ESBD_403231_1742240021956_304-26-0364RAG RFO ASPG SW Maintenance and Related Services.pdf

RFO # 304-26-0364RAG: [ASPG Software Maintenance and Related Services] Page 1 of 41 Rev. 9/8/2023

Texas Comptroller of Public Accounts

Glenn Hegar, Comptroller

Request for Offers Advanced Software Product Group (ASPG) Software Maintenance and Related Services

RFO No. 304-26-0364RAG

March 17, 2025

Anticipated Schedule of Events

March 17, 2025 Issuance of RFO

March 24, 2025 Deadline for Submission of Questions (2:00 p.m., CT) March 27, 2025 Release of Official Responses to Questions

(or as soon thereafter as practical) April 7, 2025 Deadline for Submission of Offers (2:00 p.m. CT)

Late Offers will not be considered September 1, 2025 Services Commencement Date

(or as soon thereafter as practical)

RFO # 304-26-0364RAG: [ASPG Software Maintenance and Related Services] Page 2 of 41 Rev. 6/27/23

Table of Contents

I. Summary

II. Specifications

A. Introduction

B. Background

C. Definitions and Acronyms

D. Scope of Services

E. Contract Resulting From This Solicitation; Order of Priority

F. Warranty of Performance

G. Security Incident Notification

H. Insurance and Bonds

I. Criminal Background Investigation

J. Contract Term

K. Invoice Acceptance Criteria

L. Payments

M. Discounts

N. PO Addition and Deletion

O. HUB Subcontracting Plan Information

P. Respondent Documents

Q. Respondent Exceptions

R. Respondent’s Past Performance

III. Offer Submission Requirements

A. Delivery of Offer

B. Offer Content and Format

IV. Mandatory Price Sheet

V. Standard Terms and Conditions

VI. Execution of Offer

VII. Conflict of Interest/Disclosure Statement

VIII. Nondisclosure Agreement

IX. Confidential Treatment of Information Acknowledgment

X. Certification Regarding Public Nature of the Offer

XI. Respondent Exceptions Response Template

RFO # 304-26-0364RAG: [ASPG Software Maintenance and Related Services] Page 3 of 41

I. Summary

1. Type of Solicitation: Request for Offers (RFO)

2. Issuing Office: Texas Comptroller of Public Accounts (CPA) Procurement Section Room 300, Attn: RFO No. 304-26-0364RAG 111 E. 17th Street Austin, Texas 78774

OR Texas Comptroller of Public Accounts Procurement Section Attn: RFO No. 304-26-0364RAG P.O. Box 12050 Austin, Texas 78711-2050

3. Additional Requirements/Qualifications: N/A

4. Responses to RFO: Sealed Competitive Offers

5. Deadline for Offers: In Issuing Office No Later Than:

April 7, 2025; 2:00 p.m., Central Time (CT)

6. Initial Contract Term: September 1, 2025 to August 31, 2026

7. CPA Optional Contract Terms: September 1, 2026 through August 31, 2027 September 1, 2027 through August 31, 2028 and September 1, 2028 through August 31, 2029

8. CPA Contact Person for this RFO: Rene Gonzales, CTCD Email: bidcpa@cpa.texas.gov

9. Offers Submitted by Email: Required; See Section III, Part A

10. Offers Submitted by Fax: Not Accepted

11. Pre-Offer Conference: N/A

12. Pre-Offer Inspection: N/A

13. Letters of Intent to Submit an Offer: N/A

14. RFO Addenda: Notices of changes to items directly impacting the original RFO or solicitation process will be posted on the Electronic State Business Daily (ESBD) located at: http://www.txsmartbuy.com/esbd. CPA will post any amendment to this solicitation on the ESBD as an RFO Addendum. It is the responsibility of an interested party to check the ESBD for updates to this RFO before submitting an Offer. Each Respondent is solely responsible for verifying CPA’s receipt of its questions, if applicable, and its Offer by the deadlines specified in this RFO.

15. Questions and Answers: Questions regarding this RFO must be in writing and must be submitted to the CPA Contact Person specified in Part 8, no later than March 24, 2025; 2:00 p.m. CT. Telephone inquiries will not be accepted.

Questions may be submitted by email to the email address specified in Part 8. CPA intends to post answers to the questions received on the ESBD on March 27, 2025, or as soon thereafter as practical.

16. Respondent Presentations: N/A mailto:bidcpa@cpa.texas.gov http://www.txsmartbuy.com/esbd

RFO # 304-26-0364RAG: [ASPG Software Maintenance and Related Services] Page 4 of 41

17. Evaluation of Offers. Offers will be evaluated under the Best Value Standard (Section 2157.003 of the Texas Government Code):

Criteria Weight Respondent’s Past Performance, Qualifications & Experience 20% Compliance with CPA Specifications 50% Cost 30% Total: 100%

As applicable, the factors listed in Sections 2155.074, 2155.075, 2156.007, and 2157.003 of the Texas Government Code shall also be considered in making an award.

18. Electronic Offers Only. Due to changed building access restrictions, Respondents will not be permitted to hand deliver

Offers to the Issuing Office. Respondents are required to submit Offers electronically via email in accordance with Section III, Part A.

