ESBD_404455_1749754294274_RFP 907-25-1902KW Home Energy Rebates.pdf

RFP # 907-25-1902KW SECO IRA Home Energy Rebates Page 1 of 59

Texas Comptroller of Public Accounts

Glenn Hegar, Comptroller

Request for Proposals for

State Energy Conservation Office (SECO) Inflation Reduction Act (IRA) Home Energy Rebates

Comprehensive Program Management, Administrative and Implementation Services

RFP No. 907-25-1902KW

June 12, 2025

Anticipated Schedule of Events

June 12, 2025 Issuance of RFP

June 26, 2025 Deadline for Submission of Questions (2:00 p.m., CT)

July 3, 2025 Release of Official Responses to Questions (or as soon thereafter as practical)

July 10, 2025 Deadline for Submission of Proposals (2:00 p.m. CT) Late Proposals will not be considered

August 11, 2025 Presentations from Top-Ranked Respondents (if presentations requested by CPA, dates and times to be scheduled)

September 8, 2025 Services Commencement Date (or as soon thereafter as practical)

RFP # 907-25-1902KW SECO IRA Home Energy Rebates Page 2 of 59

Table of Contents

I. Summary

II. Specifications

A. Introduction

B. Background

C. Definitions and Acronyms

D. Scope of Services

E. Contract Resulting from this Solicitation; Order of Priority

F. Warranty of Performance

G. Security Incident Notification

H. Insurance and Bonds

I. Criminal Background Investigation

J. Contract Term; Survival of Terms

K. Acceptance Criteria

L. Payments

M. Discounts

N. PO Addition and Deletion

O. HUB Subcontracting Plan Information

P. Respondent Documents

Q. Respondent Exceptions

R. Respondent’s Past Performance; Vendor Performance Tracking System

III. Proposal Submission Requirements

A. Delivery of Proposal

B. Proposal Content and Format

IV. Terms and Conditions

A. Standard Terms and Conditions

B. Federal Terms and Conditions

V. Execution of Proposal

VI. Conflict of Interest/Disclosure Statement

VII. Nondisclosure Agreement

VIII. Confidential Treatment of Information Acknowledgment

IX. Certification Regarding Public Nature of the Proposal

X. Contractor Cybersecurity Training Attestation Form

XI. Respondent Exceptions

XII. Vendor Reference Questionnaire

XIII. Federal Funding Accountability and Transparency Act (FFATA) Form

XIV. Certification Regarding Lobbying lower tier convered transactions

XV. Disclosure of Lobbying Activities

RFP # 907-25-1902KW SECO IRA Home Energy Rebates Page 3 of 59

I. Summary

1. Type of Solicitation: Request for Proposals (RFP)

2. Issuing Office: Texas Comptroller of Public Accounts (CPA) Procurement Section Room 300, Attn: RFP No. 907-25-1902KW 111 E. 17th Street Austin, Texas 78774

3. Additional Requirements/Qualifications: N/A

4. Responses to RFP: Sealed Competitive Proposals

5. Deadline for Proposals: In Issuing Office No Later Than:

July 10, 2025; 2:00 p.m., Central Time (CT)

6. Initial Contract Term: Date of Award to August 31, 2026

7. CPA Optional Contract Terms: September 1, 2026 through August 31, 2027 September 1, 2027 through August 31, 2028 September 1, 2028 through August 31, 2029 September 1, 2029 through August 31, 2030 and September 1, 2030 through August 31, 2031

8. CPA Contact Person for this RFP: Lauren Callahan, CTCD, CTCM Email with delivery receipt requested to: bidcpa@cpa.texas.gov

9. Proposals Submitted by Email: Required; See Section III, Part A

10. Proposals Submitted by Fax: Not Accepted

11. Pre-Proposal Conference: N/A

12. Pre-Proposal Inspection: N/A

13. Letters of Intent to Submit a Proposal: N/A

14. RFP Addenda: Notices of changes to items directly impacting the original RFP or solicitation process will be posted on the Electronic State Business Daily (ESBD) located at: http://www.txsmartbuy.com/esbd. CPA will post any amendment to this solicitation on the ESBD as an RFP Addendum. It is the responsibility of an interested party to check the ESBD for updates to this RFP before submitting a Proposal. Each Respondent is solely responsible for verifying CPA’s receipt of its questions, if applicable, and its Proposal by the deadlines specified in this RFP.

15. Questions and Answers: Questions regarding this RFP must be in writing and must be submitted to the CPA Contact Person specified in Part 8, no later than June 26, 2025; 2:00 p.m. CT. Telephone inquiries will not be accepted.

Questions may be submitted by email to the email address specified in Part 8. CPA intends to post answers to the questions received on the ESBD on July 3, 2025, or as soon thereafter as practical.

16. Respondent Presentations: CPA may request that Top-Scoring Respondents present an overview of the services and a demonstration of the software proposed in their Proposals. The presentations will be performed on or about August 11, 2025. Presentation location (e.g., videoconference, onsite, etc.), date(s) and time(s) to be arranged. In its sole discretion, CPA will determine the number of Top-Scoring Respondents.

