3-00338-0 RFQ Cyber Security Insurance Broker-Final.docx

REQUEST FOR QUALIFICATIONS (RFQ)

For

Cybersecurity Insurance Broker # 00338

Issue Date: September 12, 2025 Responses must be received BEFORE:

October 13, 2025, 11:00 A.M. C.S.T

Pre-Submittal Conference: There will not be a pre-submittal conference held for this solicitation.

Contents

Exhibit 1 – Pricing Sheet Exhibit 2 – Sample Contract

PART I -REQUIREMENTS FOR RESPONSES

INTRODUCTION

In accordance with the provisions of San Antonio River Authority (River Authority) Enabling Statute (Chapter 276, Page 556, Acts of the 45th Legislature, 1937, and subsequent amendments), policies and procedures, the River Authority is requesting proposals from qualified individual(s) or business(es) with considerable experience to provide the professional services as outlined in this solicitation. The responses shall be submitted to the River Authority in a sealed submission.

The awarded individual(s) or business(es) shall possess a proven track record of using innovative approaches to providing professional services to their clients. The awarded individual(s) or business(es) shall have the ability to accomplish all aspects of the requested services. The awarded individual(s) or business(es) should be able to provide innovative methods to deal with challenges and provide effective solutions and communicate effectively and in a timely manner with River Authority.

GUIDING PRINCIPALS

By working collaboratively, the River Authority is able to sustain and enrich the watershed’s ecosystem and the lives of the people in and the economies of the communities we serve.

The River Authority’s Vision: Inspiring Actions for Health Creeks and Rivers The River Authority’s Mission: Committed to Safe, Clean, Enjoyable Creeks and Rivers

SERVICE DESCRIPTION

The River Authority is seeking to award a contract(s) for the following professional services or CYBERSECURITY INSURANCE BROKER.

The San Antonio River Authority is seeking a United States based broker to secure appropriate cyber insurance coverage and provide advisory and claims support.

The goods and/or services shall be accomplished per the solicitation documents, all applicable Laws and all exhibits and Attachments identified in the table of contents.

MINIMUM QUALIFICATIONS

The following minimum requirements must be demonstrated in order for the submission to be considered responsive to the River Authority. Any submission received, which is determined to not meet these mandatory requirements may be immediately disqualified and rejected as non-responsive.

· The responding entity must demonstrate that the company, as an entity, has a minimum of three (3) years of documented experience in providing the specified services of equal complexity and magnitude. Experience must pertain to the company itself and not to the qualifications of individual employees or subcontractors.

· Three (3) references from entities for which the respondent provided the products or services, of equal complexity and magnitude, requested. The River Authority cannot be used as a reference.

· Broker must have State Insurance Producer License issued by TDI.

· At least one of the following certifications: CIC, CRM, CPCU, NAS, CISSP, ARM or PLUS (if available).

· The responding individual or business must be based in the United States.

· The responding individual or business is not on the debarred vendor list with the River Authority, the State of Texas, or Federal Debarment List (sam.gov)

· Submittal documents including a cover sheet, Executive Summary, Attachments A -G, Schedule, Resumes and Supplemental Documents per the method described in SUBMISSION FORMAT.

SCHEDULE OF EVENTS

Following is a list of projected dates with respect to this solicitation:

The River Authority reserves the right to change the dates indicated above.

PRE-SUBMITTAL CONFERENCE

There will be no pre-submittal conference for this solicitation.

CONTRACT TERM

An agreement awarded in response to this solicitation will be for a one (1) year period. The River Authority and the respondent shall have the option to renew for up to four (4) additional one (1) year terms. At the sole option of the River Authority, the Contract may be further extended as needed, not to exceed a total of six (6) months.

The Contract shall commence upon the contract execution by the River Authority and shall automatically renew each year, from the date of execution. The River Authority may terminate the contract at any time if funds are restricted, withdrawn, not approved or service is unsatisfactory.

PRICING

Only firm pricing with no escalation will be accepted for these services.

INSURANCE

The successful respondent will be required to maintain, at all times during performance of the contract, the insurance detailed below:

1. Premises/Operations

2. Independent Contractors

3. Products/Completed Operations

4. Personal Injury

5. Contractual Liability

$2,000,000 General Aggregate $2,000,000 Products/Completed Operations Aggregate $1,000,000 Personal Injury per occurrence $1,000,000 Each Occurrence

$500,000 each accident, $500,000 policy limit for Disease $500,000 each employee for Disease

$1,000,000 Combined Single Limit Non-owned vehicles include the use of an employee’s personal vehicle in the Contractor’s business.

