RFO # 304-26-1157JW: A&T Pro (Orion) Field Appraisal System Maintenance and Related Services Page 1 of 45 Rev. 6/27/23

Request for Offers

A&T Pro (Orion) Field Appraisal System Software

Maintenance and Related Services

RFO No. 304-26-1157JW

January 5, 2026

Anticipated Schedule of Events

January 5, 2026 Issuance of RFO

January 9, 2026 Deadline for Submission of Questions (2:00 p.m., CT)

January 14, 2026 Release of Official Responses to Questions

(or as soon thereafter as practical)

January 26, 2025 Deadline for Submission of Offers (2:00 p.m.

CT)

Late Offers will not be considered

April 01, 2026 Services Commencement Date

(or as soon thereafter as practical)

RFO # 304-26-1157JW: A&T Pro (Orion) Field Appraisal System Maintenance and Related Services Page 2 of 45

Table of Contents

I. Summary

II. Specifications

A. Introduction

B. Background

C. Definitions and Acronyms

D. Scope of Services

E. Contract Resulting From This Solicitation; Order of Priority

F. Warranty of Performance

G. Security Incident Notification

H. Insurance and Bonds

I. Criminal Background Investigation

J. Contract Term

K. Invoice Acceptance Criteria

L. Payments

M. Discounts

N. PO Addition and Deletion

O. HUB Subcontracting Plan Information

P. Respondent Documents

Q. Respondent Exceptions

R. Respondent’s Past Performance

III. Offer Submission Requirements

A. Delivery of Offer

B. Offer Content and Format

IV. Mandatory Price Sheet

V. Standard Terms and Conditions

VI. Execution of Offer

VII. Conflict of Interest/Disclosure Statement

VIII. Nondisclosure Agreement

IX. Confidential Treatment of Information Acknowledgment

X. Certification Regarding Public Nature of the Offer

XI. Respondent Exceptions Response Template

XII. Contractor Cybersecurity Training Attestation Form

RFO # 304-26-1157JW: A&T Pro (Orion) Field Appraisal System Maintenance and Related Services Page 3 of 45

I. Summary

1. Type of Solicitation: Request for Offers (RFO)

2. Issuing Office: Texas Comptroller of Public Accounts (CPA)

Procurement Section

Room 300, Attn: RFO No. 304-26-1157JW

111 E. 17th Street

Austin, Texas 78774

OR Texas Comptroller of Public Accounts

Procurement Section

Attn: RFO No. 304-26-1157JW

P.O. Box 12050

Austin, Texas 78711-2050

3. Additional Requirements/Qualifications: N/A

4. Responses to RFO: Sealed Competitive Offers

5. Deadline for Offers: In Issuing Office No Later Than:

January 26, 2026; 2:00 p.m., Central Time (CT)

6. Initial Contract Term: April 01, 2026 through March 31, 2027

7. CPA Optional Contract Terms:

April 01, 2027 through March 31, 2028

April 01, 2028 through March 31, 2029

April 01, 2029 through March 31, 2030

8. CPA Contact Person for this RFO: Jennifer Williams, CTCM, CTCD

Email: bidcpa@cpa.texas.gov

9. Offers Submitted by Email: Required; See Section III, Part A

10. Offers Submitted by Fax: Not Accepted

11. Pre-Offer Conference: N/A

12. Pre-Offer Inspection: N/A

13. Letters of Intent to Submit an Offer: N/A

14. RFO Addenda: Notices of changes to items directly impacting the original RFO or solicitation process will be posted on the Electronic State Business Daily

(ESBD) located at: http://www.txsmartbuy.com/esbd. CPA will post any amendment to this solicitation on the ESBD as an RFO Addendum. It is the responsibility of an interested party to check the ESBD for updates to this RFO before submitting an Offer. Each Respondent is solely responsible for verifying CPA’s receipt of its questions, if applicable, and its Offer by the deadlines specified in this RFO.

15. Questions and Answers: Questions regarding this RFO must be in writing and must be submitted to the CPA Contact Person specified in Part 8, no later than January 09, 2026; 2:00 p.m. CT. Telephone inquiries will not be accepted.

Questions may be submitted by email to the email address specified in

Part 8. CPA intends to post answers to the questions received on the

ESBD on January 14, 2026, or as soon thereafter as practical.

16. Respondent Presentations: N/A mailto:bidcpa@cpa.texas.gov http://www.txsmartbuy.com/esbd

RFO # 304-26-1157JW: A&T Pro (Orion) Field Appraisal System Maintenance and Related Services Page 4 of 45

17. Evaluation of Offers. Offers will be evaluated under the Best Value Standard (Section 2157.003 of the Texas

Government Code):

Criteria Weight

Respondent’s Past Performance, Qualifications & Experience 20%

Compliance with CPA Specifications 50%

Cost 30%

Total: 100%

As applicable, the factors listed in Sections 2155.074, 2155.075, 2156.007, and 2157.003 of the Texas Government Code shall also be considered in making an award.

18. Electronic Offers Only. Due to changed building access restrictions, Respondents will not be permitted to hand deliver

Offers to the Issuing Office. Respondents are required to submit Offers electronically via email in accordance with Section

III, Part A.

