6-696-IG-26-O012.pdf

Texas Department of Criminal Justice Response Cover Page

This form requests basic information about the Respondent and project and must be completed in its entirety, including the signature of the Authorized Representative.

SOLICITATION INFORMATION

Document Type: 2 Statutory Cite: Texas Government Code, Section 2157.006

1) Solicitation Number: 696-IG-26-O012

2) Issue Date: 3) Deadline: June 1, 2026 May 1, 2026 3:00 p.m. CT

4) Contract Specialists: Ellyse Collins (936) 437-3484 ellyse.collins@tdcj.texas.gov (reference Section G.2.2) Tatyana Lockhart (936) 437-3842 tatyana.lockhart@tdcj.texas.gov

5) Type of Solicitation: RFO-Request for Offer

6) Solicitation Description:

The OIG requires a Contractor to provide and support a cloud-based law enforcement Records Management System (RMS) designed for multi-jurisdictional use, real-time data access and sharing, evidence management, and report creation and management. Services will include personnel, hardware, software, training, licensing, implementation, storage, materials, and supplies.

RESPONSE SUBMITTAL

7) Submission Portal: https://tdcj.bonfirehub.com

Reference Section L for complete submittal instructions. LATE RESPONSES WILL NOT BE ACCEPTED.

RESPONDENT INFORMATION

8) Legal Business Name:

9) Mailing Address Information (include street, city, county, state and 9-digit zip code):

10) Payee Name and Mailing Address, including 9-digit zip code (if different from above)

(remittance address if not electing Direct Deposit):

11) Federal Tax ID No. (9-digit), State of Texas Comptroller Vendor ID

Number (14-digit) or Social Security Number (9-digit):

12) Type of Entity (check all that apply):

Corporation (incorporated under the laws of the State of _____________) Partnership Individual Non-Profit Organization* Joint Venture *If incorporated, provide 10-digit charter number assigned by Secretary of State:

If a Foreign Entity:

Individual Partnership Joint Venture Non-Profit Organization Corporation (registered for business in _________________ (country)

13) Prompt Payment Discount: _____ % _____Days or Net 30 (reference Section G.3 for additional information)

14) Amendments: The Respondent acknowledges receipt of all amendments.

RESPONDENT AUTHORITY AND SIGNATURE

15) Point of Contact Name: __________________________________ Title:

Email address: _____________________________ Telephone #: _________________

16) Authorized Signature: Date:

696–IG–26–O012

SUMMARY OF KEY DATES

In compliance with Texas Government Code 2161.252, it has been determined there is a probability of Historically Underutilized Business (HUB) subcontracting opportunities available for this Solicitation and the completion of a HUB Subcontracting Plan will be required for this Solicitation.

May 1, 2026 Issue Solicitation

May 8, 2026

10:00 a.m. CT Pre-Proposal Conference

May 15, 2026 12:00 p.m. CT Deadline for Written Questions for Clarification to the Department

May 22, 2026 Expected Date for Amendment to Answer Questions

June 1, 2026 3:00 p.m. CT Deadline for the Department Receipt of Responses.

Late Responses will not be accepted.

November 1, 2026 Service Commencement Date

TABLE OF CONTENTS

Page

SUMMARY OF KEY DATES

SECTION A - CONTRACT DEFINITIONS

A.1 GENERAL DEFINITIONS

A.2 SERVICE SPECIFIC DEFINITIONS

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 SERVICES AND PRICES/COSTS

B.1.1 Services Being Acquired B.1.2 Pricing Instructions

B.2 PRICING SCHEDULE

B.3 ALLOWABLE COSTS

B.4 NON-ALLOWABLE COSTS

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

C.1 BACKGROUND

C.2 COMPLIANCE WITH APPLICABLE RULES, REGULATIONS, POLICIES,

PROCEDURES, AND LAWS

C.2.1 Data Requirements C.2.2 Electronic Information Resource Accessibility Requirements C.2.3 Information Security Requirements

C.3 STATEMENT OF WORK

C.4 FUNCTIONAL REQUIREMENTS

C.5 TECHNICAL REQUIREMENTS

C.6 TRAINING

C.7 STAFFING

C.8 COMMUNICATION

C.9 IMPLEMENTATION

C.9.1 Implementation Plan C.9.2 Testing and Acceptance

C.10 MAINTENANCE AND SUPPORT

C.11 ADDED VALUE

SECTION D - REQUIRED DOCUMENTS FROM CONTRACTOR

SECTION E - INSPECTION AND ACCEPTANCE

E.1 INSPECTION OF SERVICES

E.2 INSPECTION BY STATE EMPLOYEES

E.3 MONITORING CRITERIA

E.4 AUDITS BY OTHER AGENCIES

E.5 FRAUD, WASTE, OR ABUSE

SECTION F - DELIVERIES OR PERFORMANCE

F.1 CONTRACT TERM

F.2 OPTION TO RENEW THE CONTRACT

F.3 OPTION TO EXTEND SERVICES

SECTION G - CONTRACT ADMINISTRATION DATA

G.1 CLAUSES INCORPORATED BY REFERENCE

G.2 AUTHORITY - AUTHORIZED REPRESENTATIVE, CONTRACT SPECIALIST,

PROGRAM SPECIALIST, OIG PROJECT MANAGER, AND PROGRAM DIRECTOR 47

G.2.1 Authorized Representative

G.2.2 Contract Specialist G.2.3 Program Specialist G.2.4 OIG Project Manager G.2.5 Program Director

