ESBD_441616_1753902539897_304-26-0214JW Credit Reporting Services.pdf

RFP # 304-26-0214JW: Credit Reporting Services Page 1 of 46

(Rev. 2/2024)

Request for Proposals

Credit Reporting Services

RFP No. 304-26-0214JW

Issuance Date: July 30, 2025

Anticipated Schedule of Events

July 30, 2025 Issuance of RFP

August 6, 2025 Deadline for Submission of Questions (2:00 p.m., CT)

August 13, 2025 Release of Official Responses to Questions

(or as soon thereafter as practical)

August 19, 2025 Deadline for Submission of Proposals (2:00 p.m. CT)

Late Proposals will not be considered

August 25, 2025 Presentations from Top-Ranked Respondents

(If presentations requested by CPA, dates and times to be scheduled)

September 1, 2025 Services Commencement Date

(or as soon thereafter as practical)

RFP # 304-26-0214JW Credit Reporting Services Page 2 of 46

Table of Contents

I. Summary

II. Specifications

A. Introduction

B. Background

C. Definitions and Acronyms

D. Scope of Services

E. Contract Resulting from this Solicitation; Order of Priority

F. Warranty of Performance

G. Security Incident Notification

H. Insurance and Bonds

I. Criminal Background Investigation

J. Contract Term; Survival of Terms

K. Acceptance Criteria

L. Payments

M. Discounts

N. PO Addition and Deletion

O. HUB Subcontracting Plan Information

P. Respondent Documents

Q. Respondent Exceptions

R. Respondent’s Past Performance; Vendor Performance Tracking System

III. Proposal Submission Requirements

A. Delivery of Proposal

B. Proposal Content and Format

IV. Mandatory Price Sheet

V. Standard Terms and Conditions

VI. Execution of Proposal

VII. Conflict of Interest/Disclosure Statement

VIII. Nondisclosure Agreement

IX. Confidential Treatment of Information Acknowledgment

X. Certification Regarding Public Nature of the Proposal

XI. Contractor Cybersecurity Training Attestation Form

XII. Respondent Exceptions

RFP # 304-26-0214JW Credit Reporting Services Page 3 of 46

I. Summary

1. Type of Solicitation: Request for Proposals (RFP)

2. Issuing Office: Texas Comptroller of Public Accounts (CPA)

Procurement Section

Room 300, Attn: RFP No. 304-26-0214JW

111 E. 17th Street

Austin, Texas 78774

3. Additional Requirements/Qualifications: N/A

4. Responses to RFP: Sealed Competitive Proposals

5. Deadline for Proposals: In Issuing Office No Later Than:

July 30, 2025; 2:00 p.m., Central Time (CT)

6. Initial Contract Term: September 1, 2025 through August 31, 2026

7. CPA Optional Contract Terms: September 1, 2026 through August 31, 2027

September 1, 2027 through August 31, 2028 and

September 1, 2028 through August 31, 2029

8. CPA Contact Person for this RFP: Jennifer Williams, CTCD, CTCM

Email with delivery receipt requested to: bidcpa@cpa.texas.gov

9. Proposals Submitted by Email: Required; See Section III, Part A

10. Proposals Submitted by Fax: Not Accepted

11. Pre-Proposal Conference: N/A

12. Pre-Proposal Inspection: N/A

13. Letters of Intent to Submit a Proposal: N/A

14. RFP Addenda: Notices of changes to items directly impacting the original RFP or solicitation process will be posted on the Electronic State Business

Daily (ESBD) located at: http://www.txsmartbuy.com/esbd. CPA will post any amendment to this solicitation on the ESBD as an RFP

Addendum. It is the responsibility of an interested party to check the

ESBD for updates to this RFP before submitting a Proposal. Each

Respondent is solely responsible for verifying CPA’s receipt of its questions, if applicable, and its Proposal by the deadlines specified in this RFP.

15. Questions and Answers: Questions regarding this RFP must be in writing and must be submitted to the CPA Contact Person specified in Part 8, no later than August 6, 2025; 2:00 p.m. CT. Telephone inquiries will not be accepted. Questions may be submitted by email to the email address specified in Part 8. CPA intends to post answers to the questions received on the ESBD on August 13, 2025, or as soon thereafter as practical.

16. Respondent Presentations: CPA may request that Top-Scoring Respondents present an overview of the services, and a demonstration of the software proposed in their Proposals. The presentations will be performed on or about August 25, 2025. Presentation location (e.g., videoconference, onsite, etc.), date(s) and time(s) to be arranged. In its sole discretion, CPA will determine the number of Top-Scoring

Respondents.

17. Evaluation of Proposals under Best Value Standard (Section 2156.125 of the Texas Government Code):

Criteria Weight

Respondent’s Past Performance, Qualifications & Experience 20%

Compliance with CPA Specifications 50%

Cost 30%

Total: 100% mailto:bidcpa@cpa.texas.gov http://www.txsmartbuy.com/esbd

RFP # 304-26-0214JW Credit Reporting Services Page 4 of 46

As applicable, the factors listed in Sections 2155.074, 2155.075, 2156.007, and 2157.003 of the Texas Government

Code shall also be considered in making an award. Best and Final Offers may be sought from Respondents whose

Proposals are ranked most highly by the evaluation committee. However, CPA encourages Respondents to offer their best pricing at all times. CPA reserves the right in its sole judgment and discretion, and at any time upon failure of negotiations, to reissue or withdraw this RFP rather than continue with negotiations.

