ESBD_443790_1756312943867_RFP 304-26-0911LC Unclaimed Property Auction Services.pdf

RFP #304-26-0911LC Unclaimed Property Auction Services Page 1 of 44

Request for Proposals

Unclaimed Property Auction Services

RFP No. 304-26-0911LC

Issuance Date: August 27, 2025

Anticipated Schedule of Events

August 27, 2025 Issuance of RFP

September 3, 2025 Deadline for Submission of Questions (2:00 p.m., CT)

September 8, 2025 Release of Official Responses to Questions (or as soon thereafter as practical)

September 12, 2025 Deadline for Submission of Proposals (2:00 p.m. CT) Late Proposals will not be considered

October 1, 2025 Presentations from Top-Ranked Respondents (if presentations requested by CPA, dates and times to be scheduled

November 1, 2025 Services Commencement Date (or as soon thereafter as practical)

RFP #304-26-0911LC Unclaimed Property Auction Services Page 2 of 44

Table of Contents

I. Summary II. Specifications

A. Introduction B. Background C. Definitions and Acronyms D. Scope of Services E. Contract Resulting from this Solicitation; Order of Priority F. Warranty of Performance G. Security Incident Notification H. Insurance and Bonds I. Criminal Background Investigation J. Contract Term; Survival of Terms K. Acceptance Criteria L. Payments M. Discounts N. PO Addition and Deletion O. HUB Subcontracting Plan Information P. Respondent Documents Q. Respondent Exceptions R. Respondent’s Past Performance; Vendor Performance Tracking System

III. Proposal Submission Requirements A. Delivery of Proposal B. Proposal Content and Format

IV. Mandatory Price Sheet V. Standard Terms and Conditions VI. Execution of Proposal VII. Conflict of Interest/Disclosure Statement VIII. Nondisclosure Agreement IX. Confidential Treatment of Information Acknowledgment X. Certification Regarding Public Nature of the Proposal XI. Respondent Exceptions XII. Vendor Reference Questionnaire

RFP #304-26-0911LC Unclaimed Property Auction Services Page 3 of 44

I. Summary

1. Type of Solicitation: Request for Proposals (RFP)

2. Issuing Office: Texas Comptroller of Public Accounts (CPA) Procurement Section Room 300, Attn: RFP No. 304-26-0911LC 111 E. 17th Street Austin, Texas 78774

3. Additional Requirements/Qualifications: N/A

4. Responses to RFP: Sealed Competitive Proposals

5. Deadline for Proposals: In Issuing Office No Later Than:

September 12, 2025; 2:00 p.m., Central Time (CT)

6. Initial Contract Term: Award Date through August 31, 2026

7. CPA Optional Contract Terms: September 1, 2026 through August 31, 2027 September 1, 2027 through August 31, 2028 and September 1, 2028 through August 31, 2029

8. CPA Contact Person for this RFP: Lauren Callahan, CTCM, CTCD Email with delivery receipt requested to: bidcpa@cpa.texas.gov

9. Proposals Submitted by Email: Required; See Section III, Part A

10. Proposals Submitted by Fax: Not Accepted

11. Pre-Proposal Conference: N/A

12. Pre-Proposal Inspection: N/A

13. Letters of Intent to Submit a Proposal: N/A

14. RFP Addenda: Notices of changes to items directly impacting the original RFP or solicitation process will be posted on the Electronic State Business Daily (ESBD) located at: http://www.txsmartbuy.com/esbd. CPA will post any amendment to this solicitation on the ESBD as an RFP Addendum. It is the responsibility of an interested party to check the ESBD for updates to this RFP before submitting a Proposal. Each Respondent is solely responsible for verifying CPA’s receipt of its questions, if applicable, and its Proposal by the deadlines specified in this RFP.

15. Questions and Answers: Questions regarding this RFP must be in writing and must be submitted to the CPA Contact Person specified in Part 8, no later than September 3, 2025; 2:00 p.m. CT. Telephone inquiries will not be accepted. Questions may be submitted by email to the email address specified in Part 8. CPA intends to post answers to the questions received on the ESBD on September 8, 2025, or as soon thereafter as practical.

16. Respondent Presentations: CPA may request that top-scoring Respondents present an overview of the services and a demonstration of the software proposed in their Proposals.

Presentations, if any, will be performed on or about October 1, 2025.

Presentation location (e.g., videoconference, onsite, etc.), date(s) and time(s) to be arranged. In its sole discretion, CPA will determine the number of top-scoring Respondents.

17. Evaluation of Proposals under Best Value Standard (Section 2156.125 of the Texas Government Code):

Criteria Weight

Respondent’s Past Performance, Qualifications & Experience 20%

Compliance with CPA Specifications 40%

Overall value to CPA (CPA resource utilization, feeds, anticipated return on auctioned items)

40%

Total: 100%

RFP #304-26-0911LC Unclaimed Property Auction Services Page 4 of 44

As applicable, the factors listed in Sections 2155.074, 2155.075, 2156.007, and 2157.003 of the Texas Government Code shall also be considered in making an award. Best and Final Offers may be sought from Respondents whose Proposals are ranked most highly by the evaluation committee. However, CPA encourages Respondents to offer their best pricing at all times. CPA reserves the right in its sole judgment and discretion, and at any time upon failure of negotiations, to reissue or withdraw this RFP rather than continue with negotiations.