$2,000,000 Per Claim $4,000,000 Annual Aggregate

a) Coverage shall be continuous (by renewal or extended reporting period) for no less than 60 months following completion of the Agreement and acceptance of the work by River Authority.

b) Coverage, including renewals, shall have the same retroactive date as the original policy applicable to this Agreement.

$1,000,000 per claim $2,000,000 Aggregate

Including the following Insuring Agreements: 1) Privacy Liability; 2) Network Security Liability; 3) Internet Media Liability; and 4) Network Extortion. Data Breach Fund & Regulatory Proceeding coverage is required and can be provided with a Sub-Limit of Liability with limits no less than $100,000 and $500,000, respectively.

a) Coverage shall be continuous (by renewal or extended reporting period) for no less than 60 months following completion of the Agreement and acceptance of the Services by River Authority.

b) Coverage, including renewals, shall have the same retroactive date as the original policy applicable to this Agreement.

Respondent is liable for all direct and general damages and special damages River Authority may incur arising out of or resulting from the negligent acts or omissions of respondent, including any agent, officer, director, representative, employee, contractor or subcontractor of respondent. Acceptance of work of the respondent by the River Authority shall not constitute a release of the responsibility, obligations or liability of the respondent for any defect in the design, working drawings, specifications, documents or work performed by the respondent.

The River Authority shall be named as an additional insured and provide a Waiver of Subrogation in favor of the River Authority, its officials, agents, employees and volunteers for umbrella, general liability, and auto policy policies. Respondent shall provide a waiver of subrogation for workers’ compensation policy.

All policies listed River Authority as an additional insured require endorsement that “other insurance” clause does not apply.

All policies require a 30 days-notice of cancellation or non-renewal if the respondent’s insurance is cancelled or non-renewed.

Insurance shall be carried with financially responsible insurance companies, licensed in the State of Texas, with an A.M. Best Rating of A (-) VI or better.

ADDENDA AND MODIFICATIONS

Any changes, additions, or clarifications to the solicitation are made by amendments (addenda) and will be posted at purchasing.sara-tx.org. Any respondent in doubt as to the true meaning of any part of the solicitation or other documents may request an interpretation from the Procurement Department. At the request of the respondent, or in the event the Procurement Department deems the interpretation to be substantive, the interpretation will be made by written addendum issued by the Procurement Department. Such addendum will be attached to the original solicitation at purchasing.sara-tx.org and will become part of the solicitation package having the same binding effect as provisions of the original solicitation. It shall be the respondent(s)’s responsibility to ensure that they have received all Addenda in respect to this solicitation. Furthermore, respondents are advised that they must recognize, and comply with each Addendum. Respondent(s)’s signature on Addenda shall be interpreted as the respondent’s recognition and compliance to official changes as outlined by the River Authority and as such are made part of the original solicitation documents. Failure of any respondent to receive any such addendum or interpretation shall not relieve such respondent from its terms and requirements. Addendums are available online at purchasing.sara-tx.org. No verbal explanations or interpretations will be binding. The River Authority does not assume responsibility for the receipt of any addendum sent to respondents.

The respondent shall properly acknowledge all addenda in the spaces provided in the Acknowledgment (Attachment G).

SUBMITTAL INSTRUCTIONS

All responses must be in the River Authority’s possession on or before the scheduled date and time (no late response will be considered). Respondents may submit a response in hard copy or electronically. The River Authority prefers electronic submissions. Electronic submissions shall be submitted through the River Authority’s third-party portal, Bonfire, at: https://sara-tx.bonfirehub.com. Bonfire will not allow submissions after the due date and time.

If a respondent prefers to submit in a hard copy, the respondent shall submit one (1) original signed document and (1) one copy. The original shall be clearly marked. In addition, the submittal shall be provided electronically on a USB drive. Statements of Qualifications must be received, in a sealed envelope, at the San Antonio River Authority Main Office no later than published date and time on the cover sheet at the address below.

Hard Copy responses shall be submitted to:

San Antonio River Authority Attn: Procurement Solicitation # 00338 100 E. Guenther San Antonio, Texas 78204

Submittals sent by facsimile or email will not be accepted. Any submittal or modification received after this time shall not be considered, and will be returned, unopened to the respondent. Respondents should strive for early submission to avoid the possibility of rejection for late arrival.

Each respondent is responsible for taking the necessary steps to ensure their submission is received by the date and time noted herein. The River Authority is not responsible for missing, lost or late mail or any mail delays, internal or external, that may result in the submission arriving after the set time. The River Authority’s Procurement Department is not open for weekend or holiday deliveries.

All submissions shall be opened in a manner that avoids disclosure of the contents to competing respondents and keeps the responses secret during negotiations. A public opening will not be conducted with this process.

