ESBD_411349_1744812609354_304-26-0960AM Opex Falcon V+ Scanner.pdf

RFO # 304-26-0960AM: Opex Falcon V+ Scanner Page 1 of 48 Rev. 9/8/2023

Texas Comptroller of Public Accounts

Glenn Hegar, Comptroller

Request for Offers

Opex Falcon V+ Scanner

RFO No. 304-26-0960AM

April 16, 2025

Anticipated Schedule of Events

April 16, 2025 Issuance of RFO

April 25, 2025 Deadline for Submission of Questions (2:00 p.m., CT)

May 6, 2025 Release of Official Responses to Questions

(or as soon thereafter as practical)

May 20, 2025 Deadline for Submission of Offers (2:00 p.m. CT)

Late Offers will not be considered

RFO # 304-26-1960AM: Opex Falcon V+ Scanner Page 2 of 48 Rev. 6/27/23

Table of Contents

I. Summary

II. Specifications

A. Introduction

B. Background

C. Definitions and Acronyms

D. Scope of Services

E. Contract Resulting From This Solicitation; Order of Priority

F. Warranty of Performance

G. Security Incident Notification

H. Insurance and Bonds

I. Criminal Background Investigation

J. Contract Term

K. Invoice Acceptance Criteria

L. Payments

M. Discounts

N. PO Addition and Deletion

O. HUB Subcontracting Plan Information

P. Respondent Documents

Q. Respondent Exceptions

R. Respondent’s Past Performance

III. Offer Submission Requirements

A. Delivery of Offer

B. Offer Content and Format

IV. Mandatory Price Sheet

V. Standard Terms and Conditions

VI. Execution of Offer

VII. Conflict of Interest/Disclosure Statement

VIII. Nondisclosure Agreement

IX. Confidential Treatment of Information Acknowledgment

X. Certification Regarding Public Nature of the Offer

XI. Respondent Exceptions Response Template

RFO # 304-26-1960AM: Opex Falcon V+ Scanner Page 3 of 48

I. Summary

1. Type of Solicitation: Request for Offers (RFO)

2. Issuing Office: Texas Comptroller of Public Accounts (CPA)

Procurement Section

Room 300, Attn: RFO No. 304-26-1960AM

111 E. 17th Street

Austin, Texas 78774

OR Texas Comptroller of Public Accounts

Procurement Section

Attn: RFO No. 304-26-1960AM

P.O. Box 12050

Austin, Texas 78711-2050

3. Additional Requirements/Qualifications: N/A

4. Responses to RFO: Sealed Competitive Offers

5. Deadline for Offers: In Issuing Office No Later Than:

May 20, 2025; 2:00 p.m., Central Time (CT)

6. Initial Contract Term: September 1, 2025 to August 31, 2026

7. CPA Optional Contract Terms: September 1, 2026 through August 31, 2027

September 1, 2027 through August 31, 2028 and

September 1, 2028 through August 31, 2029

8. CPA Contact Person for this RFO: Alyssa Mangold, CTCM, CTCD

Email: bidcpa@cpa.texas.gov

9. Offers Submitted by Email: Required; See Section III, Part A

10. Offers Submitted by Fax: Not Accepted

11. Pre-Offer Conference: N/A

12. Pre-Offer Inspection: N/A

13. Letters of Intent to Submit an Offer: N/A

14. RFO Addenda: Notices of changes to items directly impacting the original RFO or solicitation process will be posted on the Electronic State Business Daily

(ESBD) located at: http://www.txsmartbuy.com/esbd. CPA will post any amendment to this solicitation on the ESBD as an RFO Addendum. It is the responsibility of an interested party to check the ESBD for updates to this RFO before submitting an Offer. Each Respondent is solely responsible for verifying CPA’s receipt of its questions, if applicable, and its Offer by the deadlines specified in this RFO.

15. Questions and Answers: Questions regarding this RFO must be in writing and must be submitted to the CPA Contact Person specified in Part 8, no later than April 25, 2025; 2:00 p.m. CT. Telephone inquiries will not be accepted.

Questions may be submitted by email to the email address specified in

Part 8. CPA intends to post answers to the questions received on the

ESBD on May 6, 2023, or as soon thereafter as practical.

16. Respondent Presentations: N/A mailto:bidcpa@cpa.texas.gov http://www.txsmartbuy.com/esbd

RFO # 304-26-1960AM: Opex Falcon V+ Scanner Page 4 of 48

17. Evaluation of Offers. Offers will be evaluated under the Best Value Standard (Section 2157.003 of the Texas

Government Code):

Criteria Weight

Respondent’s Past Performance, Qualifications & Experience 30%

Compliance with CPA Specifications 50%

Cost 20%

Total: 100%

As applicable, the factors listed in Sections 2155.074, 2155.075, 2156.007, and 2157.003 of the Texas Government Code shall also be considered in making an award.

18. Electronic Offers Only. Due to changed building access restrictions, Respondents will not be permitted to hand deliver

Offers to the Issuing Office. Respondents are required to submit Offers electronically via email in accordance with Section

III, Part A.

19. Contact with CPA Staff: Upon issuance of this RFO, employees and representatives of CPA, other than the CPA Contact

Person identified in Part 8, will not discuss the contents of this RFO with any Respondent or its representatives. Failure of a Respondent or any of its representatives to observe this restriction may result in disqualification of any related

Offer. This restriction does not preclude discussions between the parties to conduct business unrelated to this procurement or to obtain assistance completing Historically Underutilized Business (HUB) forms required by this RFO.

