Campus Safety Platform

INDIANA UNIVERSITY
PURCHASING DEPARTMENT
Request for Proposal
For
Office of Public Safety Information Technology
Integrated Campus Safety Platform:
Emergency Mass Notification System, Campus Emergency Phones, and
Security Operations Center/Situational Awareness Software
RFP-TEC-1952-2027
Final response due no later than
12:00 p.m. (EST-Indiana) on 9/29/2026
Issued by:
Jennifer Guynn
Senior Sourcing Manager
Email: jenguynn@iu.edu
Issued: 8/27/2026
Page 1 of 13

Section A. Table of Contents
Section A. Table of Contents
Section B. Purpose
Section C. Background
Section D. Proposal Instructions and Conditions (reference Prerequisites)
Section E. Schedule of Events
Section F. Statement of Needs
Section G. Terms & Conditions (reference Prerequisites)
Section H. Proposal Response
Section I. Glossary of Terms
B. Purpose
Indiana University (IU) is requesting proposals from suppliers interested in providing a comprehensive
Integrated Campus Safety Platform as specified herein. The intent of this Request for Proposal (RFP) and
the ensuing process is to provide suppliers with the information, requirements, and specifications
necessary for the preparation of a professional and comprehensive proposal. Specific terms and
conditions are outlined.
Selection of the successful supplier(s) will be based upon a variety of factors for each component such
as:
* Ability to meet technical specifications/scope of work
* Total Cost of Ownership
* Ability to meet compliance requirements
* References
* Terms and Conditions
These criteria are listed in order of importance.
As used within this RFP, "Participant" shall refer to those companies receiving and responding to this
RFP. "Supplier" shall refer to the successful Participant of the process. "University" shall refer to Indiana
University.
C. Background
Indiana University is one of the largest universities in the nation. Founded in 1820, Indiana University is
a public, multi-campus, state-supported educational institution with undergraduate and graduate full-
time equivalent students from throughout the U.S. and the world exceeding 90,000. It has more than
Page 2 of 13

23,000 faculty, professional and support staff that support its educational, research and public service
missions.
Indiana University provides direct public safety services to nine (9) campus locations across the state of
Indiana:
Indiana University Northwest (Gary), Indiana University South Bend, Indiana University Kokomo, Indiana
University East (Richmond), Indiana University Indianapolis (IUI), Indiana University Bloomington,
Indiana University Columbus, Indiana University Southeast (New Albany), and the Deaconess Health
Sciences Building / Stone Family Center (Evansville).
In addition, the University maintains facilities at the following awareness-only locations where direct law
enforcement response is not provided but system awareness, notification reach, and monitoring
capabilities are required:
Montana (research/field stations), Wisconsin (Camp Brosius) Martha's Vineyard, Los Angeles, and
Washington, D.C..
All proposed solutions must demonstrate the ability to support this multi-campus operational model
from a single, unified platform with appropriate segmentation, delegation, and reporting by campus
location.
The University reserves the right to award services in whole, in part, separately, collectively, or not at all,
as determined to be in the University's best interest.
For more general information about the institution, please visit the institution's home page at
https://www.iu.edu/.
D. Proposal Instructions and Conditions
Reference Prerequisites Section - Proposal Instructions and Conditions
All questions and inquiries regarding this document should be submitted via the JAGGAER Supplier
Portal. If you experience issues, please contact Jennifer Guynn, Senior Sourcing Manager, at
jenguynn@iu.edu. EXCEPT FOR CASES AUTHORIZED IN WRITING BY JENNIFER GUYNN, DURING THE
DURATION OF THIS RFP PROCESS, THROUGH SELECTION AND NOTIFICATION, ANY COMMUNICATION BY
PARTICIPANTS WITH INDIANA UNIVERSITY STAFF OTHER THAN JENNIFER GUYNN MAY RESULT IN
IMMEDIATE REJECTION OF THAT PARTICIPANT. Questions regarding this RFP should be submitted
through the Q&A Board within the Supplier Portal. Questions asked after the deadline may not be
answered.
Please note that all prerequisites must be agreed to before a proposal can be submitted. Any requested
edits to the prerequisites can be submitted as an addendum to the participant's proposal. If needed,
negotiations related to the language in the prerequisites will occur before an award is made.
Page 3 of 13