19. Contact with CPA Staff: Upon issuance of this RFO, employees and representatives of CPA, other than the CPA Contact

Person identified in Part 8, will not discuss the contents of this RFO with any Respondent or its representatives. Failure of a Respondent or any of its representatives to observe this restriction may result in disqualification of any related Offer. This restriction does not preclude discussions between the parties to conduct business unrelated to this procurement or to obtain assistance completing Historically Underutilized Business (HUB) forms required by this RFO.

RFO # 304-26-0364RAG: [ASPG Software Maintenance and Related Services] Page 5 of 41

II. Specifications

A. Introduction

The Texas Comptroller of Public Accounts (CPA), an agency of the State of Texas, issues this RFO to solicit Offers from qualified vendors for Advanced Software Product Group (ASPG) Software Maintenance and Related Services, as described in this Section II and in this RFO (“Services”). CPA’s objective is to obtain the Services that represent the best value for CPA and the State of Texas, according to the terms and conditions of this RFO.

CPA anticipates making a contract award to one (1) Successful Respondent for the Services. CPA reserves the right not to award a Contract for the performance of all or part of the Services. This RFO is not exclusive and CPA reserves the right to issue additional solicitations regarding the Services or similar services at any time. All Respondents are encouraged to offer their best pricing at all times.

All costs associated with the Services must be included in the Respondent’s Offer. Offers that do not meet all of the requirements or contain all of the required documentation specified in this RFO may be rejected as non-responsive.

CPA understands that the requested items in this RFO may be proprietary to one vendor under Section 2155.067 of the Texas Government Code; however, CPA strongly encourages Offers from all qualified Respondents that may be able to provide the Services.

B. Background

CPA’s software portfolio includes perpetual licenses for ASPG Software. The existing contract for Software Maintenance and Technical Support Services for ASPG MegaCryption Software used by CPA will expire August 31, 2025.

CPA has identified a continuing need for Software Maintenance and Technical Support Services for the ASPG Licensed Software used by CPA and seeks to meet this need through a contract resulting from this RFO.

CPA’s current environment is IBM z15 T01 8561-504 (2858 MIPS/353 MSU).

Table 1: Mainframe Capacity Schedule represents CPA’s existing and anticipated mainframe capacity schedule.

Table 1: Mainframe Capacity Schedule Projected Date MACHINE MIPS* S/W MSUS*

Sept. 2025 IBM z15 T01 8561-504 2858 353 Nov. 2025 IBM zNext TBD TBD

*Capacity ratings based on November 2022 Cheryl Watson’s z/OS 2.4 IBM z CPU Chart.

C. Definitions and Acronyms

• Award Date. The Award Date is the earlier of the date an authorized representative of CPA (1) issues a Purchase Order (PO) or (2) signs a formal, written agreement.

• Contract. The agreement, if any, described in Section II, Part E (Contract Resulting from this Solicitation/Order of Priority).

• Error Correction. The correction of software malfunctions due to development, coding, or configuration issues that prevent the software application from operating as designed.

• Fiscal Year. A twelve month financial period. The State of Texas and CPA’s Fiscal Year is September 1 of one year through August 31 of the following year.

• IP Rights. All intellectual property rights, including copyrights, patents, trade secrets, trademarks, and other proprietary rights that are embedded in or used in connection with the Licensed Software and the Licensed Software Documentation.

• Licensed Software. The version of the software application(s) provided or supported under the Contract and any released Software Upgrades, Software Updates, Software Enhancements/Releases, Software Patches/Fixes, Error Corrections, and customizations of such version.

• Licensed Software Documentation. The complete set of operating manuals necessary to enable CPA to properly install and use the Licensed Software, including but not limited to all updates, revisions, and corrections to the manual.

RFO # 304-26-0364RAG: [ASPG Software Maintenance and Related Services] Page 6 of 41

• Offer. A response to this RFO.

• Respondent. Any person or entity that submits an Offer.

• Services. All of the Software Maintenance and Technical Support Services, Licensed Software Documentation, and other items listed in this RFO. The term includes, but not is not limited to, fees, shipping, freight handling, and any other services associated with Successful Respondent’s performance under any contract resulting from this RFO.

• Software Enhancement/Release. A change to a software application, intended to increase functionality, productivity, compatibility, and/or improve the user interface.

• Software Patch/Fix. Addition to a piece of code, usually as an immediate remedy to an existing software application error or defect. A software patch or fix is usually a temporary measure until a more permanent solution is implemented with a Software Enhancement, Software Release, and/or version update.

• Software Update. Any (a) commercially available versions of the Licensed Software with a version number designated to the right of the decimal point such as 1.1, 1.2, 1.3, etc., and (b) any subsequent variation of the Licensed Software which provides essentially the same functionality and accomplished substantially the same tasks as the Licensed Software but which the software publisher releases under a different name or label.

• Software Upgrade. A commercially available newer version of the Licensed Software typically designated by the number to the left of the decimal point such as 1.0, 2.0, 3.0, etc.

• Successful Respondent. The Respondent awarded a Contract, if any.

D. Scope of Services

D.1 General

a) Successful Respondent shall provide to CPA the Software Maintenance and Technical Support Services listed in Price Schedule 1, Section IV (Mandatory Price Sheet) in accordance with the terms and conditions of this RFO.

b) Successful Respondent shall provide to CPA the Optional Features, Products or Services, if any, listed in Price Schedule 2, Section IV (Mandatory Price Sheet) that are accepted by CPA.

c) CPA shall, in accordance with CPA policies and procedures, provide Successful Respondent reasonable access to the Licensed Software and CPA systems, as applicable, to perform Software Maintenance and Technical Support Services required under the Contract.

d) Unless Respondent’s Offer clearly specifies otherwise, Respondent’s pricing for the Services includes all Software Maintenance and Technical Support Services through all CPA hardware upgrades, if any, during the Contract Term.