18. Email Submission Only. Due to changed building access restrictions, Respondents will not be permitted to hand deliver Proposals to the Issuing Office. Respondents are required to submit Proposals electronically via email with delivery receipt requested in accordance with Section III, Part A.

19. Contact with CPA Staff: Upon issuance of this RFP, employees and representatives of CPA, other than the CPA Contact Person identified in Part 8, will not discuss the contents of this RFP with any Respondent or its representatives. Failure of a Respondent or any of its representatives to observe this restriction may result in disqualification of any related Proposal. This restriction does not preclude discussions between the parties to conduct business unrelated to this procurement or to obtain assistance completing Historically Underutilized Business (HUB) forms required by this RFP.

RFP #304-26-0911LC Unclaimed Property Auction Services Page 5 of 44

II. Specifications

A. Introduction

The Texas Comptroller of Public Accounts (CPA), an agency of the State of Texas, issues this Request for Proposals (RFP) to solicit Proposals from qualified vendors for Unclaimed Property Auction Services, as described in this Section II and in this RFP (Services). CPA’s objective is to obtain the Services that represent the best value for CPA and the State of Texas according to the terms and conditions of this RFP.

CPA anticipates making a Contract award to one (1) Successful Respondent for the Services. CPA reserves the right not to award a Contract for the performance of all or part of the Services. This RFP is not exclusive and CPA reserves the right to issue additional solicitations regarding the Services or similar services at any time. All Respondents are encouraged to offer their best pricing at all times.

All costs associated with the Services must be included in the Respondent’s Proposal. Proposals that do not meet all of the requirements or contain all of the required documentation specified in this RFP will be rejected as non-responsive.

B. Background

CPA’s Unclaimed Property Division is responsible for administering CPA’s unclaimed property program (UP Program) in accordance with applicable statutes and rules. Chapter 74 of the Texas Property Code requires holders of unclaimed property to report and deliver to CPA certain unclaimed property that is determined abandoned under Texas Property Code Chapters 72, 73, and 75 and Texas Finance Code Chapter 154, some of which includes tangible personal property located within a safe deposit box (Property).

Section 74.401 of the Texas Property Code provides that CPA may sell at public sale the Property and other certain abandoned personal property delivered to CPA for custody and safekeeping. CPA may conduct the sale at the location and in the manner that CPA determines affords the most favorable market for the particular property, and such public sale may be conducted on the internet or by online auction. CPA’s current UP Auction Services contract awarded to Liquidity Services Operations LLC dba GovDeals will expire August 31, 2025. CPA has determined a continuing need for online auction services to provide the most favorable market for public sale of the Property and through issuance of this RFP seeks to meet this need.

The UP Program’s internet auction sales of the Property for the period January 1, 2022 through December 31, 2024 have included average weekly auction postings: of 25 to 95 lots per week, with an average 1,826 items per week volume, and a weekly aggregate sales volume range of $10,000-$85,000.

C. Definitions and Acronyms

Award Date. The Award Date is the earlier of the date an authorized representative of CPA (1) issues a Purchase Order (PO) or (2) signs a formal, written agreement.

Contract. The agreement, if any, described in Section II, Part E (Contract Resulting from this Solicitation; Order of Priority).

CPA Contract Manager. The end-user division contact responsible for day-to-day contact with Successful Respondent; contact details to be provided by CPA after the Award Date and/or in the Contract.

CPA’s Designated Representative. The CPA staff member designated to serve as the CPA point of contact for certain communications and activities during Successful Respondent’s performance under the Contract.

KAPS. Kelmar Associates, LLC dba Kelmar Unclaimed Property Services, LLC’s (Kelmar) proprietary Unclaimed Property Management System used by CPA’s UP Program.

Proposal. A response to this RFP.

Respondent. Any person or entity that submits a Proposal to this RFP.

Successful Respondent. The Respondent awarded a Contract, if any.

Unclaimed Property Auction Services. All components related to the provision, configuration, maintenance and technical support services of the auction website, including, but not limited to, data storage, data backup, security services, disaster recovery, technical support services, hardware (if applicable), and any other services or items outlined in this RFP. The term also includes, but is not limited to, fees, handling, installation, and any other costs or services associated with the Successful Respondent's performance under the Contract.

D. Scope of Services

D.1. General

a) Respondent’s Proposal must include:

RFP #304-26-0911LC Unclaimed Property Auction Services Page 6 of 44

1) A detailed explanation of how Respondent’s offered UP Auction Services meet or exceed the minimum requirements set forth herein.

2) Pricing in Price Schedule 1, Section IV (Mandatory Price Sheet) that includes all costs associated with Respondent’s offered UP Auction Services.

3) Proposal requirements listed within this Section II, Part D. (Scope of Services) are in addition to and not in lieu of requirements set forth within Section III, Part B (Proposal Content and Format)

b) Successful Respondent shall provide to CPA all UP Auction Services and Optional Features, Products, or Services listed in Section IV (Mandatory Price Sheet) that are accepted by CPA.

c) Successful Respondent shall provide to CPA a secured portal to its auction advertising and hosting website (Auction Website) and Support Services that will enable CPA to post on the Auction Website items for auction by CPA.