19. Contact with CPA Staff: Upon issuance of this RFO, employees and representatives of CPA, other than the CPA Contact

Person identified in Part 8, will not discuss the contents of this RFO with any Respondent or its representatives. Failure of a Respondent or any of its representatives to observe this restriction may result in disqualification of any related

Offer. This restriction does not preclude discussions between the parties to conduct business unrelated to this procurement or to obtain assistance completing Historically Underutilized Business (HUB) forms required by this RFO.

RFO # 304-26-1157JW: A&T Pro (Orion) Field Appraisal System Maintenance and Related Services Page 5 of 45

II. Specifications

A. Introduction

The Texas Comptroller of Public Accounts (CPA), an agency of the State of Texas, issues this Request for Offers (RFO) to solicit Offers from qualified vendors for A&T Pro (Orion) Field Appraisal System Software Maintenance and Related

Services, as described in this Section II and in this RFO (Services). CPA’s objective is to obtain the Services that represent the best value for CPA and the State of Texas, according to the terms and conditions of this RFO.

CPA anticipates making a contract award to one (1) Successful Respondent for the Services. CPA reserves the right not to award a Contract for the performance of all or part of the Services. This RFO is not exclusive and CPA reserves the right to issue additional solicitations regarding the Services or similar services at any time. All

Respondents are encouraged to offer their best pricing at all times.

All costs associated with the Services must be included in the Respondent’s Offer. Offers that do not meet all of the requirements or contain all of the required documentation specified in this RFO may be rejected as non-responsive.

CPA understands that the requested items in this RFO may be proprietary to one vendor under Section 2155.067 of the

Texas Government Code; however, CPA strongly encourages Offers from all qualified Respondents that may be able to provide the Services.

B. Background

The CPA’s Property Tax Assistance Division (PTAD) is currently seeking A&T Pro (Orion) FAS software to support its statutory obligation under Section 403.302 of the Texas Government Code to conduct the School District Property Value

Study (SDPVS), which ensures equitable distribution of state education funding. PTAD employs over 40 remote field appraisers who rely on this software to estimate market values of sample properties across the state. While this system is needed for current operations, CPA plans to transition to a new platform in the future and reserves the right to terminate the contract upon successful implementation and go-live of the replacement system, with reasonable notice provided to the vendor.

C. Definitions and Acronyms

• Affiliates. A state agency or other entity designated by law or regulation to be under the authority or control of CPA.

• Award Date. The Award Date is the earlier of the date an authorized representative of CPA (1) issues a Purchase

Order (“PO”) or (2) signs a formal, written agreement.

• Contract. The agreement, if any, described in Section II, Part E (Contract Resulting from this Solicitation/Order of

Priority).

• CPA. Texas Comptroller of Public Accounts.

• CPA Contract Manager. The end-user division contact responsible for day-to-day contact with Successful

Respondent; contact details to be provided by CPA after the Award Date and/or in the Contract.

• CPA’s Designated Representative. The CPA staff member designated to serve as the CPA point of contact for certain communications and activities during Successful Respondent’s performance under the Contract.

• CT. Central Time.

• Error Correction. The correction of software malfunctions due to development, coding, or configuration issues that prevent the software from operating as designed.

• FAS. Field Appraisal System. The A&T Pro (Orion) software application used by the field appraisers in CPA’s

PTAD to classify and appraise sample properties.

• Fiscal Year. The State of Texas and CPA’s fiscal year that begins on September 1 and ends on August 31.

• Licensed Software. The version of the software application(s) provided under a contract resulting from this RFO in

Object Code form, any released Software Upgrades, Software Updates, Software Enhancements/Releases, Software

Patches/Fixes, Error Corrections, and Customizations of such version.

• Object Code. The machine code that can be directly executed by a computer’s central processing unit.

• Offer. A response to this RFO.

RFO # 304-26-1157JW: A&T Pro (Orion) Field Appraisal System Maintenance and Related Services Page 6 of 45

• Respondent. Any person or entity that submits an Offer to this RFO.

• Response Time. The period between Successful Respondent’s receipt of a service request from CPA and the time until Successful Respondent’s service technician responds with repair efforts underway.

• SDPVS. School District Property Value Study.

• SLA. Service Level Agreement for software support.

• Software Enhancement/Release. A change to a software application, intended to increase functionality, productivity, compatibility, and/or improve the user interface.

• Software Maintenance and Related Services (Services). All of the Licensed Software, Software Maintenance and

Technical Support, Licensed Software Documentation, and other items listed in this Section and the RFO. The term includes, but is not limited to, fees, shipping, freight handling, and any other services associated with Successful

Respondent’s performance under any contract resulting from this RFO.

• Software Patch/Fix. Addition to a piece of code, usually as an immediate remedy to an existing software application error or defect. A software patch or fix is usually a temporary measure until a more permanent solution is implemented with a Software Enhancement, Software Release, and/or version update.

• Software Update. Any (a) commercially available versions of the Licensed Software with a version number designated to the right of the decimal point such as 1.1, 1.2, 1.3, etc., and (b) any subsequent variation of the Licensed

Software which provides essentially the same functionality and accomplished substantially the same tasks as the

Licensed Software but which the software publisher releases under a different name or label.

• Software Upgrade. A commercially available new version of the Licensed Software typically designated by the number to the left of the decimal point such as 1.0, 2.0, 3.0, etc.

• Successful Respondent. The Respondent awarded a contract resulting from this RFO.

D. Scope of Services

D.1 General

1) Successful Respondent shall provide Services for the software products listed in Section IV (Mandatory Price Sheet) of this RFO as described in this RFO.