D.2 Software Maintenance and Technical Support Services.

a) General

1) Successful Respondent shall provide Software Maintenance and Technical Support Services as defined in this RFO for all the Licensed Software. Software Maintenance and Technical Support Services includes, but is not limited to, the following: telephone and on-line support, Error Corrections, Software Updates, Software Upgrades, Software Patches/Fixes, Software Enhancements/Releases, extensions, latest features, performance improvements, and Licensed Software Documentation applicable to and/or necessitated as a result of Services delivered under the Contract.

2) Successful Respondent shall provide qualified personnel to be available to CPA by telephone, email, or website for the reporting of problems or issues with the Licensed Software or Software Maintenance and Technical Support Services. All Software Maintenance and Technical Support Services must be unlimited during the term of the Contract.

3) Successful Respondent shall provide a help-desk toll-free telephone number, email, or website for the reporting of problems or issues with the Licensed Software. Successful Respondent shall provide support twenty-four (24) hours per day seven (7) day a week. Successful Respondent shall allow a maximum of ten

(10) authorized CPA contacts to report problems or issues to Successful Respondent’s help desk. Upon request of Successful Respondent, CPA will provide the list of authorized support staff.

RFO # 304-26-0364RAG: [ASPG Software Maintenance and Related Services] Page 7 of 41

4) Software Patches/Fixes and Software Updates must be accessed and initiated by CPA from the Successful Respondent’s online technical portal. Successful Respondent must send all Software Patches/Fixes release notifications to CPA’s software licensing email address listed on CPA’s purchase order.

b) Response Times

Successful Respondent shall respond to service requests in accordance with the priority and within the maximum response times listed in Table 2: Maximum Response Times. “Response Time” is defined as the period between Successful Respondent’s receipt of a service call from CPA and the time until Successful Respondent’s service technician responds with repair efforts underway. “Repair time” is defined as the timeframe for Successful Respondent to complete the Software Maintenance and Technical Support Services required to return the affected systems to normal operations. CPA, in its sole discretion, will determine the service priority reporting of problems or issues with the Licensed Software. In its Offer, Respondent must detail the Response Time for problem or trouble resolution of such service requests.

Table 2: Maximum Response Times

PRIORITY

LEVEL DESCRIPTION

MAX

RESPONSE

TIME

Priority 1 (P1) – Critical

a. Total outage or an outage of a critical component that renders the software unusable or unable to perform pending critical tasks.

b. Security issue that affects the production environment.

4 hrs.

Priority 2 (P2) – High

a. Performance degradation or diminished processing, capacity, or functionality that affects multiple users within the production environment.

b. Issue that affects fulfillment of a pending deadline or causes staff to be idle.

12 hrs.

Priority 3 (P3) – Medium

a. Performance issue related to non-production environments, non-critical issue that is time sensitive, or non-impacting issue requiring additional troubleshooting.

b. Issue that does not affect current work but will affect customer’s ability to perform work within one business day.

c. Frequent issue of minor importance yet obviously affecting work efficiency.

48 hrs.

Priority 4 (P4) – Low

a. Request for information prior to diminished processing, capacity, or functionality.

b. Low frequency error of marginal importance.

c. Minor problem that requires research, testing, or cooperative effort to resolve.

72 hrs.

c) Escalation Protocol In its Offer, Respondent must propose for CPA’s consideration an Escalation Protocol for collaboratively resolving issues encountered during the term of the Contract. The proposed Escalation Protocol must explain how issues or complaints are prioritized and resolved. The Escalation Protocol shall include (1) an organization chart addressing topics such as specific steps to be taken on top priority issues or disputes arising due to untimely response to system down or critical malfunction remedial repair requests and (2) any other top priority service requirements of the Contract that are not met.

D.3 CPA Data Security Terms.

D.3.1 CPA Data Safeguard Standards.

a. Defined Terms. The term “CPA Data” refers to CPA’s information as well as other entity information in the possession of CPA that is processed, stored, or transmitted by a computer. CPA Data includes all data that is generated by Successful Respondent in performance of a contract with CPA. The term “CPA Information System” refers to those devices, software, networks and related infrastructure that CPA owns, operates or has obtained for use to conduct CPA business. Devices include, but are not limited to, CPA-owned or managed storage, processing, and communications devices, as well as personally owned devices.

b. Access to CPA Data. Successful Respondent represents and warrants that it will implement, maintain, and use appropriate administrative, technical, and physical safeguards to preserve the confidentiality, integrity, and availability of CPA Data. Successful Respondent will not collect, access, use, disclose, or retain CPA Data other than as necessary to perform the services specified in a contract resulting from this solicitation or as otherwise authorized in writing by

RFO # 304-26-0364RAG: [ASPG Software Maintenance and Related Services] Page 8 of 41

CPA. Successful Respondent will restrict access to CPA Data to only those personnel who must have the information on a “need to know” basis. Successful Respondent will not use CPA Data, or any information derived from CPA Data, for its own benefit or the benefit of any other person or entity. Successful Respondent will not share CPA Data with its parent company or other affiliate without CPA’s express written consent.