18. Email Submission Only. Due to changed building access restrictions, Respondents will not be permitted to hand deliver Proposals to the Issuing Office. Respondents are required to submit Proposals electronically via email with delivery receipt requested in accordance with Section III, Part A.

19. Contact with CPA Staff: Upon issuance of this RFP, employees and representatives of CPA, other than the CPA

Contact Person identified in Part 8, will not discuss the contents of this RFP with any Respondent or its representatives.

Failure of a Respondent or any of its representatives to observe this restriction may result in disqualification of any related Proposal. This restriction does not preclude discussions between the parties to conduct business unrelated to this procurement or to obtain assistance completing Historically Underutilized Business (HUB) forms required by this RFP.

RFP # 304-26-0214JW Credit Reporting Services Page 5 of 46

II. Specifications

A. Introduction

The Texas Comptroller of Public Accounts (CPA), an agency of the State of Texas, issues this Request for Proposals (RFP) to solicit Proposals from qualified vendors for Credit Reporting Services, as described in this Section II and in this RFP

(Services). CPA’s objective is to obtain the Services that represent the best value for CPA and the State of Texas according to the terms and conditions of this RFP.

CPA anticipates making a Contract award to one (1) Successful Respondent for the Services. CPA reserves the right not to award a Contract for the performance of all or part of the Services. This RFP is not exclusive and CPA reserves the right to issue additional solicitations regarding the Services or similar services at any time. All

Respondents are encouraged to offer their best pricing at all times.

All costs associated with the Services must be included in the Respondent’s Proposal. Proposals that do not meet all of the requirements or contain all of the required documentation specified in this RFP will be rejected as non-responsive.

B. Background

CPA’s Enforcement Division and Human Resources (HR) Division have identified continuing need for certain Credit

Reporting Services to enable their individual divisions to fulfill their responsibilities.

CPA’s Enforcement Division. CPA’s Enforcement Division collects delinquent taxes and provides taxpayer services to promote compliance with the tax laws administered by CPA. CPA’s Enforcement Division uses Credit Reporting Services to obtain Consumer Credit Report information, excluding credit scores, under the Credit Transaction Permissible Purpose to assist CPA in the collection of taxes owed to the state by a consumer (individual or business). CPA’s Enforcement

Division Credit Transaction Permissible Purpose inquiries are conducted without the knowledge of such consumer.

CPA’s Enforcement Division Consumer Credit Report inquiry volume and expense for the two (2) Fiscal Years immediately preceding the current Fiscal Year include:

Average monthly volume of inquiries: 339

Average monthly cost (aggregate, all Fiscal Years): $ 321.65

Fiscal Year Total Volume of Inquiries Annual Cost of Inquiries

FY23 6,283 $5,968.85

FY24 3,364 $2,907.00

CPA’s HR Division. CPA’s HR Division conducts pre-employment and employment screening that includes using

Employment Credit Report information as part of such screening for certain employee positions. CPA’s HR Division uses

Credit Reporting Services to obtain Employment Credit Report information, excluding credit scores, under the

Employment Use Permissible Purpose to assist CPA in completing pre-employment and employment screening for certain employee positions. CPA’s HR Division Employment Use Permissible Purposes inquiries will be conducted with CPA providing to the consumer advance disclosure of CPA’s intent to obtain the Employment Credit Report and CPA obtaining the consumer’s authorized written consent for the procurement of the Employment Credit Report.

CPA’s HR Division Employment Credit Report inquiry volume and expense for the two (2) FY immediately preceding the current FY includes:

Fiscal Year Total Volume of Inquiries Annual Cost of Inquiries

FY23 15 $69.15

FY24 60 $271.99

Through issuance of this RFP and award of Contract, CPA seeks to obtain from a qualified entity the Services essential to fulfilling the business needs of CPA’s Enforcement Division and CPA’s HR Division.

C. Definitions and Acronyms

• Award Date. The Award Date is the earlier of the date an authorized representative of CPA (1) issues a Purchase

Order (PO) or (2) signs a formal, written agreement.

RFP # 304-26-0214JW Credit Reporting Services Page 6 of 46

• Active Directory Federation Services. A single sign-on (SSO) solution developed by Microsoft that allows users to access applications and resources across organizational boundaries using a single set of credentials

• CPA’s Designated Representative. CPA staff, such as a project manager or contract monitor, designated to serve as the CPA point of contact for certain project related communications and activities during performance of work under the Contract.

• Consumer Credit Report. Any written, oral, or other communication of any information by a Consumer Reporting

Agency bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or part for the purpose of serving as a factor in connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of the consumer, or other purpose authorized under Sections 603 and 604 of the Fair Credit Reporting Act (15 U.S.C. §§ 1681a-1681x), as amended. For purposes of this RFP and the Services, a Consumer Credit Report shall not include a Consumer’s credit score.

• Consumer Reporting Agency (CRA). A person that regularly engages wholly or partly in the practice of assembling or evaluating consumer credit information or other information on consumers to furnish consumer reports to third parties for monetary fees, for dues, or on a cooperative nonprofit basis. The term does not include a business entity that provides only check verification or check guarantee services.

• Contract. The agreement described in Section II, Part E (Contract Resulting from this Solicitation; Order of Priority), if any.

