ESBD_489546_1772718710695_SOL_ADD_2_405-25R0017163.pdf

ADDENDUM OF SOLICITATION

1. SOLICITATION NO.

405-25R0017163

2. ADDENDUM NO.

3. EFFECTIVE DATE

3/5/2026

4. ISSUED BY

Department of Public Safety Procurement and Contract Services 5805 North Lamar Blvd. Bldg. A 1st floor Austin, Texas 78752

5. NAME AND ADDRESS OF OFFEROR

6. The above numbered solicitation is amended as set forth in Item 7. The hour and date specified for receipt of Offers is extended, is not extended.

Offers must acknowledge receipt of this addendum prior to the hour and date specified in the solicitation or as amended, by one of the following methods:

(a) By completing Items 5 and 8, and returning 3 copies of the addendum; (b) By acknowledging receipt of this addendum on each copy of the offer submitted; or (c) By separate letter or e-mail which includes a reference to the solicitation and addendum numbers. FAILURE OF YOUR ACKNOWLEDGMENT TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT IN REJECTION OF YOUR OFFER.

If by virtue of this amendment you desire to change an offer already submitted, such change may be made by e-mail or letter, provided each e-mail or letter makes reference to the solicitation and this addendum, and is received prior to the opening hour and date specified.

7. DESCRIPTION OF ADDENDUM:

The purpose of this addendum is as follows:

1. To provide answers to vendor questions.

2. To replace Exhibit F.3 HUB Subcontracting Plan HSP with the new VetHUB Subcontracting Plan HSP.

3. To extend the closing date to Friday 3/20/2026 at 5 PM CST.

Except as provided herein, all terms and conditions of the solicitation, as heretofore changed, remain unchanged and in full force and effect.

8a. NAME AND TITLE OF SIGNER (Type or Print)

8b. OFFEROR

(Signature of Person Authorized to Sign) Date Signed

Vendor Questions and Answers

405-25R0017163 FAST

# Vendor Questions DPS Responses 1 Section C.1 Introduction - How many out-of-state and out-of-country captures did DPS perform in 2025?

In 2025, DPS performed 142,678 captures, which consisted of 119,298 fingerprints captured at out-of-state locations and 23,380 hard cards submitted by mail.

2 Section C.5.2.C – Fee Collection and Processing Requirements: Items # 8 and 9 - What scenarios would trigger no-cost/waived fee fingerprints?

#8 – No cost, DPS applicants, other fees may be waived by DPS according to statute.

#9 – Reprints due to submission errors would require waiving of all fingerprinting fees.

3 Section C.5.4.A DPS FAST Management Application Requirements: Reporting - What is the difference between the reporting requirements in this Section and those outlined in Section C.5.4.C:

Reporting Requirements?

C.5.4.A FAST Management Application Requirements would be used to view the lifecycle of an applicant's transaction (transaction details, fingerprint status, fees, fingerprint location, etc.) C.5.4.C are customizable reports required to monitor specific FAST metrics.

4 Does DPS require the Contractor to have direct leasehold or ownership of all 200+ physical fingerprinting locations, or is a partner-network model (utilizing third-party retail locations) acceptable, provided the Contractor maintains CJIS-compliant hardware and oversight at those sites?

DPS does not require a direct lease or ownership of all locations. Third-party or subcontractors are acceptable with DPS approval and Contractor oversight.

5 Regarding the Cloud Compliance requirement (FedRAMP High / TX-RAMP Level II): If an organization currently operates a private data center environment that is FISMA compliant and undergoes regular federal audits.

Since FISMA and FedRAMP share the same NIST 800-53 control baseline, will DPS grant TX-RAMP Level II reciprocity based on our existing FISMA Authorization to Operate (ATO), or must the system be hosted exclusively on a FedRAMP Marketplace-listed Cloud Service Provider (CSP)?

No, the vendor must contact DIR to go through the TX-RAMP process for any cloud environment in which DPS data will be stored.

6 Confirming "Exclusive State Data Ownership," is the Contractor permitted to store encrypted metadata (e.g., appointment times/dates) in a standard commercial cloud for scheduling purposes, or must all applicant-related data reside strictly within the TX-RAMP Level II boundary?

