Buy responsibly. Contract with discipline.

Purchase and Contract Authority

Purchases should be made only by people acting within documented budget, approval, and signing authority.

The Board of Trustees should retain approval over material contracts, major capital commitments, related-party transactions, debt, long-term leases, and other transactions that create significant risk or obligation.

Competitive Purchasing

The Institute should seek price comparisons, written quotations, proposals, or formal bids in proportion to the value and complexity of the purchase.

• Use clear and consistent specifications
• Give qualified vendors a fair opportunity to respond
• Evaluate total value rather than price alone
• Document the basis for selection
• Avoid splitting purchases to bypass approval thresholds

Sole-Source and Emergency Exceptions

Competition may not be practical when only one vendor can meet a technical requirement, intellectual-property constraint, compatibility need, urgent safety issue, continuity requirement, or emergency condition.

Exceptions should be documented with the reason, price reasonableness, conflicts, alternatives considered, approving authority, and duration of the exception.

Vendor Due Diligence

Review may include legal existence, ownership, financial stability, references, sanctions, licensing, qualifications, insurance, litigation, cybersecurity, accessibility, safety history, and ability to perform.

Higher-risk vendors may require enhanced review, including site visits, technical validation, background screening, audit rights, or financial assurance.

Contract Standards

Written agreements should define the full relationship, including scope, pricing, payment terms, milestones, acceptance criteria, confidentiality, data use, intellectual property, warranties, insurance, indemnification, dispute resolution, and termination.

No person should sign a vendor agreement, online term, software subscription, lease, or recurring service outside their delegated authority.

Technology, Data, and Cybersecurity

Vendors that access Institute systems, data, research, communications, facilities, or identities should meet security and privacy requirements proportionate to the risk.

• Access controls and least privilege
• Encryption and secure data transfer
• Incident notification obligations
• Subcontractor and hosting disclosures
• Data ownership, export, return, and deletion terms
• Business continuity and recovery capability

Insurance, Safety, and Operational Risk

Vendors may be required to maintain appropriate general liability, professional liability, cyber liability, workers’ compensation, vehicle, aviation, property, or other insurance.

Contractors working on Institute property should follow safety, security, access, environmental, and emergency procedures.

Invoices, Acceptance, and Payment

Payment should be based on authorized orders, completed milestones, accepted goods or services, valid invoices, and proper coding and approval.

Changes in price, scope, schedule, quantity, or terms should be approved before payment when they are material.

Vendor Performance and Renewal

Renewal decisions should consider quality, service, responsiveness, incidents, security, cost changes, contract compliance, user experience, and availability of better alternatives.

Significant deficiencies should be documented and may lead to remediation plans, withheld acceptance, reduced scope, nonrenewal, termination, or exclusion from future work.

Prohibited Conduct

• Accepting kickbacks, bribes, secret commissions, or improper gifts
• Steering business to a related party without disclosure and independent approval
• Falsifying bids, quotes, invoices, time, delivery, or performance records
• Sharing confidential competitor information improperly
• Dividing purchases to avoid review or approval
• Approving personal purchases as institutional expenses
• Retaliating against people who report procurement concerns

Framework date: July 2026