2) In its Offer, Respondent must include all costs for providing the Services, as described in this RFO, in Section IV

(Mandatory Price Sheet) of this RFO.

D.2 Licensed Software, Software Maintenance and Technical Support and Related Services

1) General

a) Successful Respondent shall provide A&T Pro (Orion) FAS Software Maintenance and Technical Support as described in this RFO. Software Maintenance and Technical Support includes, but is not limited to, the following:

telephone and on-line support, Error Corrections, Software Updates, Software Upgrades, Software Patches, Software Fixes, Software Enhancements, Software Releases, latest features, performance improvements, Licensed Software Documentation, as defined by Section II, D.2.5, and technical library CD series or online portal access, if applicable.

b) Successful Respondent shall provide qualified personnel to be available to CPA by telephone, email, or website for the reporting of problems or issues with the A&T Pro (Orion) FAS Licensed Software or Software

Maintenance and Technical Support Services. All such A&T Pro (Orion) FAS Software Maintenance and

Technical Support Services must be unlimited during the term of any contract resulting from this RFO. Qualified personnel must be Tyler certified or trained.

c) Successful Respondent shall provide a help-desk toll-free telephone number, email, or website for the reporting of problems or issues with the A&T Pro (Orion) FAS Licensed Software. Successful Respondent shall provide toll-free telephone support twenty-four (24) hours per day seven (7) days a week. Successful Respondent shall allow a minimum of three (3) authorized CPA contacts to report problems or issues to Successful Respondent’s helpdesk. Upon request of Successful Respondent, CPA will provide the list of authorized support staff, who may be changed in CPA’s sole discretion.

d) Successful Respondent shall send to CPA all A&T Pro (Orion) FAS Software Upgrades and Software Patches automatically. Electronic/Overnight delivery of software updates, replacement software and/or Software Patches will be supplied by Successful Respondent in the event of A&T Pro (Orion) FAS Licensed Software failure.

RFO # 304-26-1157JW: A&T Pro (Orion) Field Appraisal System Maintenance and Related Services Page 7 of 45

2) Release Management and Hot Fix/Patch Application

Successful Respondent shall assist in pre-release planning, scheduling, and implementing installation of mandatory

A&T Pro (Orion) FAS and other required software manufacturer Software Updates and Software Upgrades of

Licensed Software in accordance with the manufacturer-suggested support guidelines. Successful Respondent shall notify CPA of any hot fix migrations a minimum of twenty-four (24) hours before a migration. Successful

Respondent’s notification shall specify the Software Release schedule, release notes and summary of impact to the

Licensed Software. Successful Respondent shall be responsible for resolving any issues resulting from a Software

Update, Software Upgrade, Software Enhancement/Release or Software Patch/Fix as reported through Successful

Respondent’s support center.

3) Service Level Agreement

Successful Respondent shall respond to service requests in accordance with the priority and within the maximum response times listed in Table 1 (Maximum Response Times). CPA, in its sole discretion, will determine the service priority reporting of problems or issues with the Licensed Software.

Table 1 - Maximum Response Times

PRIORITY LEVEL DESCRIPTION

MAX RESPONSE

TIME

Priority 1 (P1) –

Critical

a. Total outage or an outage of a critical component that renders the software unusable or unable to perform pending critical tasks.

b. Security issue that affects the production environment.

2 hrs.

Priority 2 (P2) – High

a. Performance degradation or diminished processing, capacity, or functionality that affects multiple users within the production environment.

b. Issue that affects fulfillment of a pending deadline or causes staff to be idle.

12 hrs.

Priority 3 (P3) –

Medium

a. Performance issue related to non-production environments, non-critical issue that is time sensitive, or non-impacting issue requiring additional troubleshooting.

b. Issue that does not affect current work but will affect customer’s ability to perform work within one business day.

c. Frequent issue of minor importance yet obviously affecting work efficiency.

48 hrs.

Priority 4 (P4) –

Low

a. Scheduled maintenance outage.

b. Request for information prior to diminished processing, capacity, or functionality.

c. Low frequency error of marginal importance.

d. Minor problem that requires research, testing, or cooperative effort to resolve.

72 hrs.

4) Escalation Protocol

In its Offer, Respondent must propose for CPA’s consideration an escalation protocol for collaboratively resolving issues encountered during the term of any contract resulting from this RFO. The proposed escalation process protocol must explain how issues or complaints are prioritized and resolved. This protocol shall include:

a) An organization chart addressing topics such as specific steps to be taken on top priority issues or disputes arising due to untimely response to system down or critical malfunction remedial repair requests; and

b) Any other top priority service requirements of a contract resulting from this RFO which are not met.

Respondent shall provide current business email address and business phone number for each person listed on the organization chart. Successful Respondent shall provide updated organization chart, email addresses and phone numbers as changes occur throughout the duration of the contract.

5) Licensed Software Documentation

a) Successful Respondent shall provide to CPA at least one (1) copy of the Licensed Software Documentation via online or hardcopy for each of the Licensed Software provided. Successful Respondent shall provide CPA either:

(1) written approval which authorizes CPA to make additional copies of the documentation at no charge; or

(2) access to additional copies of the documentation at no charge.