G.3 INVOICE REQUIREMENTS

G.4 PAYMENTS

G.4.1 Payment Adjustment G.4.2 Late Payment G.4.3 Deductions for Unacceptable Compliance Standards G.4.4 Withholding of Payment G.4.5 Right to Offset

G.5 ANNUAL FINANCIAL DISCLOSURE REPORTS

SECTION H - SPECIAL CONTRACT REQUIREMENTS

H.1 INSURANCE REQUIREMENTS

H.1.1 Required Provisions

H.2 SUBCONTRACTING (IF APPLICABLE)

H.2.1 Insurance H.2.2 Historically Underutilized Business

H.3 CRIMINAL HISTORY INFORMATION COMPLIANCE

H.4 OTHER CONFIDENTIAL OR SENSITIVE INFORMATION

H.5 BOOKS AND RECORDS

H.6 ORGANIZATIONAL AND NAME CHANGE

H.7 FREE EXERCISE OF RELIGION

H.8 DELAY OF SERVICES

H.9 SECURITY

H.10 UTILIZATION OF SERVICES

H.11 TRANSITION

H.12 USE OF CONTRACT BY OTHER STATE AGENCIES

H.13 NO LITIGATION

SECTION I - CONTRACT CLAUSES

I.1 ADVERTISING OF AWARD

I.2 DEFAULT AND TERMINATION

I.2.1 Default by the Contractor I.2.2 Further Opportunity to Cure I.2.3 Remedy of the Department I.2.4 Termination for Convenience I.2.5 Termination by Mutual Agreement I.2.6 Termination Procedures I.2.7 Default by the Department I.2.8 Remedy of the Contractor

I.3 NO WAIVER OF RIGHTS

I.4 TAXES/WORKERS’ COMPENSATION/UNEMPLOYMENT INSURANCE - INCLUDING

INDEMNITY

I.5 NO WAIVER OF DEFENSES

I.6 INDEPENDENT CONTRACTOR

I.7 MAINTENANCE OF CORPORATE EXISTENCE AND BUSINESS

I.8 APPROVAL OF CONTRACT

I.9 NON-DISCRIMINATION

I.10 CONFIDENTIALITY

I.11 CONTRACT CHANGES

I.12 SEVERABILITY

I.13 IMMIGRATION

I.14 NO LIABILITY UPON TERMINATION

I.15 LIMITATION ON AUTHORITY

I.16 INTELLECTUAL PROPERTY INDEMNIFICATION

I.17 ELECTRONIC AND INFORMATION RESOURCES ACCESSIBILITY STANDARDS, AS

REQUIRED BY TEXAS ADMINISTRATIVE CODE, TITLE 1, PART 10, CHAPTER 213

I.18 RIGHTS TO DATA, DOCUMENTS AND COMPUTER SOFTWARE (STATE

OWNERSHIP)

I.19 FORCE MAJEURE

I.20 NOTICES

I.21 SUBSTITUTIONS

I.22 REQUIRED COOPERATION IN LEGAL MATTERS

SECTION J - LIST OF EXHIBITS

SECTION K - REPRESENTATIONS, CERTIFICATIONS, AND OTHER STATEMENTS OF

RESPONDENTS

K.1 RESERVED FOR FUTURE USE

K.2 FRANCHISE TAX REPRESENTATION

K.3 REPRESENTATIONS OF THE RESPONDENT

K.3.1 Organization and Qualification K.3.2 Authorization K.3.3 No Violation of Agreements, Articles of Incorporation or Bylaws K.3.4 No Defaults Under Agreements K.3.5 Compliance with Laws K.3.6 Taxes K.3.7 Financial Statements K.3.8 No Adverse Change K.3.9 Disclosure K.3.10 No Collusion K.3.11 Disclosure of Interested Parties K.3.12 Felony Conviction K.3.13 Deceptive Trade Practices; Unfair Business Practices K.3.14 Notification

K.4 REPRESENTATIONS OF THE DEPARTMENT

K.4.1 Authorization K.4.2 No Violation of Agreements K.4.3 Disclosure

SECTION L - INSTRUCTIONS, CONDITIONS AND NOTICES TO RESPONDENTS

L.1 DISCUSSIONS, CORRESPONDENCE, AND AMENDMENTS TO THE SOLICITATION

L.2 LATE SUBMISSIONS, MODIFICATIONS AND WITHDRAWALS OF RESPONSES ...74

L.3 SIGNATURES ON RESPONSES SUBMITTED

L.4 RESPONSE ACCEPTANCE

L.5 CONTRACT AWARD

L.6 RIGHTS OF THE DEPARTMENT

L.7 RESPONSE PREPARATION INSTRUCTIONS

L.8 RESPONSE SUBMISSION FILES AND CONTENT

L.8.1 Response Cover Page L.8.2 Response Introduction L.8.3 Pricing Schedule and Budget Narrative L.8.4 Response to Each Requirement in Section C L.8.5 TDCJ Required Contract Clauses L.8.6 HUB Subcontracting Plan

L.8.7 Service Agreement for Respondent’s RMS, if applicable L.8.8 Respondent’s Financial Statements L.8.9 Statement of Compliance with Sections E through K

L.9 PRE-PROPOSAL CONFERENCE

L.10 LEGISLATIVE BUDGET BOARD (LBB) POSTING

SECTION M - EVALUATION FACTORS FOR AWARD

M.1 SELECTION PROCESS

M.2 MINIMUM QUALIFICATIONS

M.3 EVALUATION CRITERIA

696–IG–26–O012 Section A

SECTION A - CONTRACT DEFINITIONS

The following terms used in this Contract shall, unless the context indicates otherwise, have the meanings set forth below, to include the singular and plural versions:

A.1 GENERAL DEFINITIONS

Authorized Representative - the person designated in writing to act for and on behalf of a party of this Contract.