All data must reside within the TX-RAMP Level II environment.

7 In the event of a transition, what contractual "cooperation requirements" are currently in place with the incumbent to ensure a seamless migration? Will DPS facilitate the transfer of existing "FAST Pass" ORI configurations and legacy applicant data?

DPS will facilitate the transition and migration of legacy applicant data.

8 If the 60-day "Registration Website" milestone or the Go-Live date is delayed due to a lack of API access or data provided by the incumbent, will DPS grant a "day-for-day" extension to the milestone without assessing the $10,000 per day liquidated damages?

DPS will discuss the Go-live plan with the selected Contractor.

9 To ensure a clean "cut-over" between vendors, is DPS prepared to authorize a temporary (e.g., 48-hour) "blackout" period for non-essential fingerprinting during the final Go-Live weekend, or is zero-downtime persistence required?

DPS will discuss the Go-live plan with the selected Contractor.

10 What is the specific HUB utilization goal for RFP 405-25R0017163? If we are unable to meet the specific percentage despite a documented Good Faith Effort, will our proposal still be considered responsive?

DPS does not currently have HUB utilization goals. An Addendum will be posted to include the updated HSP based on the new VetHUB model.

Per Section C.14.D of the solicitation, the vendor must submit a complete HSP meeting the good faith effort and supported by the required forms with the response. Bidder's response will be considered non-responsive if the agency forms are not completed in full or are missing from Bidder's original response.

11 Given the recent restructuring of the HUB program into the VetHUB model, will DPS continue to credit participation from businesses whose HUB certification was based on gender or ethnicity if that certification was valid at the time the RFP was released?

Per Emergency rules adopted under Government Code 2001.34, the Comptroller of Public Accounts has revoked all businesses previously certified based on race, ethnicity, or sex, unless they proved ownership and control by Service-Disabled Veterans(SDV).

Any solicitations posted to ESBD after 12/2/2025 will be subject to the new VetHUB eligibility standard.

12 Exhibit 7, section 4.1- In the technical requirements, it was noted that DPS-approved virus protection software should be used. Could we be provided a list of the approved software?

Additionally, are we responsible for providing anti-virus software ourselves, and should we ensure compatibility with all approved anti-virus software?

DPS does not maintain a list of approved virus protection software. The vendor is responsible for ensuring the security of any vendor-provided environment, including virus protection.

13 Section C.5.2.B.16 mentions that an appointment cancellation message must be sent to customers who are ten minutes late for the scheduled appointment time. Can the DPS clarify whether the intent of this requirement is to automatically cancel the appointment after ten minutes, or to send a reminder/warning message to the applicant?

The notification is expected to notify the applicant that their scheduled appointment time has passed and their appointment is canceled. The cancellation should only occur if the applicant has not checked in.

14 Section C.5.2.A.4 - Can DPS clarify the expected volume or percentage of walk-in versus scheduled appointments?

The accommodation of walk-in appointments is to ensure that available appointment time is utilized. The volume of walk-in applicants is expected to be minor in contrast to scheduled appointments. We currently do not have a way to monitor walk-in appointments.

15 Section B.4 - Under the pricing structure, is the Contractor eligible to collect a portion of the per-applicant transaction fee for their own profit, or would compensation be strictly the completion of the milestone goals, and annual processing task payments proposed in Tables 1-4 of Section B.4, with the estimated million records a year?

Compensation will be strictly based on the completion of the milestone goals, and annual processing task payments proposed in Tables 1-4 of Section B.4, with an estimated million records a year.

16 Exhibit F.9 Section 1.2.2, referring to DPS-hosted system details, requires "Works for Hire" source code to be stored in DPS's BitBucket repository using DPS's CI/CD pipeline. To confirm, does this requirement apply only to custom code developed specifically for DPS-hosted infrastructure?

Yes. This requirement applies to code specific to DPS, not a vendor's product source code, unless the full product is being developed for DPS. This is not applicable to out-of-the-box solutions.

