TEXAS CYBER COMMAND

Request for Offer 371-00013

Sovereign Terrain and Digital Border Defense

Commodity Item Commodity Item Description

257-78 Security Enhancement Equipment, Cyber

920-66 System, Network, Database, DBA Administration Services

920-15 Assessment and Profiling Services of Software

208-12 Architectural Software, Microcomputer

Issued: April 29, 2026

Responses Due: May 14, 2026 3:00pm CST

371-00013

Version 1.2 Page 2 of 32 Rev. 5/19/23

SOLICITATION CONTENTS

The list below contains a summary of the documents comprising this Request for Offer (RFO) issued by TXCC. The Vendor(s) are responsible for fulfilling all requirements contained in these documents.

RFO 371-00013 (this document)

a. Appendices

Appendix A Standard Terms and Conditions

b. Bid Package

Exhibit A: Vendor Information and Certifications Form (including Attachment 1, List of Vendor’s Canceled Contracts)

Exhibit A1: Exceptions Table

Exhibit B: Vendor History and Experience

Exhibit C: HUB Subcontracting Plan (HSP) Sample Form

Exhibit D: Pricing Schedule

Exhibit E: Vendor Reference

Exhibit F: Vendor Release of Liability

Exhibit G: Voluntary Product Accessibility Template (VPAT)

Version 1.2 Page 3 of 32 Rev. 5/19/23

TABLE OF CONTENTS

1. INTRODUCTION

1.1. Purpose

1.2. TXCC Vision and Desired Outcomes

1.2.1 Background

2. SCOPE

2.1. Scope Overview

2.2. Deployment and Infrastructure

2.2.1 TXCC will provide, as applicable:

2.3. Functional Capabilities

2.4. Integration and Compatibility

2.5. Monitoring, Alerting, and Patch Management

2.6. Data Handling, Confidentiality, and Evidence Preservation

2.7. Authorized Use and Operation Control

3. FUNCTIONAL AND TECHNICAL REQUIREMENTS

3.1. Core System-Wide Requirements

3.2. Performance and Availability Requirements

3.3. Acceptance Testing

4. DELIVERABLES

5. PROJECT WORK PLAN

6. REPORTS AND MEETINGS

7. SERVICE LEVEL AGREEMENT

7.1. System Availability

7.2. Performance

7.3. Incident Response and Resolution

8. PRICING

9. ELECTRONIC AND INFORMATION RESOURCES (EIR) ACCESSIBILITY

10. TEXAS RISK AND AUTHORIZATION MANAGEMENT PROGRAM (TX-RAMP)

Version 1.2 Page 4 of 32 Rev. 5/19/23

11. CONTRACT INFORMATION

11.1. Proposed Changes and Exceptions

11.2. Term of Contract

11.3. Option to Extend

11.4. Transition

12. GENERAL SOLICITATION INFORMATION

12.1. Point of Contact

12.2. Response Integrity

12.3. Schedule of Events

12.3.1 Written Questions and Official Answers

12.4. Veteran Heroes United in Business (VETHUB)

12.4.1 HUB Subcontracting Plan

12.5. HUB Continuing Performance

12.5.1 HUB Resources Available

12.6. Vendor Qualifications

12.6.1 Federal Requirements

12.6.2 Vendor Performance and Debarment

12.6.3 Required Vendor and Subcontractor Current and Former State Employee Disclosures

12.6.4 Cybersecurity Training

12.6.5 Insurance Requirements

12.6.6 Financial Reports and Ability to Perform

12.7. Response Deadline and Submission Requirements

12.8. Response Instructions

12.8.1 Vendor Experience

12.8.2 No Marketing Materials Desired

12.8.3 Response Documents

12.8.4 Response Files

12.9. Rejection of Responses

12.10. Right to Amend or Withdraw RFO

12.11. Pre-agreement Costs

12.12. Ownership of Responses

12.13. Public Information

Version 1.2 Page 5 of 32 Rev. 5/19/23

12.14. News Release

13. EVALUATIONS, NEGOTIATIONS, AND AWARD

13.1. Evaluation of Responses

13.2. Evaluation Criteria

13.2.1 Pass/Fail Criteria

13.2.2 Weighted Evaluation Criteria

13.3. Revised Offer

13.4. Negotiations

13.5. Award of Contract

13.6. Protest Procedures

Version 1.2 Page 6 of 32 Rev. 5/19/23

Definitions The following terms and acronyms used in the Contract have the meanings given in this section unless the context indicates otherwise.

“Business Day” means Monday through Friday except for federal, state, and legal holidays observed by the State of Texas.

“Business Hours” means 8:00 a.m. to 5:00 p.m. Central Time.

“Date of Award” means the date the Contract is fully executed.