Biennium - any of the two-year periods beginning on September 1st and ending on August 31st of odd numbered years, which are used for budgetary purposes by the State of Texas.

Compliance Standards - Contract requirements that have specific and clearly defined recoupment strategies to ensure that the Department does not pay for Services that are not received.

Contract - documents that form the Contract, which represents the entire and integrated agreement between the Department and the Contractor and supersedes all prior negotiations, representations, or agreements, either written or oral. The Contract may be amended or modified only by a written modification. The Contract Documents shall not be construed to create a contractual relationship of any kind (1) between the Department and a subcontractor or (2) between any persons or entities other than the Department and Contractor.

Contract Specialist - the Department employee responsible for non-technical administration of this Contract.

Contract Term - the duration of this Contract as specified in Section F.1, Contract Term.

Contractor - the individual, partnership, or corporation who performs Services under this Contract.

Day - calendar Day.

Department - the Texas Department of Criminal Justice (TDCJ).

Department Policy - all written Policies, procedures, standards, guidelines, directives, and manuals of the TBCJ and the Department, applicable to providing the Services specified under this Contract.

Event of Default - any of the events of circumstances described in Section I.2.1, Default by the Contractor.

Fiscal Year - any of the one-year periods beginning September 1st and ending August 31st, which are used for annual budgetary purposes by the State of Texas.

Inmate - a person under supervision or custody of the Department.

Material Failure - the failure of a party to fulfill one or more obligations essential to achieving the purpose of this Contract.

Non-Appropriation - failure by the Texas Legislature, as part of its budgetary process, to appropriate money to be used for the Payments due hereunder.

Payment - the amount(s) agreed to be paid by the Department to the Contractor for Services provided under this Contract.

PD - a Texas Department of Criminal Justice Personnel Directive.

Quarter - the periods that relate to the Department’s Fiscal Year, beginning September, December, March, and June.

Respondent - an individual or entity that submits a Response to this Request for Offers (RFO). The term includes anyone acting on behalf of the individual or entity, such as an agent, employee, or representative.

Service Commencement Date - the date on which the Contractor shall begin providing Services pursuant to this Contract.

Service - delivery of requirements in accordance with the terms and conditions of this Contract.

TBCJ - the Texas Board of Criminal Justice.

Working Day - a weekday, unless it is a holiday observed by the Department.

A.2 SERVICE SPECIFIC DEFINITIONS

24X7 - 24 hours a Day, seven Days a week.

Artificial Intelligence (Al) - systems capable of: (A) perceiving an environment through data acquisition and processing and interpreting the derived information to take an action or actions or to imitate intelligent behavior given a specific goal; and (B) learning and adapting behavior by analyzing how the environment is affected by prior actions.

Business Hours - Monday through Friday, 8:00 a.m. to 5:00 p.m. Central Standard Time (CST), except for State of Texas observed holidays. However, Services may be required on holidays and Days for which skeleton crews are required.

CJI Data - data necessary for law enforcement to perform their missions including, but not limited to, biometric, identity history, biographic, property and case/incident history data, and any other data identified as Criminal Justice Information (CJI) under the Code of Criminal Procedure, Title 1, Chapter 66, Subchapter A and/or the Federal Bureau of Investigation Criminal Justice Information Services Security Policy (currently available at www.fbi.gov).

Confidential Information - data that must be protected from unauthorized disclosure or public release under the provisions of the Texas Public Information Act (also known as the Texas Open Records Act), judicial rulings, or contractual agreements. Such data may include, but is not limited to, social security numbers, taxpayer identification numbers, employer identification numbers, credit card numbers, personal identifying information (PII), sensitive personal information (SPI), and personal medical information.

http://www.fbi.gov/

Criminal Justice Information System (CJIS) - comprised of the Computerized Criminal History (CCH) System and the Corrections Tracking Systems (CTS) that provide law enforcement agencies with access to criminal justice information, such as criminal records, fingerprints, and other related data, as described in Code of Criminal Procedure, Title 1, Chapter 66, Subchapter A.

Compromised - when something is made vulnerable to attack or misuse by unauthorized access, revelation, or exposure, or impaired or diminished in function. This may refer to an item that is weakened, damaged, or flawed.

Contractor Project Manager - the Contractor’s staff member dedicated to the Contract full-time from the Service Commencement Date through implementation, acceptance, and go-live.

DB2 - a relational database management system.

Deliverable (DEV) - a tangible item delivered to customers as an output of a project.

DIR - the State of Texas Department of Information Resources.

DRS - Digital Recording System.

DPS - the Texas Department of Public Safety.

IT - information technology.

Managed Access System - a contraband interdiction system that combats wireless device use in correctional facilities by capturing and dropping calls made from any contraband device.

Module - an independent portion of a software application which provides specific functionality. Each Module performs those procedures related to a specific process within a software package. Modules are normally separately compiled and linked together to build a software system. Single Modules within the application can normally be modified without requiring change to other Modules, so long as requisite inputs and outputs of the modified Module are maintained.

NCIC - the National Crime Information Center under the authority of the Federal Bureau of Investigation.

NIST - the National Institute of Standards and Technology.

OIG - the Office of the Inspector General.

OIG Project Manager - the OIG employee responsible for technical administration of this Contract through go-live.

PIN - Personal Identification Number.

Program Director - the person designated by the Contractor responsible for delivering Services under this Contract.

Program Specialist - the Department employee responsible for technical administration of this Contract after go-live.

Quality - the degree to which a product or Service satisfies stated or implied requirements.