RFP # 907-25-1902KW SECO IRA Home Energy Rebates Page 4 of 59

17. Evaluation of Proposals under Best Value Standard (Section 2156.125 of the Texas Government Code):

Criteria Weight Respondent’s Past Performance, Qualifications & Experience 30% Compliance with CPA Specifications 20% Cost 20% Reasonableness of Cost 30% Total: 100%

As applicable, the factors listed in Sections 2155.074, 2155.075, 2156.007, and 2157.003 of the Texas Government Code shall also be considered in making an award. Best and Final Offers may be sought from Respondents whose Proposals are ranked most highly by the evaluation committee. However, CPA encourages Respondents to offer their best pricing at all times. CPA reserves the right in its sole judgment and discretion, and at any time upon failure of negotiations, to reissue or withdraw this RFP rather than continue with negotiations.

18. Email Submission Only. Due to building access restrictions, Respondents will not be permitted to hand deliver Proposals to the Issuing Office. Respondents are required to submit Proposals electronically via email with delivery receipt requested in accordance with Section III, Part A.

19. Contact with CPA Staff: Upon issuance of this RFP, employees and representatives of CPA, other than the CPA Contact

Person identified in Section I, Part 8, will not discuss the contents of this RFP with any Respondent or its representatives.

Failure of a Respondent or any of its representatives to observe this restriction may result in disqualification of any related Proposal. This restriction does not preclude discussions between the parties to conduct business unrelated to this procurement or to obtain assistance completing Historically Underutilized Business (HUB) forms required by this RFP.

RFP # 907-25-1902KW SECO IRA Home Energy Rebates Page 5 of 59

II. Specifications

A. Introduction

The Texas Comptroller of Public Accounts (CPA), an agency of the state of Texas, issues this Request for Proposals (RFP) to solicit Proposals from qualified vendors to provide Comprehensive Program Management, Administrative and Implementation Services for Home Energy Rebates as described in this Section II and in this RFP (Services). CPA’s objective is to obtain the Services that represent the best value for CPA and the State of Texas according to the terms and conditions of this RFP.

CPA anticipates making a Contract award to one (1) Successful Respondent for the Services. CPA reserves the right not to award a Contract for the performance of all or part of the Services. This RFP is not exclusive and CPA reserves the right to issue additional solicitations regarding the Services or similar services at any time. All Respondents are encouraged to offer their best pricing at all times.

All costs associated with the Services must be included in the Respondent’s Proposal. Proposals that do not meet all of the requirements or contain all of the required documentation specified in this RFP will be rejected as non-responsive.

B. Background

In 2022, the 117th U.S. Congress passed H.R.5376 – Inflation Reduction Act 2022, creating the Home Energy Rebates, split into two sub-programs: Home Owner Managing Energy Savings Efficiency Rebates (HOMES) and Home Electrification and Appliance Rebates (HEAR) (collectively referred to herein as “the Programs” or individually as, “the HOMES Program” or “the HEAR Program”). The U.S. Department of Energy (DOE) is the administering federal entity for the Programs.

The State Energy Conservation Office (SECO), operated by CPA, is the administering state entity for the federal Home Energy Rebate Programs aimed to deliver innovative efficiency and electrification programs to households across Texas.

The overarching goal of the Programs is to increase the affordability and efficiency of homes and reduce energy costs for homeowners.

In this RFP, SECO is seeking a vendor to provide Comprehensive Program Management, Administrative and Implementation Services for the Programs including: extensive design, implementation, monitoring, and reporting tasks that will be closely regulated by state personnel and must meet DOE requirements and guidelines. The DOE allocated $690 million to Texas to execute the Programs, with $345 million and $344 million being allocated to the HOMES Program and HEAR Program, respectively. The Programs will end when all funds are expended by Texas or September 30th, 2031, whichever occurs sooner. Successful implementation of Services will require substantial work by the Successful Respondent.

C. Definitions and Acronyms

ALRD. Administrative and Legal Requirements Document AMI. Area Median Income API. Application Programming Interface Award Date. The Award Date is the earlier of the date an authorized representative of CPA (1) issues a Purchase

Order (PO) or (2) signs a formal, written agreement.

BIL. Bipartisan Infrastructure Law CEJST. Climate and Economic Justice Screening Tool CFR. Code of Federal Regulations Contract. The agreement described in Section II, Part E (Contract Resulting from this Solicitation; Order of Priority), if any.

CPA. Texas Comptroller of Public Accounts DAC. Disadvantaged Communities DOE. Department of Energy FARC. Federal Assistance Reporting Checklist HEAR. Home Electrification and Appliance Rebate program Section 50122 of the IRA HOMES. Home Efficiency Rebates Program Section 50121 of the IRA IIJA. Infrastructure and Investment Jobs Act

RFP # 907-25-1902KW SECO IRA Home Energy Rebates Page 6 of 59

IRA. Inflation Reduction Act LI. Low-income LI MF. Low-income multifamily PNNL. Pacific Northwest Laboratory Programmatic Guidance Documents. Includes the following documents: FARC (Exhibit 1 and Exhibit 2), ALRD

Version 2.1 (Exhibit 3), Program Requirements and Application Instructions (Exhibit 4), Data and Tools Requirements Guide (Exhibit 5), HOMES and HEAR Narrative Documents (Exhibit 6 and Exhibit 7), any additional programmatic documents released over the duration of the Program.

Progress Tranche. Phased stages of the Home Energy Rebates Programs in which certain deliverables and milestones are achieved and requirements must be met in order to move forward.

Proposal. A response to this RFP.

QA. Quality Assurance Respondent. Any person or entity that submits a Proposal.

SCEP. State and Community Energy Programs SECO. State Energy Conservation Office Service Level Plan. A comprehensive document submitted by the Successful Respondent as outlined in Section

D.2.3.c of this RFP.