c. Web-Based Remote Access to CPA Information Systems. Successful Respondent may use third-party web-based remote access connections to CPA Information Systems to provide support services under the following conditions:

1. CPA shall affirmatively initiate and accept Successful Respondent’s connections to CPA Information Systems.

2. CPA shall monitor Successful Respondent’s connections to CPA Information Systems during the Contract Term.

3. CPA shall terminate Successful Respondent’s connections to CPA Information Systems upon completion of the

Services.

d. Reserved.

e. Reserved.

f. Location of CPA Data. Successful Respondent shall ensure that CPA Data (i.e., primary and backup) remains, at all times, within the continental United States. Successful Respondent shall receive, process, transmit, and store all CPA Data within the continental United States. Successful Respondent’s point of access to CPA Data shall be within the continental United States.

g. Encryption Standards.

1. Successful Respondent shall encrypt CPA Data in transit and at rest. Data in transit means data is moving via email, in applications, or through browsers and other web connections. Data at rest (including data backups) means data is stored in databases, the cloud, removable media, or mobile devices.

2. Successful Respondent shall utilize encryption standards that are Federal Information Processing Standard (FIPS) 140-2 compliant or, upon the written approval of CPA’s Chief Information Security Officer, shall meet the intent of the standards as described in FIPS 140-2.

3. The minimum cryptographic algorithm used by Successful Respondent must be Advanced Encryption Standard (AES) 128 or higher (256 AES is preferred).

4. Successful Respondent shall encrypt CPA Data transmitted over a public or private network. CPA approved data encryption transmission protocols include the following: (1) SFTP (FTP over SSH), (2) FTPS (FTP over TLS),

(3) HTTPS (HTTP over TLS), and (4) virtual private network.

h. Reserved.

i. Auditable Information Security Framework. Successful Respondent shall secure its own and its third-party service providers’ systems (e.g., IT service provider, cloud service provider) in a manner consistent with an auditable information security framework e.g., National Institute of Standards and Technology (NIST), International Organization for Standardization (ISO) 27001.

j. Reserved.

k. Supply Chain Risk Management. Successful Respondent shall provide the contract manager designated by CPA

(“CPA Contract Manager”) a description of how it manages supply chain risks. Specifically, Successful Respondent shall describe its established agreements and procedures with entities involved in the supply chain for the notification of supply chain risks, compromises, and the result of assessments or audits. During the Contract Term, Successful Respondent shall provide CPA’s Contract Manager prompt, written notice of supply chain risks that impact the delivery of the products and services of the Contract. Examples of supply chain risks include supplier financial failure, production control/product quality, market supply and demand, labor disputes/shortages, cybersecurity threats, natural disasters. Successful Respondent shall notify CPA of a supply chain compromise and potential compromise in accordance with Section G Security Incident Notification.

l. Reserved.

m. Media Sanitization. Successful Respondent shall sanitize information system media, both digital and non-digital, in accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization) when CPA Data in the custody of Successful Respondent is no longer required to be retained by contract with CPA. Successful Respondent must maintain a record documenting each sanitization procedure that, at a minimum, includes the following information:

(i) date sanitization completed, (ii) description of the item(s), serial number(s), inventory control number(s), if applicable, and (iii) sanitization method used. No later than sixty (60) calendar days from Contract expiration or termination or as otherwise specified in the Contract, Successful Respondent must either (i) complete the sanitization

RFO # 304-26-0364RAG: [ASPG Software Maintenance and Related Services] Page 9 of 41 and submit via email to the CPA Contract Manager all sanitization documentation or (ii) submit a written statement via email to the CPA Contract Manager explaining the reason that destruction of CPA Data by Successful Respondent is technically impossible or impractical. Successful Respondent’s obligations set forth in this clause survive the termination or expiration of the Contract as long as Successful Respondent retains CPA Data.

n. Third-party service providers. It is Successful Respondent’s sole responsibility to ensure that its access and the access Successful Respondent grants to its service providers to CPA Data or CPA Information Systems does not result in unauthorized access to CPA Data or CPA Information Systems.

o. Reserved.

p. Reserved.

q. Reserved.

r. State Authorization and Risk Management Program (TX-RAMP). Successful Respondent shall obtain TX-RAMP certification in accordance with the Department of Information Resources (DIR) Program Manual. CPA requires the following TX-RAMP certification based-on Agency criteria:

1. _X_ None. Product is out of scope/low impact in accordance with the DIR TX-RAMP Manual.

2. __ Level 1 Certification. The product will administer Agency public data.

3. __ Level 2 Certification. The product will administer Agency sensitive, confidential, and/or regulated data.

Upon Contract award, Successful Respondent shall maintain compliance with TX-RAMP program requirements and certification throughout the term of the contract. Successful Respondent shall notify the CPA Contract Manager immediately if TX-RAMP certification is revoked or otherwise removed.

s. Reserved.

t. Reserved.

D.4 Liquidated Damages. In submitting an Offer, Respondent agrees that the measure of damages in the event of a default or breach of contract by Successful Respondent may be difficult or impossible to calculate. In the event Successful Respondent fails to perform Services or complete the obligations under the Contract in a timely manner, CPA may require Successful Respondent to pay, as liquidated damages and not as a penalty, an amount equivalent to two percent (2%) of the total cost for Services or obligations not completed as required by the Contract per calendar day of delay.