Quality assurance focuses on process Quality to prevent mistakes and defects and avoid problems when delivering products or Services to customers. Quality control focuses on identifying and correcting product defects.

Redundancy - the incorporation of backup components or systems to ensure continuous operation in the event of a primary component failure.

Related Services - installation, maintenance, warranty, repairs, training, and other incidentals.

Relational Database Management System (RDBMS) - a system designed to manage and organize data in a relational model.

Resolution - restoring the system to full capacity.

Resolution Time - the period between the Contractor's receipt of a service request from the Department or OIG and completion of the maintenance Services required to return the affected systems to normal operations.

RFO - Request for Offers, this solicitation.

RMS - Records Management System (Crime Management System).

Security Incident - an occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of information or an information system; or constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Sensitive Information - sensitive data that is not protected by law from being disclosed or released under the Texas Public Information Act; however, it may still require an elevated level of protection and special precautions to ensure its accuracy and integrity.

Some information the Department maintains is deemed sensitive, as determined by the Department's standards and risk management decisions. Examples of "Sensitive Information" include, but are not limited to, the following:

A. The Department's operational information;

B. The Department’s personnel records;

C. The Department’s information security procedures;

D. The Department's internal communications; and

E. Comments.

Software as a Service (SaaS) - a method for delivering software applications, on demand, over the Internet. The Contractor hosts and manages the application software and underlying infrastructure, and handles any maintenance, such as software upgrades and security patching. Users connect to the application over the Internet, usually by a web browser on their phone, tablet, or personal computer.

TDCJ-ITD - the TDCJ-Information Technology Division.

TDCJ-ITD Directives - written policies, procedures, standards, guidelines, directives, and manuals of the Information Technology Division, which are in effect or as may be amended from time to time, which the Information Technology Division has referenced or has made available to the Contractor and with which the Contractor has an affirmative obligation to be and remain familiar.

TX-RAMP - the Texas Risk and Authorization Management Program which provides a standardized approach for security assessment, certification, and continuous monitoring of cloud computing services that process the data of Texas state agencies.

696–IG–26–O012 Section B

SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS

B.1 SERVICES AND PRICES/COSTS

B.1.1 Services Being Acquired

The Contractor shall, in accordance with the terms of this Contract, provide all necessary personnel, hardware, software, training, licensing, implementation, storage, materials, supplies, and Services, and otherwise do all things necessary for, or incidental to, providing and supporting a cloud-based law enforcement Records Management System

(RMS).

B.1.2 Pricing Instructions

A. The Department anticipates the award of a firm, fixed-price Contract.

B. Respondents shall complete Section B.2, Pricing Schedule, according to the Services being provided.

C. In its pricing response, the Respondent shall include all costs of providing the Services required in Section C, Description/Specifications/Work Statement. The Respondent shall present a detailed budget and budget narrative for the implementation, operation, and management of the Software as a Service (SaaS).

D. The Respondent shall provide a detailed budget and budget narrative for each

Deliverable in Section B.2, Pricing Schedule.

E. The Respondent shall provide line-item detail of all products, Services, training, storage, licensing, and information on the anticipated frequency of recurring service costs.

F. The Respondent shall not include any pay-per-user licensing arrangements or restrictions.

696–IG–26–O012 Section B

B.2 PRICING SCHEDULE

B.3 ALLOWABLE COSTS

The proposed budget shall include only costs that are reasonable, necessary, and allowable under state statutes, Department Policy, and federal cost standards. The Department shall make the final decision on the allowance or acceptability of a cost.

B.4 NON-ALLOWABLE COSTS

The proposed budget shall not include costs that are not allowed by the State or any authorized agency, statute, policy, or procedure. Types of non-allowable costs may include, but are not limited to, alcoholic beverages, bad debts, fundraising, political lobbying, and tobacco products.

Deliverable Name Price

Project management plan

Implementation plan

Analysis and development

Integration plan RMS application configuration and integration test release including technical, functional, and design documentation.

Property and Evidence Module configuration and integration test release including technical, functional, and design documentation.

National Incident Based Reporting (NIBRS) Module configuration and integration test release including technical, functional, and design documentation, and the successful delivery of data to the Department of Public Safety (DPS).

Texas Law Enforcement Telecommunication System (TLETS) Module configuration and integration test release including technical, functional, and design documentation.

Training materials, user manuals, and train-the-trainer

• Cost of potential additional training sessions ____________

Completion of functionality for importation of data from existing Texas Department of Criminal Justice (TDCJ) data

Deployment to production environment and final acceptance

Migration of existing Office of the Inspector General (OIG) data into the RMS

Maintenance and support plan

Project closure

Total

Recurring cost for SaaS after project closure

Frequency of recurring costs (e.g., monthly, yearly)

Total Cost Response for Base Period and All Option Years

696–IG–26–O012 Section C

SECTION C - DESCRIPTION/SPECIFICATIONS/WORK STATEMENT

C.1 BACKGROUND

A. The Texas Board of Criminal Justice (TBCJ) - Office of the Inspector General (OIG) is the primary law enforcement and investigative entity of the Texas Department of Criminal Justice (Department). OIG investigators are certified Texas peace officers with statewide jurisdiction who investigate allegations of criminal activity and misconduct that impact TDCJ programs, personnel, and resources, including waste, fraud, and abuse. The OIG furthers its law enforcement efforts through task force partnerships with the Federal Bureau of Investigation (FBI), the United States Drug Enforcement Administration (DEA), and the United States Marshals Service. These partnerships bind a commitment of sharing information and reinforce a law enforcement allegiance when dealing with escapees, fugitives, parolees, and organized prison gangs. The OIG currently has a staff of 172 Peace Officers and 50 civilian personnel. The OIG does not operate a dispatch center or jail.