Subcontractor. Successful Respondent’s contracted vendors.

Successful Respondent. The Respondent awarded a Contract, if any. (Also referred to as “Contractor”)

D. Scope of Services

D.1. General

a) Successful Respondent must provide all Services described in Section II, Part D (Scope of Services).

b) Successful Respondent will create, develop, and administer the Programs in conjunction with SECO throughout the State of Texas. The Successful Respondent must provide comprehensive administrator services throughout the life of the Programs but must track activities for each program phase and program separately.

c) Services and related deliverables will be structured to follow the established Progress Tranches as outlined in this Scope of Services and in the following Programmatic Guidance Documents which are incorporated by reference into this RFP:

i. Federal Assistance Reporting Checklist (FARC) (Exhibit 1 - HOMES, Exhibit 2 – HEAR);

ii. Administrative and Legal Requirements Document (ALRD) Version 2.1 (Exhibit 3);

iii. Program Requirements and Application Instructions (Exhibit 4);

iv. Data and Tools Requirements Guide (Exhibit 5);

v. HOMES and HEAR Narrative Documents (Exhibit 6 – HOMES, Exhibit 7 – HEAR);

vi. Reimbursement Request Checklist (Exhibit 8); and

vii. Such additional programmatic documents and updates released by DOE over the duration of the Programs, as applicable.

d) Each Program must be divided into two phases. The first phase is called the Early Administration Period, and the second phase is called the Full Program Performance Period. The Early Administration Period consists of the activities outlined in Part D.2. The Full Program Performance Period consists of the activities outlined in Parts D.3 through D.6.

e) The Services include providing a project delivery solution with customer support and rebate processing capabilities, and tasks including but not limited to analysis; Programs monitoring, tracking, reporting auditing, evaluation activities, rebate processing; outreach, marketing, and consulting. Successful Respondent will provide all services, systems, and personnel to maintain and support the system components for technology support.

f) Successful Respondent will establish and maintain a customer service operation including phone lines with dedicated support for interested parties.

g) Successful Respondent will conduct applicable market research and analysis to assist SECO in determining its priorities and the goals of the Programs.

RFP # 907-25-1902KW SECO IRA Home Energy Rebates Page 7 of 59

h) Successful Respondent will assist with implementing best practices for federal and state award management, including performance, financial oversight, and training CPA staff as requested by SECO.

i) Successful Respondent will maintain consistent communication and coordinate directly with the SECO Contract

Manager. Successful Respondent will attend monthly meetings with the SECO Contract Manager (in-person or virtually) between the 10th and 15th day of each month. The SECO Contract Manager will oversee the direction and quality of work of Successful Respondent.

j) Successful Respondent will maintain consistent communication and coordinate directly with the SECO Contract Manager for all education and outreach events.

k) Successful Respondent will maintain, track, and report budget and audit items for each Program separately.

l) Successful Respondent will adhere to all SECO reporting requirements and written deliverables associated with both

HOMES and HEAR rebate Programs.

m) Services and deliverables as outlined in Section II, Parts D.2 through D.6 will apply to the HOMES Program and the HEAR Program independently and separately from one another. Submittal of invoices for each Program, as detailed in Appendix 1, Mandatory Price Sheet, must be independent of the other Program’s.

n) The resulting Agreement will be based upon the availability of IRA funding, and SECO will reserve the right to cancel same upon providing 14 calendar days' written notice to the Successful Respondent should funding cease to be available. Funding under the Full Program Performance Period is not available until Early Administration Period funds have been expended and deliverables have been accepted by SECO. Successful Respondent must receive written approval to access Full Program Performance Period funds. Full Program Performance Period funding by the DOE or SECO is not guaranteed.

D.2. Early Administration Period

1. Overview During the Early Administration Period, the Successful Respondent will coordinate and collaborate with communities to understand and determine the local, community, and regional needs to maximize benefits to low-income and low to moderate-income single family and multifamily residents. Successful Respondent must complete preliminary planning, market research, community engagement, contractor engagement, and adhere to the Program guidelines during the Early Administration Period. The approved State Grant Applications will provide the guiding goals and methodologies for subsequent Program requirements. All fees charged in the performance of the Early Administration Period must be reflected in Appendix 1 Mandatory Price Sheet. The following is a summary of the tasks to be completed in the Early Administration Period:

a) The Successful Respondent will develop strategic and implementation plans.

b) The Successful Respondent will design and develop a rebate processing and tracking system that can be accessed through the web and link to the DOE API. The system must be functioning and approved by SECO within the Early Administration Period.

c) The Successful Respondent will provide a comprehensive Service Level Plan describing their approach to ensuring consistent and responsive services for both the rebate processing and tracking system and customer support operations.

d) The Successful Respondent will assist SECO in providing Pre-Launch Data Details to the DOE as described in the Data and Tools Requirements Guide (Exhibit 5).

2. Timeline

a) SECO has submitted the State Grant Applications and received approval for both HOMES and HEAR. Early

Administration Period has started and will continue upon award.

3. Deliverables

Successful Respondent will incorporate feedback and submit deliverables to receive written approval from SECO and the DOE. Completion of deliverables for each Program may not be simultaneous but must follow the order as outlined in Programmatic Guidance Documents (Section II, Part D.1.c). All deliverables must be compliant with applicable federal and state statutes and align with Program goals as outlined by DOE. Early Administration Period deliverables are detailed below:

a) All documents in the Implementation Blueprint as detailed in the Program Requirements and Application Instructions (Exhibit 4) and the ALRD (Exhibit 3) to include (at a minimum):

i. Outreach partnerships, outreach channels strategic and implementation plan.

ii. Single family and multifamily education strategic and implementation plan.