“Days” means calendar days unless otherwise specified.

“TXCC” means the Texas Cyber Command, a state agency in the executive branch created under Tex. Gov’t Code Ch. 2063.

“Vendor” means the individual, business entity, or organization at any stage in the procurement or contracting process (prior to response, during response, and after contract award).

Version 1.2 Page 7 of 32 Rev. 5/19/23

1. INTRODUCTION

1.1. Purpose

A. The objective of this Request for Offer (RFO) is to solicit Responses from potential Vendors for a solution that will take back Texas’ sovereign IP terrain and map and enumerate Texas’ networks.

B. As a result of this RFO, TXCC expects to receive and evaluate Responses and select one or more qualified Vendors with whom to enter into negotiations. RFO Section 9 EVALUATIONS, NEGOTIATIONS, AND AWARD contains more information regarding evaluation and Vendor selection process. TXCC reserves the right to make a single award or multiple awards from this RFO. All contract(s) awarded will be indefinite quantity contracts with no minimum guarantees of any purchases.

1.2. TXCC Vision and Desired Outcomes

1.2.1 Background

TXCC is building operational capability to prevent, detect, respond to, and recover from cybersecurity incidents affecting government networks and other environments within its authority. This solicitation supports TXCC’s mission to detect, identify, and mitigate cyber vulnerabilities and eliminate cyber threat activity across information technology and operational networks, sensors, and devices. The solution must provide advanced deep-packet-inspection and network-monitoring technologies that deliver real-time visibility, threat detection, and enriched cyber-intelligence workflows. Additional high-assurance sensors and analytics must enhance ability to monitor, analyze, and respond to sophisticated network activity across critical environments.

This RFO is for a TXCC-managed defensive capability. It does not require any other governmental entity to purchase a specific cybersecurity product or service. Use of the solution by Texas governmental entities outside TXCC-controlled or TXCC-authorized environments is permitted only when expressly approved by TXCC and applicable law, and TXCC’s role in such use is limited strictly to monitoring telemetry and metadata— not the content of chats, emails, or other communications.

The solution must support TXCC threat intelligence, incident response, digital forensics, and executive reporting functions by generating timely, reliable, and exportable operational data.

Version 1.2 Page 8 of 32 Rev. 5/19/23

2. SCOPE

2.1. Scope Overview

The Vendor must deliver a turnkey managed solution that includes data aggregation, analysis, and routing capability with all required hardware, software, licenses, subscriptions, deployment services, documentation, monitoring, support, maintenance, and updates necessary to meet this RFO. The solution must integrate multiple sensing, collection, and analytics capabilities into unified, immediately accessible data sources that support network interoperability, real‑time network sensing, cyber defense, and cybersecurity operations across information technology and operational environments.

The Vendor must have existing, operationally deployed systems and sensors capable of remote data collection at scale, secure access to appropriate network and data resources, and the ability to provide resilient backhaul, processing, and large‑scale data storage to support continuous operations.

TXCC seeks a single, integrated enterprise communications intelligence and advanced artificial intelligence solution that provides real-time visualization and understanding of all network communications, enables autonomous network enforcement and proactive threat hunting, and rapidly identifies vulnerabilities, anomalies, and malicious activity to accelerate detection, response, and mitigation across the enterprise

The solution must be limited to defensive cybersecurity activities authorized by TXCC.

The Vendor must not perform offensive cyber activity, unauthorized monitoring, or any action outside the scope expressly approved in writing in advance by TXCC.

2.2. Deployment and Infrastructure

The Vendor must deploy the solution within TXCC-designated data centers, cloud environments, or hosting environments approved in writing by TXCC. Hybrid deployment is permitted only if the Vendor fully discloses each external component and TXCC approves the architecture.

2.2.1 TXCC will provide, as applicable:

a. Rack or floor space, power, and cooling.

b. Network connectivity and approved insertion points.

c. Out-of-band management access and related network services.

d. Access to existing security, monitoring, and logging integration points.

2.3. Functional Capabilities

At a minimum, the Vendor must:

Version 1.2 Page 9 of 32 Rev. 5/19/23

a. Must have extensive verifiable experience working with network-level traffic collection, deep-packet inspection, cybersecurity operations, traffic manipulation, and decryption.

b. Must have proven capability to invent, develop, and deploy advanced network path analysis and cyber defense tools.

c. Must have existing deployed systems and sensors for remote data collection.

d. Must have secured access to appropriate network and data resources and be able to provide both backhaul and storage at large scale for data.

e. Assess deployment locations and operational requirements.

f. Validate compatibility with the existing TXCC network and security environment.

g. Install, configure, harden, and document all system components.

h. Maintain all components, including replacement of failed or degraded hardware.

i. Coordinate installation and change activity through TXCC change management procedures.