Each CPA auction (CPA Listing) may include, but is not limited to, one or more items falling within a variety of categories such as fine, costume, and other jewelry, watches, loose jewels, precious metals, collectible coins and paper currency, memorabilia, sports cards, stamps and other collectibles, art, books, antiques, rarities and novelties.

d) Services solicited under this RFP do not include receiving, inventorying, appraising, photographing, describing and preparing items for auction and do not include packaging of items and shipping of items to buyers. CPA performs evaluations, appraisals and description development using internal CPA staff and/or external appraisers (that are contracted under solicitation separate from this RFP) who possess subject matter expertise and by applying industry best practices and use of appropriate tools, technology, reference resources and methodologies.

D.2. Requirements.

a) Auction Website Standards

Successful Respondent’s Proposal shall clearly demonstrate the Auction Website meets or exceeds all requirements stated in this section. Successful Respondent’s Auction Website shall be capable of hosting and advertising CPA Listings and include, at a minimum, the following features:

1) Optimization for:

a. Use on desktop, tablet, and mobile devices;

b. Access by buyers and sellers using multiple web browser platforms; and

c. Discoverability by buyers and sellers using multiple search engine platforms;

2) An integrated payment gateway that delivers buyer’s payment safety and security during the transaction and that accepts multiple methods of payment (e.g., major credit and debit cards, PayPal or similar payment platform, Google Pay or similar digital wallet application, etc.);

3) Hosting and advertising of CPA Listings on an uninterrupted, twenty-four (24) hours per day, seven (7) days per week basis;

4) Visibility of and access to the Auction Website by buyers and sellers on an uninterrupted, twenty-four (24) hours per day, seven (7) days per week basis;

5) Buyer and seller account creation and registration portals with enhanced security features providing protection during entry, transmission, and storage of buyer and seller information, including, but not limited to, confidential information;

6) Online auction listings management (ALM) tools that would enable CPA to perform, at a minimum, the following CPA Listings management tasks:

a. Pre-sale

i. Individually or batch create, edit, save, and store listings (prior to posting), either in a secured online location within CPA’s account dashboard or offline but with ability to upload, including via bulk upload. Respondent’s description field for CPA Listings must allow unlimited character count within the description field;

ii. Develop and save customized listings using an ALM template library;

iii. Enter CPA declarations, terms and conditions to be included in single, multiple, or all CPA Listings;

and

RFP #304-26-0911LC Unclaimed Property Auction Services Page 7 of 44

b. Post-sale

i. Provide CPA-selected, automatic emails to buyers (e.g., payment acknowledgement, shipping notification, request for customer feedback);

ii. Generate transaction number, invoices, and packing lists;

iii. Complete shipping processes (e.g., print shipping and carrier labels with tracking, print postage, include shipping insurance, etc.); and

iv. Collect CPA Listing transaction data (final price, buyer’s information, fees applicable to buyer, and fees charged to CPA, etc.) for export/download by CPA;

c. CPA Listings Pricing

i. All starting prices on all CPA Listings shall be determined by CPA, in its sole discretion, and include $00.01 bid increments. CPA reserves the right, in its sole discretion, to establish default or editable starting prices and default or editable bid increments;

ii. All lots will be subject to CPA's final approval for sale;

iii. All lots shall be sold to highest bidder, regardless of whether the final highest bid is less than, greater than, or equal to the appraised value;

iv. The starting price shall be the minimum acceptable price on all lots;

v. Shipping and insurance costs will be determined by CPA after the CPA Listing auction closes.

7) Successful Respondent shall indicate within its Proposal any ALM software platform (e.g., Auctiva, SixBit Software, Sellbrite, Vendio, or equivalent) with which its Auction Website can interface and that would enable CPA to perform, at a minimum, the pre-sale and post-sale auction listings management tasks noted above;

8) A seller’s secured access interface that must allow CPA to:

a. Manage CPA’s user profile, including ability to update and modify CPA contact information and passwords;

b. Upload and include descriptions, photos, disclosures, requirements, minimum, or reserve bid price, CPA instructions to bidders, and any related information CPA determines is necessary to ensure the Property is sold to the highest bidder for a price deemed sufficient in sole discretion of CPA;

c. Preview, edit, and update each CPA Listing prior to the CPA Listing being made viewable to the public;

d. Edit, as necessary in sole discretion of CPA, in bulk or isolation, any CPA Listings throughout the duration of applicable auction periods;

e. Automatically or manually initiate and end any CPA Listing, including canceling before or during the applicable auction period;

f. Monitor and/or observe in real time any CPA Listing activity throughout duration of applicable auction period;

g. Provide winning bidder of a CPA Listing a twenty-four (24) hour period following close of auction to complete payment in full;

h. Receive notifications of CPA Listing activities through automatic or push notifications at CPA’s discretion; and

i. Instantly download CPA Listing data, including, but not limited to, sales information, bid history, list of non-winning bidders, winning bidder’s mailing/shipping information, email address and other available contact information; and

9) The system shall be fully integrated with CPA’s KAPS, hosted by Kelmar. Integration includes uploading and entering auction data, synchronizing auction sales proceeds, and providing shipping details. This shall be done without users having to manually load files from one system to another. The system shall support the ability for a user to manually import auction records if required as a work around.