RFP # 907-25-1902KW SECO IRA Home Energy Rebates Page 8 of 59

iii. Contractor partnerships, outreach channels strategic and implementation plan.

iv. Retailer and Distributor Outreach strategic and implementation plan.

v. Consumer protection strategic and implementation plan.

vi. Program monitoring, tracking, reporting auditing, and evaluation strategic and implementation plan.

vii. Privacy and Security Risk Assessment for State Systems strategic and implementation plan.

b) Timeline for executing activities.

c) Service Level Plan addressing at a minimum the following components:

i. Rebate Processing and Tracking System Service Levels

1. System Availability & Uptime. Describing proposed service level targets for system uptime, including expected monthly and annual availability percentages. Include strategies for redundancy, disaster recovery, and business continuity.

2. System Performance & Response Time. Defining standards for portal responsiveness (e.g., page load times, transaction processing speeds). Explain monitoring protocols and mechanisms to proactively detect and resolve performance issues.

3. User Support & Issue Resolution. Outlining procedures and timelines for responding to technical support requests, bug reports, and user feedback related to the portal (e.g., Tier 1, Tier 2, Tier 3 escalation framework).

4. Maintenance & Update Schedules. Describing plans for routine maintenance, system upgrades, security patches, and planned downtime, including communication strategies to notify users in advance.

5. Accessibility & User Experience. Describing measures to ensure the portal meets accessibility standards and provides a user-friendly experience for diverse populations.

ii. Customer Support Operation Service Levels

1. Hours of Operation. Specifying proposed hours of operation (including time zones), and describe how coverage will meet the needs of the target population.

2. Call Handling Metrics. Proposing service level targets for key metrics such as average speed of answer, abandonment rate, first call resolution rate, and call escalation timelines.

3. Multilingual & Accessibility Support. Describing capabilities to provide services in multiple languages and accommodate users with disabilities, including use of translation services or assistive technologies.

4. Staffing & Training. Outlining proposed staffing levels, training programs, and quality assurance measures to ensure knowledgeable, courteous, and efficient service.

5. Customer Satisfaction Measurement. Explaining how customer satisfaction will be measured and reported (e.g., surveys, feedback tools), and how continuous improvement will be incorporated into call center operations.

iii. Reporting & Compliance

1. The Successful Respondent must describe how they will:

a. Monitor and report service level compliance on a regular basis (e.g., monthly dashboards, quarterly reports)

b. Address and remediate service level deficiencies

c. Ensure compliance with applicable data privacy, cybersecurity, and regulatory requirements

iv. Approval and Liquidated Damages

1. The Successful Respondent will submit the Service Plan for review, feedback, and approval by SECO.

2. Failure to meet agreed upon service levels may result in the assessment of liquidated damages.

D.3. Full Program Performance Period: Progress Tranche 1

During Progress Tranche 1, the Successful Respondent will launch the Programs to the public for participation.

Staged rollout is acceptable; Successful Respondent must provide the schedule for each of the Programs to SECO.

Continuous updates, improvement, and maintenance of the Implementation Blueprint documents, rebate system, and reporting will be expected. The Successful Respondent will work closely with SECO and CPA to analyze and manage goals for both the HOMES Program and the HEAR Program based on the Programmatic Guidance Documents. All fees charged in the performance of this Progress Tranche 1 must be reflected in Appendix 1 Mandatory Price Sheet.

The following is a summary of the tasks to be completed in Progress Tranche 1:

a) Program Launch.

b) Continuous updates to Implementation Blueprint documents and activities.

RFP # 907-25-1902KW SECO IRA Home Energy Rebates Page 9 of 59

c) Maintenance and improvement of the rebate system.

2. Timeline

a) Progress Tranche 1 will begin when the Implementation Blueprint documents are approved by the DOE for both Programs.

3. Deliverables Successful Respondent will incorporate feedback and submit deliverables to receive written approval from SECO and the DOE. Completion of deliverables for each Program may not be simultaneous but must follow the order as outlined in Programmatic Guidance Documents (Section II, Part D.1.c). All deliverables must be compliant with applicable federal and state statutes and align with Program goals as outlined by DOE. Progress Tranche 1 deliverables are detailed below:

a) Pre-Launch information from the Data & Tools Requirement Guide (Exhibit 5) using the PNNL standardized spreadsheet.

b) An updated Service Level Plan reflecting the updated needs for this Progress Tranche.

c) Progress Tranche 1 Summary Report submitted to SECO at least one hundred and twenty (120) days prior to moving to Progress Tranche 2.

d) Monthly, quarterly, and annual reports for both the HOMES Program and the HEAR Program.

i. Prepare subcontractor reports and an executive summary for both Programs.

ii. Prepare ad-hoc reports as requested by SECO.

iii. Submit all required report documentation in requested format through the SECO Contract Portal no later than the 10th day of each applicable month.

iv. At a minimum, reports must include all reporting requirements outlined in the FARC (Exhibit 1 and Exhibit 2).

D.4. Full Program Performance Period: Progress Tranche 2

During Progress Tranche 2, the Successful Respondent will continue Program execution, implementing updates and improvements as needed and approved by SECO and completing federal and state reporting requirements.