RFO # 304-26-1960AM: Opex Falcon V+ Scanner Page 5 of 48

II. Specifications

A. Introduction

The Texas Comptroller of Public Accounts (CPA), an agency of the State of Texas, issues this Request for Offers (RFO) to solicit Offers from qualified vendors for one Opex Falcon V+ Scanner with Control Unit and Full Service Maintenance as described in this Section II and in this RFO (Services). CPA’s objective is to obtain the Services that represent the best value for CPA and the State of Texas, according to the terms and conditions of this RFO.

CPA anticipates making a contract award to one (1) Successful Respondent for the Services. CPA reserves the right not to award a Contract for the performance of all or part of the Services. This RFO is not exclusive and CPA reserves the right to issue additional solicitations regarding the Services or similar services at any time. All

Respondents are encouraged to offer their best pricing at all times.

All costs associated with the Services must be included in the Respondent’s Offer. Offers that do not meet all of the requirements or contain all of the required documentation specified in this RFO may be rejected as non-responsive.

CPA understands that the requested items in this RFO may be proprietary to one vendor under Section 2155.067 of the

Texas Government Code; however, CPA strongly encourages Offers from all qualified Respondents that may be able to provide the Services.

B. Background

CPA is responsible for operating and maintaining the statewide financial accounting systems, state tax administration and collection systems, treasury operations and statewide enterprise resource planning. CPA is a fast-paced agency with approximately 3,000 employees. CPA has six (6) offices in Austin, Texas including its headquarters, thirty-seven (37) field offices across the State of Texas and four (4) out-of-state field offices.

The Comptroller of Public Accounts executed a contract in June 2014 for an Enterprise Content Management System

(ECMS). The ECMS brought in new software, Hyland OnBase and AnyDoc, and set up a new agency document repository, data/remittance entry systems and electronic workflows. A key component of ECMS is the use of Opex

Falcon high volume document scanners.

The functionality of the scanners is critical to ECMS, and only Opex scanners can be used in the division without extensive additional programming. The scanners are used to systematically identify different types of tax forms, identify backup documents, identify checks and capture MICR (magnetic ink character recognition) information and dollar amounts used in electronic deposits, separate checks, and forms and to identify envelopes to mark the end of document sets. In fiscal 2024, the agency processed over 450,000 tax returns, 344,000 checks and 6,770,000 document images through the Opex Falcon scanners.

The Comptroller of Public Accounts is replacing an Opex 7200 scanner used for Disaster Recovery with a Falcon V+ operating under the Windows 11 operating system.

C. Definitions and Acronyms

• Award Date. The Award Date is the earlier of the date an authorized representative of CPA (1) issues a Purchase

Order (“PO”) or (2) signs a formal, written agreement.

• CPA Contract Manager. The end-user division contact responsible for day-to-day contact with Successful

Respondent; contact details to be provided by CPA after the Award Date and/or in the Contract.

• Contract. The agreement, if any, described in Section II, Part E (Contract Resulting from this Solicitation/Order of

Priority).

• Control Unit. The Windows 11 PC which controls the operation of the Opex Falcon V+ scanner.

• Equipment. The Opex Falcon V+ scanner, including all components and software necessary for proper operation of the scanner.

• Licensed Software. Software provided by Opex which controls the functionality of the scanner.

• Offer. A response to this RFO.

RFO # 304-26-1960AM: Opex Falcon V+ Scanner Page 6 of 48

• Respondent. Any person or entity that submits an Offer to this RFO.

• Scanner. The digital high-volume production scanner and any component parts and ancillary equipment that are provided under any contract resulting from this RFO.

• Services. All of the Scanners, Maintenance Services, Licensed Software, Software Maintenance Support, Delivery

Services, Installation Services and Configuration Services and other items listed in this Section and the RFO which are necessary for the Scanners to fully function in CPA’s production environment. Services include, but are not limited to, any shipping charges, freight charges, and any other fees associated with Successful Respondent’s performance under any contract resulting from this RFO.

• Successful Respondent. The Respondent awarded a Contract.

• OEM. Original Equipment Manufacturer.

D. Scope of Services

D.1. General. CPA seeks to purchase one (1) Opex Falcon V Control Unit and Scanner (Equipment) that meets CPA’s minimum requirements as described in this RFO. Successful Respondent’s Services shall include at a minimum the following:

a. Full Service Maintenance: Successful Respondent must provide Full Service Maintenance Services for the

Equipment, including any embedded or licensed Software.

b. Delivery and Installation: The Successful Respondent shall deliver the Opex Falcon V Control Unit and Scanner

(Equipment) with updated Windows 11Operating System and all Opex software loaded and configured. The

Equipment is subject to testing, analysis and hardening by CPA staff. CPA will work with Successful Respondent on any issues detected. (See Section II, Part D.3.1)

c. Testing and Acceptance: The Successful Respondent shall physically unpack, inspect, and verify correct part numbers, power-up, test, and configure all items procured from this RFO. Once acceptance is complete, the

Successful Respondent shall ensure they provide the signed ‘In Production and Acceptance’ certificate. (See Section

II, Part D.3.2)

D.2. Full Service Maintenance Services.

a. General.

