ESBD_501701_1774639793512_Scope of Work.pdf

Cloud-Based Public Safety Software Solution at TSTC I.Purpose Texas State Technical College (TSTC) is soliciting proposals from qualified suppliers to provide, implement, configure, migrate, and support a cloud-based public safety software solution that includes Computer-Aided Dispatch (CAD), Records Management System (RMS), and Mobile Field Reporting.

The solution will serve as the centralized platform for dispatch, patrol, incident and case records, investigative workflows, and related reporting across the TSTC police environment. TSTC seeks a single enterprise solution that supports multiple campus police locations and Originating Agency Identifiers (ORIs) within a unified system.

II.Scope of Work The following sections supplement the attached requirements spreadsheet and provide additional scope, context, and response instructions.

A. Functional Requirements Response The attached requirements spreadsheet is part of this solicitation and must be completed as part of the proposal. For each requirement, respondents must indicate whether the capability is:

● Included in base solution

● Requires additional solution

● Not Available

● Other - Please describe in proposal

TSTC will use the spreadsheet responses to evaluate functional fit, licensing implications, implementation approach, and overall solution value.

B. TSTC Police Department Structure and Operating Environment TSTC currently operates four police department locations and plans to add two more. Each location has its own ORI, but TSTC Police operates as a unified law enforcement organization with Waco as headquarters.

Current locations:

● Waco (Headquarters)

● Harlingen

● Sweetwater

● Marshall

Planned locations:

● Abilene (No defined ETA)

● Fort Bend (No defined ETA)

Current operating environment:

● Approximately 30 employees

● 3 CAD workstations, with 1 additional workstation planned

● CAD workstations are not staffed 24/7

● Patrol operations are 24/7

● 22 vehicles with:

○ GPS Tracking

○ Mobile Data Terminal (MDT)

● 10 mobile phone devices

The solution must support this multi-location operating model within a unified environment with appropriate ORI-based, role-based, and location-based access, data visibility, and reporting controls.

C. Data Migration TSTC requires data migration services as part of the proposed solution. For this RFP, supplier names for the current systems will not be disclosed. Respondents should assume a standard public safety CAD/RMS environment with structured records and associated media. Additional system details may be provided after award to support detailed migration planning.

Source systems:

● System 1: Approximately 128 GB, including a large volume of images and video

● System 2: Approximately 417 GB total, used across three campuses with multiple databases per campus, of which approximately 410 GB is media

These sizes reflect the current source environments and not the final volume to be migrated. TSTC does not expect all media to be migrated.

Respondents shall describe their approach to:

● Source data assessment

● Data clean-up

● Archival, exclusion, or migration decisions

● Data mapping and field crosswalks

● Migration validation

● Public safety migration best practices

TSTC expects the selected supplier to provide guidance and support for an effective migration approach.

D. Security and Compliance Validations The proposed solution must satisfy applicable security, privacy, and compliance requirements.

Required security items:

● FBI CJIS Security Policy, version 6.0, as applicable

● SOC 2 Type II report, or equivalent independent third-party assessment

● TX-RAMP certification

● Federal Information Processing Standards (FIPS)-validated cryptographic modules, including

FIPS 140-2 or FIPS 140-3 where applicable

● Encryption at rest and in transit, with AES-256 or stronger encryption for data at rest

● Redundant and geographically separated data centers

● Documented disaster recovery and business continuity procedures

FedRAMP and StateRAMP do not satisfy the TX-RAMP requirement. Respondents must hold TX-RAMP certification to qualify.

At proposal submission, respondents shall provide the relevant report identifier, certification identifier, validation identifier, or program status for each required item, including the current status and expected completion date if not yet complete.

All required security validations, reports, certifications, and program statuses must be complete and verifiable before a respondent advances to the second phase. Respondents selected for the second phase shall provide supporting documentation to TSTC’s IT Security team for review.

Upon contract execution, the selected supplier shall provide disaster recovery and business continuity documentation to the appropriate TSTC IT personnel.

TSTC reserves the right to request supplemental documentation, impose additional review requirements, or determine that specific features are not acceptable.

TSTC maintains internal confidentiality requirements for personnel involved in the solicitation and evaluation process, and submitted security documentation will be shared only with personnel who have a legitimate need to review it. If a respondent requires additional nondisclosure documentation before providing supporting materials, that requirement must be identified in the proposal.

E. Future Expansion and Growth Respondents shall describe their standard post-implementation process for:

● Adding new campus police locations (Ex: Abilene, Ft Bend)

● Pricing new campus locations

● Pricing additional users

● Storage or data-related pricing associated with growth

This information is requested for planning and evaluation purposes only and does not require a detailed future implementation plan.

III.Requirements for Proposal Organize submissions in the order below. Each criterion includes specific deliverables to enable clear scoring.