B. The OIG currently uses the Sam Houston State University (SHSU) Police Research

Center - Criminal Research, Information Management and Evaluation System (CRIMES). Although this system has been a worthy tool to manage investigations performed by the OIG, this system has become obsolete based on federal and state standards, as well as current operational requirements. The goal of this Contract is to implement a new RMS to enhance and modernize the investigative capabilities required by today’s ever-changing landscape.

C. The Department is administering the procurement process for this Request for Offers

(RFO) at the direction of the OIG and any actions taken by the Department are in service of the OIG’s objectives.

C.2 COMPLIANCE WITH APPLICABLE RULES, REGULATIONS, POLICIES,

PROCEDURES, AND LAWS

A. The Contractor shall provide Services to the OIG that are in compliance with all applicable local, state, and federal laws, whether now in effect or hereafter effected or implemented; all relevant federal and state financial cost principles and audit requirements; and all rules, policies, and procedures established by the OIG, the Department, and the TBCJ related to these Services.

B. The Contractor’s RMS must meet federal and state information security regulations and standards, to include securing personally identifiable information. The RMS shall meet Criminal Justice Information System (CJIS), National Crime Information Center (NCIC), and the United States Department of Justice compliance requirements. Where not specifically required in this Contract, the Contractor shall follow industry standards, as applicable, to include the National Institute of Standards and Technology (NIST), in relation to information security and/or cybersecurity.

C. The Contractor shall not deviate from applicable OIG or Department Policies and procedures in the provision of Services without the prior written approval of the OIG- Inspector General or designee. Such approval shall not be unreasonably withheld by the OIG.

D. The Department shall notify the Contractor of all changes in, or additions to, such policies and procedures, after which time the Contractor shall comply with the policies and procedures contained therein, unless the OIG-Inspector General, or designee, approves in writing a deviation from such policies and procedures.

E. The Contractor’s written requests for deviations from said policy statements shall originate from the Contractor’s Authorized Representative or designee and shall be forwarded to the OIG-Inspector General or designee. The Contractor’s written requests for deviations shall specify the deviation, with justification, and reference the policy number/procedure, section, and paragraph. Unless a deviation requested by the Contractor is specifically approved in writing by the OIG-Inspector General, or designee, the Contractor shall comply with OIG and Department Policies and procedures. A Contract award shall not imply approval of a policy/procedure deviation.

Any deviations previously granted by the OIG or the Department under a separate or previous contract do not apply to this Contract.

F. When differences between applicable standards exist, the higher standard, as defined by the OIG will prevail. The specified requirements and standards will serve as the benchmark for monitoring the Contractor’s performance under this Contract.

G. Applicable local, state, and federal laws, rules, and regulations include, but are not limited to: the Civil Rights Act of 1964; Title VII of the Civil Rights Act of 1964; Section 504 of the Rehabilitation Act of 1973; the Age of Discrimination in Employment Act;

the Immigration Reform and Control Act of 1986; Code of Federal Regulations, Title 42, Part 2 (regarding information about drug and alcohol abuse Inmates); the Environmental Protection Department (EPA) Rules and Regulations; Texas Code of Criminal Procedure; Texas Health and Safety Code, Chapters 85, 595, and 611; Texas Administrative Code, Title 25, Chapter 403, Subchapter K (regarding Inmate identifying information); the Americans with Disabilities Act (ADA) of 1990; the Civil Rights Act of 1991; the Occupational Safety and Health Act (OSHA) of 1970; Texas Family Code, Section 231.006; Texas Government Code, Chapters 492-508, 783, 2254, 2259, and 2260; the Uniform Grant Management Standards (UGMS); and any and all rules, policies, and procedures established from time to time by the OIG and the TBCJ.

C.2.1 Data Requirements

A. Data Ownership

All data produced, created, obtained, maintained, recorded, retained, uploaded, stored, or archived as a part of the RMS shall be the property of the OIG, unless exclusively specified by the OIG.

B. Data Usage

1. All information and databases associated with the RMS are the property of the OIG and shall not be given, sold, or used for any other purpose outside of the RMS without express written consent from the OIG.

2. OIG information, data, and information resources should only be used for the purposes of this Contract.

3. Third party usage of data is prohibited unless authorized by the OIG-Inspector General or designee, the Data Management Office (DMO), and the Office of the Chief Information Security Officer (OCISO).

C. Data Disclosure

1. The Contractor will not disclose OIG data or content or any information about the OIG, except as compelled by a court or administrative body or required by any law or regulation.

2. The Contractor will give notice to the OIG if any disclosure request is received for

OIG data or content so the OIG may file an objection with the court or administrative body.

3. The Contractor has no authority to respond to public information requests.

D. Data Classification/Record Retention

1. In accordance with Texas Government Code 2054.161, all data produced from or used in this RMS shall be available for classification as determined appropriate for data security and applicable retention requirements under Texas Government Code Sections 441.185 and 441.187 for each classification.

2. The Contractor shall maintain and dispose of data, information, and records in accordance with the retention requirements specified by the OIG and using established and approved techniques and methods based on the level of confidentiality.

3. The Contractor shall provide certification of its destruction of any Department data per NIST Special Publication 800-88, (https://csrc.nist.gov/publications/detail/sp/800-88/rev-1/final), Guidelines for Media Sanitization, and CJIS Security Policy, current version in effect as of the Response submission deadline, and any subsequent updates published during the Contract Term, on media protection and media sanitization.