17 General Due to the volume and complexity of the requirements, would DPS consider granting a two‑week extension to ensure we address all requirements thoroughly and deliver the highest‑quality response?

DPS will extend the closing date to Friday, 3/20/2026, at 5 PM CST. This change is reflected in Addendum 2.

18 Section B.1.2.B The requirement states that evidence of financial stability includes providing audited financial statements for each of the last two years of the Respondent's operations.

QUESTION:

Since audited financial statements for 2025 are not yet available, please confirm whether submitting audited financial statements for fiscal years 2023 and 2024 will be considered compliant with this requirement.

Yes, audited financial statements for fiscal years 2023 and 2024 will be considered if your financial statements for your fiscal year 2025 are not available.

19 Section C.1 "The current FAST service processes approximately one million applicant submissions per year with an anticipated annual growth rate of 5%."

QUESTION:

What was the total volume of FAST applicant submissions per year in 2023, 2024 & 2025?

Total Volume of FAST applicants per year:

2023 – 938,404 2024 – 905,401 2025 – 849,936

20 Section C.1

"The current FAST service processes approximately one million applicant submissions per year with an anticipated annual growth rate of 5%."

QUESTION:

Volume has trended at a decline since 2022. Can DPS provide more details as to why they are anticipating an annual growth rate of 5%?

The 5% expected growth was based on the FAST program's growth since implementation.

Factors that may influence growth or decline are State and Federal laws and workforce trends.

21 Section C.4.D

"A plan for one or more Contractor's staff to be housed at DPS headquarters in Austin, Texas, to provide onsite assistance and resolution for customer support escalation, billing, remittance, reconciliation, or other issues covered by this Contract."

QUESTION:

Is a Texas-based remote Contract Employee an acceptable alternative to this requirement?

No, a remote Contract Employee may not be an acceptable alternative. DPS requests that one or more of the Contractor's staff be housed at DPS headquarters in Austin, Texas, to provide onsite assistance and resolution for customer support escalation, billing, remittance, reconciliation, or other issues covered by this Contract.

22 Section C.4.D

A plan for one or more Contractor's staff to be housed at DPS headquarters in Austin, Texas, to provide onsite assistance and resolution for customer support escalation, billing, remittance, reconciliation, or other issues covered by this Contract.

QUESTION:

Would remote Contractor staff meet this requirement?

No, a remote Contract Employee may not be an acceptable alternative. DPS requests that one or more Contractor's staff be housed at DPS headquarters in Austin, Texas, to provide onsite assistance and resolution for customer support escalation, billing, remittance, reconciliation, or other issues covered by this Contract.

23 Section C.5.2.A #1: The Contractor must ensure that 90% of Texans are within 25 miles of a physical fingerprinting service location, and that all Texans are within 50 miles of a physical fingerprinting service location.'

QUESTIONS:

Regarding Coverage 1, can DPS confirm that TX cities/counties in remote and/or low-populated areas do not apply to this 25-mile direct route or 50-mile radius requirement?

Regarding all remote and/or low-populated areas, can DPS confirm that a kiosk/flat is sufficient to meet this requirement?

All cities will require fingerprinting coverage within 50 miles, regardless of population density or geographic location.

DPS only accepts rolled fingerprints.

24 Section C.5.2.A #16: "The Contract must ensure all scheduled appointments are rescheduled at another reasonably nearby location prior to the identified closure date and submit proof of rescheduling in writing to DPS."

QUESTION:

In the event of an Emergency Closure where scheduled appointments cannot be rescheduled prior to the closure, what is the acceptable amount of time for all scheduled appointments to be rescheduled by in remote areas, and in metropolitan areas?

Section C.5.2.A #2 The Contractor must ensure that all Texas locations have appointments available within five business days.

25 Section C.5.2.A #11: "The Contractor must provide one or more Contractor staff to be onsite at DPS headquarters in Austin, TX, to provide assistance with resolution for customer support escalation, billing, remittance, reconciliation, or other issues covered by this Contract."

QUESTION: Would remote Contractor staff meet this requirement?

No, a remote Contract Employee may not be an acceptable alternative.

