OneTrust Managed Services and Scopes of Work

The State of Ohio, through the Department of Administrative Services, Office of Information Security and Privacy, has established a requirements contract (RSI040799 / CTR040799) for a OneTrust Trusted-tier partner to serve as the administrative lead and subject matter expert for its enterprise Governance, Risk, and Compliance platform. Effective from November 9, 2026, to August 31, 2027, the contract is structured into two primary categories: Category A provides base managed services for recurring administration, maintenance, and strategic advisory with an estimated minimum of 20 hours per week, while Category B allows agencies to procure project-based work through optional statements of work. The agreement includes a potential renewal period of up to 60 months and requires the contractor to remit a revenue share of 0.75% of total quarterly sales to the State. The selected partner must adhere to strict operational and security standards, including compliance with the NIST Cybersecurity Framework and the State IT Policy. Key requirements include maintaining Technology Errors and Omissions and Cyber Liability Insurance of at least 5 million dollars, conducting background checks for all personnel, and ensuring all work products are treated as works made for hire owned by the State. Performance is monitored through monthly activity and service-level reports, with specific penalties and required improvement plans for repeated service deficiencies. Award evaluation is based on a weighted scoring system focusing on unit costs for base services and blended hourly rates for project work, alongside qualifications such as professional certifications and public-sector experience.