CPA will restrict distribution of the Licensed Software Documentation to those users with a “Need to Know” classification. CPA shall not remove, deface, or otherwise obscure any copyright, patent, trademark, service mark, RFO # 304-26-1157JW: A&T Pro (Orion) Field Appraisal System Maintenance and Related Services Page 8 of 45 or other proprietary legend (Proprietary Legends) on the Licensed Software or the documentation. Furthermore, CPA shall include such Proprietary Legends in any reproductions of either the Licensed Software or the Licensed

Software Documentation that CPA is permitted to make.

b) Successful Respondent shall update application documentation for all Software Upgrades and Software Updates.

Successful Respondent shall notify CPA of online documentation availability or provide electronically to CPA.

Successful Respondent shall provide updated documentation electronically to CPA for any CPA-specific customizations or configurations developed during the contract term or developed previously for A&T Pro

(Orion) FAS. Successful respondent shall confirm CPA’s Designated Representative’s review and approval of custom documentation.

6) Licensed Software Integration

a) Licensed Software must fully integrate with CPA’s third-party solution: Marshall & Swift Valuation Platform

(MSVP) Texas Residential and Commercial Licensed Software.

b) Successful Respondent shall provide any support for installation and troubleshooting of integration of MSVP modules and databases within A&T Pro (Orion) FAS for the term of the Contract, including any exercised renewal periods.

c) Successful Respondent shall confirm with CPA and its current third-party cost data software provider that the

Licensed Software minimum hardware and software requirements do not conflict with the minimum requirements of A&T Pro (Orion) FAS.

7) Licensed Software Delivery

a) Annual updates to the Licensed Software shall be delivered electronically to CPA between each year. Successful

Respondent shall work with CPA’s Designated Representative to plan upgrade timing to ensure the least amount of business disruption possible. CPA’s preferred annual upgrade timing is the second week of February through

March 30.

b) Successful Respondent shall deliver files directly to CPA’s Designated Representative via CPA secure file transfer protocol (SFTP) software. In the event of CPA SFTP software failure or unavailability, Successful

Respondent shall provide CPA access to the Licensed Software using Successful Respondent’s SFTP software, if CPA Information Security and Information Technology divisions approve the use of the Successful

Respondent’s SFTP software. In the event of Successful Respondent’s SFTP software failure or unavailability, Successful Respondent shall overnight CDs to a mutually agreed upon CPA address.

8) Configuration Management

Successful Respondent shall provide the following configuration management services:

a) Develop, document, and implement a configuration management plan and protect it from unauthorized disclosure and modification.

b) Develop, document, and maintain current inventory of configuration changes for A&T Pro (Orion) FAS.

c) Provide Configuration Change Reports to CPA’s Designated Representative after changes are implemented to

A&T Pro (Orion) FAS.

d) Submit requests for individual access privileges changes to CPA’s Designated Representative.

e) Configuration stores shall be secured from unauthorized access and tampering.

f) Configuration credentials and authentication tokens shall not be held in plain text in configuration files (e.g., client config file with remote login ID and password).

g) User accounts and service accounts used for configuration management shall only have the minimum privileges required for the task.

h) Establish and document configuration settings that reflect the most restrictive mode consistent with operational requirements; implement configuration settings; identify, document, and approve any deviations from established configuration settings; monitor and control changes to the configuration settings in accordance with CPA’s policies and procedures.

i) Identify and document any deviations from established configuration settings and submit for approval by CPA’s

Designated Representative.

9) Software Change Request Supplemental Services

RFO # 304-26-1157JW: A&T Pro (Orion) Field Appraisal System Maintenance and Related Services Page 9 of 45

In order to accommodate future business objectives, CPA may require Supplemental Services to support A&T Pro

(Orion) FAS. If proposed in the Offer, Supplemental Services may be used in CPA’s discretion to provide for additional technical services including enhancements or customized improvements to the functionality of the

Licensed Software used by CPA. In its Offer, Respondent must provide a not to exceed hourly rate for providing

Supplemental Services on Section IV (Mandatory Pricing Form Table 1) of the RFO.

CPA may initiate a Supplemental Services request by providing Successful Respondent with a Statement of Work

(“SOW”) in order for the Successful Respondent to propose an estimation of the level of effort required to complete the requested services within the CPA-proposed timeline. Each SOW will define the requirements, tasks, deliverables, resources, anticipated timeline, and not to exceed cost to support the particular requested Supplemental

Services.

Successful Respondent shall provide resources with the technical expertise to perform the Supplemental Services.

CPA will provide Successful Respondent with the necessary access, if needed, to CPA’s systems (e.g., building, network, servers, workstations) to complete the tasks identified in the SOW.

A CPA-approved Supplemental Services SOW will be signed by CPA’s Deputy Comptroller. Successful

Respondent must receive a Purchase Order from CPA prior to commencing any Supplemental Services. CPA shall not prepay any amounts for Supplemental Services. Successful Respondent shall not invoice, and CPA shall not pay for Supplemental Services which (1) deviate from the CPA-approved SOW, (2) commence prior to the date of the new/revised Purchase Order, or (3) exceed the rates specified in Section IV (Mandatory Pricing Form) of the

RFO.

Supplemental Services do not include services which are covered by Maintenance and Technical Support.

Supplemental Services may include, but are not limited to, the following:

a) Application customizations to include the design and development of new source code; and

b) Report development.

D.3 CPA Data Security Terms.