RFP #304-26-0911LC Unclaimed Property Auction Services Page 8 of 44

b) Minimum Qualifications

Respondent’s Proposal must clearly demonstrate Respondent possesses the following minimum qualifications:

1) Respondent must be regularly and continuously engaged in online auction services substantially similar to those described in Section II, Part D. (Scope of Services) for a minimum of three (3) or more years within the most recent ten (10) years immediately preceding Issuance Date of this RFP.

2) Respondent possesses all certifications, permits, licenses, and surety bonds required by any applicable federal, state, and/or local statutes, rules, ordinances or regulations.

c) Support Services; Roles and Responsibilities

1) Support Services.

a. Technical Support Services. Successful Respondent shall provide Auction Website Technical Support Services that include, at a minimum,

i. Unlimited, toll-free telephone and on-line help-desk support with qualified personnel available to CPA during CPA normal business hours, Monday through Friday, 8:00 a.m. through 5:00 p.m. (CT) for reporting of problems or issues with the Auction Website. Successful Respondent shall allow a minimum of three (3) authorized CPA contacts to report problems or issues to Successful Respondent’s help-desk. Upon request of Successful Respondent, CPA will provide the list of authorized support staff.

ii. Successful Respondent solely shall be responsible for Auction Website management and maintenance, including ensuring the Auction Website maintains a minimum uptime of 99%.

b. Dedicated Account Manager Services. Successful Respondent shall provide a dedicated account manager that shall provide CPA and auction bidders support services to address, at a minimum, fraudulent charges, questions related to account setups and information, assistance with returns, and troubleshooting and resolution of other auction related matters. Such dedicated account manager shall be accessible by email and phone during CPA’s normal business hours, Monday through Friday, 8:00 a.m. through 5:00 p.m.

(CT) .

2) Roles and Responsibilities.

a. Successful Respondent shall require all bidders on CPA Listings to be a registered bidder of the Auction Website prior to placing a bid on any CPA Listing. Successful Respondent shall prohibit from bidding on a CPA Listing any Auction Website user that is not a registered bidder of the Auction Website.

b. Successful Respondent shall confirm each registered bidder is eligible to enter into a legal contract to bid and purchase items offered on the Auction Website.

c. Successful Respondent shall comply with all federal, state, and local statutes, rules, ordinances, regulations, and industry best practices applicable to the Services.

d. Successful Respondent shall be responsible for immediately notifying the winning bidder of winning bid upon close of a CPA Listing and for providing such winning bidder appropriate instructions for completion of the related transaction.

e. Successful Respondent shall ensure that upon conclusion of an auction period for a CPA Listing and sending of Successful Respondent’s prompt notification to the winning bidder, the CPA Listing is removed from public view.

f. For purposes of inspecting, monitoring, auditing, or evaluating by CPA, Successful Respondent shall keep and maintain in a current and auditable format all records related to CPA Listings (CPA Listings Records).

i. CPA Listings Records shall include, but not be limited to, all information, data, correspondence, work papers, reports, books, and supporting documents related to CPA Listings, bidders on CPA Listings, and transactions related to CPA Listings.

ii. Successful Respondent shall protect CPA Listings Records from unauthorized access and modification.

iii. Successful Respondent shall share CPA Listings Records with CPA upon reasonable request and notice received from CPA’s Designated Representative.

g. Payments and processing:

RFP #304-26-0911LC Unclaimed Property Auction Services Page 9 of 44

i. Successful Respondent shall be responsible for accepting buyer’s payments through Successful Respondent’s payment gateways.

ii. Successful Respondent shall be responsible for any credit card chargebacks.

iii. Successful Respondent shall be responsible for collection and payment of applicable sales tax.

D.3. CPA Data Safeguard Standards.

a) Defined Terms. The term “CPA Data” refers to CPA’s information as well as other entity information in the possession of CPA that is processed, stored, or transmitted by a computer. CPA Data includes all data that is generated by Successful Respondent in performance of a contract with CPA. The term “CPA Information System” refers to those devices, software, networks and related infrastructure that CPA owns, operates or has obtained for use to conduct CPA business. Devices include, but are not limited to, CPA-owned or managed storage, processing, and communications devices, as well as personally owned devices.

b) Access to CPA Data. Successful Respondent represents and warrants that it will implement, maintain, and use appropriate administrative, technical, and physical safeguards to preserve the confidentiality, integrity, and availability of CPA Data. Successful Respondent will not collect, access, use, disclose, or retain CPA Data other than as necessary to perform the services specified in a contract resulting from this solicitation or as otherwise authorized in writing by CPA. Successful Respondent will restrict access to CPA Data to only those personnel who must have the information on a “need to know” basis. Successful Respondent will not use CPA Data, or any information derived from CPA Data, for its own benefit or the benefit of any other person or entity. Successful Respondent will not share CPA Data with its parent company or other affiliate without CPA’s express written consent.

c) Web-Based Remote Access to CPA Information Systems. Successful Respondent may use third-party web-based remote access connections to CPA Information Systems to provide support services under the following conditions:

1) CPA shall affirmatively initiate and accept Successful Respondent’s connections to CPA Information Systems.

2) CPA shall monitor Successful Respondent’s connections to CPA Information Systems for the duration of the Services.