SUBMISSION FORMAT

Each submittal shall be typewritten, single spaced and submitted on 8 ½” x 11” white paper. 11” x 17” paper may only be used if identified below and will count as one page. Font size shall be no less than 12-point type for all items (including graphics) and may be in full color. All pages shall be numbered and should be printed two-sided. Margins shall be no less than 1” around the perimeter of each page. Submittals shall be no longer than 60 pages total, front to back, and shall include the documents listed below (excluding Solicitation Packet Attachments and Special Documents). Websites or URLs shall not be submitted in lieu of the printed submittal or electronic submission.

Each submittal must include the sections and attachments in the sequence listed below, and each section and attachment must be indexed and divided by tabs and indexed in a Table of Contents page. If respondent is proposing as a team, provide the same information for each member of the team. The electronic submittal should be submitted in Adobe PDF.

Submission shall be in the following order:

A. COVER SHEET (Maximum one page):

Include solicitation number and name, firm name, address, contact phone, fax, website and email address.

B. EXECUTIVE SUMMARY (Maximum two pages):

The summary including a statement of the work to be accomplished, how Respondent proposes to accomplish and perform each specific service and unique problems perceived by respondent and their solutions.

C. PRICING SHEET- EXHIBIT 1 – in excel format

D. SOLICITATION PACKET ATTACHMENTS (Excluded from page count):

Attachment A – Business Questionnaire Attachment B – Exception Form Attachment C – References Attachment D – Conflict of Interest Form Attachment E – Small, Women, Minority Veteran Business Enterprises Form Attachment F – Subcontractor Utilization Plan Attachment G – Acknowledgment

E. EXPERIENCE AND RESOURCES (Included in page count)

1. Background of respondent and support personnel, including professional qualifications and length of time working in respondent’s capacity. Include résumés of key personnel for services that respondent proposes to perform including relevant experience of respondent as it relates to the scope of services contemplated by the solicitation. Ensure team members project experience is clearly tied to projects of similar scope and magnitude.

2. Include an organization chart of the proposed project team. (11” x 17” acceptable and counts as one page)

F. PROJECT SCHEDULE (Included in page count):

Respondents shall provide a schedule with their response for adoption of a cyber policy taking into consideration the River Authority’s renewal date is March 18, 2026. The schedule must include timelines, milestones and deliverables. (11” x 17” document acceptable and counts as one page).

G. SPECIAL DOCUMENTS (excluded in page count):

1. State Insurance Producer Licenses issued by TDI (graphic of licensure).

2. Evidence of certification(s) per minimum qualifications which includes one or more of the following per staff member: CIC, CRM, CPCU, NAS, CISSP, ARM or PLUS (if available). Copy of the certification must show name and active status of all certified staff proposed for the team.

3. Sample Proposal Comparison Repot – should include a side-by-side analysis of quotes from multiple carriers, and should include pricing (bid tabulation), limits, submlimits, exclusions, endorsements and a broker recommendation.

4. Sample Policy Binder Review Checklist – sample should demonstrate the brokers process for verifying accuracy of policies and endorsements.

5. Sample Claim Assistance Memo – sample should show how broker documents claims, interacts with insurers, and guides clients through the process.

PREPARATION OF RESPONSE

Responses MUST give full firm name and address of respondent, and be manually signed in the Acknowledgment, Attachment G. Failure to do so will disqualify your submittal. The person signing the response must show title or AUTHORITY TO BIND FIRM IN A CONTRACT. Firm name and authorized signature must appear on each page that calls for this information. The legal status of the respondent whether corporation, partnership, or individual, shall also be stated in the submittal. A corporation shall execute the submittal by its duly authorized officers in accordance with its corporate by-laws and shall also list the state in which it is incorporated. A partnership respondent shall give full names and business addresses of all partners proposed to be utilized on this project. Partnership and individual respondent shall state in the submittal the names and addresses of all persons with a vested interest therein. The place of residence of each respondent, or the office address in the case of a firm or company, with county and state and telephone number, shall be given after the signature. Any costs associated with assembling this submittal will be at the sole expense of the respondent.

WITHDRAWAL

Responses may be withdrawn prior to the due date for submission. Written notice of withdrawal shall be provided to the Procurement Department. No response may be withdrawn after opening time without reasonable exception in writing and only after approval by the River Authority.

1. ALTERATIONS/AMENDMENTS TO RESPONSES

Responses CANNOT be altered or amended after the opening deadline. Alterations made before opening time must be initialed by respondent guaranteeing authenticity.