Continuous updates, improvement, and maintenance of the Implementation Blueprint documents, rebate system, and reporting will be expected. This Progress Tranche will also include the development of the Market Transformation Plan. All fees charged in the performance of this Progress Tranche 2 must be reflected in Appendix 1 Mandatory Price Sheet.

The following is a summary of the tasks to be completed in Progress Tranche 2.

a) Develop a Market Transformation Plan.

b) Continuous updates to Implementation Blueprint documents and activities.

c) Maintenance and improvement of the rebate system.

d) Within this Progress Tranche 2, rebate funds distributed to low-income (LI) and low-income multifamily

(LI MF) qualifying subrecipients must achieve minimums outlined in the ALRD (Exhibit 3).

2. Timeline

a) Progress Tranche 2 will begin when the Progress Tranche 1 Summary Report is approved by the DOE for both Programs.

3. Deliverables Successful Respondent will incorporate feedback and submit deliverables to receive written approval from SECO and the DOE. Completion of deliverables for each Program may not be simultaneous but must follow the order as outlined in Programmatic Guidance Documents (Section II, Part D.1.c). All deliverables must be compliant with applicable federal and state statutes and align with Program goals as outlined by DOE. Progress Tranche 2 deliverables are detailed below:

a) Market Transformation Plan as described in the Program Requirements and Application Instructions (Exhibit 4).

b) An updated Service Level Plan reflecting the updated needs for this Progress Tranche.

c) Progress Tranche 2 Summary Report submitted to SECO at least one hundred and twenty (120) days prior to moving to Progress Tranche 3.

d) Monthly, quarterly, and annual reports for both Programs.

i. Prepare subcontractor reports and an executive summary for the Programs.

ii. Prepare ad-hoc reports as requested by SECO.

iii. All required report documentation will be submitted in requested format through the SECO Contract Portal no later than the 10th day of each applicable month.

iv. At a minimum, reports must include all reporting requirements outlined in the FARC (Exhibit 1 and

D.5. Full Program Performance Period: Progress Tranche 3

RFP # 907-25-1902KW SECO IRA Home Energy Rebates Page 10 of 59

During Progress Tranche 3, the Successful Respondent will continue Program execution, implementing updates and improvements as needed and approved by SECO and completing federal and state reporting requirements.

Independent reviews as outlined in the FARC (Exhibit 1 and Exhibit 2) and ALRD (Exhibit 3) will be completed and submitted to SECO for review. All fees charged in the performance of this Progress Tranche 3 must be reflected in Appendix 1 Mandatory Price Sheet.

The following is a summary of the tasks to be completed in Progress Tranche 3.

a) Independent and SECO-initiated reviews of Program implementation and benchmarks.

b) Continuous updates to Implementation Blueprint documents and activities.

c) Maintenance and improvement of the rebate system.

d) Within this Progress Tranche 3, rebate funds distributed to LI and LI MF qualifying subrecipients must achieve minimums outlined in the ALRD (Exhibit 3).

2. Timeline

a) Program Tranche 3 will begin when an approved Market Transformation Plan is approved by the DOE for both Programs and the Progress Tranche 2 Summary Report is approved by the DOE for both Programs.

3. Deliverables Successful Respondent will incorporate feedback and submit deliverables to receive written approval from SECO and the DOE. Completion of deliverables for each Program may not be simultaneous but must follow the order as outlined in Programmatic Guidance Documents (Section II, Part D.1.c.). All deliverables must be compliant with applicable federal and state statutes and align with Program goals as outlined by DOE and the FARC (Exhibit 1 and Exhibit 2).

Progress Tranche 3 deliverables are detailed below:

a) The following reviews as indicated in the ALRD (Exhibit 3) and FARC (Exhibit 1 and Exhibit 2):

i. Independent privacy and security review.

ii. QA Plan review.

iii. Incentive implementation review.

b) Progress Tranche 3 Summary Report submitted to SECO at least one hundred and twenty (120) days prior to moving to Progress Tranche 4.

c) An updated Service Level Plan reflecting the updated needs for this Progress Tranche.

d) Monthly, quarterly, and annual reports for both HOMES and HEAR.

i. Prepare subcontractor reports and an executive summary for both Programs.

ii. Ad-hoc reports as requested by SECO.

iii. All required report documentation will be submitted in requested format through the SECO Contract Portal no later than the 10th day of each applicable month.

iv. At a minimum, reports must include all reporting requirements outlined in the FARC (Exhibit 1 and

D.6. Full Program Performance Period: Progress Tranche 4

During Progress Tranche 4, the Successful Respondent will continue Program execution, implementing updates and improvements as needed and approved by SECO as well as prepare for Program Closeout. Final evaluations and reporting as designated by SECO and the DOE will be completed. The Successful Respondent will complete all Program Closeout tasks as outlined in Programmatic Guidance Documents (Section II, Part D.1.c). All fees charged in the performance of this Progress Tranche 4 must be reflected in Appendix 1 Mandatory Price Sheet.

The following is a summary of the tasks to be completed in Progress Tranche 4.

a) Program Closeout.

b) Continuous updates to Implementation Blueprint documents and activities.

c) Maintenance and improvement of the rebate system.

d) Within this Progress Tranche 4, rebate funds distributed to LI and LI MF qualifying subrecipients achieve minimums outlined in the ALRD (Exhibit 3).

2. Timeline

a) The milestones to begin Tranche 4 are:

i. Approved QA Plan review;

ii. Approved independent privacy and security review; and

iii. A completed incentive implementation review.

iv. Approved Progress Tranche 3 Summary Report.

b) All funds have been fully dispersed, and the rebate system is closed and no longer receiving rebate recipient applications.