3) CPA shall terminate Successful Respondent’s connections to CPA Information Systems upon completion of the Services.

d) Reserved.

e) Reserved.

f) Location of CPA Data. Successful Respondent shall ensure that CPA Data (i.e., primary and backup) remains, at all times, within the continental United States. Successful Respondent shall receive, process, transmit, and store all CPA Data within the continental United States. Successful Respondent’s point of access to CPA Data shall be within the continental United States.

g) Encryption Standards.

1) Successful Respondent shall encrypt CPA Data in transit and at rest. Data in transit means data is moving via email, in applications, or through browsers and other web connections. Data at rest (including data backups) means data is stored in databases, the cloud, removable media, or mobile devices.

2) Successful Respondent shall utilize encryption standards that are FIPS 140-2 compliant or, upon the written approval of CPA’s Chief Information Security Officer, shall meet the intent of the standards as described in

FIPS 140-2.

3) The minimum cryptographic algorithm used by Successful Respondent must be Advanced Encryption Standard (AES) 128 or higher (256 AES is preferred).

4) Successful Respondent shall encrypt CPA Data transmitted over a public or private network. CPA approved data encryption transmission protocols include the following: (1) SFTP (FTP over SSH), (2) FTPS (FTP over TLS), (3) HTTPS (HTTP over TLS), and (4) virtual private network.

h) System Security Plan and Continuous Monitoring Plan. Successful Respondent, in collaboration with CPA, shall develop, implement, and maintain a comprehensive written System Security Plan that contains administrative, technical, and physical safeguards designed to: (i) ensure the confidentiality, integrity and availability of CPA Data;

(ii) protect against unauthorized access to or use of CPA Data; and (iii) comply with all applicable legal and regulatory requirements for data protection. Successful Respondent shall develop, implement, and maintain a plan for the continuous monitoring of security control effectiveness and provide a report to CPA on a quarterly basis.

RFP #304-26-0911LC Unclaimed Property Auction Services Page 10 of 44

The report shall include evidence that Successful Respondent has implemented security controls correctly, the controls are operating as intended, and the controls are producing the desired outcome with respect to meeting security requirements for the information system(s).

i) Auditable Information Security Framework. Successful Respondent shall secure its own and its third-party service providers’ systems (e.g., IT service provider, Cloud Service Provider) in a manner consistent with an auditable information security framework e.g., National Institute of Standards and Technology (NIST), International Organization for Standardization (ISO) 27001.

j) Defects and Vulnerabilities. Upon Contract award and during the term of the Contract, Successful Respondent shall provide CPA with prompt, written notice upon Successful Respondent’s discovery of any product defects and vulnerabilities of the proposed Licensed System/Solution that allow an attacker to violate an explicit (or implicit) security policy to achieve some impact or consequence. Examples of vulnerabilities include defects that allow intruders to gain increased levels of access or interfere with the normal operations of information systems.

Vulnerabilities caused by insecure configurations, design choices, and changing environmental conditions are additional examples.

k) Supply Chain Risk Management. Successful Respondent shall provide CPA’s Contract Manager a description of how it manages supply chain risks. Specifically, Successful Respondent shall describe its established agreements and procedures with entities involved in the supply chain for the notification of supply chain risks, compromises, and the result of assessments or audits. During the term of the contract, Successful Respondent shall provide CPA’s Contract Manager prompt, written notice of supply chain risks that impact the delivery of the products and services of the Contract. Examples of supply chain risks include supplier financial failure, production control/product quality, market supply and demand, labor disputes/shortages, cybersecurity threats, natural disasters. Successful Respondent shall notify CPA of a supply chain compromise and potential compromise in accordance with Section G Security Incident Notification.

l) Independent Information Security Assessment. If Successful Respondent has access to a CPA Information System or receives, processes, transmits, or stores CPA Data, then Successful Respondent shall provide CPA’s Contract Manager with its most recent information security assessment conducted by an independent third-party (e.g., SSAE- 18 SOC 2 Type II, ISO 27002) upon Contract award and annually thirty (30) days prior to the anniversary of the Contract award date thereafter. CPA, in its sole discretion, may conduct a security assessment of any information system holding CPA Data or connected to a CPA Information System. CPA’s security assessment may consist of a review of the following: (i) independent third-party assessment(s) contracted by Successful Respondent (e.g., SSAE-18 SOC 2 Type II, ISO 27002) and (ii) Successful Respondent’s System Security Plan.

m) Media Sanitization. Successful Respondent shall sanitize information system media, both digital and non-digital, in accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization) when CPA Data in the custody of Successful Respondent is no longer required to be retained by contract with CPA. Successful Respondent must maintain a record documenting each sanitization procedure that, at a minimum, includes the following information: (i) date sanitization completed, (ii) description of the item(s), serial number(s), inventory control number(s), if applicable, and (iii) sanitization method used. No later than sixty (60) calendar days from contract expiration or termination or as otherwise specified in the Contract, Successful Respondent must either (i) complete the sanitization and submit via email to the CPA Contract Manager all sanitization documentation or (ii) submit a written statement via email to the CPA Contract Manager explaining the reason that destruction of CPA Data by Successful Respondent is technically impossible or impractical. Successful Respondent’s obligations set forth in this clause survive the termination or expiration of the contract as long as Successful Respondent retains CPA Data.