D.3.1 CPA Data Safeguard Standards.

a. Defined Terms. The term “CPA Data” refers to CPA’s information as well as other entity information in the possession of CPA that is processed, stored, or transmitted by a computer. CPA Data includes all data that is generated by

Successful Respondent in performance of a contract with CPA. The term “CPA Information System” refers to those devices, software, networks and related infrastructure that CPA owns, operates or has obtained for use to conduct CPA business. Devices include, but are not limited to, CPA-owned or managed storage, processing, and communications devices, as well as personally owned devices.

b. Access to CPA Data. Successful Respondent represents and warrants that it will implement, maintain, and use appropriate administrative, technical, and physical safeguards to preserve the confidentiality, integrity, and availability of CPA Data. Successful Respondent will not collect, access, use, disclose, or retain CPA Data other than as necessary to perform the services specified in a contract resulting from this solicitation or as otherwise authorized in writing by

CPA. Successful Respondent will restrict access to CPA Data to only those personnel who must have the information on a “need to know” basis. Successful Respondent will not use CPA Data, or any information derived from CPA Data, for its own benefit or the benefit of any other person or entity. Successful Respondent will not share CPA Data with its parent company or other affiliate without CPA’s express written consent. If communications with Contractor necessitate the access or use of confidential Comptroller information, upon Comptroller’s written consent, Contractor shall require each individual who will require access to or may be exposed to Comptroller’s confidential information to sign the Confidential Treatment of Information Acknowledgment (CTIA) form (Attachment I).

c. Web-Based Remote Access to CPA Information Systems. Successful Respondent may use third-party web-based remote access connections to CPA Information Systems to provide support services under the following conditions:

1. CPA shall affirmatively initiate and accept Successful Respondent’s connections to CPA Information Systems.

2. CPA shall monitor Successful Respondent’s connections to CPA Information Systems for the duration of the

Services.

3. CPA shall terminate Successful Respondent’s connections to CPA Information Systems upon completion of the

Services.

d. Reserved.

e. Reserved.

RFO # 304-26-1157JW: A&T Pro (Orion) Field Appraisal System Maintenance and Related Services Page 10 of 45

f. Location of CPA Data. Successful Respondent shall ensure that CPA Data (i.e., primary and backup) remains, at all times, within the continental United States. Successful Respondent shall receive, process, transmit, and store all CPA

Data within the continental United States. Successful Respondent’s point of access to CPA Data shall be within the continental United States.

g. Encryption Standards.

1. Successful Respondent shall encrypt CPA Data in transit and at rest. Data in transit means data is moving via email, in applications, or through browsers and other web connections. Data at rest (including data backups) means data is stored in databases, the cloud, removable media, or mobile devices.

2. Successful Respondent shall utilize encryption standards that are FIPS 140-2 compliant or, upon the written approval of CPA’s Chief Information Security Officer, shall meet the intent of the standards as described in FIPS

140-2.

3. The minimum cryptographic algorithm used by Successful Respondent must be Advanced Encryption Standard

(AES) 128 or higher (256 AES is preferred).

4. Successful Respondent shall encrypt CPA Data transmitted over a public or private network. CPA approved data encryption transmission protocols include the following: (1) SFTP (FTP over SSH), (2) FTPS (FTP over TLS),

(3) HTTPS (HTTP over TLS), and (4) virtual private network.

h. Reserved.

i. Auditable Information Security Framework. Successful Respondent shall secure its own and its third-party service providers’ systems (e.g., IT service provider, Cloud Service Provider) in a manner consistent with an auditable information security framework e.g., National Institute of Standards and Technology (NIST), International

Organization for Standardization (ISO) 27001. In its response to this solicitation, Successful Respondent shall disclose its adopted information security framework.

j. Reserved.

k. Supply Chain Risk Management. Successful Respondent shall provide CPA’s Contract Manager a description of how it manages supply chain risks. Specifically, Successful Respondent shall describe its established agreements and procedures with entities involved in the supply chain for the notification of supply chain risks, compromises, and the result of assessments or audits. During the term of the contract, Successful Respondent shall provide CPA’s Contract

Manager prompt, written notice of supply chain risks that impact the delivery of the products and services of the

Contract. Examples of supply chain risks include supplier financial failure, production control/product quality, market supply and demand, labor disputes/shortages, cybersecurity threats, natural disasters. Successful Respondent shall notify CPA of a supply chain compromise and potential compromise in accordance with the Section G Security

Incident Notification.

l. Reserved.

m. Media Sanitization. Successful Respondent shall sanitize information system media, both digital and non-digital, in accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization) when CPA Data in the custody of Successful Respondent is no longer required to be retained by contract with CPA. Successful Respondent must maintain a record documenting each sanitization procedure that, at a minimum, includes the following information:

(i) date sanitization completed, (ii) description of the item(s), serial number(s), inventory control number(s), if applicable, and (iii) sanitization method used. No later than sixty (60) calendar days from contract expiration or termination or as otherwise specified in the Contract, Successful Respondent must either (i) complete the sanitization and submit via email to the CPA Contract Manager all sanitization documentation or (ii) submit a written statement via email to the CPA Contract Manager explaining the reason that destruction of CPA Data by Successful Respondent is technically impossible or impractical. Successful Respondent’s obligations set forth in this clause survive the termination or expiration of the contract as long as Successful Respondent retains CPA Data.

n. Third-Party Service Providers. It is Successful Respondent’s sole responsibility to ensure that its access and the access

Successful Respondent grants to its service providers to CPA Data or CPA Information Systems does not result in unauthorized access to CPA Data or CPA Information Systems.

o. Reserved.

p. Reserved.

q. Reserved.