E. Data Protection/Data Privacy

The Contractor shall ensure the protection and privacy of OIG information, data, and information systems by:

1. Implementing security controls based on the classification of the data, as determined by the OIG, that are proportionate to the OIG's risk under the Contract, based on the sensitivity and confidentiality of the data.

2. Complying with the information security requirements and the individual OIG information policy requirements maintained in the Information Resources Security Program (IRSP), OIG's security policy based on NIST 800-53 and the security requirements within this Contract.

3. Adhering to standards, privacy requirements and regulations for confidential, sensitive, and regulated data such as:

a. Personal Identifying information (PII) or Sensitive Personal information (SPI) as defined in the Texas Business and Commerce Code 521.002(a)(1) and 521.002(a)(2).

b. Student education data as defined under the Family Educational Rights and Privacy Act (FERPA) 20 U.S.C. § 1232g; 34 CFR Part 9.

c. Federal Tax Information (FTI), Federal Insurance Contributions Act (FICA), tax information per Internal Revenue Service (IRS) Publication 1075 (IRS-1075).

d. Payment card information data as defined in the Payment Card Industry Data Security Standard (PCI DSS) v2.0.

e. Public Health Information (PHI) as defined under the Health Insurance Portability and Accountability Act (HIPAA) 45 CFR Parts 164.

f. CJIS Information as defined under Code of Criminal Procedure, Title 1, Chapter 66, Subchapter A and ensure that all components of and data used or created as a part of the RMS is compliant with the FBI CJIS Security Policy found on the DPS website, https://www.dps.texas.gov/.

g. Biometric identifiers, global positioning system technology, or individual contact tracing defined under Biometric Standards by National Science and Technology Council (NSTC), NIST, and American National Standards Institute (ANSI) and Texas Government Code, Chapter 560.001, 560.002, 2062.001, 2062.002.

h. Biometric authentication information as required in NIST SP 800-63-3 Digital

Identity Guidelines.

4. If applicable, comply with all applicable federal, state, and local and European privacy laws and practices to include General Data Protection Regulation (GDPR).

5. If applicable, cloud Services must be Texas Risk and Authorization Management Program (TX-RAMP) certified. The OIG will determine applicability and certification level based on the data classification and impact level of the information resource and in consultation with the Department of Information Resources. The TX-RAMP Program Manual can be found on the DIR website, https://dir.texas.gov/.

F. Data Encryption

All OIG data, information or records shall be encrypted in transit and at rest according to the OIG IRSP and the OIG's security policy based on NIST 800-53.

G. Data Quality

1. The Contractor shall incorporate data Quality management by:

a. Ensuring that data is sufficiently reliable and consistent for each use case.

b. Verifying that both existing and new data meets data Quality standards.

c. Setting up data management processes that block low Quality data from entering the system and ensuring data meets basic data check rules.

d. Ensuring data accuracy and data Quality is consistent across the system.

2. The RMS shall support:

a. Structured data (i.e., data that represents well in tabular format);

b. Unstructured data (e.g., documents, images, and videos); and

c. Semi-structured data that combines the preceding two types.

3. If the data format is audio or video, the data must be maintained, retained, and accessible at the same audio or video quality at which it was recorded.

4. If requested by the OIG, the Contractor shall provide reports for data Quality standards, which include identifying key information and missing, incomplete, and duplicate records, for testing and validation purposes.

H. Availability of Data

1. Data, information, and records should be available from the Contractor within the specified timelines, as specified by the OIG (e.g., real-time, batch, archived.)

2. The OIG reserves the right to request data, information, or records from the Contractor, at no cost to the OIG. The data, information, or records shall be provided to the OIG via a secure method.

I. Data Architecture

If requested by the OIG, the Contractor shall provide:

1. A data architecture design document which describes OIG's data assets and provides a blueprint for creating and managing data flows, entry points, interfaces, and environment names.

2. A data management plan to include technical details, such as operational databases, data lakes, data warehouse, and servers that are best suited to implement the data management strategy.

3. Data models (conceptual and logical) during the design phase.

J. Data Storage

1. If this Contract is for Cloud Computing Services, as defined by the Texas

Government Code Section 2054.0593(a), the Contractor shall:

a. Disclose the name of the cloud service provider, and the location(s) of the data centers used to store data, information, and records.

b. Not store data, information, or records outside the continental United States without express written consent from the OIG.

2. The RMS shall allow access to long-term storage for data retrieval from within the solution.

3. The RMS shall have the ability and capacity to prevent inactive cases from negatively affecting the performance of active cases.

K. Disaster Recovery

The Contractor shall:

1. Replicate data across mirrored databases to ensure high availability.

2. Ensure there is a scheduled data backup frequency based on its criticality and how often it changes.

3. Plan and test a disaster recovery strategy to ensure data can be quickly restored after a data loss incident.

L. Data Sharing

External information systems are not permitted to the internal network without the appropriate monitoring and/or approval by the appropriate approving authority in accordance with an accompanying Memorandum of Understanding (MOU) and Interconnection Security Agreement (ISA), if appropriate.

M. Data Transition

1. Upon termination of this Contract, the Contractor, if requested by the OIG, shall transfer all data, information, and records to the OIG, on the agreed upon acceptable secure methods of return, destruction, or disposal and within the time specified by the OIG.

2. At the end of the contract the Contractor shall provide data transfer to the OIG of all OIG property contained, controlled, collected, gathered, or stored by the vendor related to RMS. Said information shall be provided to the OIG within 30 Days of Contract termination.