DPS requests that one or more Contractor's staff be housed at DPS headquarters in Austin, Texas, to provide onsite assistance and resolution for customer support escalation, billing, remittance, reconciliation, or other issues covered by this Contract.

26 Section C.5.2.A #4: The Contractor must accommodate walk-in and same-day appointments at DPS-designated locations.

QUESTION:

Can DPS clarify what the designated locations are?

Same-day appointment - all locations.

Walk-in appointments – the walk-in locations will be selected from the vendor network and appointment availability.

27 Section C.5.2.A #7: The Contractor must provide availability for DPS-designated locations, spread across various regions to include some rural, but primarily metropolitan areas, on Saturdays for at least 4 business hours within their designated time zones.

QUESTIONS:

Is this requirement stating that every location within the metropolitan areas is required to provide Saturday hours when there are multiple locations in the metropolitan area?

Can DPS provide more details as to what they consider 'some rural, but primarily metropolitan areas'?

Yes, metropolitan areas are required to offer a minimum of 4 hours for Saturday service.

Examples of rural and metropolitan areas are as follows:

Rural- Ft. Stockton, Brady, San Angelo.

Metropolitan-Dallas, Austin, Houston, San Antonio, El Paso.

28 Section C.2 The Contractor must comply with the terms of this Contract and perform as directed by DPS, ensuring adherence to all applicable state and federal laws, rules, regulations, and policies that relate to the obtaining, use, storage, dissemination, and destruction of criminal history record information."

QUESTION:

At what point is the Contractor ever in possession of criminal history record information under the FAST contract?

The vendor may be in possession of criminal history record information when the vendor collects any applicant's personal information identifiers (PII), biometrics, and photos.

29 Section C.7.2.6

A. DEL-29 Employee Roster: A final list of hired agents. To be provided to DPS 5-7 days prior to the scheduled go-live date.

QUESTION:

Can DPS provide more details as to what they're requiring in the employee roster?

The employee roster is to include a list of agents that are assigned to this project, along with their background clearance documentation. The background clearances will be performed post-award.

30 Section C.7.2.7 A. DEL-31 Go-Live Readiness Memo B. DEL-32 End-to-End Testing Report

QUESTION:

For these two deliverables, can DPS provide a template or additional details as to exactly what is required?

These can be provided post-award of the Contract.

31 Exhibit F.2 Information and Certifications Form In Section 3 - Vendor Acknowledgements, Certifications, Assurances, Warranties, and Affirmations of the Information and Certifications Form, there is a requirement to sign and submit the form with the response.

Yet, there is no specific place in the form to provide a signature.

Can DPS let us know exactly where we should provide the signature in the form?

The Signature on Page 1 of the Solicitation certifies the acknowledgement. The Information and Certification Form must be completed and returned with the response.

32 Exhibit F.8 CJIS Security Addendum and Certifications Should the CJIS Security Addendum and Certifications document be submitted as a standalone document or included in one of the four volumes?

Documentation pertaining to Exhibits can be submitted as standalone documents.

33 Exhibit F.7 Cyber Security Contract Requirements Should the Cyber Security Contract Exhibit be submitted as a standalone document or included in one of the four volumes?

Documentation pertaining to Exhibits can be submitted as standalone documents.

34 Exhibit F.10 Data and AI Requirements Attachment A: Automated Decision-making System Questionnaire states that, "The Contractor must provide and maintain up-to-date documentation on any AI used under this Agreement.

Documentation must be submitted with the response, at project initiation, for sign-off prior to implementation, and updated quarterly or upon change if any changes have occurred."

QUESTION:

Can DPS confirm whether this documentation is due with the response (i.e., proposal submission) or at project initiation?

Yes, per the instructions, documentation must be submitted with the response.

35 Exhibit F.10 Data and AI Requirements If the Attachment A: Automated Decision-making System Questionnaire is due with the proposal submission, should it be a standalone document or included in one of the four volumes?

Documentation pertaining to Exhibits can be submitted as standalone documents.

36 General Is this a new contract for DPS? Or is there an incumbent vendor currently fulfilling these services? If yes, can you provide me with the name of the vendor and contract number?