CPA may impose, but is not obligated to impose, these liquidated damages in lieu of any monetary damages available to CPA under the Contract or applicable law.

D.5 Optional Features, Products or Services. If Respondent believes there are additional features, products or services that would benefit CPA under this RFO, Respondent may describe such features, products or services in its Offer and include pricing for such features, products or services in Price Schedule 2, Section IV (Mandatory Price Sheet).

Optional Features, Products or Services are not scored as part of the evaluation process.

E. Contract Resulting From This Solicitation; Order of Priority.

Respondent’s Offer is a legal offer to contract based upon the terms, conditions, and specifications set forth in this RFO.

A Contract award by CPA may be by (1) valid PO or (2) a formal, written agreement between CPA and Successful Respondent. The Contract is effective as of the Award Date and will be between CPA and the Successful Respondent. The entire Contract between CPA and Successful Respondent shall consist of the following documents, which shall control in the following order of priority, except as otherwise provided in the formal signed agreement or PO: (1) the PO and PO Change Notices (POCN), if any, except for any provisions conflicting with item E(2); (2) the formal, signed agreement, if any; (3) this RFO; and (4) Successful Respondent’s Offer (collectively, the “Contract”).

F. Warranty of Performance

Successful Respondent represents and warrants that its performance under the Contract shall be conducted conscientiously in a professional and workmanlike manner to the full extent of Successful Respondent’s talents and capabilities with due diligence and in full compliance with the highest professional standards of practice in the industry applicable to the Services.

RFO # 304-26-0364RAG: [ASPG Software Maintenance and Related Services] Page 10 of 41

G. Security Incident Notification

Successful Respondent shall have policies and procedures for the effective management of Security Incidents, which shall be made available to CPA upon written request. Within twenty-four (24) hours of Successful Respondent’s discovery or reasonable belief that there has been an event which results in the accidental or deliberate unauthorized access, loss, disclosure, modification, disruption, or destruction of confidential CPA information (“Security Incident”), Successful Respondent shall provide notice to CPA by calling (800) 531-5441 EXT 34357. Until the investigation is complete, Successful Respondent shall submit, on a daily basis or as otherwise agreed by CPA, a written report via encrypted email to security.alerts@cpa.texas.gov that includes, at a minimum, the following:

• Date and time incident occurred,

• Date and time incident detected,

• Date and time incident contained,

• Address where incident occurred,

• Name of person(s) that discovered incident,

• Description of how Successful Respondent discovered incident,

• Type of CPA information involved,

• Description of the nature of the incident,

• Description of the steps Successful Respondent has taken or will take to investigate incident,

• Description of the steps Successful Respondent has taken or will take to mitigate any negative impacts of incident,

• Information technology involved (e.g., laptop, server, mainframe),

• Description of steps taken to preserve computer evidence and maintain chain of custody, and

• Description of corrective action Successful Respondent has taken or will take to prevent future incidents.

Successful Respondent shall coordinate all media or other breach notifications with CPA in advance of such notification(s), unless expressly prohibited by law. Subject to review and approval of CPA, Successful Respondent shall provide notice at its own cost that satisfies the requirements of applicable law to individuals whose information was compromised or likely compromised as a result of the Security Incident. If CPA, in its sole discretion, elects to send its own separate notice, then all costs associated with preparing and providing the notice shall be reimbursed to CPA by Successful Respondent. If Successful Respondent does not reimburse such costs within thirty (30) days of CPA’s written request, then CPA shall have the right to collect such costs. CPA reserves the right to conduct an independent investigation of any Security Incident, and should CPA choose to do so, Successful Respondent shall cooperate fully with CPA and assume responsibility at its own expense for making personnel, resources, and systems access available to CPA and CPA’s authorized representative(s).

H. Insurance and Bonds

Successful Respondent represents and warrants that it shall obtain and maintain the following coverages throughout the term of the Contract and that all coverages shall be with companies licensed in Texas with an “A” rating from A.M. Best Co. authorized to provide the required coverages:

• Blanket Employee Dishonesty Bond or Employee Dishonesty Coverage under a liability insurance policy with a minimum $25,000 for each individual who will provide Services. A rider or endorsement shall name the Texas Comptroller of Public Accounts as loss payee or additional named insured under the respective bond or policy;

• Standard Workers Compensation Insurance covering all individuals who will provide Services;

• Commercial General Liability Insurance: $1,000,000 minimum each occurrence limit; $2,000,000 minimum aggregate limit; and

• Professional Liability Insurance: $1,000,000 minimum each occurrence limit; $2,000,000 minimum aggregate limit.

All of the above policies and bonds shall contain endorsements prohibiting cancellation except upon thirty (30) calendar days’ prior written notice to CPA. No later than five (5) business days following the Award Date, and on an annual basis thereafter, Successful Respondent shall furnish proof to CPA of such coverage in the form of a Certificate of Insurance from Successful Respondent’s insurance carrier(s) indicating the required coverages. The certificate shall be addressed to CPA as the certificate holder. Successful Respondent shall submit proof of required insurance coverage via email, referencing the PO number, to the following email address: contract.administration@cpa.texas.gov.

