Canva Pro Subscription Renewal Services

Seeking a provider for annual Canva Pro subscription renewal for one user in Ohio.

Comply with State IT Security Policies and Standards and these Terms.
Maintain information security in Contractor's environments in accordance with State IT Security Policies and Standards.
Comply with NIST SP 800-53 (moderate level baseline) and FISMA 2014 requirements.
Implement information security policies, standards, and capabilities as set forth in the Contract.
Support State IT security policies, standards, and procedures development and maintenance.
Maintain an Information Security Program (ISP) to protect State Data.
Ensure all State Data at rest resides within the contiguous United States with a minimum of two data center facilities at two different and distant geographic locations.
Provide additional documentation (ISP, contingency plans, incident response plans, PIA, FIPS-199, SSP, POA&M) if handling Sensitive Data.
Maintain appropriate and effective business continuity and disaster recovery plans.
Maintain a privacy policy that includes processes for obtaining individual privacy consent for PII and responding to individual requests to access, correct, and delete PII.
Scan all source code for vulnerabilities (before and after changes) and promptly remediate them at no cost to the State.
Follow best practices for application code review and the most current version of OWASP top 10.
Warrant that software and/or service are free from defects, viruses, malware, and other harmful code.
Notify the State within 24 hours of any order or request to disclose State information.
Obtain an annual audit (AICPA SSAE No. 18, SOC 1 Type 2 and SOC 2 Type 2) at the Contractor's sole expense and provide results to the State within 30 days.
Immediately remedy any issues, material weaknesses, or other items identified in each audit at no cost to the State.
Cooperate with any Security and Data Protection Audit performed by the State or a third-party contractor.
Comply with background investigation requirements for Contractor personnel who may have access to State Data, FTI, or CJI.
Report Security Incidents in writing to the State within 24 hours of becoming aware.
Provide follow-up reports for all Security Incidents within five business days of the initial report and continue updates until the investigation is complete.
Comply with all applicable laws requiring notification of individuals in the event of a Security Incident involving personally identifiable information.
Reimburse the State for the cost of providing notification and any credit monitoring or similar services resulting from a Security Incident.
Preserve sufficient evidence to ensure accurate Security Incident records and facilitate investigation.
Establish a Security Incident reporting communications procedure with the customer State agency.
Cooperate with the State's independent investigation of Security Incidents.
Maintain a robust security capability incorporating generally recognized system hardening techniques when accessing State network systems and data.
Encrypt State Data when stored on any portable computing or storage device/media or when transmitted across any data network.
Maintain an accurate inventory of all portable devices authorized for use with State Data and report any loss or theft.
Use multifactor authentication to limit access to systems that contain Sensitive Data.
Comply with HIPAA data handling and privacy requirements when handling health or medical data.
Comply with 42 C.F.R. Part 2 for client identifying information.
Comply with IRS Publication 1075 safeguards for Federal Tax Information (FTI).
Ensure FTI is used only for the purpose of carrying out the contract and treated as confidential.
Account for FTI upon receipt and properly store it before, during, and after processing.
Certify that FTI processed will be completely purged from all physical and electronic data storage upon completion of work, or safeguarded if not immediately purged.
Provide any spoilage or intermediate hard copy printouts of FTI to the agency, or destroy and certify destruction.
Ensure all computer systems receiving, processing, storing, or transmitting FTI meet IRS Publication 1075 requirements.
Do not subcontract work involving FTI without prior written approval of the IRS.
Include FTI safeguards in any approved subcontract for work involving FTI.
Develop, document, disseminate, and update audit and accountability policies and procedures for contractor systems handling FTI.
Archive audit information for seven years.
Protect audit information and audit tools from unauthorized access, modification, and deletion.
Notify officers and employees of criminal/civil sanctions for unauthorized FTI disclosure (IRC sections 7213, 7213A, 7431, and Privacy Act of 1974).
Certify and annually recertify that each officer or employee understands the agency’s security policy and procedures for safeguarding FTI.
Cooperate with IRS and Agency inspections of facilities performing work with FTI.
Comply with NCIC Operating Manual, CJIS Security Policy, and 28 CFR Part 20 for Criminal Justice Information (CJI).
Require all employees, independent contractors, and consultants performing work under the Contract to complete and submit the FBI CJIS Security Addendum and Certification.
Bidder must be registered with the Office of Budget & Management (OBM) and have received a payee/supplier ID.
Data Security form is a required attachment for responsible bidders.

Ohio Department Of Developmental Disabilities

Organization overview and procurement intelligence available on paid plans.

A vendor is sought to provide Canva Pro subscription renewal services, covering an annual subscription for one user. The selected provider will ensure continuous access and support for the Canva Pro platform.

Interested vendors are advised to note that all questions regarding the renewal services must be submitted by March 20, 2026.

Canva Pro Subscription Renewal Services

Overview

Fit Score

SUMMARY

KEY REQUIREMENTS

BUDGET

CONTRACT DURATION

Issuing Agency

DESCRIPTION

Similar RFPs