4. Deliverables Successful Respondent will incorporate feedback and submit deliverables to receive written approval from SECO and the DOE. Completion of deliverables for each Program may not be simultaneous but must follow the order as outlined

RFP # 907-25-1902KW SECO IRA Home Energy Rebates Page 11 of 59 in Programmatic Guidance Documents. All deliverables must be compliant with applicable federal and state statutes and align with Program goals as outlined by DOE and the FARC (Exhibit 1 and Exhibit 2). Progress Tranche 4 deliverables are detailed below:

a) Continuous updates to Implementation Blueprint documents and activities.

b) An updated Service Level Plan reflecting the updated needs for this Progress Tranche.

c) Maintenance of improvement of the rebate system.

d) Monthly, quarterly, and annual reports for both HOMES and HEAR.

i. Prepare subcontractor reports and an executive summary for both Programs.

ii. Ad-hoc reports as requested by SECO.

iii. All required report documentation will be submitted in requested format through the SECO Contract Portal no later than the 10th day of each applicable month.

iv. At a minimum, reports must include all reporting requirements outlined in the FARC.

e) Final Program evaluation and summary of rebate delivery effectiveness.

f) Program Closeout (including, but not limited to):

i. All requirements as outlined in 2CFR §200.

ii. All tasks as outlined in the FARC.

iii. Rebate processing system shut down and applications cannot be submitted.

iv. All rebate recipients paid.

v. All contractor work completed and paid.

vi. All retailers paid and retail program activity halted.

vii. All reports submitted and accepted by SECO.

viii. Program records retained as outlined in 2CFR §200.334.

ix. Final invoice is submitted.

D.7 CPA Data Safeguard Standards.

a. Defined Terms. The term “CPA Data” refers to CPA’s information as well as other entity information in the possession of CPA that is processed, stored, or transmitted by a computer. CPA Data includes all data that is generated by Successful Respondent in performance of a contract with CPA. The term “CPA Information System” refers to those devices, software, networks and related infrastructure that CPA owns, operates or has obtained for use to conduct CPA business. Devices include, but are not limited to, CPA-owned or managed storage, processing, and communications devices, as well as personally owned devices.

b. Access to CPA Data. Successful Respondent represents and warrants that it will implement, maintain, and use appropriate administrative, technical, and physical safeguards to preserve the confidentiality, integrity, and availability of CPA Data. Successful Respondent will not collect, access, use, disclose, or retain CPA Data other than as necessary to perform the services specified in a contract resulting from this solicitation or as otherwise authorized in writing by CPA. Successful Respondent will restrict access to CPA Data to only those personnel who must have the information on a “need to know” basis. Successful Respondent will not use CPA Data, or any information derived from CPA Data, for its own benefit or the benefit of any other person or entity. Successful Respondent will not share CPA Data with its parent company or other affiliate without CPA’s express written consent.

c. Web-Based Remote Access to CPA Information Systems. Successful Respondent may use third-party web-based remote access connections to CPA Information Systems to provide support services under the following conditions:

1. CPA shall affirmatively initiate and accept Successful Respondent’s connections to CPA Information Systems.

2. CPA shall monitor Successful Respondent’s connections to CPA Information Systems for the duration of the

Services.

3. CPA shall terminate Successful Respondent’s connections to CPA Information Systems upon completion of the

Services.

d. Remote Access to CPA Information Systems. Successful Respondent shall accept the CPA Remote Access Terms and Conditions and obtain CPA’s written approval of Successful Respondent’s Remote Access Request Form before CPA will issue Successful Respondent with credentials to remotely access CPA Information Systems (e.g., for continuous access). Successful Respondent may contact the CPA Contract Manager for the applicable forms. Successful Respondent shall only access CPA Information Systems in accordance with CPA’s security protocols using CPA-approved remote access technologies, processes, and procedures. CPA reserves the right to immediately terminate any access to a CPA Information System.

e. CPA-Required Security Awareness Training. As a condition of CPA issuing credentials and Successful Respondent gaining access to a CPA Information System, Successful Respondent shall complete CPA’s security awareness training or an equivalent DIR-approved training on an annual basis during the Contract term, including renewal periods. Successful Respondent shall submit to CPA at contract.administration@cpa.texas.gov: (i) the Contractor Cybersecurity Training Attestation (CCTA) form attached as Section XI; and (ii) any other information reasonably

RFP # 907-25-1902KW SECO IRA Home Energy Rebates Page 12 of 59 requested by CPA to comply with Section 2054.5192 of the Texas Government Code. Successful Respondent must complete, sign, and return the CCTA form to CPA no later than sixty (60) calendar days following contract award and each anniversary thereafter during the term of the Contract, including any renewal periods. Successful Respondent shall maintain records of all individuals who have completed the CPA-required training for the duration of the individual’s employment or other business relationship with Successful Respondent, plus five years. CPA, in its sole discretion, may deny network or system access to any individual that does not complete the CPA-required training within thirty (30) calendar days following the date of CPA’s grant of access to the CPA Information System(s).

f. Location of CPA Data. Successful Respondent shall ensure that CPA Data (i.e., primary and backup) remains, at all times, within the continental United States. Successful Respondent shall receive, process, transmit, and store all CPA Data within the continental United States. Successful Respondent’s point of access to CPA Data shall be within the continental United States.

g. Encryption Standards.