This information can be found in our publicly available documentation and can be obtained through a Public Information Request (PIR).

Pursuant to §552.301(c) of the Public Information Act (PIA), the Director has designated the following portal for public information requests: Public Information Center | Texas Department of Public Safety (govqa.us) or by emailing publicrecords@dps.texas.gov. A request must be sent directly to that address or through the Department's Public Information Request Page on our public website, found at Public Information Requests | Department of Public Safety (texas.gov).

https://txdps.govqa.us/WEBAPP/_rs/(S(y0rfizmpwa3gds5330znopcz))/supporthome.aspx https://txdps.govqa.us/WEBAPP/_rs/(S(y0rfizmpwa3gds5330znopcz))/supporthome.aspx https://txdps.govqa.us/WEBAPP/_rs/(S(y0rfizmpwa3gds5330znopcz))/supporthome.aspx mailto:publicrecords@dps.texas.gov https://www.dps.texas.gov/section/general-counsel/public-information-requests https://www.dps.texas.gov/section/general-counsel/public-information-requests

37 Exhibit F.10 Data and AI Requirements Are there any instructions/required tasks related to the "Data and AI Requirements" document? Does this require review and potential redlining from the vendor's legal team?

Attachment A must be answered and returned with the response.

Legal review on the vendor's side is not a requirement. The goal of the question in Attachment A is to ensure proper model usage and data handling.

38 Exhibit F.8 CJIS Security Addendum and Certification Are we correct in stating that signed CJIS Security Addenda are only required for the selected vendor(s), post award?

Yes. Each contract employee or subcontractor performing duties related to the Contract will be required to sign a CJIS Security Addendum prior to beginning work. The vendor is expected to acknowledge acceptance of the CJIS requirements in their response.

39 General We are not a cloud-based solution, but rather we utilize our own wholly owned servers. Do we need to maintain DPS data on a completely separate, dedicated server, segregated from all other client data?

The Contractor must provide a fully integrated and managed solution. The proposed solution must utilize a cloud model that is CJIS-compliant and approved by the State of Texas.

40 General What aspects of your program are you looking to improve upon? Can you please respond from a variety of perspectives (i.e., operational, IT, compliance, accounting, etc.)?

We are looking for the requirements in the solicitation to be completed efficiently and effectively.

41 Table 3.2: C.5.3: Technical Submission and System Requirements, are these change order items for the first two years? If not, can you please specify what this pricing would reflect?

The pricing represents the base scope associated with the initial implementation and required system specifications as outlined in the solicitation documentation.

42 Section C.1 The RFP states that it is DPS's "objectives include fingerprint collection; customer service;

appointment scheduling, fee processing, acceptance of electronic and hard-card fingerprints, and submission of the fingerprint data to DPS." However, in other sections of the RFP, photo capture is mentioned. Is DPS seeking a solution by which the applicant's appointment only includes a fingerprint collection, or in which the

Photo capture is required for all fingerprint appointments.

appointment includes a fingerprint collection and a photo capture?

43 Section C.3 The RFP states that vendors "must utilize a cloud model that is CJIS-compliant and approved by the State of Texas." Will SaaS solutions that are not cloud-based be considered? If not, and a cloud model is required, does DPS have a preferred vendor list?

The Contractor must provide a fully integrated and managed solution. The proposed solution must utilize a cloud model that is CJIS-compliant and approved by the State of Texas.

44 Section C.5.2.A, #7 The RFP states that "the Contractor must provide availability for DPS-designated locations." Can DPS please clarify what is meant by "designated"?

Does this include specific parameters/requirements?

DPS holds the right to designate locations that the Contractor must provide availability.

45 Section C.5.2.A, #30 The RFP states that "the Contractor is responsible for hiring, including completing DPS background checks, training, and staffing all FAST locations."

Can DPS please specify what comprises a DPS background check?

Please refer to Section C.16 Criminal History Background Check of the RFP for further information on background checks.

