Data Security and Compliance Audit Services

The State University of New York is seeking a subcontractor to perform annual third-party vulnerability assessments and compliance audits to ensure adherence to federal and state data protection regulations including FERPA, HIPAA, GLBA, and the NY SHIELD Act. The contractor will be responsible for identifying security weaknesses, evaluating current controls, and delivering comprehensive audit reports with actionable remediation recommendations to address gaps and enhance the university’s data security posture. These assessments must be conducted comprehensively and consistently each year to maintain regulatory compliance across all applicable frameworks. The solicitation is posted under NAICS code 541611 for administrative management and general management consulting services, with aresponse deadline of June 22, 2026. While no set-aside designation is specified, the opportunity is structured as a subcontract and is accessible through SUNY’s procurement portal. The place of performance and specific office details are not provided, implying that work may be conducted remotely or across multiple campus locations within New York. The contractor must demonstrate expertise in educational and healthcare data compliance, with a proven ability to deliver clear, practical guidance that supports ongoing risk mitigation and regulatory alignment.