MHEC Technology Solutions contracts gives certain institutions the ability to save millions of dollars annually. Through use of an extensive RFP process, it’s designed to make the purchasing of technology easier, and leverages the combined volume of campuses in its member states to reach favorable agreements with various technology vendors.

Eligibility:
Higher Education
K-12 Districts and Schools
State Governments
Cities, Counties and Local Subdivisions
Education-related Non-profit Organizations

A NASPO ValuePoint contract is a cooperative purchasing agreement that allows vendors to sell products and services to government entities across multiple states through a single contract. Benefits for businesses include expanded market access to state, local, and education (SLED) customers, reduced administrative burden by eliminating the need to respond to multiple RFPs, and increased visibility to government buyers across participating states.

NASPO contracts typically cover a wide range of cybersecurity services including security operations center (SOC) services, vulnerability management, incident response, penetration testing, security assessments, compliance services, cloud security, identity and access management, security awareness training, and managed detection and response (MDR). These contracts allow government entities to access vetted cybersecurity providers through streamlined procurement processes.

NASPO ValuePoint contracts typically have an initial term of 3-5 years, with possible extensions that can bring the total contract length to 5-10 years. This long-term structure provides stability for both vendors and purchasing entities while allowing for periodic reassessment of terms and conditions. Contract renewals are subject to vendor performance and continued alignment with procurement requirements.

MSPs serving government clients through NASPO contracts must comply with various requirements including FedRAMP or StateRAMP certification for cloud services, NIST Cybersecurity Framework implementation, state-specific data protection regulations, potentially CMMC requirements for defense-related work, and regular security assessments and reporting. Additionally, they must maintain any industry certifications specified in the contract and adhere to strict data sovereignty and privacy standards.