E. Event Schedule
ACTIVITY DATE
Request for Proposal issued. 8/27/2026
Participants' questions concerning the proposal must be received no 9/10/2026
later than 12:00 pm Eastern Time.
An email response or status of response will be provided no later than 9/16/2026
12:00 pm. If the information is related to substantive content of the
RFP, then clarifications will be sent to all known participants of the RFP.
Proposals due by 4:30 pm Eastern Time 10/16/2026
Remote or on-site demos/presentations will be scheduled as deemed Oct.
necessary
Selection of supplier on or about Nov.
F. Statement of Needs
The Office of Public Safety Information Technology is issuing this Request for Proposal (RFP) to identify
qualified suppliers capable of providing one or more of the following integrated components:
(A) Enterprise-grade Emergency Mass Notification System (EMNS) for rapidly disseminating emergency
alerts and safety communications using multiple redundant communication channels;
(B) Campus Emergency Blue Light Phone System to replace aging POTS-based infrastructure with a
modern, redundant, multi-path communications solution for indoor, outdoor, parking, and remote
campus environments; and
(C) Security Operations Center (SOC) / Situational Awareness Software that provides a unified, vendor-
agnostic platform for real-time monitoring and incident management, aggregating data from video
management, access control, ALPR, sensors, and emergency systems.
The selected system(s) must be reliable, scalable, accessible, and integrate with existing University
infrastructure across the University's full operational footprint.
Page 4 of 13

Supplier should be aware of the following existing technology systems with which the proposed
solution(s) must integrate or coexist. The University maintains a supplier-agnostic approach to its
security operations center architecture, with strong preferences noted below:
* Video Management System (VMS): Milestone XProtect (strong preference)
* Cameras: Hanwha Wisenet (strong preference)
* Access Control: CBORD / CS Gold (strong preference)
* Automated License Plate Recognition (ALPR)
* Digital Signage: FourWinds Interactive (pending confirmation - subject to change)
* Computer-Aided Dispatch / Records Management: ARMS by End2End (integration required)
* Security Guard Services: Allied Universal Security; guard tour/patrol management via Heliaus platform
* Body-Worn Cameras: CoreForce (formerly Utility Inc.)
* Emergency Operations Center (EOC): WebEOC
* Weather Provider: BAM WX Clarity (BAMWX LLC)
* Learning Management System (LMS): Canvas by Instructure (primary; may change vendors)
* Telecommunications / Unified Communications: Microsoft Teams (primary phone system) -
AudioCodes MP-1288 for analog services at most campuses. This is the current platform for Blue Light
phones.
* IT Service Management (ITSM): ServiceNow
* Identity Provider: [Shibboleth / Azure AD / Duo SSO]
NOTE: Suppliers are invited to propose solutions addressing one, two, or all three platform components.
Proposals addressing the full scope of all three components are preferred. Suppliers proposing partial
scope must clearly describe integration capabilities with third-party solutions for the remaining
components.
NOTE: The University may not implement all components of this RFP simultaneously. In particular, the
SOC / Situational Awareness component and other platform elements may be deployed in phases as
existing vendor contracts expire or are renewed. Suppliers must demonstrate the ability to support a
phased implementation approach, with each component delivering standalone value while maintaining a
clear integration path to the full platform vision.
Scope of Work:
Please respond to each of the requirements listed utilizing the Excel spreadsheet titled "Section F. SOW
Requirements" which can be located within the Buyer Attachment section of the sourcing portal.
G. Terms & Conditions
Reference Prerequisites Section - Terms and Conditions
Page 5 of 13

H. Proposal Response
The Participant's response to this proposal should include answers to the following series of
questions. So that the RFP Team can easily follow the questions and responses, please assure that
the question is stated immediately before the response. In addition to point-by-point responses, you
may include descriptive literature if you make reference to specific contents. In reviewing the
proposals, university personnel will not search through general literature. Where a question is asked,
answer the question and supply any supportive detail. Any deviation from this format and sequence
may result in the proposal being immediately rejected.
While responses should address all solicitation items, it is important to note that we also encourage
and will consider any creative ideas for improvements or cost savings related to this transaction
that may not be suggested in this document. Functional, technical, and economic solutions beyond
the confines of this solicitation may also be considered.
The responses should address all solicitation items. However, the University reserves the right to
consider other ideas and solutions, or only a restricted subset of the configuration discussed in this
document.
All optional arrangements should be described and priced separately.
All proposal responses must include:
1. The name, phone, fax number, and email address for the duly authorized agent submitting the
proposal.
2. Full description of company, including experience, qualifications and executive leadership chart.
3. Documentation of any intent to use another company(ies) or private individual(s) as a
subcontractor(s) for any part or the whole of the services offered in response to this
RFP. Indiana University reserves the right to approve or reject any subcontracting agent or to
reject proposals based on the use of subcontracted work.
4. Copies of all documents that could become part of a final Agreement arising from this process. A
legal review of the Participant's proposed Agreement terms will be part of the criteria in
evaluating the Participant's offer.
5. Provide a minimum of five (5) client references from colleges or universities willing to be
contacted. Include name, title, institution, phone, and email. At least two (2) references must
be from Big Ten, ACC, SEC, or Pac-12 institutions, or major hospital networks (500+ beds).
6. Provide a list of current higher education clients with comparable enrollment (minimum 40,000
students) using this system. Include Institution name, enrollment size, contract start date, and
modules deployed.
Page 6 of 13