n) Third-Party Service Providers. It is Successful Respondent’s sole responsibility to ensure that its access and the access Successful Respondent grants to its service providers to CPA Data or CPA Information Systems does not result in unauthorized access to CPA Data or CPA Information Systems.

o) Reserved.

p) State Agency Website Requirements. Successful Respondent shall comply with the requirements for state agency websites set forth in 1 Texas Administrative Code §206.

q) Payment Card Industry Standards. Successful Respondent shall implement and maintain certification of Payment Card Industry (PCI) compliance standards. In addition, Successful Respondent represents and warrants that the software used for the processing of credit card payments is in compliance with all applicable PCI standards including, but not limited to, Payment Application Data Security Standards (PA-DSS) and Point to Point Encryption Solution Requirements (P2PE).

RFP #304-26-0911LC Unclaimed Property Auction Services Page 11 of 44

r) State Authorization and Risk Management Program (TX-RAMP). Successful Respondent shall obtain TX-RAMP certification in accordance with the Department of Information Resources (DIR) Program Manual. CPA requires the following TX-RAMP certification based-on Agency criteria:

1) X None. Product is out of scope/low impact in accordance with the DIR TX-RAMP Manual.

2) ___ Level 1 Certification. The product will administer Agency public data.

3) ___ Level 2 Certification. The product will administer Agency sensitive, confidential, and/or regulated data.

Upon Contract award, Successful Respondent shall maintain compliance with the immediately preceding TX- RAMP program requirements and certification throughout the term of the contract. Successful Respondent shall notify the CPA Contract Manager immediately if such TX-RAMP certification is revoked or otherwise removed.

If Successful Respondent uses a cloud service provider to host (i.e., Infrastructure as a Service or IaaS) or build (i.e., Platform-as-a-Service or PaaS) a custom-developed CPA system or application, Successful Respondent shall ensure its cloud service provider obtains TX-RAMP certification in accordance with the Department of Information Resources (DIR) Program Manual. If applicable, CPA requires the following TX-RAMP certification based-on Agency criteria:

4) ___ None. Product is out of scope/low impact in accordance with the DIR TX-RAMP Manual.

5) ___ Level 1 Certification. The product will administer Agency public data.

6) X Level 2 Certification. The product will administer Agency sensitive, confidential, and/or regulated data.

Upon Contract award, Successful Respondent shall ensure its cloud service provider used to host or build a custom-developed CPA system or application maintains compliance with the immediately preceding TX-RAMP program requirements and certification throughout the term of the contract. Successful Respondent shall notify the CPA Contract Manager immediately if such TX-RAMP certification is revoked or otherwise removed.

s) Reserved.

t) FedRAMP or StateRAMP Authorization. If Successful Respondent uses a cloud service provider to host (i.e., Infrastructure as a Service or IaaS) or build (i.e., Platform-as-a-Service or PaaS) a custom-developed CPA system or application, Successful Respondent shall ensure its cloud service provider maintains continuous FedRAMP or StateRAMP acceptable status and notify the CPA Contract Manager immediately if such authorization is revoked or otherwise removed.

u) Reserved.

D.4. Accessibility Compliance. Successful Respondent shall provide Services that complies with the applicable, statutorily required accessibility standards for the State of Texas. In the event that the Services do not meet or exceed the applicable statutorily required accessibility standards for the State of Texas, Successful Respondent shall provide technical support and Services documentation necessary to enable CPA to comply with the State of Texas reporting requirements outlined in 1 Texas Administrative Code Chapters 206 and 213. Such assistance includes, but is not limited to, Successful Respondent providing a Voluntary Product Accessibility Template (VPAT) or a similar report in substantially the same format as a VPAT. Successful Respondent shall respond to all written inquiries from CPA regarding the Services’ compliance with requisite accessibility standards within five (5) business days of receiving such request.

D.5. Liquidated Damages. In submitting a Proposal, Respondent agrees that the measure of damages in the event of a default or breach by Successful Respondent may be difficult or impossible to calculate. In the event Successful Respondent fails to perform Services or complete the obligations under the Contract in a timely manner, CPA may require Successful Respondent to pay, as liquidated damages and not as a penalty, an amount equivalent to two percent (2%) of the total cost for Services or obligations not completed as required by the Contract per calendar day of delay. CPA may impose, but is not obligated to impose, these liquidated damages in lieu of any monetary damages available to CPA under the Contract or applicable law.

D.6. Optional Features, Products or Services. If Respondent believes there are additional features, products or services that would benefit CPA under this RFP, Respondent may describe such features, products or services and include pricing for such features, products or services in Price Schedule 2, Section IV (Mandatory Price Sheet). Optional features, products or services are not scored as part of the evaluation process.

E. Contract Resulting from this Solicitation; Order of Priority

Respondent’s Proposal is a legal offer to contract based upon the terms, conditions, and specifications set forth in this RFP.