I. Criminal Background Investigation mailto:security.alerts@cpa.texas.gov mailto:contract.administration@cpa.texas.gov

RFO # 304-26-0364RAG: [ASPG Software Maintenance and Related Services] Page 11 of 41

1. Criminal Background Investigation by Successful Respondent. Prior to an Assigned Personnel commencing Services under the Contract, Successful Respondent shall conduct a criminal background investigation and provide written notice via email to CPA’s Criminal Investigation Division of any Assigned Personnel that have any felony criminal conviction(s). If such information related to felony criminal conviction(s) for the Assigned Personnel changes during the Contract term, Successful Respondent shall provide written notice via email to CPA’s Criminal Investigation Division no later than three (3) business days after Successful Respondent’s discovery of such changed information.

Written notice to CPA’s Criminal Investigation Division shall be submitted to cid.analysts@cpa.texas.gov.

Successful Respondent’s exercise of due diligence in conducting the criminal background investigation shall include, at a minimum, the following: (1) compliance with Successful Respondent’s published policies and procedures for background and criminal conviction checks and (2) a comprehensive search of the public information portion of the Texas Department of Public Safety criminal conviction database located at:

https://publicsite.dps.texas.gov/ConvictionNameSearch/. If Successful Respondent asserts that a search of the Texas Department of Public Safety criminal conviction database is not appropriate for a particular Assigned Personnel, Successful Respondent must provide written notice via email to CPA’s Criminal Investigation Division that explains the proposed alternate approach for conducting the criminal background investigation.

For purposes of this clause, “Assigned Personnel” includes, without limitation, (1) all individuals provided by Successful Respondent under the Contract who will or may (a) be assigned as lead or key personnel; (b) provide Services on-site at CPA’s premises; or (c) access CPA information resources, i.e., the procedures, equipment, and software that are employed, designed, built, operated, and maintained to collect, record, process, store, retrieve, display, and transmit information, and (2) associated personnel, including consultants and contractors. At CPA’s written request, Successful Respondent shall replace Assigned Personnel with any felony criminal conviction(s).

Within five (5) business days of receipt of a written request by CPA’s Criminal Investigation Division during the Contract Term, Successful Respondent shall provide written notice to CPA’s Criminal Investigation Division of any Assigned Personnel that have any felony criminal conviction(s).

2. Criminal Background Investigation by CPA. At CPA’s discretion, CPA may conduct a criminal background investigation on Successful Respondent’s Assigned Personnel. Should any Assigned Personnel not be acceptable to CPA due to a finding of felony criminal conviction(s) as a result of the criminal background investigation, Successful Respondent shall replace such Assigned Personnel upon CPA’s written request or CPA may terminate the Contract.

3. Remedies. If CPA becomes aware that Successful Respondent provided false information, Successful Respondent fails to promptly notify CPA of changed information that related to felony criminal convictions, or Successful Respondents fails to replace Assigned Personnel as required by this Section, Successful Respondent shall be in breach of contract and CPA shall have the option to terminate the Contract without further obligation to Successful Respondent as well as pursue all other remedies and rights available to CPA under contract, at law, or in equity.

J. Contract Term

The initial term of the Contract shall be from September 1, 2025 through August 31, 2026 (“Initial Term”). CPA may, in its sole discretion, exercise the option to extend the Contract for up to three (3) additional, one-(1)-year periods. The optional additional periods are September 1, 2026 through August 31, 2027; September 1, 2027 through August 31, 2028;

and September 1, 2028 through August 31, 2029. To exercise the option to extend the term, CPA will notify Successful Respondent; such notice may be by PO or POCN issuance. The “Contract Term” is the Initial Term plus any additional periods. Notwithstanding the termination or expiration of the Contract, certain provisions that by their nature are intended to continue beyond the termination or expiration of the Contract, e.g., indemnification, confidentiality, dispute resolution, records retention, CPA Data safeguards, and rights to audit, shall survive the termination or expiration of the Contract.

K. Invoice Acceptance Criteria

Prior to payment, CPA will evaluate the provided products and/or Services using the following criteria and any additional acceptance criteria provided in the Contract:

1. The products and/or Services must meet all specifications and standards of performance in the Contract; and

2. The products and/or Services must comply with all published specifications.

L. Payments

Payment(s) to Successful Respondent will be based upon the schedule described in Section IV (Mandatory Price Sheet) and the Contract. CPA makes no express or implied warranty whatsoever that any minimum compensation or minimum quantity will be guaranteed under the Contract. Payment and remedies for late payment and non-payment shall be made mailto:cid.analysts@cpa.texas.gov https://publicsite.dps.texas.gov/ConvictionNameSearch/

RFO # 304-26-0364RAG: [ASPG Software Maintenance and Related Services] Page 12 of 41 in accordance with the Texas Prompt Payment Act, Chapter 2251 of the Texas Government Code. Generally, subject to several exceptions, the Texas Prompt Payment Act requires payments to be made no later than 30 days after the later of the date goods are received, services are completed, or an undisputed invoice is received. Payments will be made to Successful Respondent as provided in Section V (Provision for Direct Deposit or Warrant).

M. Discounts

If Successful Respondent provides a discount on the final Contract costs at any time during the term of the Contract, Successful Respondent will notify CPA in writing ten (10) calendar days before the effective date of the discount. CPA will send a POCN to Successful Respondent. If an early payment discount is available to CPA, then Respondent’s Offer must describe the early payment discount offered and the discount percentage that would apply to CPA’s early payment within ten (10), fifteen (15), twenty (20) or twenty-five (25) calendar days after receipt of a correct invoice. Successful Respondent shall also specify any applicable, early payment discount option(s) on each submitted invoice.