Successful Respondent shall provide CPA with full access to the Opex technical assistance center.

Successful Respondent must provide Full Service Maintenance Services for the Equipment, including any embedded or licensed Software.

Full Services Maintenance Services shall include Preventative Maintenance and Remedial Maintenance as described in this Part D.2. Successful Respondent shall be solely responsible for all maintenance of the Equipment. Successful

Respondent may provide Full Service Maintenance Services through its own maintenance program, the OEM

Warranty, or through a sub-contract for maintenance with an authorized third party.

Successful Respondent shall complete all warranty registration procedures and maintain all warranties offered by the

OEM for Equipment that is included in the contract resulting from this RFO. Successful Respondent shall enforce the provisions of the OEM’s warranty to ensure that all Equipment is properly maintained for the duration of the period of performance. Upon request by CPA, Successful Respondent shall provide CPA written proof of OEM warranty entitlement for the Equipment.

All OEM software, storage and hardware specific warranties shall remain effective throughout their original warranty period, whether or not those warranties extend beyond the term(s) of any contract resulting from this RFO.

Respondent must submit in its Offer a firm-fixed annual price for the term set forth in Price Schedule 2 of Section

IV (Mandatory Price Sheet_. All costs associated with Full Service Maintenance Services must be included on the

Mandatory Price Sheet located in Price Schedule 2 of Section IV (Mandatory Price Sheet) of this PR. Successful

Respondent’s pricing for Full Service Maintenance Services shall include all parts, labor, and travel associated with the Full Service Maintenance Services. All Equipment will be located within Austin, Texas. CPA will not pay for any additional travel charges or excess mileage as long as the Equipment is installed at and located in the LBJ State

Office Building, 111 East 17th Street, Austin, Texas, 78774.

RFO # 304-26-1960AM: Opex Falcon V+ Scanner Page 7 of 48

b. Preventative Maintenance.

Preventative Maintenance is defined as all maintenance performed or required to be performed to keep the

Equipment, in operating condition in accordance with OEM published specifications and any additional standards required by this RFO. Successful Respondent shall perform scheduled Preventative Maintenance in accordance with

OEM’s recommended standards during CPA normal business hours.

c. Remedial Maintenance.

Remedial Maintenance includes the following: managing and resolving problems or issues with the Equipment; and technical support services. CPA will consider any repair problem or service request within the scope of Full Service

Maintenance Services.

If Successful Respondent utilizes subcontractors, Successful Respondent must manage each subcontractor(s) to ensure that the subcontractor(s) performs the maintenance in compliance with the Service Level Agreements (SLAs) provided in this RFO. Failure of Successful Respondent to meet the SLAs within the allotted timeframe will entitle

CPA to any and all remedies allowed under the contract resulting from this RFO.

Successful Respondent shall provide on-site maintenance at all CPA locations, unless CPA provides written authorization that such Equipment maintenance repair is eligible for off-site servicing.

d. Support Line and Support Call Center.

Successful Respondent must provide a toll free telephone number support line for CPA repair and technical assistance requests.

Successful Respondent must maintain a Support Call Center to receive CPA’s notifications of Equipment malfunctions and requests of Full Service Maintenance Services. Successful Respondent must staff the Support Call

Center with an adequate number of qualified technical personnel sufficient to meet the following required services levels.

e. Service Levels and Performance Requirements

1. General. In order to maintain CPA designated service levels, Successful Respondent shall be responsible for the following:

a) The vendor must notify Successful Respondent’s representative when the designated service levels have not been met by e mail outlining the cause, steps to be taken for resolution and the expected time for the incident to be resolved.

b) Replace defective Equipment with identical or equivalent Equipment as provided for within this RFO; and

c) Correct issues with Equipment in a timely manner and within the timeframe provided for within this RFO.

2. Service Levels. Successful Respondent shall comply with a standard maintenance service levels as defined in the following table:

Table 1

Service Level Resolution Times

Equipment Response Time

Restore to Service /

Dispatch of Parts

Severity Level A 2-hour phone response 8 business hours

Severity Level B 2-hour phone response 8 business hours

Severity Level C 4-hour phone response 16 business hours

Severity Level D 6-hour phone response 16 business hours

RFO # 304-26-1960AM: Opex Falcon V+ Scanner Page 8 of 48

Table 2

Service Level Descriptions

Severity Levels Descriptions

Severity Level A Problem

Total outage of the Equipment, or an outage of a critical component of the Equipment, rendering the Equipment unusable

Severity Level B Problem

Failure of any component which leaves the Equipment usable, but with diminished performance, capacity, or functionality, e.g. processor failure, memory failure, feature failure

Severity Level C Problem

Failure of any component which leaves the Equipment usable, but with diminished performance, capacity, or functionality, but a work around is available

Severity Level D Problem

Informational problem needs attention before the

Equipment becomes unusable or begins performing with diminished capacity, performance or functionality.

f. Credit for Equipment Malfunction.

Failure by Successful Respondent to meet the Service Level specified in Section I, Part C.8 of this PR will result in a credit to CPA from Successful Respondent in the amount of any fees which may be assessed by CPA in accordance with this Section II, Part D.2.f. If the Equipment remains inoperative for a total of six (6) hours or more in any twenty-four (24) hour period, Successful Respondent will provide a credit to CPA, provided the malfunction was not caused by the fault and negligence of CPA, or was not due to causes external to the equipment. Such credit shall be given for the inoperative Equipment and for any other interconnected equipment deemed unusable as a result of the breakdown. The amount of credit shall be computed as follows: $10,000 for every six (6) hours of downtime.