• Credit Reporting Services (Services). All services necessary for Respondent to provide to CPA accurate Consumer

Credit Reports and Employment Credit Reports that shall include, but not be limited to, a consumer’s (individual or business entity) identifying information, public records, and any other related information permissible under applicable law to be released in such Consumer Credit Reports or Employment Credit Reports.

• Credit Transaction Permissible Purpose. Furnishing of a consumer report from a consumer reporting agency to a person that intends to use the information in connection with a credit transaction involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer as provided under Section 604(a)(3)(A) of the Fair Credit Reporting Act.

• Days. The word “days” shall mean calendar days unless otherwise specified.

• Employment Credit Report. Any written, oral, or other communication of any information by a Consumer Reporting

Agency bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or part for the purpose of serving as a factor in connection with establishing the consumer’s eligibility for employment, promotion, reassignment or retention as an employee as authorized under Sections 603 and 604 of the Fair Credit Reporting Act

(15 U.S.C. §§ 1681a-1681x), as amended. For purposes of this RFP and the Services, a Consumer Report shall not include a Consumer’s credit score.

• Employment Use Permissible Purpose. Furnishing of a consumer report from a consumer reporting agency to a person that intends to use the information for employment purposes as provided under Section 604(a)(3)(A) and in compliance with Section 604(b) of the Fair Credit Reporting Act.

• Fair Credit Reporting Act (FCRA). Title VI of the Federal Consumer Credit Protection Act (15 U.S.C. §§ 1681a-

1681x, as amended) that protects information collected by consumer reporting agencies and promotes accuracy, fairness, and privacy of consumer information contained in the files of consumer reporting agencies.

• Fiscal Year (FY). The State of Texas and CPA’s fiscal year that begins on September 1 of one year and ends on

August 31.

• Lightweight Directory Access Protocol. A protocol used for accessing and maintaining distributed directory information services over an IP network (like Active Directory).

• Proposal. A response to this RFP.

• Respondent. Any person or entity that submits a Proposal.

• Respondent’s System (System). Respondent’s internet-based, secured access portal, website and searchable

Consumer Reporting Agency database that furnishes downloadable and printable, accurate Consumer Reports.

• Successful Respondent. The Respondent awarded a Contract.

D. Scope of Services

D.1. General

a. Respondent’s pricing in Price Schedule 1, Section IV (Mandatory Price Sheet) shall be quoted as per each completed transaction (includes inquiry and results).

RFP # 304-26-0214JW Credit Reporting Services Page 7 of 46

b. Successful Respondent shall provide all Credit Reporting Services in Price Schedule 1, Section IV (Mandatory

Price Sheet) and all Optional Features, Products or Services in Price Schedule 2, Section IV (Mandatory Price

Sheet) that are accepted by CPA.

c. During the Proposal evaluation phase, Respondent shall provide CPA access to Respondent’s System to conduct test inquiries for purposes of evaluation and scoring.

1) Respondent must allow CPA secure and fully functional access to its System for a period of eight (8) hours over the course of one week to test and verify the functionality of the System.

2) Respondent’s Proposal must include contact information for its designated point of contact for CPA to coordinate access to Respondent’s System for the required one-week testing period.

3) All access to Respondent’s System and all of CPA’s evaluation phase tests of Respondent’s System shall be provided by Respondent at no cost to CPA.

d. Successful Respondent’s Credit Reporting Services activities and actions must comply with all applicable federal and state laws, rules and regulations, including those regarding disclosure of personal identification information, and shall specifically comply with the requirements of the FCRA.

D.2. System Requirements

a. CPA System. CPA’s system consists of an IBM mainframe computer with networked Windows personal computers. CPA’s system operates using Windows 11 Enterprise Version 1909 with proprietary software and off the shelf software. Respondent’s platform must be compatible with and accessible using the latest versions of

Microsoft Edge and Google Chrome internet browsers and must not require installation of software by CPA. CPA will access Successful Respondent’s System using authorized, secured, data encrypted passwords.

b. Successful Respondent’s System. Successful Respondent’s System shall grant CPA access to Successful

Respondent’s searchable CRA database for CPA to conduct inquiries and obtain Consumer Credit Report information and Employment Credit information under applicable permissible purposes of the FCRA.

c. System Availability and Performance. Successful Respondent must provide CPA with secure and fully functional access to its System Monday through Friday during all hours of 7:00 a.m. through 6:00 p.m. CT (CPA

Business Hours). Any routine maintenance of Successful Respondent’s System, website or database used by CPA must be performed outside CPA Business Hours. Successful Respondent must notify CPA twenty-four (24) hours in advance of any scheduled maintenance which would result in any System downtime. Such notification shall include the type of maintenance being performed and the duration of the scheduled downtime. Respondent must provide CPA with an estimated time to restore services when access is unavailable to CPA for more than thirty

(30) minutes during CPA Business Hours.

d. Security and Access Control.

1) Confidentiality and Security. Successful Respondent must encrypt all data transmissions to ensure the confidentiality and security of all data provided to or requested by CPA. Access must automatically terminate

(time-out) a user’s session following thirty (30) minutes of inactivity.

2) User Access and Control. Successful Respondent must provide access to the System and training for up to ten (10) CPA authorized users. Within the pool of access for up to ten (10) CPA authorized users, Successful

Respondent shall include one (1) to three (3) administrative accounts for purposes of online access to the

System. If feasible, Successful Respondent shall implement Active Directory Federation Services (CPA preferred) or Lightweight Directory Access Protocol for identity management of CPA internal users. At a minimum, user access and control to Successful Respondent’s System shall require each CPA authorized user to log in using a unique username and password to access the System. CPA’s Designated Representative shall maintain and regularly update users and account access. Successful Respondent shall provide for regular password resets for CPA user access accounts.