INTERPRETATIONS

Any questions concerning the requirements or scope of work with regards to this solicitation shall be directed to the designated individuals as outlined herein. Such interpretations, which may affect the eventual outcome of this solicitation for Responses, shall be furnished in writing to all prospective respondents via Addendum. No interpretation shall be considered binding unless provided in writing by the River Authority in accordance with paragraph entitled “Addenda and Modifications”.

EVALUATION PROCEDURES

The River Authority’s selection committee will conduct a comprehensive, fair and impartial evaluation of all submittals received. Each submittal will be analyzed to determine overall responsiveness and qualifications. The River Authority Procurement Department reserves the right to contact any respondent, at any time, to clarify, verify or request information with regard to any response. The evaluation process consists of three steps:

Step 1: The River Authority will evaluate the submittal in accordance with the selection criteria and will rank the firms on the basis of the submittals. The River Authority may elect to conduct oral discussions, request clarifications, and presentations concerning the project approach and ability to furnish the requirements during the evaluation process, and rescore submittals based upon the interviews/presentations. The River Authority reserves the right to consider information obtained in addition to the data submitted in the response. The selection criterion is listed below:

A. Experience and qualifications of the Respondent for this project (FACTOR: 45%).

The Respondents proven experience in placing cyber insurance for similar organizations (size, sector, risk profile). In addition, understanding of emerging cyber threats, trends, and coverage gaps. Should have access to multiple top-rated cyber insurance carriers, ability to customize and compare policy terms, limits, sub limits, exclusions, and endorsements and capability to negotiate favorable terms and pricing.

B. Schedule presented for this service and defined in the scope of work (FACTOR: 5%)

Proposed schedule for the scope of work. Management of critical path items and schedule for timely completion.

C. Schedule Price, Total Cost of Ownership (FACTOR: 10%).

The price of the annual advisory services detailed out in the scope of work.

D. Communication and Service Model (FACTOR 5 %) Have an assigned account team or dedicated point of contact, regular review meetings and cyber risk updates and tools available for managing policies and incidents.

E. Risk Assessment and Advisory Services (FACTOR: 25%) Provides pre-policy risk assessments or cyber readiness evaluations, offers guidance on improving cyber hygiene to qualify for better coverage or premiums and advises on appropriate policy limits based on your risk exposure and digital footprint.

F. Claims Support and Advocacy (FACTOR: 10%).

Strong track record of guiding clients through claims processes. In-house or partner expertise in breach response and cyber incident recovery. Availability during critical times (e.g., breach events, claim escalations).

RIGHT TO REJECT/ AWARD

The River Authority reserves the right to refuse and reject any or all responses, waive any or all formalities or technicalities, accept the response or portions of the response and to make such awards of contract(s) as may be deemed to be in the best interest and most advantageous to the River Authority, considering the relative importance and other evaluation factors specified herein.

RESTRICTIONS ON COMMUNICATION

Respondent(s) are prohibited from communicating with: 1) The River Authority Board of Directors and the River Authority staff regarding the solicitation or submittals from the time the solicitation has been released until the contract is posted as a Board agenda item; and 2) the River Authority employees from the time the solicitation has been released until the contract is awarded. These restrictions extend to “thank you” letters, phone calls, emails and any contact that results in the direct or indirect discussion of the solicitation and/or submittal by respondent. Violation of this provision by respondent and/or its agent may lead to disqualification of respondent’s submittal from consideration.

Exceptions to the restrictions on communication with the River Authority employees include:

A. Respondents may ask verbal questions concerning this solicitation at the Pre-Submittal Conference (if applicable) or submit clarification requests via email to the contact below.

B. Respondents may provide responses to questions asked of them by the Procurement Department after submittals are received and opened. The Procurement Department may request clarification to assist in evaluating respondent’s Response. The information provided is not intended to change the Response in any fashion. Such additional information must be provided within two (2) business days from the River Authority’s request. Respondents may also respond to requests by the Procurement Department for best and final offers, which do allow respondents to change their response. Requests for best and final offers will be clearly designated as such.

Respondents shall direct all inquiries and communications concerning this solicitation to the Point of Contact(s) listed below:

Emily Hanson Senior Buyer

(210) 302-3605 ehanson@sariverauthority.org

INVITATION FOR RESPONSES PREPARATION COSTS

Issuance of this solicitation does not commit the River Authority, in any way, to pay any costs incurred in the preparation and submission of a response. All costs related to the preparation and submission of this solicitation shall be borne by the respondent.

ANTI-LOBBYING PROVISION

During the period between the solicitation submission date and the contract award, respondents, including their agents and representatives, shall not directly discuss or promote their response with any member of the Board of Directors or River Authority staff except in the course of River Authority-sponsored inquiries, briefings, interviews, or presentations. Violation of this provision may result in the rejection of the respondent's response and disqualification from future consideration of a similar solicitation.