1. Successful Respondent shall encrypt CPA Data in transit and at rest. Data in transit means data is moving via email, in applications, or through browsers and other web connections. Data at rest (including data backups) means data is stored in databases, the cloud, removable media, or mobile devices.

2. Successful Respondent shall utilize encryption standards that are FIPS 140-2 compliant or, upon the written approval of CPA’s Chief Information Security Officer, shall meet the intent of the standards as described in FIPS 140-2.

3. The minimum cryptographic algorithm used by Successful Respondent must be Advanced Encryption Standard (AES) 128 or higher (256 AES is preferred).

4. Successful Respondent shall encrypt CPA Data transmitted over a public or private network. CPA approved data encryption transmission protocols include the following: (1) SFTP (FTP over SSH), (2) FTPS (FTP over TLS),

(3) HTTPS (HTTP over TLS), and (4) virtual private network.

h. System Security Plan and Continuous Monitoring Plan. Successful Respondent, in collaboration with CPA, shall develop, implement, and maintain a comprehensive written System Security Plan that contains administrative, technical, and physical safeguards designed to: (i) ensure the confidentiality, integrity and availability of CPA Data;

(ii) protect against unauthorized access to or use of CPA Data; and (iii) comply with all applicable legal and regulatory requirements for data protection. Successful Respondent shall develop, implement, and maintain a plan for the continuous monitoring of security control effectiveness and provide a report to CPA on a quarterly basis. The report shall include evidence that Successful Respondent has implemented security controls correctly, the controls are operating as intended, and the controls are producing the desired outcome with respect to meeting security requirements for the information system(s).

i. Auditable Information Security Framework. Successful Respondent shall secure its own and its third-party service providers’ systems (e.g., IT service provider, Cloud Service Provider) in a manner consistent with an auditable information security framework e.g., National Institute of Standards and Technology (NIST), International Organization for Standardization (ISO) 27001.

j. Defects and Vulnerabilities. Upon Contract award and during the term of the Contract, Successful Respondent shall provide CPA with prompt, written notice upon Successful Respondent’s discovery of any product defects and vulnerabilities of the proposed Licensed System/Solution that allow an attacker to violate an explicit (or implicit) security policy to achieve some impact or consequence. Examples of vulnerabilities include defects that allow intruders to gain increased levels of access or interfere with the normal operations of information systems.

Vulnerabilities caused by insecure configurations, design choices, and changing environmental conditions are additional examples.

k. Supply Chain Risk Management. Successful Respondent shall provide CPA’s Contract Manager a description of how it manages supply chain risks. Specifically, Successful Respondent shall describe its established agreements and procedures with entities involved in the supply chain for the notification of supply chain risks, compromises, and the result of assessments or audits. During the term of the contract, Successful Respondent shall provide CPA’s Contract Manager prompt, written notice of supply chain risks that impact the delivery of the products and services of the Contract. Examples of supply chain risks include supplier financial failure, production control/product quality, market supply and demand, labor disputes/shortages, cybersecurity threats, natural disasters. Successful Respondent shall notify CPA of a supply chain compromise and potential compromise in accordance with Section G Security Incident Notification.

l. Independent Information Security Assessment. If Successful Respondent has access to a CPA Information System or receives, processes, transmits, or stores CPA Data, then Successful Respondent shall provide CPA’s Contract Manager with its most recent information security assessment conducted by an independent third-party (e.g., SSAE-18 SOC 2

RFP # 907-25-1902KW SECO IRA Home Energy Rebates Page 13 of 59

Type II, ISO 27002) upon Contract award and annually thirty (30) days prior to the anniversary of the Contract award date thereafter. CPA, in its sole discretion, may conduct a security assessment of any information system holding CPA Data or connected to a CPA Information System. CPA’s security assessment may consist of a review of the following:

(i) independent third-party assessment(s) contracted by Successful Respondent (e.g., SSAE-18 SOC 2 Type II, ISO 27002) and (ii) Successful Respondent’s System Security Plan.

m. Media Sanitization. Successful Respondent shall sanitize information system media, both digital and non-digital, in accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization) when CPA Data in the custody of Successful Respondent is no longer required to be retained by contract with CPA. Successful Respondent must maintain a record documenting each sanitization procedure that, at a minimum, includes the following information:

(i) date sanitization completed, (ii) description of the item(s), serial number(s), inventory control number(s), if applicable, and (iii) sanitization method used. No later than sixty (60) calendar days from contract expiration or termination or as otherwise specified in the Contract, Successful Respondent must either (i) complete the sanitization and submit via email to the CPA Contract Manager all sanitization documentation or (ii) submit a written statement via email to the CPA Contract Manager explaining the reason that destruction of CPA Data by Successful Respondent is technically impossible or impractical. Successful Respondent’s obligations set forth in this clause survive the termination or expiration of the contract as long as Successful Respondent retains CPA Data.

n. Third-Party Service Providers. It is Successful Respondent’s sole responsibility to ensure that its access and the access Successful Respondent grants to its service providers to CPA Data or CPA Information Systems does not result in unauthorized access to CPA Data or CPA Information Systems.

o. Federal Taxpayer Information. Successful Respondent shall not access, process, store or transmit IRS Federal

Taxpayer Information for or on behalf of CPA unless expressly authorized by a contract with CPA.

p. State Agency Website Requirements. Successful Respondent shall comply with the requirements for state agency websites set forth in 1 Texas Administrative Code §206.

q. Reserved.

r. State Authorization and Risk Management Program (TX-RAMP). Successful Respondent shall obtain TX-RAMP certification in accordance with the Department of Information Resources (DIR) Program Manual. CPA requires the following TX-RAMP certification based-on Agency criteria:

1. __ None. Product is out of scope/low impact in accordance with the DIR TX-RAMP Manual.