“Contract” means (1) a valid PO issued by CPA or (2) a formal, written agreement between CPA and Successful Respondent, if any. The Contract is effective as of the Award Date and will be between CPA and the Successful Respondent. Successful Respondent shall be solely responsible to CPA for all performance by Successful Respondent’s employees, representatives, RFP #304-26-0911LC Unclaimed Property Auction Services Page 12 of 44 agents, subcontractors, suppliers, third-party service providers, and similar entities (“Persons” for purposes of this sentence) and for ensuring that all such Persons comply with applicable provisions of this RFP and the Contract. The entire Contract between CPA and Successful Respondent shall consist of the following documents, which shall control in the following order of priority, except as otherwise provided in the formal, signed agreement between the parties or CPA’s PO: (1) the PO and PO Change Notices (POCN), if any; (2) the formal, signed agreement, if any; (3) this RFP; and (4) Successful Respondent’s Proposal (collectively, these documents constitute the “Contract”).

F. Warranty of Performance

Successful Respondent represents and warrants that its performance under the Contract shall be conducted conscientiously in a professional and workmanlike manner to the full extent of Successful Respondent’s talents and capabilities with due diligence and in full compliance with the highest professional standards of practice in the industry applicable to the Services.

G. Security Incident Notification

Successful Respondent shall have policies and procedures for the effective management of Security Incidents, which shall be made available to CPA upon written request. Within twenty-four (24) hours of Successful Respondent’s discovery or reasonable belief that there has been an event which results in the accidental or deliberate unauthorized access, loss, disclosure, modification, disruption, or destruction of confidential CPA information (“Security Incident”), Successful Respondent shall provide notice to CPA by calling (800) 531-5441 EXT 34357. Until the investigation is complete, Successful Respondent shall submit, on a daily basis or as otherwise agreed by CPA, a written report via encrypted email to security.alerts@cpa.texas.gov that includes, at a minimum, the following:

Date and time incident occurred, Date and time incident detected, Date and time incident contained, Address where incident occurred, Name of person(s) that discovered incident, Description of how Successful Respondent discovered incident, Type of CPA information involved, Description of the nature of the incident, Description of the steps Successful Respondent has taken or will take to investigate incident, Description of the steps Successful Respondent has taken or will take to mitigate any negative impacts of incident, Information technology involved (e.g., laptop, server, mainframe), Description of steps taken to preserve computer evidence and maintain chain of custody, and Description of corrective action Successful Respondent has taken or will take to prevent future incidents.

Successful Respondent shall coordinate all media or other breach notifications with CPA in advance of such notification(s), unless expressly prohibited by law. Subject to review and approval of CPA, Successful Respondent shall provide notice at its own cost that satisfies the requirements of applicable law to individuals whose information was compromised or likely compromised as a result of the Security Incident. If CPA, in its sole discretion, elects to send its own separate notice, then all costs associated with preparing and providing the notice shall be reimbursed to CPA by Successful Respondent. If Successful Respondent does not reimburse such costs within thirty (30) days of CPA’s written request, then CPA shall have the right to collect such costs. CPA reserves the right to conduct an independent investigation of any Security Incident, and should CPA choose to do so, Successful Respondent shall cooperate fully with CPA and assume responsibility at its own expense for making personnel, resources, and systems access available to CPA and CPA’s authorized representative(s).

H. Insurance and Bonds

Successful Respondent represents and warrants that it shall obtain and maintain the following coverages throughout the term of the Contract and that all coverages shall be with companies licensed in Texas with an “A” rating from A.M. Best Co.

authorized to provide the required coverages:

Blanket Employee Dishonesty Bond or Employee Dishonesty Coverage under a liability insurance policy with a minimum $25,000 for each individual who will provide Services. A rider or endorsement shall name the Texas Comptroller of Public Accounts as loss payee or additional named insured under the respective bond or policy.

Standard Workers Compensation Insurance covering all individuals who will provide Services.

Commercial General Liability Insurance: $1,000,000 minimum each occurrence limit; $2,000,000 minimum aggregate limit.

Professional Liability Insurance: $1,000,000 minimum each occurrence limit; $2,000,000 minimum aggregate limit.

RFP #304-26-0911LC Unclaimed Property Auction Services Page 13 of 44

All of the above policies and bonds shall contain endorsements prohibiting cancellation except upon thirty (30) calendar days’ prior written notice to CPA. Successful Respondent shall furnish proof to CPA of such coverage in the form of a Certificate of Insurance from Successful Respondent’s insurance carrier(s) indicating the required coverages. The certificate shall be addressed to CPA as the certificate holder. Successful Respondent shall submit proof of required insurance coverage withing five (5) days after the Effective Date, and annually thereafter, via email, referencing the PO number, to the following address: contract.administration@cpa.texas.gov.

I. Criminal Background Investigation

1. Criminal Background Investigation by Successful Respondent. Prior to an Assigned Personnel commencing Services under the Contract, Successful Respondent shall conduct a criminal background investigation and provide written notice via email to CPA’s Criminal Investigation Division of any Assigned Personnel that have any felony criminal conviction(s). If any information for the Assigned Personnel changes during the Contract Term, Successful Respondent shall provide written notice via email to CPA’s Criminal Investigation Division no later than three (3) business days after Successful Respondent’s discovery of such changed information that relates to felony criminal conviction(s).

Written notice to CPA’s Criminal Investigation Division shall be submitted to cid.analysts@cpa.texas.gov.