D.3. Reports Requirements

a. Successful Respondent must provide CPA with Consumer Credit Reports and Employment Credit Reports that contain the most current and accurate information and must comply with all applicable federal and state laws, rules, and regulations regarding disclosure of personal identification information when providing CPA with consumer data and related reports.

b. Consumer Credit Inquiries; Consumer Credit Reports.

1) Consumer Credit Inquiries.

a) CPA shall access Successful Respondent’s System to conduct Consumer Credit Report inquiries under the Credit Transaction Permissible Purpose.

RFP # 304-26-0214JW Credit Reporting Services Page 8 of 46

b) Successful Respondent’s System shall allow CPA’s Enforcement Division to conduct Consumer Credit

Report inquiries without the knowledge of the consumer owing taxes to the state.

c) Successful Respondent shall set its System so that all Consumer Credit Report inquiries conducted by

CPA authorized users are reflected as soft inquiries.

d) Respondent’s Proposal must include Respondent’s procedures to report and address Consumer Credit

Reports run in error by providing a point of contact and appropriate documentation (e.g., authorization letter, deletion letter) that Comptroller’s Designative Representative must complete and provide to the consumer.

e) CPA’s Enforcement Division will not retain or save results from Consumer Credit Report inquiries conducted by CPA.

2) Consumer Credit Reports. Successful Respondent shall provide CPA’s Enforcement Division access to a robust CRA System capable of delivering Consumer Credit Reports that

a) Exclude credit scores, and

b) Include multiple data fields. While CPA requires some data fields be included in Consumer Credit

Reports delivered by Respondent’s System, Respondent’s Proposal shall clearly indicate which of the following data fields may be included in a Consumer Credit Report resulting from a CPA inquiry using

Respondent’s System.

• Name (First, Last, Middle)*

• Aliases (AKAs) and former names*

• Social Security Number (SSN)*

• Date of Birth*

• Address (street name, street number)*

• Apartment, Suite, Room, etc.*

• City*

• State*

• Zip Code*

• Country

• Country if not in United States

• Month and Year Reported/Updated Information*

• Address History (prior addresses for last three (3) years)*

• Current Phone Number*

• Phone Number History

• Current Email Address

• Email Address History

• Spouse (First Name, Last Name, SSN and Suffix)

• Driver’s License (DL) Number(s) and State(s) of issuance

• Government Issued Identification (ID) Number (and issuing federal agency or state)

• Age of Current Address*

• Previous Addresses*

• A source code indicator identifying whether SSN exists in the Social Security Administration’s

Deceased Master File*

• A source code indicator identifying the origin of data being reported*

• A source code indicator for data values identified as missing for each consumer and data field included in a query*

• Vehicle(s) information (Vehicle Identification Number, registration plate number, state in which the vehicle is registered, date of registration)

• Reported Income

• Employment (employer name, address, date of hire, occupation, employment history for the last three (3) years)*

• Other Source(s) of Income (sources and amount)

• Consumer reported alerts such as Fraud, Active Duty, and Identity Theft*

• Credit Account Summary* o Creditor Name* o Creditor Address* o Creditor Industry Type* o Account Number*

RFP # 304-26-0214JW Credit Reporting Services Page 9 of 46 o Type of Account (individual, joint or business/corporate)* o Date Account Opened* o Date Account Reported to CRA* o Account Payment Status* o Account Status (active/inactive)* o High Credit Limit* o Current Credit Balance* o Monthly Payment(s)* o Payment History for past twenty-four (24) months* o Inquiries for new credit*

▪ Name of Inquiring Company*

▪ Date of Inquiry*

*Indicates required data fields. Successful Respondent’s System must enable CPA to obtain Consumer

Reports that include, at a minimum, the data fields marked with “*”.

c. Employment Credit Inquiries; Employment Credit Reports.

1) Employment Credit Inquiries.

a) CPA shall access Successful Respondent’s System to conduct Employment Credit Report inquiries under the Employment Use Permissible Purpose.

b) Successful Respondent’s System shall allow CPA’s HR Division to conduct permissible Employment

Credit Report inquiries with CPA providing to the consumer advance disclosure of CPA’s intent to obtain the Employment Credit Report and CPA obtaining the consumer’s authorized written consent for the procurement of the Employment Credit Report.

c) Successful Respondent shall set its System so that all Employment Credit Report inquiries conducted by

CPA authorized users are reflected as soft inquiries.

d) Respondent’s Proposal must include Respondent’s procedures to report and address Employment Credit

Reports run in error by providing a point of contact and appropriate documentation (e.g., authorization letter, deletion letter) that CPA’s Designative Representative must complete and provide to the consumer.

e) CPA’s HR Division will not retain or save results from Employment Credit Report inquiries conducted by CPA.

2) Employment Credit Reports. Successful Respondent shall provide CPA’s HR Division access to a robust

CRA System capable of delivering Employment Credit Reports that

a) Exclude credit scores, and

b) Include multiple data fields. While CPA requires some data fields be included in Employment Credit

Reports delivered by Respondent’s System, Respondent’s Proposal shall clearly indicate which of the following data fields may be included in a Employment Credit Report resulting from a CPA inquiry using Respondent’s System.

