Education Management Information System (EMIS) SOC-1 Type 2 Audit

The Ohio Department of Education and Workforce’s Office of Information Technology is seeking a qualified vendor to conduct a System and Organization Controls (SOC) 1 Type 2 audit on its Education Management Information System (EMIS) covering state fiscal years 2026 and 2027. This audit is intended to thoroughly evaluate and validate the controls and security measures of the EMIS system to ensure compliance with established control objectives and system descriptions provided in the solicitation attachments. The contract is solicited under NAICS code 541519, indicating professional services in IT consulting, and the work will be performed in Columbus, Ohio. The solicitation was posted on January 16, 2026, with a response deadline of February 2, 2026. Prospective offerors are required to submit current and prior grant agreements disclosures from the past five years as part of their proposals, facilitating transparency around previous engagements related to this field. Additionally, submitting offerors must follow strict proposal submission protocols, including legally binding acknowledgments that restrict indemnification, arbitration clauses, and unauthorized contract terms, ensuring compliance with Ohio laws such as the Ohio Sunshine Laws for public records and confidentiality. Proposals must include both redacted and unredacted versions, with specific guidelines for redactions based on legal statutes. The contract emphasizes that no services or data processing may be conducted in Russia, and agreements will only be binding once all statutory requirements and funding approvals are met. Overall, this contract seeks an experienced auditor capable of performing a rigorous SOC-1 Type 2 audit to validate the security and integrity of Ohio’s EMIS data system over a two-year period.