7. Describe experience supporting Big Ten or Tier 1 research university environments, including
multi-campus, multi-building, or distributed enterprise deployments comparable in scale to
Indiana University's nine-campus footprint.
8. Describe specific experience with Title IX, Clery Act, and FERPA compliance as they relate to the
proposed system's operations.
9. Provide case studies documenting system performance during actual emergency activations,
including response times and outcomes.
10. List all relevant industry certifications, memberships, or partnerships (e.g., IPAWS certification,
ATIS, APCO, NENA, BICSI, ASIS International, Campus Safety Magazine).
11. Describe any active participation in emergency management standards bodies, working groups,
or higher education consortia (e.g. OASIS CAP committee, NENA, EDUCAUSE, NACAS).
12. Describe any partnerships with wireless carries, including names and details about the
relationship and how they benefit higher education clients.
Costs
13. Provide a 5-year Total Cost of Ownership (TCO) model. Also provide pricing for base contract of
3 years with two (2) additional one-year extension options. Pricing should be based on the
University's estimated total population of approximately 157,000 users across nine campuses
plus awareness-only sites.
14. Identify all fees including base platform license, per-user fees, per-message fees,
implementation/onboarding, training, professional services, hardware (if applicable), annual
maintenance, support costs, per-call fees, data overages, software module add-ons, and API
access fees. Identify any costs associated with modules proposed as optional or additional to the
base platform.
15. Indicate what price guarantees or caps are offered on annual maintenance and support, or any
other component.
16. Specify the complete warranty terms and conditions for all products and services.
17. For all items, indicate the timeframe or expiration date for the price quoted. If prices are subject
to change, indicate pricing beyond the expiration date.
18. Attach a copy of all relevant terms and conditions, such as sample contracts, Service Level
Agreements, etc.
19. We encourage submitting vendors to be creative and flexible in offering pricing, financing, or
other options. Indicate any other terms, discounts, conditions, opportunities, or arrangements
that may be of value and interest to IU.
Page 7 of 13

Data Privacy and Security
20. Please describe the measures your organization and personnel will take to ensure that:
a) all data activities are performed in a sufficiently secure manner to protect against
reasonably anticipated threats or hazards to the security or integrity of such data, and
to prevent unauthorized access to or use of the data;
b) all data activities involving Indiana University (IU) institutional data are performed in
accordance with all applicable laws and IU policies, as well as prevailing commercial
best practices with regard to the type(s) of data involved. These include but are not
limited to:
Data Type Reference Citation and Requirements
Student Education Records Family Education 20 USC 1232g et seq., and related regulations at 34
Rights and Privacy CFR Part 99
Act (FERPA)
Protected Health Information Health Insurance 42 USC 1320d-2 (note); implementing privacy and
Portability and security regulations at 45 CFR Parts 160 and 164,
("PHI")
Accountability Act and related agency guidance
(HIPPA)
If Supplier will access PHI to perform a service on
behalf of IU, then Supplier and IU must also enter
into a Business Associate Agreement (BAA) in a
form approved by IU. In the event of any conflict
between the BAA and this Agreement, with respect
to the security or privacy of PHI, the terms of the
BAA shall control.
Student Financial Records Gramm-Leach- 15 USC 1681 et seq.; Privacy Rule 16 CFR 313;
(e.g., records regarding tuition Bliley Act (GLBA) Safeguards Rule 16 CFR 314
payments and financial aid)
As applicable, Supplier shall have a program in
place, documented in writing, to identify, detect,
and address warning signs of identity theft,
pursuant to the FACT Act, 15 USC 1681 et seq., and
corresponding "Red Flag Rules."
Genetic Information Genetic 42 USC 2000ff and implementing regulations
Information
Nondiscrimination
Act of 2008 (GINA)
Social Security Numbers, Indiana SSN Law Indiana Code 4-1-10
Driver's License Numbers, or
Indiana Breach Indiana Code 4-1-11; Indiana Code 24-4.9
Financial Account
Notification Laws
Information
Payment Card Information The Payment Card Supplier acknowledges responsibility for the
Industry Data
security of cardholder data it possesses or
Security Standards
otherwise stores, processes, or transmits, on behalf
(PCI-DSS)
of IU. Supplier warrants it is Payment Card
Industry Data Security Standards (PCI DSS)
compliant and shall remain compliant for the term
of this Agreement. Supplier shall provide IU its
most recent Attestation of Compliance (AOC) or
Page 8 of 13