• Name (First, Last, Middle)*

• Aliases (AKAs) and former names*

• Social Security Number (SSN)*

• Date of Birth*

• Address (street name, street number)*

• Apartment, Suite, Room, etc.*

• City*

• State*

• Zip Code*

• Country

• Country if not in United States

• Month and Year Reported/Updated Information*

• Address History (prior addresses for last three (3) years)*

• Current Phone Number*

• Phone Number History

• Spouse (First Name, Last Name, SSN and Suffix)

• Driver’s License (DL) Number(s) and State(s) of issuance

RFP # 304-26-0214JW Credit Reporting Services Page 10 of 46

• Government Issued Identification (ID) Number (and issuing federal agency or state)

• Age of Current Address*

• Previous Addresses*

• A source code indicator identifying whether SSN exists in the Social Security Administration’s

Deceased Master File*

• A source code indicator identifying the origin of data being reported*

• A source code indicator for data values identified as missing for each consumer and data field included in a query*

• Vehicle(s) information (Vehicle Identification Number, registration plate number, state in which the vehicle is registered, date of registration)

• Reported Income

• Employment (employer name, address, date of hire, occupation, employment history for the last three (3) years)*

• Other Source(s) of Income (sources and amount)

• Consumer reported alerts such as Fraud, Active Duty, and Identity Theft*

• Credit Account Summary* o Creditor Name* o Creditor Address* o Creditor Industry Type* o Account Number* o Type of Account (individual, joint or business/corporate)* o Date Account Opened* o Date Account Reported to CRA* o Account Payment Status* o Account Status (active/inactive)* o High Credit Limit* o Current Credit Balance* o Monthly Payment(s)* o Payment History for past twenty-four (24) months* o Inquiries for new credit*

▪ Name of Inquiring Company*

▪ Date of Inquiry*

D.4. *Indicates required data fields. Successful Respondent’s System must enable CPA to obtain Consumer Reports that include, at a minimum, the data fields marked with “*”.

D.5. Training Requirements; Implementation Requirements.

Successful Respondent shall provide Training and Implementation that meets or exceeds the requirements set forth herein at no additional cost to CPA.

a. Training. Successful Respondent will cooperate with CPA’s Designated Representative to provide System access and use training to CPA authorized users and shall maintain a record of training completed that includes CPA authorized user name(s), date(s), and type(s) of training, and shall provide such records to CPA upon receipt of written request.

b. Implementation. Successful Respondent must:

1) Provide fully operational products and/or services, as specified in the Contract, no later than September 1, 2025 at 7:00 a.m. CT (“Go Live Date”);

2) Provide access to all administrative interface(s), in fully functional form, to CPA no later than one (1) month prior to the Go Live Date;

3) Collaborate with the CPA’s Designated Representative within ten (10) business days following Contract award to establish an acceptable schedule for timely completion of all implementation requirements;

4) Collaborate with CPA’s Designated Representative on finalizing an acceptable list of data fields to be included in each Consumer Credit Report and each Employment Credit Report resulting from a CPA inquiry.

The accepted list of Consumer Credit Report data fields and Employment Credit Report Fields must include, but is not limited to, the required data fields identified in Section II, Part D.3.b)2) for Consumer Credit Report and D.3.c)2) for Employment Credit Report and shall be finalized no later than one (1) month prior to the Go

Live Date;

5) No later than one (1) month prior to the Go Live Date, provide CPA with a maximum turnaround time (from date of receiving a CPA batch inquiry) required by Successful Respondent to deliver to CPA batch Consumer

RFP # 304-26-0214JW Credit Reporting Services Page 11 of 46

Credit Reports resulting from CPA’s batch inquiry. Batch inquiries and batch Consumer Credit Reports shall be for the purposes of CPA confirming batch Consumer Credit Reports contain the accepted list of data fields to be included in a Consumer Report resulting from a CPA query; and,

6) No later than one (1) month prior to the Go Live Date, in collaboration with CPA, determine the acceptable period of time required to produce administrative reports accurately indicating CPA’s current and historical use of Successful Respondent’s System.

D.6. CPA Data Safeguard Standards.

a. Defined Terms. The term “CPA Data” refers to CPA’s information as well as other entity information in the possession of CPA that is processed, stored, or transmitted by a computer. CPA Data includes all data that is generated by Successful Respondent in performance of a contract with CPA. The term “CPA Information System” refers to those devices, software, networks and related infrastructure that CPA owns, operates or has obtained for use to conduct CPA business. Devices include, but are not limited to, CPA-owned or managed storage, processing, and communications devices, as well as personally owned devices.

b. Access to CPA Data. Successful Respondent represents and warrants that it will implement, maintain, and use appropriate administrative, technical, and physical safeguards to preserve the confidentiality, integrity, and availability of CPA Data. Successful Respondent will not collect, access, use, disclose, or retain CPA Data other than as necessary to perform the services specified in a contract resulting from this solicitation or as otherwise authorized in writing by CPA. Successful Respondent will restrict access to CPA Data to only those personnel who must have the information on a “need to know” basis. Successful Respondent will not use CPA Data, or any information derived from CPA Data, for its own benefit or the benefit of any other person or entity. Successful

Respondent will not share CPA Data with its parent company or other affiliate without CPA’s express written consent.

c. Web-Based Remote Access to CPA Information Systems. Successful Respondent may use third-party web-based remote access connections to CPA Information Systems to provide support services under the following conditions:

1) CPA shall affirmatively initiate and accept Successful Respondent’s connections to CPA Information

Systems.