RFO # 304-26-1157JW: A&T Pro (Orion) Field Appraisal System Maintenance and Related Services Page 11 of 45

r. Prohibited Technology. Successful Respondent shall not use covered applications or prohibited technologies in its technology solutions or services provided to Comptroller. In addition, Successful Respondent represents and warrants that its system, software, components, and services do not use the covered applications or prohibited technologies listed on the Department of Information Resources (DIR) Covered Applications and Prohibited Technologies website.

s. Use of Artificial Intelligence. Successful Respondent shall comply with all federal and state laws and regulations for artificial intelligence. Successful Respondent shall implement and maintain the following.

a. Transparency. Disclose the artificial intelligence (AI) that Successful Respondent embeds in its technology products and services and provide detailed information on the purpose of the AI, the specific

AI model(s) in use, if the AI uses CPA data to train AI model(s), the configuration settings and options to disable or opt out of using the AI.

b. Artificial Intelligence Inventory. Successful Respondent shall implement and maintain an inventory of the AI used in Successful Respondent’s solution, software, system components, and services provided to Comptroller. Comptroller is required to report an inventory of artificial intelligence in biennial statutorily required reports and Successful Respondent shall support Comptroller’s compliance by providing the inventory information upon Comptroller’s written request.

c. Monitoring. Successful Respondent shall monitor AI for query attacks, malicious inputs, and perturbations for model manipulation, theft, data poisoning, and data drift. Successful Respondent shall establish model integrity validation checks and data poisoning detection capabilities. Successful

Respondent shall implement processes for detecting personally identifying information (PII) in the model and removing PII from the model, as appropriate to ensure the AI cannot provide PII to Successful

Respondent’s other customers or outside the boundaries of the Comptroller’s systems.

d. Disclosure Notice. Successful Respondent shall disclose to the public prior to system use, the use of AI in systems that interact with the public and receive, process, transmit, or store CPA data.

e. Data Ownership. Successful Respondent shall acknowledge that Comptroller owns CPA data. If

Successful Respondent uses generative AI to provide services to customers of a CPA system, Successful

Respondent shall ensure that the AI cannot provide CPA data to Successful Respondent’s other customers or outside the boundaries of the Comptroller’s systems.

t. State Authorization and Risk Management Program (TX-RAMP). Successful Respondent shall obtain TX-RAMP certification in accordance with the Department of Information Resources (DIR) Program Manual. CPA requires the following TX-RAMP certification based-on Agency criteria:

1. _X_ None. Product is out of scope/low impact in accordance with the DIR TX-RAMP Manual.

2. __ Level 1 Certification. The product will administer Agency public data.

3. __ Level 2 Certification. The product will administer Agency sensitive, confidential, and/or regulated data.

Upon Contract award, Successful Respondent shall maintain compliance with the immediately preceding TX-RAMP program requirements and certification throughout the term of the contract. Successful Respondent shall notify the

CPA Contract Manager immediately if such TX-RAMP certification is revoked or otherwise removed.

If Successful Respondent uses a cloud service provider to host (i.e., Infrastructure as a Service or IaaS) or build (i.e., Platform-as-a-Service or PaaS) a custom-developed CPA system or application, Successful Respondent shall ensure its cloud service provider obtains TX-RAMP certification in accordance with the Department of Information

Resources (DIR) Program Manual. If applicable, CPA requires the following TX-RAMP certification based-on

Agency criteria:

4. _X_ None. Product is out of scope/low impact in accordance with the DIR TX-RAMP Manual.

5. __ Level 1 Certification. The product will administer Agency public data.

6. __ Level 2 Certification. The product will administer Agency sensitive, confidential, and/or regulated data.

Upon Contract award, Successful Respondent shall ensure its cloud service provider used to host or build a custom-developed CPA system or application maintains compliance with the immediately preceding TX-RAMP program requirements and certification throughout the term of the contract. Successful Respondent shall notify the CPA

Contract Manager immediately if such TX-RAMP certification is revoked or otherwise removed.

u. Reserved.

v. Reserved.

w. Reserved.

https://dir.texas.gov/information-security/covered-applications-and-prohibited-technologies https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdir.texas.gov%2Fresource-library-item%2Ftexas-risk-and-authorization-management-program-manual-30&data=05%7C02%7CJason.Frizzell%40cpa.texas.gov%7C9b22e092447c41d9816108dd30f4dbc3%7C2055feba299d4d0daa5a73b8b42fef08%7C0%7C0%7C638720550387877709%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=dFBcq3mGLKSAe5BKAYCH%2FFcMW6eaImJiVx85PviOPho%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdir.texas.gov%2Fresource-library-item%2Ftexas-risk-and-authorization-management-program-manual-30&data=05%7C02%7CJason.Frizzell%40cpa.texas.gov%7C9b22e092447c41d9816108dd30f4dbc3%7C2055feba299d4d0daa5a73b8b42fef08%7C0%7C0%7C638720550387877709%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=dFBcq3mGLKSAe5BKAYCH%2FFcMW6eaImJiVx85PviOPho%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdir.texas.gov%2Fresource-library-item%2Ftexas-risk-and-authorization-management-program-manual-30&data=05%7C02%7CJason.Frizzell%40cpa.texas.gov%7C9b22e092447c41d9816108dd30f4dbc3%7C2055feba299d4d0daa5a73b8b42fef08%7C0%7C0%7C638720550387877709%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=dFBcq3mGLKSAe5BKAYCH%2FFcMW6eaImJiVx85PviOPho%3D&reserved=0