N. Artificial Intelligence/Machine Learning

1. The Contractor agrees not to use Artificial Intelligence (Al) in the performance of this contract without prior written consent of the OIG. AI or Machine Learning (ML) may be used only for purposes limited to analytics-driven trend analysis and resource optimization, including predictive analytics, subject to prior written consent of the OIG.

2. The Contractor shall disclose any Al used in any component of the RMS, in what capacity it is being used, and ensure that TDCJ policies and procedures regarding the use of Al are followed at all times. All predictive analytics or ML features must be documented and approved under OIG governance and operate within a documented model risk management framework addressing data integrity, bias mitigation, transparency, and ongoing monitoring.

C.2.2 Electronic Information Resource Accessibility Requirements

A. The TDCJ aims to comply with applicable federal and state laws governing accessibility when procuring digital products and Services:

1. Texas Government Code 2054.457, enacted in 2005, requires that all state agencies and institutions of higher education provide state employees and members of the public access to and use of electronic information resources.

2. 1 Texas Administrative Code 206 aligns state web accessibility standards with the federal regulations set forth in Section 508 of the Rehabilitation Act of 1973.

3. 1 Texas Administrative Code 213 enacted state standards for procurement, development, or usage of Electronic Information Resource (EIR) for people with disabilities and aligns accessibility standards with the federal regulations set forth in Section 508 of the Rehabilitation Act.

B. The Contractor shall provide an Accessibility Conformance Report (ACR) for all equipment and systems associated with this Contract based on the Information Technology Industry (ITI) Voluntary Product Accessibility Template (VPAT), the leading global reporting format for assisting buyers and sellers in identifying information and communications technology (ICT) products and services with accessibility features. Version 2 of the VPAT was expanded to include the leading ICT accessibility standards: Section 508 (U.S.), EN 301 549 (EU), and W3C/WAI WCAG.

Information on this can be found here: https://www.itic.org/policy/accessibility/vpat.

C.2.3 Information Security Requirements

A. All cloud Services and SaaS required as part of this Contract must comply with CJIS Security Policy, current version in effect as of the Response submission deadline, and any subsequent updates published during the Contract Term, and TX-RAMP requirements.

B. The Contractor shall ensure all contract staff performing Services under this Contract complete the required Department security and data security training at intervals determined by the Department.

C. The Contractor is responsible for following all federal and state laws as well as the

IRSP, the TDCJ security policy based on NIST 800-53.

D. If applicable, cloud services must be TX-RAMP Level 2 certified. The Department will determine applicability based on the data classification and impact level of the information resource and in consultation with the Department of Information Resources (DIR). TX-RAMP Program Manual can be found DIR’s website.

E. All Contractor staff, including any subcontractors, must complete the TDCJ's Cybersecurity Training Course if they require access to OIG systems or data.

F. All Contractor staff, including any subcontractors with access to OIG systems, data, or proprietary information, must agree to and sign the TDCJ EMPL3 form, Data Use and Non-Disclosure Agreement.

G. All deliverables within this Contract are subject to security vulnerability scanning by the TDCJ OCISO. Any vulnerabilities found must be corrected on a schedule based on the criticality of the vulnerability.

H. The TDCJ shall perform security penetration testing of the RMS as the Department deems necessary. Any shortcomings identified through the security penetration testing shall be resolved within 30 Days of the results being submitted in writing to the Contractor.

I. The Contractor shall furnish a recent independent report from a certified contractor for network and program security, noting that no vulnerabilities were found for all components of the RMS.

J. Each version of any mobile application or public-facing website that stores or processes confidential or sensitive information must undergo a security penetration test before going live. Any shortcomings identified during the testing must be resolved before the version goes live.

K. The Contractor shall notify the OIG within 24 hours of any supply chain compromises.

L. The Contractor shall notify the OIG ISO and TDCJ OCISO of a security incident, including but not limited to cybersecurity breaches or suspected cybersecurity breaches, within six hours of discovery.

M. The Contractor shall resolve a security incident within 30 hours.

N. At OIG's request, the Contractor shall submit the results of any assessments or audits to continuously monitor the Contractor.

O. The Contractor shall provide secure Internet Protocol (IP) communications by authenticating and encrypting each IP packet of a communication session for all components of the RMS.

P. The Contractor shall provide firmware updates, application updates, and security testing for all components of the RMS.

Q. The Contractor shall promptly install all relevant security patches and anti-virus updates on the Contractor's network.

R. The Contractor shall ensure that all OIG data, information, and records are encrypted in transit and at rest according to the TDCJ-IRSP and the TDCJ security policy based on NIST 800-53.

S. The Contractor shall dispose of any OIG data, documentation, tools, or system components using established and approved techniques and methods based on the level of confidentiality.

T. When any software in the system reaches end of life (EOL), the TDCJ OCISO must be notified in writing with a list of EOL components, including a remediation plan.

C.3 STATEMENT OF WORK

The Contractor shall deliver and support an RMS solution. The Contractor is responsible for all resources necessary to provide the Services in this Contract and the OIG will look solely to the Contractor for performance.

A. The Contractor shall be responsible for the entire RMS, including software, hardware, all components and parts, and maintenance support, unless otherwise agreed to in this Contract.

B. The Contractor shall outline the process to replace any aspect of the RMS that has failed.

C. The Contractor shall have complete end-to-end responsibility to ensure Quality operational service as required for full system functionality.

D. The Contractor shall customize technology as needed at the OIG's discretion to provide system security.

E. The Contractor shall ensure the RMS is able to meet specific performance measures as listed in Exhibit J.3, Compliance Standards.

F. The Contractor shall work with OIG personnel to monitor performance prior to the full deployment of the RMS. Before an assignment is considered complete, the OIG will conduct a Quality assurance review.

