards and subject to review upon request. The subcontract is open for response until July 10, 2026, and must be executed under NAICS code 541990 for other professional, scientific, and technical services.