Downtime for each incident shall start from the time CPA notifies Successful Respondent's designated representative(s) via the specified contact telephone contact number. Downtime shall end when the equipment is returned to full operating condition.

In the event that equipment is inoperable due to equipment failure, and the total number of hours of downtime exceeds 10% of the total scheduled use time during the month for three (3) consecutive calendar months during the term of the contract, as calculated by the CPA Incident Management system, CPA reserves the right to require

Successful Respondent to replace the Equipment with equivalent or better Equipment at Successful Respondent's expense. Refusal of Successful Respondent to promptly replace the Equipment/s will be considered a material breach of contract.

g. Systemic Equipment Issues.

At CPA’s discretion, upon CPA’s written request, CPA will request a new, identically configured replacement for

Equipment that shows signs of systemic issues and which requires a repair four (4) times in a three (3) month rolling period. The Replacement Equipment must be the same model and configuration as the original Equipment provided, or an equivalent model and configuration made available at no additional charge to CPA. Replacement

Equipment will have the same Period of Performance as the Equipment it replaces.

CPA will promptly notify Successful Respondents of the need for Replacement Equipment and disposition of the defective Equipment. Successful Respondent shall provide Replacement Equipment within five (5) business days of

CPA’s written request. If Successful Respondent determines that more than five (5) business days is required to replace the Equipment, Successful Respondent’s Project Manager shall provide CPA with a written explanation. If it is determined that more than ten (10) business days is required to replace the defective Equipment, Successful

Respondent’s Project Manager shall prepare a written explanation for the delay and specify the expected delivery date. If replacement of the Equipment exceeds one month, Successful Respondent shall not charge the monthly service rate for the defective Equipment. Once Successful Respondent delivers the Replacement Equipment to

CPA’s designated location, CPA will release the defective Equipment within ten (10) business days following the delivery date.

h. Maintenance Parts.

RFO # 304-26-1960AM: Opex Falcon V+ Scanner Page 9 of 48

Successful Respondent shall use only new standard parts or parts of equal quality and operating specifications in providing Full Service Maintenance Services. All parts placed into operation shall be deemed to be additions and accessories to the listed equipment involved and shall become part of the Equipment.

With the exception of storage devices (e.g., hard drives) that cannot be securely erased, parts that are removed and replaced by Successful Respondent shall become the property of Successful Respondent. In the event of a failed hard disk drive that requires replacement in applicable Equipment, at any time during the Period of Performance, CPA reserves the right to keep any hard disk drives that Successful Respondent or CPA is unable to successfully erase CPA data from at no additional cost

i. No Additional Charges.

There shall be no additional charges, under any contract resulting from this price request, for the following:

• Preventative Maintenance;

• Remedial Maintenance;

• Remedial Maintenance required again within 48-hours due to a recurrence of the same malfunction;

• Time spent by maintenance personnel after arrival at the site awaiting the arrival of additional maintenance personnel and/or delivery of parts, etc., after maintenance has commenced;

• Remedial Maintenance required when the Scheduled Preventative Maintenance preceding the malfunction had not been performed;

• Replacement parts; or

• Any and all travel expenses associated with Full Service Maintenance Services.

In addition, CPA shall provide reasonable storage space for spare parts and reasonable working space, including heat, light, ventilation, electrical current and outlets for use of Successful Respondent's maintenance personnel.

These facilities shall be within a reasonable distance of the equipment to be serviced and shall be provided at no charge to Successful Respondent.

D.3. Delivery, Installation, Testing, and Acceptance of the Equipment

D.3.1 Delivery and Installation

a. Successful Respondent shall deliver the Equipment on or before August 31, 2025, or other date approved by CPA in writing, to LBJ State Office Building at 111. E. 17th Street, Room 420, Austin, Texas 78701 and shall provide

Installation and Configuration Services associated with the Equipment. This shall occur during normal CPA business hours, which are Monday through Friday, 8:00 A.M. to 4:30 P.M. Central Time.

b. In its Offer, Respondent shall outline the manufacturer’s maximum order lead-time in calendar days. Respondent shall provide the estimated timeframe to order, ship, and deliver the requested equipment.

c. Prior to contract award, CPA will verify delivery dates and times for installation. Successful Respondent will work in a cooperative manner with CPA to finalize the delivery and installation schedule

d. All Opex software should be loaded and configured thirty (30) days prior to the delivery date of the scanner for testing, analysis and hardening by CPA staff. CPA will work with Opex on any issues detected.

e. Successful Respondent shall be responsible for installation of the Equipment. Installation services shall include the full assembly of the Equipment, assembly of any components, connection of cables, and any other reasonably related tasks.

D.3.2 Testing and Acceptance

a. Upon Successful Respondent’s delivery and installation of the Equipment, a standard of performance must be met before CPA accepts any Equipment or replacement Equipment during any term of the contract resulting from this

RFO. Therefore, CPA will conduct acceptance testing for all Equipment acquired from Successful Respondent. CPA will provide written notice to Successful Respondent of the date that CPA will commence acceptance testing.