G. The OIG reserves the right to approve, reject, or request substitutions of equipment/component parts. During the Contract Term, responsibility for the operation, maintenance, and support of the entire RMS shall remain with the Contractor unless otherwise agreed to in this Contract. The data comprising the RMS, excluding any proprietary software systems used under license from the owner(s) of such intellectual property, shall be the property of the OIG.

C.4 FUNCTIONAL REQUIREMENTS

The Contractor shall ensure the RMS fulfills the functional requirements in this section.

A. Incident and Case Management

The RMS shall:

1. Handle complex criminal and administrative cases, including use of force and response to resistance incidents.

2. Allow users to create, view, edit, and archive incident reports.

3. Assign case numbers automatically.

4. Track the status of cases (e.g., open, active, closed, suspended).

5. Attach digital evidence (e.g., photos, documents, videos).

6. Record arrest details (e.g., charges, time/date, location).

7. Manage warrants, including issuance, service, arrest, and returns.

8. Identify duplicate complaints or incidents to prevent separate investigators from creating duplicate cases on the same complaint.

B. Evidence and Property Management

1. Have an efficient evidence Module supporting barcode or radio-frequency identification (RFID) to manage physical and electronic evidence, including collection, storage and security, chain of custody tracking, search and retrieval, inventory management and inspection, and reporting capabilities.

2. Contain advanced multimedia support for body-worn camera footage and other digital evidence with tagging ability.

3. Log collected evidence.

4. Schedule evidence destruction or return.

5. Capture or create crime scene video and sketches.

C. Field Reporting/Mobile Access

1. Allow officers to write and submit reports in the field.

2. Support offline capabilities, including interoperability and integration with third-party applications.

3. Provide offline data capture and collection workflows with connected synchronization when network connectivity is unavailable to reduce the need for paper-based data collection and manual workflows.

4. Provide voice-to-text or digital dictation support.

D. Records Search and Retrieval

1. Provide a quick search option to search records by name, incident number, date, and other basic demographics, as well as an advanced search option based on any combination of demographics including, but not limited to, state identification (SID) number, TDCJ number, name, date of birth (DOB), race, sex, social security number (SSN), FBI number, driver license number, passport number, court case number, and uniform case number, to retrieve all TDCJ numbers associated with those personal demographics, including active and inactive Inmates and Clients on supervision.

2. Provide full audit trails for all Modules to log all system activities for accountability and compliance.

3. Integrate with internal and external systems, such as national or state databases (e.g., NCIC, NIBRS), in a manner that precludes the storage of duplicate data.

4. Be compliant with the DPS-NIBRS, with the ability to report utilizing the most current preferred method of the DPS with pre-submission checks to prevent errors.

5. Include a data exchange development toolkit enabling authorized OIG personnel to develop future interfaces with external agencies and partners without requiring Contractor support.

E. Data Entry/Management

1. Be designed to minimize redundant data entry.

2. Have the ability to merge duplicate data entries (e.g., duplicate person).

3. Provide data validation with built-in checks for errors during entry to ensure accuracy and reduce rework.

4. Provide tools to redact sensitive details in a case before sharing.

5. Provide secure data sharing with prosecutors and other agencies.

6. Have the ability to load local offense and administrative offense into offense tables that are not included in state-provided offense datasets.

7. Have the ability to expunge cases, people, and data upon order of a court.

8. Have the ability to manage records retention schedules and delete data meeting retention requirements.

9. Receive uploads of and provide downloads of files, data, or attachments that are compatible with widely used, non-proprietary industry standard formats, as agreed to by the OIG.

10. Validate data entries based on parameters such as data type, range, and format, and not allow invalid data entry values.

11. Allow the OIG to add custom validation fields.

12. Allow authorized OIG staff to configure default input values.

13. Allow data capture by other modes of authorized input from external data-capturing devices, such as card scanners, Quick Response (QR) scanners, barcode readers, and similar technology for tracking.

14. Be capable of adding support for new data capture technologies.

F. Master Indexes

1. Use Person, Vehicle, Location, and Organization indexes.

2. Use Unique IDs for tracking recurring entities across cases.

3. Support linking related cases, people, and incidents.

4. Use relationship mapping (e.g., known associates, spouse, friend, child) tied to suspects, victims, and witnesses.

5. Support the ability to set a person’s or entity’s role, or multiple roles, and type in an incident.

a. Person or entity roles in an incident include victim, suspect, witness, reportee, and named.

b. Person or entity types in an incident include Inmate, parolee, employee, contractor, volunteer, intern, civilian, and organization.

6. Support linkage of related records connecting suspects, victims, witnesses, and evidence to a case.

7. Provide the ability to create and modify staff identification information to include office location, position title, position ID, staff name, supervisor ID, phone number, currently employed, date assigned, inactive status, date inactive, and staff user ID.

G. Workflow, Task Management, and User Interface

1. Support the processes required to maintain OIG and Department document templates, image and store documents, and address archival requirements levied by the OIG, the Department, and/or the State.

2. Provide customizable workflows to fit agency-specific needs, such as streamlined workflows that enhance interagency collaboration and supervisor approval workflows.

3. Contain supervisory management tools for tracking investigations, assigning tasks, managing case progress, approving cases, and tracking case status.

4. Generate automated alerts and/or reminders for follow-up actions and notifications (e.g., flash notices, overdue tasks/workflow notifications, generated emails).

5. Provide alerts for case inactivity, evidence destruction, and other agency tasks.

6. Support case reassignment and hand-off tracking.

7. Provide tools to redact…