CONFIDENTIAL INFORMATION & SECURITY

Any information deemed to be confidential by the respondent should be clearly annotated on the pages where confidential information is contained. The River Authority cannot guarantee that it will not be required to disclose all or part of any public record under Texas Public Information Act, since information deemed to be confidential by the responder may not be confidential under Texas Law, or pursuant to a Court order.

Should the successful respondent be awarded a contract and become the holder of, and have access to, confidential information, (in the process of fulfilling its responsibilities in connection with the contract), the successful respondent agrees that it shall keep such information confidential and will comply fully with the laws and regulations of the State of Texas, ordinances and regulations of the River Authority, and any applicable federal laws and regulations relating to confidentiality.

DEBRIEFS

After the contract has been awarded all submissions will be open for public inspection, and the unsuccessful respondent(s) may request a debriefing regarding their submittal. Please contact the Procurement Department to request a debriefing within 60 days of notice of award. An in-person meeting with the Procurement Department and the using Division will be scheduled within a reasonable time.

BUSINESS OVERVIEW – ATTACHMENT A

Respondent shall complete the Business Overview Questionnaire as applicable per Attachment A. Subconsultants do not need to complete this form, unless they are a co-responder as defined on Attachment A.

DEVIATION FROM SPECIFICATION/ REQUIREMENTS -ATTACHMENT B

Please read the requirements thoroughly and be sure that your response complies with all requirements/specifications noted. Any variation from the solicitation requirements/ specifications must be clearly indicated in Attachment B, on a point-by-point basis, attached to and made a part of your response. If no exceptions are noted, and you are the successful respondent, the River Authority will require that the good/service(s) be provided as specified.

Respondents shall itemize all exceptions on Attachment B. Additional pages may be added as necessary. Do not mark or change the text of the solicitation document, exceptions shall be noted only on Attachment B.

REFERENCES – ATTACHMENT C

Provide three (3) references, that the respondent has provided services to within the past three (3) years. The contact person named should be familiar with the day-to-day management of the contract and be willing to respond to questions regarding the type, level, and quality of service provided.

The River Authority reserves the right to use other references and any additional information provided to evaluate the firm’s ability to meet the River Authority’s needs.

CONFLICT OF INTEREST – ATTACHMENT D

Chapter 176 of the Texas Local Government Code requires that any vendor or person considering doing business with a local government entity must disclose in the Questionnaire Form CIQ, the vendor or person’s affiliation or business relationship that might cause a conflict of interest with a local government entity. This questionnaire must be filed, by law, with the River Authority no later than the 7th business day after the date the person becomes aware of facts that require the statement be filed. See Section 176.006, Local Government Code. A person commits an offense if the person violates Section 176.006, Local Government Code. An offense under this section is a Class C misdemeanor. For more information or to obtain the Questionnaire CIQ, go to the Texas Ethics Commission web page at www.ethics.state.tx.us/forms/CIQ.pdf.

IF YOU HAVE ANY QUESTIONS ABOUT COMPLIANCE, PLEASE CONSULT YOUR OWN LEGAL COUNSEL. COMPLIANCE IS THE INDIVIDUAL RESPONSIBILITY OF EACH PERSON OR AGENT OF A PERSON WHO IS SUBJECT TO THE FILING REQUIREMENT. AN OFFENSE UNDER CHAPTER 176 IS A CLASS C MISDEMEANOR.

SMALL, WOMEN MINORITY VETERAN BUSINESSES ENTERPRISE– (SWMVBE) ATTACHMENT E

The River Authority encourages the utilization of certified Small, Women Owned, Minority, Veteran business enterprises. Businesses must be at least 51% minority-owned, woman-owned, veteran owned, or service-disabled veteran owned for designation to apply. SWMVBE’s must be certified by state or regional agency for these designations to apply in accordance with applicable policies. Respondents shall identify their certification in the Attachment E and subconsultants on Attachment F – Subcontracting Utilization Plan.

Respondent will be required to submit monthly reports, payments, and forms electronically through River Authority’s Supplier Diversity Management System (SDMS), https://sariverauthority.diversitycompliance.com, to include but not limited to Diversity Utilization Plan and/or Schedule, good faith efforts, and unconditional lien waivers. Respondent must, within five (5) calendar days from awarding a subcontract to a subconsultant, enter all required data for its first-tier subconsultants electronically into the SDMS and shall ensure such data remains current throughout the project. Respondent must also electronically enter payments made to each subconsultant into the SDMS within ten (10) calendar days of electronic notification that the monthly audit period is open for data and subconsultants must verify their actual participation in the project by acknowledging in the SDMS payments were received from respondent within ten (10) calendar days of payment entry. Unless otherwise stated in any correspondence from River Authority, both respondent and their subconsultants must respond electronically through the SDMS within five (5) calendar days of a request for information.