N. PO Addition and Deletion

CPA reserves the right, in its sole discretion, to add or delete products or Services during the Contract Term. All additions or deletions will be processed through CPA’s Procurement Section by POCN. The rate at the time of the addition or deletion shall be the same as the rate quoted in the Contract for the same model product or Service. The effective date of any addition or deletion will be no later than five (5) business days after receipt of CPA’s written notification of the addition or deletion. For this purpose, written notification may be by POCN sent by registered mail, regular mail, or email with confirmation receipt.

For any additions, CPA’s Procurement Section will provide a POCN to Successful Respondent. The total number of additions allowed to CPA is determined by the number CPA chooses to purchase. For any deletions, CPA’s Procurement Section will provide a POCN to Successful Respondent indicating the effective date of the deletion, the amount of the reduction or refund (if any), and sufficient details to identify the product or Service.

O. HUB Subcontracting Plan Information

In accordance with Section 2161.252 of the Texas Government Code and 34 Texas Administrative Code §20.285, each state agency that considers entering into a contract with an expected value of $100,000 or more over the life of the contract (including any renewals) shall, before the agency solicits bids, proposals, offers, or other applicable expressions of interest, determine whether subcontracting opportunities are probable under the contract. If subcontracting opportunities are probable, each state agency’s invitation for bids, requests for proposals, or other purchase solicitation documents with an expected value of $100,000 or more shall state that probability and require a State of Texas HUB Subcontracting Plan

(HSP).

CPA has determined that subcontracting opportunities are probable and requires Respondents to complete the HSP form located at: https://comptroller.texas.gov/purchasing/vendor/hub/forms.php.

For purposes of the HSP, CPA has determined that this procurement falls under the following category:

Special Trade Construction ____ Professional Services ____ Other Services _X___ Commodities ____

CPA has identified the possible subcontracting opportunities on the “Agency Special Instructions/Additional Requirements” portion of the HSP form set forth below:

https://comptroller.texas.gov/purchasing/vendor/hub/forms.php

RFO # 304-26-0364RAG: [ASPG Software Maintenance and Related Services] Page 13 of 41

- - Agency Special Instructions/Additional Requirements - -

The Texas Comptroller of Public Accounts is committed to increasing contracting opportunities with HUBs by contracting directly with HUBs or indirectly through subcontracting opportunities in compliance with Chapter 2161 of the Texas Government Code, and by requesting an HSP for contracts with an expected value of $25,000 to $99,999.

If a bid/proposal/offer to a solicitation with an expected value of $100,000 or more does not contain a completed HSP and supporting documentation, the bid/proposal/offer will be considered non-responsive and will be disqualified. After the Contract Award, Successful Respondent may be subject to debarment pursuant to Section 2161.253(d) of the Texas Government Code if any modifications are made to the HSP without PRIOR approval from CPA.

For assistance in completing the HSP, Respondent may visit the following website:

https://comptroller.texas.gov/purchasing/vendor/hub/. The HSP is available as part of this RFO package on the ESBD website, available at: http://www.txsmartbuy.com/esbd. Respondents may send an HSP review request to the CPA Contact Person provided in Section I, Part 8. CPA will provide a courtesy HSP review if the request is received no later than the date questions are due, as specified in Section I, Part 15.

If Respondent is not subcontracting any portion of the Contract, Sections 1, 2(a), 3 and 4 of the HSP must be completed.

If Respondent is subcontracting some portion of the Contract, the supporting documentation of “Good Faith Effort” must be demonstrated in either Method A (Attachment A) or Method B (Attachment B) of the HSP.

The Texas Comptroller of Public Accounts requests all Respondents to consider utilizing HUBs in subcontracting areas listed below; however, this list should not be considered exhaustive.

Class Item Description 920 45 Software Maintenance and Support Services

In accordance with 34 TAC §20.285(d)(1)(D)(iii), a Respondent (prime contractor) may demonstrate a good faith effort to utilize Texas certified HUBs for its subcontracting opportunities if the total value of Respondent’s subcontracts with Texas certified HUBs meets or exceeds the statewide HUB goal or the agency specific HUB goal, whichever is higher. When a Respondent uses this method to demonstrate a good faith effort, the Respondent must identify the HUBs with which it will subcontract. If using existing contracts with Texas certified HUBs to satisfy this requirement, only contracts that have been in place for five years or less shall qualify toward meeting the HUB goal.

P. Respondent Documents

All Respondent documents that are related to the Services, this RFO, Respondent’s Offer, or the Contract including, but not limited to, boilerplate service agreements, service schedules, published specifications, warranty information, terms of service, ordering documents, maintenance agreements, and license agreements, are collectively referred to in this RFO as “Respondent Documents.” Respondent must include copies of all proposed Respondent Documents with Respondent’s Offer. CPA reserves the right, in its sole discretion, to amend the Respondent Documents to conform to this RFO and Texas law and provide them to Respondent for approval and signature prior to Contract award. Respondent Documents that are (1) submitted as part of the Offer and (2) amended to conform to this RFO and Texas law through mutual, written agreement of Successful Respondent and CPA will be incorporated as part of the Contract. Upon written request, Respondent shall promptly provide to CPA a Word version of all Respondent Documents.

Q. Respondent Exceptions

If Respondent takes any exception to any provisions of this RFO, the exceptions must be specifically and clearly identified by section number in Respondent’s Offer as provided in Section XI (Respondent Exceptions Response Template).