Acceptance testing will last from the date listed in CPA’s written notice and continue until the Equipment meets the

Minimum Performance Standard for at least thirty (30) consecutive calendar days. In order to meet the Minimum

Performance Standard, the Equipment must:

1. Conform with the OEM technical specifications and functional descriptions;

2. Conform with CPA’s requirements, as set forth by this RFO and any contract resulting from this RFO;

3. Operate without requiring modification(s) to other CPA operational system(s) and network(s); and

RFO # 304-26-1960AM: Opex Falcon V+ Scanner Page 10 of 48

4. Operate without causing performance degradation or malfunctions to CPA operational system(s) and network(s).

b. If the Equipment does not meet the Minimum Performance Standard during acceptance testing, CPA reserves the right, in its sole discretion, to:

1. Request and receive replacement equipment (i.e., new, not used) for such Equipment; or

2. Continue the acceptance testing until the Minimum Performance Standard is met for thirty (30) consecutive calendar days for Control Unit and Scanner; or

3. In the event CPA determines to continue the acceptance testing and the Equipment fails to meet the Minimum

Performance Standard after ninety (90) consecutive calendar days from the commencement date of the acceptance testing, then CPA may, in its sole discretion, terminate that portion of the contract resulting from this RFO without penalty. CPA’s right to terminate that portion of the contract resulting from this RFO after ninety (90) consecutive calendar days will remain effective until the Equipment meets the Minimum

Performance Standard for thirty (30) consecutive calendar days.

c. The official Acceptance Date for Equipment is defined as the day immediately following the day that the Equipment meets the Minimum Performance Standard for thirty (30) consecutive calendar days. The Acceptance Date for

Equipment shall be the date designated by CPA on the Certificates of Acceptance (COA) for Equipment. The date on the COA will be the first day on which Successful Respondent shall be authorized to invoice CPA for such

Equipment and the first day on which CPA will be authorized to compensate Successful Respondent for such amounts. CPA shall not authorize any payments or provide any COAs prior to CPA’s receipt and acceptance of

Services.

D.4 CPA Data Security Terms.

D.4.1 CPA Data Safeguard Standards.

a. Defined Terms. The term “CPA Data” refers to CPA’s information as well as other entity information in the possession of CPA that is processed, stored, or transmitted by a computer. CPA Data includes all data that is generated by

Successful Respondent in performance of a contract with CPA. The term “CPA Information System” refers to those devices, software, networks and related infrastructure that CPA owns, operates or has obtained for use to conduct CPA business. Devices include, but are not limited to, CPA-owned or managed storage, processing, and communications devices, as well as personally owned devices.

b. Access to CPA Data. Successful Respondent represents and warrants that it will implement, maintain, and use appropriate administrative, technical, and physical safeguards to preserve the confidentiality, integrity, and availability of CPA Data. Successful Respondent will not collect, access, use, disclose, or retain CPA Data other than as necessary to perform the services specified in a contract resulting from this solicitation or as otherwise authorized in writing by

CPA. Successful Respondent will restrict access to CPA Data to only those personnel who must have the information on a “need to know” basis. Successful Respondent will not use CPA Data, or any information derived from CPA Data, for its own benefit or the benefit of any other person or entity. Successful Respondent will not share CPA Data with its parent company or other affiliate without CPA’s express written consent.

c. Web-Based Remote Access to CPA Information Systems. Successful Respondent may use third-party web-based remote access connections to CPA Information Systems to provide support services under the following conditions:

1. CPA shall affirmatively initiate and accept Successful Respondent’s connections to CPA Information Systems.

2. CPA shall monitor Successful Respondent’s connections to CPA Information Systems for the duration of the

Services.

3. CPA shall terminate Successful Respondent’s connections to CPA Information Systems upon completion of the

d. Reserved.

e. Reserved.

f. Location of CPA Data. Successful Respondent shall ensure that CPA Data (i.e., primary and backup) remains, at all times, within the continental United States. Successful Respondent shall receive, process, transmit, and store all CPA

Data within the continental United States. Successful Respondent’s point of access to CPA Data shall be within the continental United States.

g. Encryption Standards.

1. Successful Respondent shall encrypt CPA Data in transit and at rest. Data in transit means data is moving via email, in applications, or through browsers and other web connections. Data at rest (including data backups) means data is stored in databases, the cloud, removable media, or mobile devices.

RFO # 304-26-1960AM: Opex Falcon V+ Scanner Page 11 of 48

2. Successful Respondent shall utilize encryption standards that are FIPS 140-2 compliant or, upon the written approval of CPA’s Chief Information Security Officer, shall meet the intent of the standards as described in FIPS

140-2.

3. The minimum cryptographic algorithm used by Successful Respondent must be Advanced Encryption Standard

(AES) 128 or higher (256 AES is preferred).

4. Successful Respondent shall encrypt CPA Data transmitted over a public or private network. CPA approved data encryption transmission protocols include the following: (1) SFTP (FTP over SSH), (2) FTPS (FTP over TLS),

(3) HTTPS (HTTP over TLS), and (4) virtual private network.

h. Reserved.

i. Auditable Information Security Framework. Successful Respondent shall secure its own and its third-party service providers’ systems (e.g., IT service provider, Cloud Service Provider) in a manner consistent with an auditable information security framework e.g., National Institute of Standards and Technology (NIST), International

Organization for Standardization (ISO) 27001.

j. Defects and Vulnerabilities. Upon Contract award and during the term of the Contract, Successful Respondent shall provide CPA with prompt, written notice upon Successful Respondent’s discovery of any product defects and vulnerabilities of the proposed Licensed System/Software/Solution that allow an attacker to violate an explicit (or implicit) security policy to achieve some impact or consequence. Examples of vulnerabilities include defects that allow intruders to gain increased levels of access or interfere with the normal operations of information systems.