SUBCONTRACTOR UTILIZATION PLAN-ATTACHMENT F

The respondent will be required to establish, to the satisfaction of the River Authority, the reliability and responsibility of the respondent’s own work force and proposed subcontractors to be used for stated portions of the work for this project. The respondent is required to complete and submit with the submittal a "Subcontractor Utilization Plan”.

During the evaluation of responses, if the River Authority has a reasonable and substantial objection to any person or organization on the "Subcontractor Utilization Plan" in Attachment F and refuses in writing to accept such person or organization, the respondent may, at their option, withdraw the submittal. If the respondent submits an acceptable substitute, the River Authority may, at its discretion, accept the substitute or may disqualify the respondent. Subcontractors and other persons and organizations proposed by the respondent and accepted by the River Authority must be used on the work for which they were proposed and accepted and shall not be changed except with the written approval of the River Authority.

ACKNOWLEDGEMENT - ATTACHMENT G

Submit a signed acknowledgement by authorized agent of the responding firm.

CONTRACT

The successful respondent will be required to sign a contract using the River Authority’s terms and conditions. An example of the contract draft is provided as Exhibit 2 as a reference. This is only a sample, and the actual contract will be updated to match any requirements of this solicitation and funding sources. The River Authority frequently updates the contract template, and the final contract may be modified before final execution between the parties.

Respondents should note any exceptions to the draft contract on Attachment B, otherwise the respondent accepts the draft contract terms and conditions.

Part II –STATEMENT OF WORK

1. BACKGROUND

The San Antoino River Authority was created in 1937, and its jurisdiction covers 3,658 square miles—all of Bexar, Wilson, Karnes and Goliad Counties. The River Authority’s mission is committed to safe, clean, and enjoyable creeks and rivers. The need to protect consumer and employee data, maps, water quality, wastewater utility, and flood and dam information is of high importance to the River Authority. The adoption of cyber security insurance will continue to provide the protection needed to keep our mission successful.

OBJECTIVE

The objective is to assess cyber risk, identify and secure appropriate cyber insurance coverage, and provide advisory and claims support.

COMPENSATION

Compensation for broker services will be structured as a single, fixed annual services fee. Payment will be made following the successful placement of coverage with an insurance carrier. This fee will constitute the broker’s sole compensation for all services outlined in the scope of work, and no commissions or additional compensation shall be added by the insurer.

CONFIDENTIALITY

All proprietary or sensitive information shared during this engagement shall be treated as confidential and will not be disclosed without prior written consent, except as required by law.

RIVER AUTHORITY RESPONSIBILITIES

A. Provide timely access to relevant information and staff.

B. Respond to requests for documentation needed for underwriting.

C. Make timely decisions regarding policy selection and placement.

CONSULTANT RESPONSIBILITIES

A. Deliver all services outlined in the scope of work in accordance with industry best practices and agreed timelines.

B. Consistently act in the best interest of the client, providing objective, transparent, and client-focused recommendations and services.

C. Protect and maintain the confidentiality, integrity, and security of all client data, records, and systems, and comply with all applicable privacy and information security requirements.

SCOPE OF WORK

A. Risk Assessment & Coverage Planning

1. Conduct initial discovery sessions to assess the organization's cyber risk exposure.

2. Review existing policies and identify potential coverage gaps.

3. Advise on optimal coverage limits, retentions, and endorsements within 30 days of kickoff.

B. Market Research & Proposal Management

1. Prepare insurance applications and submissions including all River Authority coverage and service needs.

2. Solicit quotes from a minimum of three (3) qualified cyber insurance carriers to ensure a competitive and transparent selection process.

3. Evaluate and compare terms, pricing, exclusions, sublimits, and endorsements.

4. Develop and present a recommended best-fit insurance policy or policies that align with the agency’s coverage needs and budget. The recommendation shall be supported by a comprehensive bid tabulation that compares all proposals received, clearly identifying and itemizing all costs and fees associated with each option.

C. Policy Placement & Documentation

1. Negotiate final terms and place selected coverage.

2. Review binders and policies for accuracy and correct any discrepancies before delivery to the client.

3. Deliver all policy documentation and certificates within 30 days of execution or renewal.

D. Claims Support & Advocacy

1. Provide guidance and assistance in the event of a cyber incident or claim.

2. Monitor all communications between the organization and the insurer and intervene as necessary to ensure claims are managed promptly, efficiently, and in accordance with policy terms.