2) CPA shall monitor Successful Respondent’s connections to CPA Information Systems for the duration of the

Services.

3) CPA shall terminate Successful Respondent’s connections to CPA Information Systems upon completion of the Services.

d. Reserved.

e. Reserved.

f. Location of CPA Data. Successful Respondent shall ensure that CPA Data (i.e., primary and backup) remains, at all times, within the continental United States. Successful Respondent shall receive, process, transmit, and store all CPA Data within the continental United States. Successful Respondent’s point of access to CPA Data shall be within the continental United States.

g. Encryption Standards.

1) Successful Respondent shall encrypt CPA Data in transit and at rest. Data in transit means data is moving via email, in applications, or through browsers and other web connections. Data at rest (including data backups) means data is stored in databases, the cloud, removable media, or mobile devices.

2) Successful Respondent shall utilize encryption standards that are FIPS 140-2 compliant or, upon the written approval of CPA’s Chief Information Security Officer, shall meet the intent of the standards as described in

FIPS 140-2.

3) The minimum cryptographic algorithm used by Successful Respondent must be Advanced Encryption

Standard (AES) 128 or higher (256 AES is preferred).

4) Successful Respondent shall encrypt CPA Data transmitted over a public or private network. CPA approved data encryption transmission protocols include the following: (1) SFTP (FTP over SSH), (2) FTPS (FTP over

TLS), (3) HTTPS (HTTP over TLS), and (4) virtual private network.

h. Reserved.

i. Auditable Information Security Framework. Successful Respondent shall secure its own and its third-party service providers’ systems (e.g., IT service provider, Cloud Service Provider) in a manner consistent with an auditable

RFP # 304-26-0214JW Credit Reporting Services Page 12 of 46 information security framework e.g., National Institute of Standards and Technology (NIST), International

Organization for Standardization (ISO) 27001.

j. Defects and Vulnerabilities. Upon Contract award and during the term of the Contract, Successful Respondent shall provide CPA with prompt, written notice upon Successful Respondent’s discovery of any product defects and vulnerabilities of the proposed Licensed System/Software/Solution that allow an attacker to violate an explicit

(or implicit) security policy to achieve some impact or consequence. Examples of vulnerabilities include defects that allow intruders to gain increased levels of access or interfere with the normal operations of information systems. Vulnerabilities caused by insecure configurations, design choices, and changing environmental conditions are additional examples.

k. Supply Chain Risk Management. Successful Respondent shall provide CPA’s Contract Manager a description of how it manages supply chain risks. Specifically, Successful Respondent shall describe its established agreements and procedures with entities involved in the supply chain for the notification of supply chain risks, compromises, and the result of assessments or audits. During the term of the contract, Successful Respondent shall provide

CPA’s Contract Manager prompt, written notice of supply chain risks that impact the delivery of the products and services of the Contract. Examples of supply chain risks include supplier financial failure, production control/product quality, market supply and demand, labor disputes/shortages, cybersecurity threats, natural disasters. Successful Respondent shall notify CPA of a supply chain compromise and potential compromise in accordance with Section G Security Incident Notification.

l. Independent Information Security Assessment. If Successful Respondent has access to a CPA Information System or receives, processes, transmits, or stores CPA Data, then Successful Respondent shall provide CPA’s Contract

Manager with its most recent information security assessment conducted by an independent third-party (e.g., SSAE-18 SOC 2 Type II, ISO 27002) upon Contract award and annually thirty (30) days prior to the anniversary of the Contract award date thereafter. CPA, in its sole discretion, may conduct a security assessment of any information system holding CPA Data or connected to a CPA Information System. CPA’s security assessment may consist of a review of the following: (i) independent third-party assessment(s) contracted by Successful

Respondent (e.g., SSAE-18 SOC 2 Type II, ISO 27002) and (ii) Successful Respondent’s System Security Plan.

m. Media Sanitization. Successful Respondent shall sanitize information system media, both digital and non-digital, in accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization) when CPA Data in the custody of Successful Respondent is no longer required to be retained by contract with CPA. Successful

Respondent must maintain a record documenting each sanitization procedure that, at a minimum, includes the following information: (i) date sanitization completed, (ii) description of the item(s), serial number(s), inventory control number(s), if applicable, and (iii) sanitization method used. No later than sixty (60) calendar days from contract expiration or termination or as otherwise specified in the Contract, Successful Respondent must either

(i) complete the sanitization and submit via email to the CPA Contract Manager all sanitization documentation or

(ii) submit a written statement via email to the CPA Contract Manager explaining the reason that destruction of

CPA Data by Successful Respondent is technically impossible or impractical. Successful Respondent’s obligations set forth in this clause survive the termination or expiration of the contract as long as Successful

Respondent retains CPA Data.

n. Third-Party Service Providers. It is Successful Respondent’s sole responsibility to ensure that its access and the access Successful Respondent grants to its service providers to CPA Data or CPA Information Systems does not result in unauthorized access to CPA Data or CPA Information Systems.

o. Reserved.

p. Reserved.

q. Reserved.

r. State Authorization and Risk Management Program (TX-RAMP). Successful Respondent shall obtain TX-RAMP certification in accordance with the Department of Information Resources (DIR) Program Manual. CPA requires the following TX-RAMP certification based-on Agency criteria:

1) None. Product is out of scope/low impact in accordance with the DIR TX-RAMP Manual.