2. __ Level 1 Certification. The product will administer Agency public data.

3. __ Level 2 Certification. The product will administer Agency sensitive, confidential, and/or regulated data.

Upon Contract award, Successful Respondent shall maintain compliance with TX-RAMP program requirements and certification throughout the term of the contract. Successful Respondent shall notify the CPA Contract Manager immediately if TX-RAMP certification is revoked or otherwise removed.

If Successful Respondent uses a cloud service provider to host (i.e., Infrastructure as a Service or IaaS) or build (i.e., Platform-as-a-Service or PaaS) a custom-developed CPA system or application, Successful Respondent shall ensure its cloud service provider obtains TX-RAMP certification in accordance with the Department of Information Resources (DIR) Program Manual. If applicable, CPA requires the following TX-RAMP certification based-on Agency criteria:

4. ___ None. Product is out of scope/low impact in accordance with the DIR TX-RAMP Manual.

5. ___ Level 1 Certification. The product will administer Agency public data.

6. _X_ Level 2 Certification. The product will administer Agency sensitive, confidential, and/or regulated data.

Upon Contract award, Successful Respondent shall ensure its cloud service provider used to host or build a custom-developed CPA system or application maintains compliance with TX-RAMP program requirements and certification throughout the term of the contract. Successful Respondent shall notify the CPA Contract Manager immediately if TX-RAMP certification is revoked or otherwise removed.

s. FedRAMP or StateRAMP Authorization. If Successful Respondent obtained TX-RAMP certification through FedRAMP or StateRAMP authorization, upon Contract award, Successful Respondent, shall maintain continuous FedRAMP or StateRAMP acceptable status and notify the CPA Contract Manager immediately if such authorization is revoked or otherwise removed.

D.8 Liquidated Damages. In submitting a Proposal, Respondent agrees that the measure of damages in the event of a default or breach by Successful Respondent may be difficult or impossible to calculate. In the event Successful Respondent fails to perform Services or complete the obligations under the Contract in a timely manner, CPA may require Successful

RFP # 907-25-1902KW SECO IRA Home Energy Rebates Page 14 of 59

Respondent to pay, as liquidated damages and not as a penalty, an amount equivalent to two percent (2%) of the total cost for Services or obligations not completed as required by the Contract per calendar day of delay. CPA may impose, but is not obligated to impose, these liquidated damages in lieu of any monetary damages available to CPA under the Contract or applicable law.

D.9 Optional Features, Products or Services. If Respondent believes there are additional features, products or services that would benefit CPA under this RFP, Respondent may describe such features, products or services and include pricing for such features, products or services in Appendix 1, Mandatory Price Sheet. Optional features, products or services are not scored as part of the evaluation process.

E. Contract Resulting from this Solicitation; Order of Priority

Respondent’s Proposal is a legal offer to contract based upon the terms, conditions, and specifications set forth in this RFP.

“Contract” means (1) a valid PO issued by CPA or (2) a formal, written agreement between CPA and Successful Respondent, if any. The Contract is effective as of the Award Date and will be between CPA and the Successful Respondent. Successful Respondent shall be solely responsible to CPA for all performance by Successful Respondent’s employees, representatives, agents, subcontractors, suppliers, third-party service providers, and similar entities (“Persons” for purposes of this sentence) and for ensuring that all such Persons comply with applicable provisions of this RFP and the Contract. The entire Contract between CPA and Successful Respondent shall consist of the following documents, which shall control in the following order of priority, except as otherwise provided in the formal, signed agreement between the parties or CPA’s PO: (1) the PO and PO Change Notices (POCN), if any; (2) the formal, signed agreement, if any; (3) this RFP; and (4) Successful Respondent’s Proposal (collectively, these documents constitute the “Contract”).

F. Warranty of Performance

Successful Respondent represents and warrants that its performance under the Contract shall be conducted conscientiously in a professional and workmanlike manner to the full extent of Successful Respondent’s talents and capabilities with due diligence and in full compliance with the highest professional standards of practice in the industry applicable to the Services.

G. Security Incident Notification

Successful Respondent shall have policies and procedures for the effective management of Security Incidents, which shall be made available to CPA upon written request. Within twenty-four (24) hours of Successful Respondent’s discovery or reasonable belief that there has been an event which results in the accidental or deliberate unauthorized access, loss, disclosure, modification, disruption, or destruction of confidential CPA information (“Security Incident”), Successful Respondent shall provide notice to CPA by calling (800) 531-5441 EXT 34357. Until the investigation is complete, Successful Respondent shall submit, on a daily basis or as otherwise agreed by CPA, a written report via encrypted email to security.alerts@cpa.texas.gov that includes, at a minimum, the following:

Date and time incident occurred, Date and time incident detected, Date and time incident contained, Address where incident occurred, Name of person(s) that discovered incident, Description of how Successful Respondent discovered incident, Type of CPA information involved, Description of the nature of the incident, Description of the steps Successful Respondent has taken or will take to investigate incident, Description of the steps Successful Respondent has taken or will take to mitigate any negative impacts of incident, Information technology involved (e.g., laptop, server, mainframe), Description of steps…