Vulnerabilities caused by insecure configurations, design choices, and changing environmental conditions are additional examples.

k. Supply Chain Risk Management. Successful Respondent shall provide CPA’s Contract Manager a description of how it manages supply chain risks. Specifically, Successful Respondent shall describe its established agreements and procedures with entities involved in the supply chain for the notification of supply chain risks, compromises, and the result of assessments or audits. During the term of the contract, Successful Respondent shall provide CPA’s Contract

Manager prompt, written notice of supply chain risks that impact the delivery of the products and services of the

Contract. Examples of supply chain risks include supplier financial failure, production control/product quality, market supply and demand, labor disputes/shortages, cybersecurity threats, natural disasters. Successful Respondent shall notify CPA of a supply chain compromise and potential compromise in accordance with Section G Security Incident

Notification.

l. Reserved.

m. Media Sanitization. Successful Respondent shall sanitize information system media, both digital and non-digital, in accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization) when CPA Data in the custody of Successful Respondent is no longer required to be retained by contract with CPA. Successful Respondent must maintain a record documenting each sanitization procedure that, at a minimum, includes the following information:

(i) date sanitization completed, (ii) description of the item(s), serial number(s), inventory control number(s), if applicable, and (iii) sanitization method used. No later than sixty (60) calendar days from contract expiration or termination or as otherwise specified in the Contract, Successful Respondent must either (i) complete the sanitization and submit via email to the CPA Contract Manager all sanitization documentation or (ii) submit a written statement via email to the CPA Contract Manager explaining the reason that destruction of CPA Data by Successful Respondent is technically impossible or impractical. Successful Respondent’s obligations set forth in this clause survive the termination or expiration of the contract as long as Successful Respondent retains CPA Data.

n. Third-Party Service Providers. It is Successful Respondent’s sole responsibility to ensure that its access and the access

Successful Respondent grants to its service providers to CPA Data or CPA Information Systems does not result in unauthorized access to CPA Data or CPA Information Systems.

o. Reserved.

p. Reserved.

q. Reserved.

r. Reserved.

RFO # 304-26-1960AM: Opex Falcon V+ Scanner Page 12 of 48

s. Reserved.

t. Reserved.

u. Service Provider, Outsourced, and Cloud Computing. Regardless of TX-RAMP certification, the following requirements apply if Successful Respondent is a Service Provider or Cloud Service Provider (CSP) or contracts with a CSP or other Data Center to receive, process, transmit, or store CPA Data.

1. Security Control Verification. Upon Contract award and annually thereafter, Successful Respondent shall provide to CPA evidence that it has implemented security controls correctly, the controls are operating as intended, and the controls are producing the desired outcome with respect to meeting security requirements for the information system. Acceptable documentation includes:

• SSAE-18 SOC 2 Type II Report (or the updated, equivalent report);

• FedRAMP certification (CPA preferred option for CSP);

• Level Two: Cloud Security Alliance (CSA) Security, Trust & Assurance Registry (STAR) Attestation;

• Level Two: CSA STAR Certification;

• Level One: CSA STAR Self-Assessment;

• Completed CSA Cloud Controls Matrix (CCM) and CSA Consensus Assessment Initiative Questionnaire;

• CSA CCM;

• Successful Respondent information security plan; and

• Successful Respondent information security policies and procedures.

2. Department of Information Resources Security Control Standards Catalog. At a minimum, Successful Respondent shall comply with the control baselines established by the Security Control Standards Catalog, all CPA specific security requirements, and any other applicable federal or statutory requirements.

3. Penetration Test. Successful Respondent shall ensure that information system(s) that receive, process, transmit, or store CPA Data undergo an independent third-party annual penetration test. Successful Respondent shall provide a summary of the penetration test results to CPA annually thirty (30) days prior to the anniversary of the

Contract award date. Successful Respondent shall coordinate with CPA to schedule the initial penetration test and subsequent annual penetration tests during the term of the Contract.

4. Information System(s) Architecture. For information system(s) that receive, process, transmit, or store CPA Data, Successful Respondent shall develop and maintain a comprehensive architectural diagram that identifies the information system (s) components and environment, including ports, protocols, and services. Successful

Respondent shall protect the architectural diagram from unauthorized access, disclosure, modification, and /or destruction. Successful Respondent shall provide the diagram to CPA annually.