2) Level 1 Certification. The product will administer Agency public data.

3) X Level 2 Certification. The product will administer Agency sensitive, confidential, and/or regulated data.

Upon Contract award, Successful Respondent shall maintain compliance with the immediately preceding TX-

RAMP program requirements and certification throughout the term of the contract. Successful Respondent shall notify the CPA Contract Manager immediately if such TX-RAMP certification is revoked or otherwise removed.

https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdir.texas.gov%2Fresource-library-item%2Ftexas-risk-and-authorization-management-program-manual-30&data=05%7C02%7CJason.Frizzell%40cpa.texas.gov%7C9b22e092447c41d9816108dd30f4dbc3%7C2055feba299d4d0daa5a73b8b42fef08%7C0%7C0%7C638720550387877709%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=dFBcq3mGLKSAe5BKAYCH%2FFcMW6eaImJiVx85PviOPho%3D&reserved=0

RFP # 304-26-0214JW Credit Reporting Services Page 13 of 46

If Successful Respondent uses a cloud service provider to host (i.e., Infrastructure as a Service or IaaS) or build

(i.e., Platform-as-a-Service or PaaS) a custom-developed CPA system or application, Successful Respondent shall ensure its cloud service provider obtains TX-RAMP certification in accordance with the Department of

Information Resources (DIR) Program Manual. If applicable, CPA requires the following TX-RAMP certification based-on Agency criteria:

4) X None. Product is out of scope/low impact in accordance with the DIR TX-RAMP Manual.

5) Level 1 Certification. The product will administer Agency public data.

6) Level 2 Certification. The product will administer Agency sensitive, confidential, and/or regulated data.

Upon Contract award, Successful Respondent shall ensure its cloud service provider used to host or build a custom-developed CPA system or application maintains compliance with the immediately preceding TX-RAMP program requirements and certification throughout the term of the contract. Successful Respondent shall notify the CPA Contract Manager immediately if such TX-RAMP certification is revoked or otherwise removed.

s. FedRAMP or StateRAMP Authorization. If Successful Respondent obtained TX-RAMP certification through

FedRAMP or StateRAMP authorization, upon Contract award, Successful Respondent shall maintain continuous

FedRAMP or StateRAMP acceptable status and notify the CPA Contract Manager immediately if such authorization is revoked or otherwise removed.

t. Reserved.

u. Service Provider, Outsourced, and Cloud Computing. Regardless of TX-RAMP certification, the following requirements apply if Successful Respondent is a Service Provider or Cloud Service Provider (CSP) or contracts with a CSP or other Data Center to receive, process, transmit, or store CPA Data.

1) Security Control Verification. Upon Contract award and annually thereafter, Successful Respondent shall provide to CPA evidence that it has implemented security controls correctly, the controls are operating as intended, and the controls are producing the desired outcome with respect to meeting security requirements for the information system. Acceptable documentation includes:

• SSAE-18 SOC 2 Type II Report (or the updated, equivalent report);

• FedRAMP certification (CPA preferred option for CSP);

• Level Two: Cloud Security Alliance (CSA) Security, Trust & Assurance Registry (STAR) Attestation;

• Level Two: CSA STAR Certification;

• Level One: CSA STAR Self-Assessment;

• Completed CSA Cloud Controls Matrix (CCM) and CSA Consensus Assessment Initiative

Questionnaire;

• CSA CCM;

• Successful Respondent information security plan; and

• Successful Respondent information security policies and procedures.

2) Department of Information Resources Security Control Standards Catalog. At a minimum, Successful

Respondent shall comply with the control baselines established by the Security Control Standards Catalog, all CPA specific security requirements, and any other applicable federal or statutory requirements.

3) Penetration Test. Successful Respondent shall ensure that information system(s) that receive, process, transmit, or store CPA Data undergo an independent third-party annual penetration test. Successful

Respondent shall provide a summary of the penetration test results to CPA annually thirty (30) days prior to the anniversary of the Contract award date. Successful Respondent shall coordinate with CPA to schedule the initial penetration test and subsequent annual penetration tests during the term of the Contract.

4) Information System(s) Architecture. For information system(s) that receive, process, transmit, or store CPA

Data, Successful Respondent shall develop and maintain a comprehensive architectural diagram that identifies the information system (s) components and environment, including ports, protocols, and services.

Successful Respondent shall protect the architectural diagram from unauthorized access, disclosure, modification, and /or destruction. Successful Respondent shall provide the diagram to CPA annually.