3. Provide and collect support documentation, communicate resolution strategies, and monitor settlement negotiations.

E. Annual Advisory Services

1. Provide updates on cyber insurance market trends, regulatory changes and emerging threats relevant to cyber insurance.

2. Conduct periodic policy reviews (annually).

3. Recommend adjustments to coverage as the organization’s risk profile evolves.

4. Provide an annual cybersecurity benchmarking report comparing the organization to industry peers.

DELIVERABLES REQUIRED

PERFORMANCE MEASURES

A. Broker shall submit all deliverables by the deadlines stated in Section 8 (Deliverables Required).

B. Late deliverables shall be reported in writing with justification and a revised timeline agreed upon in advance.

C. Broker shall provide detailed premium breakdowns by entity, limit type, sublimit, retention, and amount with each proposal submission. This document should clearly state that no commission was received by broker.

D. For nonurgent matters, broker shall return phone calls and emails within one (1) business day.

E. For urgent matters related to cyber incidents or claims, broker shall respond within one (1) hour of receipt.

F. Broker shall provide weekly written updates on the status of submissions, negotiations, and feedback from insurance carriers during the renewal/placement period.

G. Broker shall allow the client a minimum of five (5) business days to review and respond to carrier feedback or requests for additional information, unless an urgent deadline is imposed by a carrier.

PART III - ATTACHMENTS

All Attachments are to be returned with Submittal

ATTACHMENT A-BUSINESS QUESTIONNAIRE

Provide the following information regarding the prime firm, that if selected would sign a contract with the River Authority. Subconsultants do not have to complete this form.

(NOTE: Co-Responders are two or more entities proposing as a team or joint venture with each signing the contract, if awarded. Sub-contractors are not Co-Responders and should not be complete this form. If this submittal includes Co-Responders, each Co-respondent should complete an Attachment A, questions 1-21 only)

1. Contract Information (for formal contracting purposes):

The following information will be used to write a contract, should your firm be selected for award.

a. Firm’s Legal Name:

b. Principal Address:

c. Telephone No.

d. Fax No:

e. Agent Authorized to sign contract (Name):

f. Authorized Agent’s Job Title

g. Authorized Agent’s email address:

h. Contract Compliance Contact Name:

i. Contract Compliance Contact email:

j. Contract Compliance Contact phone number:

1. Provide any other names under which responders have operated within the last 10 years and length of time for each

2. Website address:

3. Organization Class (check ):

· Individual or Sole Proprietorship, if checked, list Assumed Name, if any:

· Partnership

· Corporation, if checked check one:

· For-Profit

· Nonprofit

· Domestic

· Foreign

4. Federal Employer Identification Number:

5. Texas Comptroller’s Taxpayer Number, if applicable (NOTE: This 11-digit number is sometimes referred to as the Comptroller’s TIN or TID.)

1. DUNS Number & SAM.gov Unique Entity ID

7. Date Established:

· Number of years in business under present name:

8. Provide address of office from which this project would be managed:

· Principal Address:

· Telephone No.

· Fax No:

· Total Number of Employees:

· Total Number of Current Clients/Customers:

9. Contact Information: List the one person who the River Authority may contact contract concerning your submittal:

· Name

· Title

· Address:

· Telephone No:

· Fax No:

· Email address:

10. Does your firm anticipate any mergers, transfers or organization ownership or management reorganization within the next twelve (12) months?

· No

· Yes

11. Is firm authorized and/or licenses to do business in Texas?

· No

· Yes, If yes, list authorizations/licenses:

12. Does the firm have an office located in Bexar County?

· No

· Yes, If yes, respond to “a” and “b” below:

a. How long has the respondent conducted business from it’s Bexar County Office?

b. State the number of full-time employees at the Bexar County office:

13. Has the firm or any of its principals been debarred or suspended from contracting with any public entity?

· No

· Yes, If yes, identify the public entity, contact name and phone number of representative familiar with the debarment or suspension, and state the reason for or the circumstances surrounding the debarment or suspension, including but not limited to the period of time for such debarment or suspension:

14. Has the firm ever been declared bankrupt or filed for protection from creditors under state of federal proceedings:

· No

· Yes, If yes, state the date, court jurisdiction, cause number, amount of liabilities and amount of assets:

15. Has the firm ever received any disciplinary action, or any pending disciplinary action, from any regulatory bodies or professional organizations? If “Yes”, state the name of the regulatory body or professional organization, date and reason for disciplinary or impending disciplinary action:

16. Has the firm ever failed to complete any contract awarded?

· No

· Yes, If yes, state name of the organization contracted with, services/goods contracted, date, contract amount and reason for failing to complete the contract:

17. Has any officer or partner proposed for this project/contract ever failed to complete a contract handled in her or her own name:

· No

· Yes, If yes, state name of the organization contracted with, services/goods contracted, date, contract amount and reason for failing to complete the contract:

18. Litigation Disclosure:

a. Has the project manager or any member of the firm’s team to be assigned to this engagement ever been indicted or convicted of a felony of misdemeanor greater than Class C in the last five (5) years?