Respondent’s proposed alternative must also be provided in the Offer; however, it is acceptable for Respondent to reference the terms of a previous contract with CPA. If a Respondent takes a “blanket exception” to the entire RFO or does not https://comptroller.texas.gov/purchasing/vendor/hub/ http://www.txsmartbuy.com/esbd

RFO # 304-26-0364RAG: [ASPG Software Maintenance and Related Services] Page 14 of 41 propose alternate language for CPA’s consideration, Respondent’s Offer may be considered non-responsive and disqualified from further consideration.

Respondents are strongly encouraged to submit any inquiries regarding specific terms or conditions of this RFO during the question-and-answer period designated in Section I (Summary).

R. Respondent’s Past Performance

CPA may conduct reference checks with other entities regarding past performance of Respondent or its subcontractors. In addition to evaluating performance through the Vendor Performance Tracking System (VPTS) as authorized by 34 Texas Administrative Code §20.115, CPA may examine other sources of vendor performance, including, but not limited to, notices of termination, cure notices, assessments of liquidated damages, litigation, audit reports, and non-renewals of contracts. Such sources of vendor performance may include any governmental entity, whether an agency or political subdivision of the State of Texas, another state, or the Federal government. Further, CPA may initiate such examinations of vendor performance based upon media reports. Any such investigations shall be at the sole discretion of CPA, and any negative findings, as determined by CPA, may result in a non-award to Respondent. The VPTS information is located on CPA’s website at: https://www.comptroller.texas.gov/purchasing/programs/vendor-performance-tracking/.

https://www.comptroller.texas.gov/purchasing/programs/vendor-performance-tracking/

RFO # 304-26-0364RAG: [ASPG Software Maintenance and Related Services] Page 15 of 41

III. Offer Submission Requirements

A. Delivery of Offer

Respondent must submit its Offer electronically via email with delivery receipt requested, in accordance with the following:

1. The Offer must be emailed to bidcpa@cpa.texas.gov, with copy to the CPA Contact Person identified in Section I, Part 8 at Rene.Gonzales@cpa.texas.gov;

2. The subject line of the email must include Respondent’s name and a reference to RFO No. 304-26-0364RAG;

3. All attachments to the email must be in a format that is accessible to CPA (specific acceptable formats include Word, Excel, and pdf);

4. All required forms must be electronically signed or manually signed with scanned signatures; and

5. CPA strongly encourages Respondent to send the email with the attached Offer at least fifteen (15) minutes prior to the deadline for submission of offers as specified in this RFO to allow for any networking delays that may occur (e.g., firewalls, security scans, etc.).

Respondent is solely responsible for ensuring timely delivery of its Offer to the Issuing Office by the deadline. Late Offers will not be accepted.

B. Offer Content and Format

The Offer must contain the information listed in this Part B. Failure to include all information may result in exclusion of the Offer from consideration. The Offer must contain an organized, paginated table of contents with hyperlinks corresponding to the sections and pages of the Offer. The Offer must be organized as follows:

1. Respondent’s Contact Person and Identifying Information. Respondent must submit the following in its Offer:

a. Respondent’s identifying information:

(1) name and address of business entity submitting the Offer;

(2) list of all principals;

(3) type of business entity (e.g., corporation, partnership);

(4) state of incorporation or organization; and

(5) principal place of business.

b. Respondent’s contact information (i.e., name, title, email address, phone number and fax number) for the individual(s) who will be CPA’s point of contact for questions regarding the Offer and the Contract.

2. Respondent Questionnaire: Respondent’s Qualifications, Experience and Past Performance.

a. In its Offer, Respondent must provide a profile that:

(1) describes the size and scope of all of Respondent’s operations, including number of Respondent’s employees and years in business;

(2) describes the general nature of previous, similar work performed by Respondent, particularly work in the last three (3) years;

(3) describes Respondent’s prior contracting experience with CPA and other public sector entities;

(4) includes a statement regarding the financial stability of Respondent, including the ability of Respondent to perform the Services and any other services proposed in its Offer; and

(5) includes any other information Respondent believes is pertinent to this RFO (e.g., certificates, industry awards).

b. References. In its Offer, Respondent must provide a list of three (3) entities other than CPA for which Respondent has provided services and/or products described in this RFO during the past three (3) years. For each of the three references, Respondent must include dates when items that were the same or similar to those requested in this RFO were provided, and the names, telephone numbers and email addresses of the entity’s contact person.

Respondent must provide the reference information in a format similar to the following:

(1) Entity Name:

Date Item(s) Provided:

Name of Entity’s Contact Person:

Telephone Number of Entity’s Contact Person:

mailto:bidcpa@cpa.texas.gov mailto:PuchaserName@cpa.texas.gov

RFO # 304-26-0364RAG: [ASPG Software Maintenance and Related Services] Page 16 of 41

Email Address of Entity’s Contact Person:

(2) Entity Name:

Date Item(s) Provided:

Name of Entity’s Contact Person:

Telephone Number of Entity’s Contact Person:

Email Address of Entity’s Contact Person:

(3) Entity Name:

Date Item(s) Provided:

Name of Entity’s Contact Person:

Telephone Number of Entity’s Contact Person:

Email Address of Entity’s Contact Person:

In CPA’s sole discretion, CPA may contact Respondent’s references by email or telephone. CPA will not notify Respondent of its reference-checking activities.