5) Configuration Minimum Requirements.

a) Successful Respondent shall implement (SAML) an XML-based standard (CPA preferred) or OpenID

Connect (OIDC) for exchanging authentication and authorization data for identity management of CPA internal users. If Successful Respondent is technically incapable of integrating with CPA’s identity services provider, Successful Respondent shall ensure identifier and authenticator controls are consistent with CPA standards.

https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdir.texas.gov%2Fresource-library-item%2Ftexas-risk-and-authorization-management-program-manual-30&data=05%7C02%7CJason.Frizzell%40cpa.texas.gov%7C9b22e092447c41d9816108dd30f4dbc3%7C2055feba299d4d0daa5a73b8b42fef08%7C0%7C0%7C638720550387877709%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=dFBcq3mGLKSAe5BKAYCH%2FFcMW6eaImJiVx85PviOPho%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdir.texas.gov%2Fresource-library-item%2Ftexas-risk-and-authorization-management-program-manual-30&data=05%7C02%7CJason.Frizzell%40cpa.texas.gov%7C9b22e092447c41d9816108dd30f4dbc3%7C2055feba299d4d0daa5a73b8b42fef08%7C0%7C0%7C638720550387877709%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=dFBcq3mGLKSAe5BKAYCH%2FFcMW6eaImJiVx85PviOPho%3D&reserved=0 https://dir.texas.gov/sites/default/files/2023-06/Security%20Control%20Standards%20Catalog%202.1%20for%20Web%20-%20UPDATED%206.21.23.pdf

RFP # 304-26-0214JW Credit Reporting Services Page 14 of 46

b) Successful Respondent shall remove root access, where feasible, to information system(s) that receive, process, transmit, or store CPA Data.

c) Successful Respondent shall prohibit Privileged User access to CPA data on information system(s) that receive, process, transmit, or store CPA data.

d) Successful Respondent shall employ multifactor authentication for Privileged Users who support information system(s) that receive, process, transmit, or store CPA Data when accessing CPA

Information System(s).

e) Pursuant to Section 2054.192 of the Texas Government Code, Privileged Users that have access to a

CPA Information System shall complete the CPA-Required Security Awareness Training described in

Part D.#.1.e above.

f) Secure Baseline Configuration. Successful Respondent shall develop secure baseline configurations for information system(s), components, or services that receive, process, transmit, or store CPA Data in accordance with industry best practices (e.g., U.S. Government Configuration Baseline (USGCB), Center for Internet Security (CIS) Benchmarks). In the absence of an industry defined secure configuration, Successful Respondent shall develop a baseline for information system(s), components, or services in collaboration with CPA.

g) Audit Information. For information system(s) that receive, process, transmit, or store CPA Data, Successful Respondent shall enable information system(s) auditing to the greatest extent necessary to capture access, modification, and deletion of data by each unique user and Privileged User system access and actions. Audit controls shall ensure the movement of sensitive, confidential, and regulated data is traceable throughout the data lifecycle. Audit records shall contain date, time, type, source, and outcome of system event, the user account involved, service account, service, or process responsible for initiating the system event, and other information that facilitates reconstruction of events. Successful Respondent shall protect audit information from unauthorized access and modification. Successful Respondent shall share audit information with CPA upon request.

h) Successful Respondent shall configure information system(s) that receive, process, transmit, or store

CPA Data to deny local network mapping and prevent copy and paste from the information system(s) to unapproved workstations, laptops, or terminals.

6) Configuration Management Plan. Successful Respondent shall develop a Configuration Management Plan for information system(s) that receive, process, transmit, or store CPA Data. The Configuration Management

Plan must include a comprehensive description of the roles, responsibilities, policies, and procedures that apply when managing the configuration of products and systems. The Configuration Management Plan may be an all-inclusive, stand-alone document or may be comprised of more broadly defined configuration management procedures contained in multiple documents. CPA shall review and approve the Configuration

Management Plan annually during the contract term. Successful Respondent shall treat the Configuration

Management Plan as confidential CPA information and protect the Configuration Management Plan from unauthorized disclosure and modification.

7) Data Center Resiliency, Environmental Protections, and Physical Security. Successful Respondent shall provide multiple geographic regions and availability zones to ensure resiliency in the event of natural disasters, common equipment failures, or information system failures. The data center(s) shall ensure electrical power systems are fully redundant and maintainable without interruption to continuous operations.

Data center(s) shall provide backup power through various mechanisms including, but not limited to, UPS batteries. Data center(s) backup power shall supply consistently reliable power protection during utility brownouts, blackouts, over voltage, under voltage, and out-of-tolerance frequency conditions. The data center(s) shall use generators to provide power to critical equipment and customer loads. Trained security personnel shall staff the data center(s) twenty-four (24) hours a day, seven (7) days a week. Data center(s) shall use a security organization responsible for physical security functions to monitor its data center(s). The data center(s) shall have state-of-the-art electronic surveillance and multi-factor access control systems.

Successful Respondent and/or CSP shall authorize physical access to its data center(s) strictly on a least privilege basis and access control systems shall log unauthorized activity and failed access attempts.

8) Roles and Responsibilities. Successful Respondent and CPA shall define and document CPA oversight and user roles and responsibilities with regard to the outsourced and/or CSP information system(s) that receive, process, transmit, or store CPA Data.

9) Vulnerability Assessment and Continuous Monitoring. For information system(s) that receive, process, transmit, or store CPA Data, Successful Respondent shall employ vulnerability scanning tools and techniques to identify information system(s) flaws, improper configurations, and vulnerabilities. Successful Respondent

RFP # 304-26-0214JW Credit Reporting Services Page 15 of 46 shall conduct information system(s) scans at least monthly and remediate and mitigate vulnerabilities in accordance with the National Institute of Standards and Technology National Vulnerability Database

Common Vulnerability Scoring System (CVSS). Successful Respondent shall report vulnerability assessment results and remediation efforts to CPA on a monthly basis.

10) Court and Administrative Orders. Except as otherwise required by law, the Successful Respondent and/or

CSP shall promptly notify CPA of any subpoena, judicial, or administrative order that it receives and that relates to…