5. Configuration Minimum Requirements.

a) Successful Respondent shall implement (SAML) an XML-based standard (CPA preferred) or OpenID

Connect (OIDC) for exchanging authentication and authorization data for identity management of CPA internal users. If Successful Respondent is technically incapable of integrating with CPA’s identity services provider, Successful Respondent shall ensure identifier and authenticator controls are consistent with CPA standards.

b) Successful Respondent shall remove root access, where feasible, to information system(s) that receive, process, transmit, or store CPA Data.

c) Successful Respondent shall prohibit Privileged User access to CPA data on information system(s) that receive, process, transmit, or store CPA data.

d) Successful Respondent shall employ multifactor authentication for Privileged Users who support information system(s) that receive, process, transmit, or store CPA Data when accessing CPA Information System(s).

e) Pursuant to Section 2054.192 of the Texas Government Code, Privileged Users that have access to a CPA

Information System shall complete the CPA-Required Security Awareness Training described in Part D.#.1.e above.

f) Secure Baseline Configuration. Successful Respondent shall develop secure baseline configurations for information system(s), components, or services that receive, process, transmit, or store CPA Data in accordance with industry best practices (e.g., U.S. Government Configuration Baseline (USGCB), Center for

Internet Security (CIS) Benchmarks). In the absence of an industry defined secure configuration, Successful

Respondent shall develop a baseline for information system(s), components, or services in collaboration with

CPA.

g) Audit Information. For information system(s) that receive, process, transmit, or store CPA Data, Successful

Respondent shall enable information system(s) auditing to the greatest extent necessary to capture access, modification, and deletion of data by each unique user and Privileged User system access and actions. Audit controls shall ensure the movement of sensitive, confidential, and regulated data is traceable throughout the data lifecycle. Audit records shall contain date, time, type, source, and outcome of system event, the user https://dir.texas.gov/sites/default/files/2023-06/Security%20Control%20Standards%20Catalog%202.1%20for%20Web%20-%20UPDATED%206.21.23.pdf

RFO # 304-26-1960AM: Opex Falcon V+ Scanner Page 13 of 48 account involved, service account, service, or process responsible for initiating the system event, and other information that facilitates reconstruction of events. Successful Respondent shall protect audit information from unauthorized access and modification. Successful Respondent shall share audit information with CPA upon request.

h) Successful Respondent shall configure information system(s) that receive, process, transmit, or store CPA

Data to deny local network mapping and prevent copy and paste from the information system(s) to unapproved workstations, laptops, or terminals.

6. Configuration Management Plan. Successful Respondent shall develop a Configuration Management Plan for information system(s) that receive, process, transmit, or store CPA Data. The Configuration Management Plan must include a comprehensive description of the roles, responsibilities, policies, and procedures that apply when managing the configuration of products and systems. The Configuration Management Plan may be an all-inclusive, stand-alone document or may be comprised of more broadly defined configuration management procedures contained in multiple documents. CPA shall review and approve the Configuration Management Plan annually during the contract term. Successful Respondent shall treat the Configuration Management Plan as confidential CPA information and protect the Configuration Management Plan from unauthorized disclosure and modification.

7. Data Center Resiliency, Environmental Protections, and Physical Security. Successful Respondent shall provide multiple geographic regions and availability zones to ensure resiliency in the event of natural disasters, common equipment failures, or information system failures. The data center(s) shall ensure electrical power systems are fully redundant and maintainable without interruption to continuous operations. Data center(s) shall provide backup power through various mechanisms including, but not limited to, UPS batteries. Data center(s) backup power shall supply consistently reliable power protection during utility brownouts, blackouts, over voltage, under voltage, and out-of-tolerance frequency conditions. The data center(s) shall use generators to provide power to critical equipment and customer loads. Trained security personnel shall staff the data center(s) twenty-four (24) hours a day, seven (7) days a week. Data center(s) shall use a security organization responsible for physical security functions to monitor its data center(s). The data center(s) shall have state-of-the-art electronic surveillance and multi-factor access control systems. Successful Respondent and/or CSP shall authorize physical access to its data center(s) strictly on a least privilege basis and access control systems shall log unauthorized activity and failed access attempts.

8. Roles and Responsibilities. Successful Respondent and CPA shall define and document CPA oversight and user roles and responsibilities with regard to the outsourced and/or CSP information system(s) that receive, process, transmit, or store CPA Data.

9. Vulnerability Assessment and Continuous Monitoring. For information system(s) that receive, process, transmit, or store CPA Data, Successful Respondent shall employ vulnerability scanning tools and techniques to identify information system(s) flaws, improper configurations, and vulnerabilities. Successful Respondent shall conduct information system(s) scans at least monthly and remediate and mitigate vulnerabilities in accordance with the

National Institute of Standards and Technology National Vulnerability Database Common Vulnerability Scoring

System (CVSS). Successful Respondent shall report vulnerability assessment results and remediation efforts to

CPA on a monthly basis.

10. Court and Administrative Orders. Except as otherwise required by law, the Successful Respondent and/or CSP shall promptly notify CPA of any subpoena, judicial, or administrative order that it receives and that relates to

CPA Data held by the CSP or other data center.

11. Transition of CPA Data. Following termination of the Services, Successful Respondent shall, for no additional compensation, aid in the timely and secure transition of CPA Data to CPA or CPA’s designated service provider in a secure agreed file format usable without the outsourced information system or cloud service.

D.5 Accessibility Compliance. Successful Respondent shall provide Licensed Software that complies with the applicable, statutorily required accessibility standards for the State of Texas. In the event that the Licensed Software does not meet or exceed the applicable statutorily required accessibility standards for the State of Texas, Successful Respondent shall provide technical support and Licensed Software documentation necessary to enable CPA to comply with the

State of Texas reporting requirements outlined in 1 Texas Administrative Code Chapters 206 and 213. Such assistance includes, but is not limited to, Successful Respondent providing a Voluntary Product Accessibility Template (VPAT) or a similar report in substantially the same format as a VPAT. Successful Respondent shall respond to all written inquiries from CPA regarding the Licensed Software’s compliance with requisite accessibility standards within five

(5) business days of receiving such request.