RFO # 304-26-1157JW: A&T Pro (Orion) Field Appraisal System Maintenance and Related Services Page 12 of 45

D.4 Optional Features, Products or Services. Respondents are encouraged to submit and describe in detail in their Offers optional features, products or services that would benefit CPA but are not part of the minimum requirements of this

RFO. Optional features, products, or services may include additional training, additional maintenance, perpetual software licenses, increased service levels, etc. In its Offer, Respondent must describe with specificity any proposed optional features, products, or services. For pricing associated with optional items that exceed the minimum requirements of this RFO, Respondent must include the line-item cost associated with each proposed optional feature, product, or service in the “Optional Features, Products, or Services” pricing portion of Section IV (Mandatory Price

Sheet) of this RFO.

CPA has identified the following for Respondents’ consideration as optional features, products, or services:

Alternative Product/Service Option.

• System Administrator and Supervisor Training

D.5 Accessibility Compliance. Successful Respondent shall provide Licensed Software that complies with the applicable, statutorily required accessibility standards for the State of Texas. In the event that the Licensed Software does not meet or exceed the applicable statutorily required accessibility standards for the State of Texas, Successful Respondent shall provide technical support and Licensed Software documentation necessary to enable CPA to comply with the State of

Texas reporting requirements outlined in 1 Texas Administrative Code Chapters 206 and 213. Such assistance includes, but is not limited to, Successful Respondent providing a Voluntary Product Accessibility Template (VPAT) or a similar report in substantially the same format as a VPAT. Successful Respondent shall respond to all written inquiries from

CPA regarding the Licensed Software’s compliance with requisite accessibility standards within five (5) business days of receiving such request.

D.6 Liquidated Damages. In submitting an Offer, Respondent agrees that the measure of damages in the event of a default or breach of contract by Successful Respondent may be difficult or impossible to calculate. In the event Successful

Respondent fails to perform Services or complete the obligations under the Contract in a timely manner, CPA may require Successful Respondent to pay, as liquidated damages and not as a penalty, an amount equivalent to two percent

(2%) of the total cost for Services or obligations not completed as required by the Contract per calendar day of delay.

CPA may impose, but is not obligated to impose, these liquidated damages in lieu of any monetary damages available to CPA under the Contract or applicable law.

E. Contract Resulting From This Solicitation; Order of Priority.

Respondent’s Offer is a legal offer to contract based upon the terms, conditions, and specifications set forth in this RFO.

A contract award by CPA may be by (1) valid PO or (2) a formal, written agreement between CPA and Successful

Respondent. The Contract is effective as of the Award Date and will be between CPA and the Successful Respondent. The entire Contract between CPA and Successful Respondent shall consist of the following documents, which shall control in the following order of priority, except as otherwise provided in the formal signed agreement or PO: (1) the PO and PO

Change Notices, if any; (2) the formal, signed agreement, if any; (3) this RFO; and (4) Successful Respondent’s Offer

(collectively, the “Contract”).

F. Warranty of Performance

Successful Respondent represents and warrants that its performance under the Contract shall be conducted conscientiously in a professional and workmanlike manner to the full extent of Successful Respondent’s talents and capabilities with due diligence and in full compliance with the highest professional standards of practice in the industry applicable to the

Services.

G. Security Incident Notification

Successful Respondent shall have policies and procedures for the effective management of Security Incidents, which shall be made available to CPA upon written request. Within twenty-four (24) hours of Successful Respondent’s discovery or reasonable belief that there has been an event which results in the accidental or deliberate unauthorized access, loss, disclosure, modification, disruption, or destruction of confidential CPA information (“Security Incident”), Successful

Respondent shall provide notice to CPA by calling (800) 531-5441 EXT 34357. Until the investigation is complete, Successful Respondent shall submit, on a daily basis or as otherwise agreed by CPA, a written report via encrypted email to security.alerts@cpa.texas.gov that includes, at a minimum, the following:

• Date and time incident occurred,

• Date and time incident detected, mailto:security.alerts@cpa.texas.gov

RFO # 304-26-1157JW: A&T Pro (Orion) Field Appraisal System Maintenance and Related Services Page 13 of 45

• Date and time incident contained,

• Address where incident occurred,

• Name of person(s) that discovered incident,

• Description of how Successful Respondent discovered incident,

• Type of CPA information involved,

• Description of the nature of the incident,

• Description of the steps Successful Respondent has taken or will take to investigate incident,

• Description of the steps Successful Respondent has taken or will take to mitigate any negative impacts of incident,

• Information technology involved (e.g., laptop, server, mainframe),

• Description of steps taken to preserve computer evidence and maintain chain of custody, and

• Description of corrective action Successful Respondent has taken or will take to prevent future incidents.