46 Section C.5.2.C, #5 The RFP states that "the Contractor's FAST solution must accept various payment methods approved by the Comptroller, including business checks, money orders, credit cards, or other approved methods." Are vendors required to accept all of these, or minimally just electronic payments?

The vendor must accept all payment methods listed.

47 General Can you please advise on the date the last RFP was issued for this program, the title of that RFP/solicitation, and which vendor was selected?

This information can be found in our publicly available documentation.

Pursuant to §552.301(c) of the Public Information Act (PIA), the Director has designated the following portal for public information requests: Public Information Center | Texas Department of Public Safety (govqa.us) or by emailing publicrecords@dps.texas.gov. A request must https://txdps.govqa.us/WEBAPP/_rs/(S(y0rfizmpwa3gds5330znopcz))/supporthome.aspx https://txdps.govqa.us/WEBAPP/_rs/(S(y0rfizmpwa3gds5330znopcz))/supporthome.aspx https://txdps.govqa.us/WEBAPP/_rs/(S(y0rfizmpwa3gds5330znopcz))/supporthome.aspx mailto:publicrecords@dps.texas.gov be sent directly to that address or through the Department's Public Information Request Page on our public website, found at Public Information Requests | Department of Public Safety (texas.gov)

48 Section C.4.H The RFP states that "a plan for walk-in applicants that would address ongoing location availability and a description of how customers can be served without an appointment if availability exists at the location." Can DPS please explain the connection between offering walk-in appointments and ongoing location availability?

If the location has appointment availability, walk-in customers are expected to be seen at designated locations if the fingerprint schedule allows.

See C.5.2.A section Location Coverage and Availability Requirements.

49 Section C.5.2.A, #21 The RFP states that specifications will follow contract award; however, would it be possible for DPS to share the exterior signage requirements at this stage?

Full details will be provided to the awarded vendor. At a minimum, the building, address, business name, and hours of operation should be visible.

50 Section C.5.2.A, #22 Can DPS please clarify what is meant by "separate from the waiting area"?

A separate room or partitioned area to ensure the applicant's privacy during their fingerprint appointment.

51 Section C.5.2.A, #26 Are hotspots required if the system can collect data locally during an internet outage?

Yes.

52 Section C.5.3.B, #15 The RFP states that "the Contractor provided solution must digitally capture an applicant's biometric attributes (i.e., fingerprints, palms, and iris [as directed by DPS]." Are palm print and iris captures part of the existing program?

If not, will they be components required in the new program?

Iris captures and palm prints are not currently required, but they are required for the new FAST contract.

53 Section C.5.4.A, #14 The RFP states that "the FMA must provide dashboard visualizations with weekly appointments by region for all

The top ten service types are the top ten agencies utilizing fingerprinting.

https://www.dps.texas.gov/section/general-counsel/public-information-requests service areas with the ability to drill down on the top ten service types." Can DPS please provide examples of "top ten service types"?

54 General The RFP is fairly extensive and requires input/review from a number of our internal teams (i.e., Operations, IT, Accounting, etc.) Would DPS consider extending the question submission date to EOD Friday, 2/20/2026?

Addendum 1 has been posted to extend the question due date to 2/20/2026 and the Estimated Answer submittal date of 2/24/2026.

55 Section C.5.2.C.9 What scenarios would warrant manual fee waiving? Are they verifiable in real time?

Reprints resulting from vendor submission errors would necessitate the waiver of all fingerprinting fees. Yes, they are verifiable in real time, provided that the proposed system is capable of detecting the submission error.

56 C.5.2.A.1 How many locations are currently active?

Currently, there are 140 public and 94 private locations active.

57 C.5.2.A.5 How many hard cards are processed each year?

Hard cards processed per year are as follows:

2022: 26,551 2023: 36,878 2024: 28,178 2025: 23,477

58 C.5.4.A.6 What is an example of a designated partner?

State agencies, school districts, and internal DPS programs are examples of designated partners.

59 C.5.4.B How many subcontractors are used on average?

There are currently 102 subcontractors. This number can change depending on the number of active locations.

60 C.5.4.B Do subcontractors undergo the same background checks as the Contractor?

Yes, subcontractors are subject to the same background checks as contractors.