Self-Assessment Questionnaire (SAQ) upon
execution of this Agreement and annually for the
term of this Agreement. Supplier shall notify IU
within seven (7) days of becoming aware Supplier
is no longer PCI DSS compliant and promptly
remedy that non-compliance. If Supplier uses a
third party to process cardholder data, Supplier
shall ensure that both itself and the third party
meet the above requirements.
c) Supplier has adopted and stays current with a set of commonly used security
standards which substantially align with (or are reasonably analogous to) the
"Moderate" baseline of standards recommended by National Institute of Standards
and Technology (NIST) SP 800-53 (https://csrc.nist.gov/publications/detail/sp/800-
53/rev-5/final). (See also, http://csrc.nist.gov/publications/PubsByLR.html.) The
security standards adopted by Supplier must be published by an independent,
authoritative entity.
d) Immediately upon becoming aware of an incident that results in exposure or potential
exposure of IU Data, Supplier will notify IU at it-incident@iu.edu, preserve all relevant
authentication and system logs, and cooperate fully with IU's investigation of, and
response to, the incident.
e) Logs: To facilitate the investigation of security incidents, Supplier will retain all
authentication and other relevant system logs, including relevant logs from any
contractors or subcontractors, for a minimum of sixty (60) days from the creation of
such logs, and provide such logs to IU upon request.
f) IU institutional data is only accessed and used for the purpose of performing the
activities that are the subject of this RFP, and will not be used for targeted
marketing purposes;
g) IU institutional data is only accessed and used by those personnel within your
organization, or approved subcontractors, who require access to perform activities
that are the subject of this RFP;
h) IU institutional data will not be shared with any third party except as required by
state or federal law or a valid court order, or with prior written consent from IU and
the individual(s) whose personal records would be disclosed; and
i) Supplier's personnel and approved subcontractors understand, accept, and have
received appropriate instruction regarding their obligations to handle IU institutional
data with the proper security as described, and all such personnel and
subcontractors will have read, understood, accepted, and received appropriate
instruction as to how to comply with, the data protection provisions reflected in this
RFP and the ultimate agreement between Supplier and IU.
21. Please provide a copy of all policies and procedures within your organization that relate to the
measures described above.
22. Please provide the name(s) and contact information for the person(s) responsible in your
organization for electronic and paper records security.
Page 9 of 13

23. To provide details regarding your information management systems and practices, please
complete the Higher Education Cloud Vendor Assessment worksheet titled "HECVAT FULL
3.03" found at the HECVAT Toolkit link below:
Protect IU Data
HECVAT Toolkit
Accessibility
Development
24. How do you ensure that the web applications you develop meet the Web Content Accessibility
Guidelines 2.0 Level AA? Please describe and provide supporting evidence of the process you
follow.
25. What percentage of your software development and QA testing team is focused on
accessibility?
Testing & Issue Tracking
26. What automated manual testing do you perform accessibility for people with impairments?
Please describe your testing process in detail.
27. Does your product undergo accessibility testing prior to each major release?
28. Do you use a third-party accessibility evaluation company to verify your accessibility
compliance? If so, are you willing to provide a copy of your most recent evaluation report?
29. Which assistive technologies do you test with in order to evaluate access for people who are
blind or visually impaired? Please describe and provide supporting evidence of your assistive
technology testing process.
30. What is your policy and process for responding to issues tagged as accessibility errors for
applications in development and production environments?
31. How do you track and prioritize accessibility issues?
Vendor Internal Training
32. Do your developers and project managers receive or engage in accessibility training on a regular
basis? Please describe the extent of such accessibility trainings.
Page 10 of 13