A. Technical Requirements & Functional Fit

● A completed requirements spreadsheet with a clear response for each item, including whether the capability is included in the base solution, available through an additional licensed module, dependent on third-party software, not available, or available only through custom configuration or development.

● A narrative describing the overall solution architecture, including CAD, RMS, Mobile Field Reporting, ORI-based access, role-based access, location-based access, reporting capabilities, and iOS mobile functionality.

● Security package summary: CJIS applicability statement; SOC 2 Type II (or equivalent) summary; TX-RAMP Level 2 status; encryption and key management approach; DR/BCP overview including proposed RTO/RPO.

● AI disclosure consistent with Section II.E, including any AI-enabled features and the associated security and risk controls.

● Representative screenshots, workflow diagrams, or similar visual artifacts supporting core use cases such as dispatch, case workflow, and reporting.

B. Implementation Approach

● Suppliers must provide a detailed project plan for system implementation and migration of existing records.

● This should include:

● Timeline with milestones

● Roles and responsibilities

● Data conversion and testing process

● Cutover and support strategy

C. Data Migration Approach

● Preliminary Data Migration Plan covering: source assessment, data clean-up, archival/exclusion logic, mapping/crosswalks, tooling, sequencing, and validation.

● Roles and responsibilities matrix (supplier vs. TSTC) for migration tasks.

● Risk register specific to migration (e.g., media volume, field normalization) with mitigations and validation strategy.

D. Future Expansion and Growth

● Approach to onboarding new campuses/ORIs and scaling users in a unified environment.

● Future Growth Price List: per‑campus (per‑ORI) setup/onboarding fees, per‑user licensing tiers, storage/media pricing increments, and applicable discounts (volume or multi‑year).

● Any configuration or data partitioning considerations that impact future locations.

E. Pricing Proposal

● Itemized implementation, licensing/subscriptions, training, data migration, and support/maintenance.

● Identification of pass‑through/third‑party costs and any optional modules.

F. History of Support for Texas IHEs [Texas Education Code 51.9335(b)(8)]

● Provide a history of support for Institutions of Higher Education (IHE) in Texas, including sponsorships, grants, donations in-kind or otherwise, internships/externships, apprenticeships, etc., with dates, institutions, and impact summaries.

G. Artificial Intelligence Disclosure and Review The information requested in this section will not be evaluated or scored as part of the proposal evaluation process; however, it may be considered in determining a respondent’s eligibility or ability to conduct business with TSTC.

Respondents shall disclose whether the proposed solution includes artificial intelligence (AI), machine learning, generative AI, automated decision support, or other AI-enabled capabilities.

If no AI-enabled functionality is included, the respondent shall state that in its proposal.

If the proposed solution includes AI-enabled functionality, the respondent shall provide, as part of its proposal, a supplemental response that addresses the following:

● Identify the foundation models, large language models, or APIs used by the solution, including whether they are developed in-house, hosted internally, or provided through third-party services.

● Identify which components, modules, or features of the solution use AI-enabled functionality and which features remain fully functional without AI.

● State whether AI-enabled functionality can be enabled, disabled, or otherwise controlled through administrative settings.

● Describe whether customer data can be restricted from being transmitted to third-party AI providers and whether customer data is used for model training, retraining, fine-tuning, or service improvement.

● Provide a data flow diagram or equivalent documentation showing how prompts, contextual data, outputs, logs, and related information are processed, transmitted, and stored.

● Describe how bias is evaluated, tested, monitored, and mitigated for use cases relevant to the proposed solution.

● Describe how hallucinations, inaccurate outputs, or other unreliable AI-generated responses are identified, limited, and communicated to end users, including whether citations, source references, confidence indicators, or similar safeguards are provided.

● Describe the controls in place to protect against prompt injection, unauthorized disclosure, data exfiltration, and other AI-related security risks.

● Identify which AI-related events are logged, who is authorized to access those logs, and the applicable retention period for such logs.

● Describe how customer data contained in backups, archives, or replicated environments is handled upon contract termination or data destruction.

● Identify the geographic locations and hosting environments in which AI-related data is stored, processed, or transmitted.

● Describe how customers are notified of model changes, feature updates, or other AI-related modifications, and whether model versions or related functionality can be controlled or maintained for stability.

Any AI-enabled functionality will be subject to additional TSTC review, including additional security verification and risk evaluation. TSTC reserves the right to request supplemental documentation, impose additional review requirements, or determine that specific AI-enabled features are not acceptable.

IV.Evaluation Criteria

The evaluation of the proposals shall be based on the requirements described in this RFP. All properly submitted proposals will be reviewed, evaluated, and ranked by TSTC in accordance with the evaluation criteria set forth below:

Criteria to be Evaluated Points

Technical Requirements & Functional Fit 30

Implementation Approach 5

Data Migration Approach 25

Future Expansion and Growth 10

Pricing Proposal 25

History of Support for Texas IHEs 5

Total 100

IV.Evaluation Criteria