Successful Respondent shall coordinate all media or other breach notifications with CPA in advance of such notification(s), unless expressly prohibited by law. Subject to review and approval of CPA, Successful Respondent shall provide notice at its own cost that satisfies the requirements of applicable law to individuals whose information was compromised or likely compromised as a result of the Security Incident. If CPA, in its sole discretion, elects to send its own separate notice, then all costs associated with preparing and providing the notice shall be reimbursed to CPA by Successful Respondent. If

Successful Respondent does not reimburse such costs within thirty (30) days of CPA’s written request, then CPA shall have the right to collect such costs. CPA reserves the right to conduct an independent investigation of any Security Incident, and should CPA choose to do so, Successful Respondent shall cooperate fully with CPA and assume responsibility at its own expense for making personnel, resources, and systems access available to CPA and CPA’s authorized representative(s).

H. Insurance and Bonds

Successful Respondent represents and warrants that it shall obtain and maintain the following coverages throughout the term of the Contract and that all coverages shall be with companies licensed in Texas with an “A” rating from A.M. Best

Co. authorized to provide the required coverages:

• Blanket Employee Dishonesty Bond or Employee Dishonesty Coverage under a liability insurance policy with a minimum $25,000 for each individual who will provide Services. A rider or endorsement shall name the Texas

Comptroller of Public Accounts as loss payee or additional named insured under the respective bond or policy;

• Standard Workers Compensation Insurance covering all individuals who will provide Services;

• Commercial General Liability Insurance: $1,000,000 minimum each occurrence limit; $2,000,000 minimum aggregate limit; and

• Professional Liability Insurance: $1,000,000 minimum each occurrence limit; $2,000,000 minimum aggregate limit.

All of the above policies and bonds shall contain endorsements prohibiting cancellation except upon thirty (30) calendar days’ prior written notice to CPA. No later than five (5) business days following the Award Date, and on an annual basis thereafter, Successful Respondent shall furnish proof to CPA of such coverage in the form of a Certificate of Insurance from Successful Respondent’s insurance carrier(s) indicating the required coverages. The certificate shall be addressed to

CPA as the certificate holder. Successful Respondent shall submit proof of required insurance coverage via email, referencing the PO number, to the following address: contract.administration@cpa.texas.gov.

I. Criminal Background Investigation

1. Criminal Background Investigation by Successful Respondent. Prior to an Assigned Personnel commencing Services under the Contract, Successful Respondent shall conduct a criminal background investigation and provide written notice via email to CPA’s Criminal Investigation Division of any Assigned Personnel that have any felony criminal conviction(s). If any information related to felony criminal conviction(s) for the Assigned Personnel changes during the Contract term, Successful Respondent shall provide written notice via email to CPA’s Criminal Investigation

Division no later than three (3) business days after Successful Respondent’s discovery of such changed information.

Written notice to CPA’s Criminal Investigation Division shall be submitted to cid.analysts@cpa.texas.gov.

Successful Respondent’s exercise of due diligence in conducting the criminal background investigation shall include, at a minimum, the following: (1) compliance with Successful Respondent’s published policies and procedures for background and criminal conviction checks and (2) a comprehensive search of the public information portion of Texas

Department of Public Safety criminal conviction database located at:

https://publicsite.dps.texas.gov/ConvictionNameSearch/. If Successful Respondent asserts that a search of the Texas

Department of Public Safety criminal conviction database is not appropriate for a particular Assigned Personnel, mailto:contract.administration@cpa.texas.gov mailto:cid.analysts@cpa.texas.gov https://publicsite.dps.texas.gov/ConvictionNameSearch/

RFO # 304-26-1157JW: A&T Pro (Orion) Field Appraisal System Maintenance and Related Services Page 14 of 45

Successful Respondent must provide written notice via email to CPA’s Criminal Investigation Division that explains the proposed alternate approach for conducting the criminal background investigation.

For purposes of this clause, “Assigned Personnel” includes, without limitation, (1) all individuals provided by

Successful Respondent under the Contract who will or may (a) be assigned as lead or key personnel; (b) provide

Services on-site at CPA’s premises; or (c) access CPA information resources, i.e., the procedures, equipment, and software that are employed, designed, built, operated, and maintained to collect, record, process, store, retrieve, display, and transmit information, and (2) associated personnel, including consultants and contractors. At CPA’s written request, Successful Respondent shall replace Assigned Personnel with any felony criminal conviction(s).

Within five (5) business days of receipt of a written request by CPA’s Criminal Investigation Division during the

Contract term, Successful Respondent shall provide written notice to CPA’s Criminal Investigation Division of any

Assigned Personnel that have any felony criminal conviction(s).

2. Criminal Background Investigation by CPA. At CPA’s discretion, CPA may conduct a criminal background investigation on Successful Respondent’s Assigned Personnel. Should any Assigned Personnel not be acceptable to CPA due to a finding of felony criminal conviction(s) as a result of the criminal background investigation, Successful Respondent shall replace such Assigned Personnel upon CPA’s written request or CPA may terminate the Contract.

3. Remedies. If CPA becomes aware that Successful Respondent provided false information, Successful Respondent fails to promptly notify CPA of changed information that related to felony criminal convictions, or Successful Respondents fails to replace Assigned Personnel as required by this Section, Successful Respondent shall be in breach of contract and CPA shall have the option to terminate the Contract without further obligation to Successful Respondent as well as pursue all other remedies and rights available to CPA under contract, at law, or in equity.

J. Contract Term

The initial term of the Contract shall be from April 1, 2026, to March 31, 2027.