D.6 Liquidated Damages. In submitting an Offer, Respondent agrees that the measure of damages in the event of a default or breach of contract by Successful Respondent may be difficult or impossible to calculate. In the event Successful

Respondent fails to perform Services or complete the obligations under the Contract in a timely manner, CPA may require Successful Respondent to pay, as liquidated damages and not as a penalty, an amount equivalent to two percent

RFO # 304-26-1960AM: Opex Falcon V+ Scanner Page 14 of 48

(2%) of the total cost for Services or obligations not completed as required by the Contract per calendar day of delay.

CPA may impose, but is not obligated to impose, these liquidated damages in lieu of any monetary damages available to CPA under the Contract or applicable law.

D.7 Optional Features, Products or Services. If Respondent believes there are additional features, products or services that would benefit CPA under this RFO, Respondent may describe such features, products or services in its Offer and include pricing for such features, products or services in the Mandatory Price Sheet. Optional features, products or services are not scored as part of the evaluation process.

E. Contract Resulting From This Solicitation; Order of Priority.

Respondent’s Offer is a legal offer to contract based upon the terms, conditions, and specifications set forth in this RFO.

A contract award by CPA may be by (1) valid PO or (2) a formal, written agreement between CPA and Successful

Respondent. The Contract is effective as of the Award Date and will be between CPA and the Successful Respondent. The entire Contract between CPA and Successful Respondent shall consist of the following documents, which shall control in the following order of priority, except as otherwise provided in the formal signed agreement or PO: (1) the PO and PO

Change Notices, if any; (2) the formal, signed agreement, if any; (3) this RFO; and (4) Successful Respondent’s Offer

(collectively, the “Contract”).

F. Warranty of Performance

Successful Respondent represents and warrants that its performance under the Contract shall be conducted conscientiously in a professional and workmanlike manner to the full extent of Successful Respondent’s talents and capabilities with due diligence and in full compliance with the highest professional standards of practice in the industry applicable to the

G. Security Incident Notification

Successful Respondent shall have policies and procedures for the effective management of Security Incidents, which shall be made available to CPA upon written request. Within twenty-four (24) hours of Successful Respondent’s discovery or reasonable belief that there has been an event which results in the accidental or deliberate unauthorized access, loss, disclosure, modification, disruption, or destruction of confidential CPA information (“Security Incident”), Successful

Respondent shall provide notice to CPA by calling (800) 531-5441 EXT 34357. Until the investigation is complete, Successful Respondent shall submit, on a daily basis or as otherwise agreed by CPA, a written report via encrypted email to security.alerts@cpa.texas.gov that includes, at a minimum, the following:

• Date and time incident occurred,

• Date and time incident detected,

• Date and time incident contained,

• Address where incident occurred,

• Name of person(s) that discovered incident,

• Description of how Successful Respondent discovered incident,

• Type of CPA information involved,

• Description of the nature of the incident,

• Description of the steps Successful Respondent has taken or will take to investigate incident,

• Description of the steps Successful Respondent has taken or will take to mitigate any negative impacts of incident,

• Information technology involved (e.g., laptop, server, mainframe),

• Description of steps taken to preserve computer evidence and maintain chain of custody, and

• Description of corrective action Successful Respondent has taken or will take to prevent future incidents.

Successful Respondent shall coordinate all media or other breach notifications with CPA in advance of such notification(s), unless expressly prohibited by law. Subject to review and approval of CPA, Successful Respondent shall provide notice at its own cost that satisfies the requirements of applicable law to individuals whose information was compromised or likely compromised as a result of the Security Incident. If CPA, in its sole discretion, elects to send its own separate notice, then all costs associated with preparing and providing the notice shall be reimbursed to CPA by Successful Respondent. If

Successful Respondent does not reimburse such costs within thirty (30) days of CPA’s written request, then CPA shall have the right to collect such costs. CPA reserves the right to conduct an independent investigation of any Security Incident, and should CPA choose to do so, Successful Respondent shall cooperate fully with CPA and assume responsibility at its own expense for making personnel, resources, and systems access available to CPA and CPA’s authorized representative(s).

mailto:security.alerts@cpa.texas.gov

RFO # 304-26-1960AM: Opex Falcon V+ Scanner Page 15 of 48

H. Insurance and Bonds

Successful Respondent represents and warrants that it shall obtain and maintain the following coverages throughout the term of the Contract and that all coverages shall be with companies licensed in Texas with an “A” rating from A.M. Best

Co. authorized to provide the required coverages:

• Blanket Employee Dishonesty Bond or Employee Dishonesty Coverage under a liability insurance policy with a minimum $25,000 for each individual who will provide Services. A rider or endorsement shall name the Texas

Comptroller of Public Accounts as loss payee or additional named insured under the respective bond or policy;

• Standard Workers Compensation Insurance covering all individuals who will provide Services;

• Commercial General Liability Insurance: $1,000,000 minimum each occurrence limit; $2,000,000 minimum aggregate limit;

• Professional Liability Insurance: $1,000,000 minimum each occurrence limit; $2,000,000 minimum aggregate limit;

and

• Cyber Liability Insurance: $1,000,000 minimum per incident or claim and $2,000,000 minimum aggregate limit.

This policy must include, at a…