Successful Respondent’s exercise of due diligence in conducting the criminal background investigation shall include, at a minimum, the following: (1) compliance with Successful Respondent’s published policies and procedures for background and criminal conviction checks and (2) a comprehensive search of the public information portion of Texas Department of Public Safety criminal conviction database located at:

https://publicsite.dps.texas.gov/ConvictionNameSearch/. If Successful Respondent asserts that a search of the Texas Department of Public Safety criminal conviction database is not appropriate for a particular Assigned Personnel, Successful Respondent must provide written notice via email to CPA’s Criminal Investigation Division that explains the proposed alternate approach for conducting the criminal background investigation.

For purposes of this clause, “Assigned Personnel” includes, without limitation, all individuals provided by Successful Respondent under the contract resulting from this RFP who will or may (1) be assigned as lead or key personnel; (2) provide Services on-site at CPA’s premises; or (3) access CPA information resources, i.e., the procedures, equipment, and software that are employed, designed, built, operated, and maintained to collect, record, process, store, retrieve, display, and transmit information, and associated personnel including consultants and contractors. At CPA’s written request, Successful Respondent shall replace Assigned Personnel that has any felony criminal conviction(s).

Within five (5) business days of receipt of a written request by CPA’s Criminal Investigation Division during the Contract Term, Successful Respondent shall provide written notice to CPA’s Criminal Investigation Division of any Assigned Personnel that have any felony criminal conviction(s).

2. Criminal Background Investigation by CPA. At CPA’s discretion, CPA may conduct a criminal background investigation on Successful Respondent’s Assigned Personnel. Should any Assigned Personnel not be acceptable to CPA due to a finding of felony criminal conviction(s) as a result of the criminal background investigation, Successful Respondent shall replace such Assigned Personnel upon CPA’s written request or CPA may terminate the Contract.

3. Remedies. If CPA becomes aware that Successful Respondent provided false information, Successful Respondent fails to promptly notify CPA of changed information that related to felony criminal convictions, or Successful Respondents fails to replace Assigned Personnel as required by this Section, Successful Respondent shall be in breach of contract and CPA shall have the option to terminate the Contract without further obligation to Successful Respondent as well as pursue all other remedies and rights available to CPA under contract, at law, or in equity.

J. Contract Term; Survival of Terms

The Initial Term of the Contract shall be from Award Date through August 31, 2026. CPA may, in its sole discretion, exercise the option to extend the Contract for up to three (3) additional, one (1) year periods. The optional additional periods are September 1, 2026 through August 31, 2027; September 1, 2027 through August 31, 2028; and September 1, 2028 through August 31, 2029. “Contract Term” means the Initial Term and any optional additional periods exercised. To exercise an option to extend the term, CPA will notify Successful Respondent; such notice may be by PO issuance. Termination of the Contract for any reason shall not release Successful Respondent from liability or obligation set forth in the Contract that is expressly stated to survive any such termination or by its nature would be intended to be applicable following any such termination, e.g., indemnification, confidentiality, dispute resolution, records retention, CPA data security terms, and right to audit.

K. Acceptance Criteria

Prior to payment, CPA will evaluate the provided products and/or Services using the following criteria and any additional acceptance criteria agreed to by the parties prior to the Award Date and included in the Contract:

1. The products and/or services must meet all specifications and standards of performance in the Contract; and

RFP #304-26-0911LC Unclaimed Property Auction Services Page 14 of 44

2. The products and/or services must comply with all published specifications.

L. Payments

Payment(s) to Successful Respondent will be based upon the schedule described in Section IV (Mandatory Price Sheet) and the Contract. CPA may, in its sole discretion, process payments on a monthly basis. CPA makes no express or implied warranty whatsoever that any minimum compensation or minimum quantity will be guaranteed under the Contract. Payment shall be made in accordance with the Texas Prompt Payment Act, Chapter 2251 of the Texas Government Code (“Chapter 2251”) and Chapter 2251 shall govern remedies for late payment. Payments will be made to Successful Respondent as provided in Section V, Provision for Direct Deposit or Warrant.

M. Discounts

If Successful Respondent provides a discount on the final Contract costs at any time during the term of the Contract, Successful Respondent will notify CPA in writing ten (10) calendar days before the effective date of the discount. CPA will generate a POCN and send it to Successful Respondent. If an early payment discount is available to CPA, then Respondent’s Proposal must describe the early payment discount offered and the discount percentage that would apply to CPA’s early payment within ten (10), fifteen (15), twenty (20) or twenty-five (25) calendar days after receipt of a correct invoice.

Successful Respondent shall also specify any applicable, early payment discount option(s) on each submitted invoice.

N. PO Addition and Deletion

CPA reserves the right, in its sole discretion, to add or delete products or Services during the Contract Term. All additions or deletions will be processed through CPA’s Procurement Section. The rate at the time of the addition or deletion shall be the same as the rate quoted in the Contract for the same model product or Service. The effective date of any addition or deletion will be no later than five (5) business days after receipt of CPA’s written notification of the addition or deletion.

For this purpose, written notification includes registered mail, regular mail, or email with confirmation receipt.

For any additions, CPA’s Procurement Section will provide a POCN to Successful Respondent. The total number of additions allowed to CPA is determined by the number CPA chooses to purchase. For any deletions, CPA’s Procurement Section will provide a POCN to Successful Respondent with the effective date of the deletion, the amount of the reduction or refund (if any), and the…