· No

· Yes

b. Has the project manager or any member of the firm’s team been terminated (for cause or otherwise) from any work being performed by the River Authority or any other federal, state, or local government, or private entity?

· No

· Yes

c. Has the company or any member of the company to include but not limited to principals, owners, project managers, executive officers, employees or any proposed subcontractor been involved in any claim or litigation with the River Authority or any other federal, state or local government, or private entity during the last ten (10) years?

· No

· Yes

19. Has your company implemented an Employee Health and Safety Program compliant with 29 CFR 1910 “General Industry Standards” and/or 29 CFR 1926 “General Construction Standards” as they apply to your Company’s customary activities?

http://www.osha.gov/pls/oshaweb/owasrch.search_form?p_doc_type=STANDARDS&p_toc_level=1&p_keyvalue=1926

20. How did your firm learn about this solicitation from the River Authority?

☐ Newspaper Legal Notice

☐ Email notification from Bonfire

☐ River Authority website: purchasing.sara-tx.org

☐ 3rd Party solicitation service: www.gobonfire.com

☐ Plan Room. Please identify plan room

☐ Other. If so, please indicate

21. I certify that our firm meets the minimum qualifications as stated in Part 1, Section 4.

☐ Three (3) years’ experience providing similar products or services of equal complexity and magnitude

☐ Broker must have State Insurance Producer License issued by TDI and provide a copy of license in submittal.

☐ At least one of the following certifications: CIC, CRM, CPCU, NAS, CISSP, ARM or PLUS (if available) and provide a copy of certification(s) in submittal.

☐ The responding individual or business must be based in the United States.

☐ The responding individual or business is not on the debarred vendor list with the River Authority, the State of Texas, or Federal Debarment List (sam.gov)

☐ Submittal documents including a cover sheet, Executive Summary, Attachments A -G, Schedule, Resumes and Supplemental Documents per the method described in SUBMISSION FORMAT.

Signature Company Date

ATTACHMENT A – SUPPLEMENTAL QUESTIONNAIRE

Please provide answers to the questions below. The answers provided will assist the evaluation team understand your firm’s qualifications. The details must be completed on this form and shall not point to another document in the respondent’s submittal. The evaluation is not limited to the questions below, but the entire submission.

Provide details to support the evaluation criteria stated in Part 1, Section 17. (Provide details to assist the evaluation team understand how your firm meets each criterion. Please be thorough, answers that are vague or simply restate the evaluation criteria will be scored less than other firms that provide adequate details.).

A. Experience and qualifications of the Respondent available for this project (FACTOR: 45%).

1. How many cyber insurance policies are placed each year for organizations of comparable size and industry?

2. Which insurers are most frequently engaged for cyber coverage?

3. What is the experience level of key personnel proposed for this project, and what roles will be dedicated to the Scope of Work?

4. What certifications, licenses, or specialized training do proposed personnel maintain that are relevant to cyber insurance placement and advisory services?

B. Schedule presented for this service and defined in the scope of work (FACTOR: 5%)

1. What is the standard renewal timeline and how far in advance of expiration is coverage marketed?

2. What methods are used to ensure deliverables outlined in the Scope of Work are completed on schedule?

3. What is the standard turnaround time for draft proposals, policy comparisons, and requested documentation?

4. How are urgent requests outside of business hours (such as incident response) handled?

C. Communication and Service Model (FACTOR 5 %)

1. What is the standard response time for phone calls, emails, and service requests?

2. How frequently are status updates provided to clients during the policy placement process and throughout the policy year?

3. What communication methods (meetings, dashboards, reports, portals) are used to ensure transparency with clients?

4. What dedicated contacts or service team structure will be assigned for account management and claims support?

5. Please describe your firm’s compensation structure and explain how it is designed to promote high-quality service delivery and maximize value for the River Authority?

D. Risk Assessment and Advisory Services (FACTOR: 25%)

1. How is premium determined, and what factors are most likely to increase premium year over year?

2. How are coverage recommendations aligned with changes in organizational risk profile?

3. What proactive risk management services or guidance are provided outside of policy placement?

4. How is benchmarking performed against industry peers or best practices to identify potential gaps?

5. How are exclusions that may significantly limit coverage for the industry identified and addressed?

6. How are sublimits structured within policies, and how are they evaluated to ensure adequacy?

7. How is emerging risk intelligence incorporated into coverage…