j. Bring together the various capabilities into instantly accessible data sources that support network interoperability, network sensing, cyber defense and cyber security operations.

k. Leverage existing deployed global sensing architecture that can be blended with the Texas state information grid in order to correlate between threat data.

l. Provide 24x7 monitoring and support.

m. Maintain the required service levels stated in Section 7.

n. Respond to incidents, outages, and degradations in accordance with the severity-based response targets in this RFO.

o. Coordinate planned maintenance in advance with TXCC.

p. Provide ongoing tuning, rule maintenance, signature updates, and software updates.

q. Preserve TXCC data confidentiality and support evidentiary handling when directed by TXCC.

r. Implement and maintain comprehensive access logging for all administrative, user, and system activities, ensuring auditability, traceability, and retention in accordance with TXCC policy and applicable law.

s. Provide robust identity and account management capabilities, including secure provisioning, de‑provisioning, multi‑factor authentication, and

Version 1.2 Page 10 of 32 Rev. 5/19/23 role‑based identity governance for all users and service accounts.

t. Enforce granular access control mechanisms that restrict system functions, data access, and administrative privileges to authorized personnel based on least‑privilege and separation‑of‑duties principles.

At a minimum, the solution must:

a. Provide real‑time and near‑real‑time visibility into network communications across information technology and operational technology environments, including encrypted traffic metadata analysis.

b. Provide role‑based dashboards and visualizations that present real‑time network activity, threat indicators, and operational status.

c. Include configurable reporting and analytics to support operational decision‑making, incident response, compliance, and executive oversight.

d. Include auditability and governance controls that ensure transparency, traceability, and accountability of system actions, data access, and automated decisions.

e. Secure administrative interfaces supporting policy management, access control, and operational oversight consistent with TXCC security requirements.

f. Include design, installation, configuration, integration, testing, and production cutover.

g. Take over control of unallocated IPv4 Texas State Government IP Space.

h. Provide a routing solution.

i. Include documentation, training, knowledge transfer, and transition-out support.

j. Maintain comprehensive access logs for all administrative, user, and system activities, ensuring traceability, retention, and audit support consistent with TXCC policy.

k. Provide secure identity and access management capabilities, including provisioning, de‑provisioning, multi‑factor authentication, role‑based access, and privileged access controls

l. Process only telemetry and metadata; the solution must not ingest, store, or analyze the content of chats, emails, or other communications unless expressly authorized by TXCC and applicable law.

2.4. Integration and Compatibility

The solution must integrate with TXCC systems and tools that may include:

a. Internet access points and boundary security controls.

Version 1.2 Page 11 of 32 Rev. 5/19/23

b. Security Information and Event Management (SIEM), log management, monitoring, ticketing, and case management platforms.

c. Identity, access management, and administrative authentication controls.

d. Other TXCC-approved security tooling in use during the contract term.

The Contract must document supported integration methods, including syslog, Application Programming Interface (API), file export, and any standards-based exchange mechanisms available with the proposed platform.

2.5. Monitoring, Alerting, and Patch Management

The Vendor must provide continuous monitoring of the solution and generate near real-time notifications for critical events, service disruptions, threshold breaches, failed updates, and security incidents affecting the service.

The Vendor must apply critical security patches within 48 hours of public release, without exception for weekends, holidays, or non-business days, or sooner when active exploitation materially increases risk to the TXCC environment. The Vendor must apply routine patches and updates through TXCC-approved change procedures.

2.6. Data Handling, Confidentiality, and Evidence Preservation

The Vendor must comply with the following data handling requirements:

a. All TXCC traffic, files, metadata, logs, and derived outputs remain the property of TXCC.

b. The Vendor must not use TXCC data for product training, benchmarking, marketing, or any purpose not expressly authorized in writing by TXCC.

c. Access to TXCC data will be limited to authorized personnel with a documented need to know.

d. Any data retained must be protected in transit and at rest using TXCC-approved methods and retained only for the period authorized by TXCC.

e. When requested by TXCC, the Vendor must preserve relevant artifacts, logs, and chain-of-custody documentation to support incident response, forensics, audit, or legal review.

2.7. Authorized Use and Operation Control

This section controls over any conflicting capability description in Sections 2.1, 2.3, or 3.1.

The Vendor may monitor, collect, route, analyze, decrypt, block, redirect, or otherwise affect traffic only within TXCC-approved environments, using TXCC-approved insertion points, under written TXCC authorization. The default collection boundary is telemetry, Version 1.2 Page 12 of 32 Rev. 5/19/23 metadata, packet headers, flow records, routing data, and security event data. Content collection or payload inspection beyond approved defensive use requires written TXCC authorization and General Counsel approval. Autonomous enforcement must be policy-governed, logged, reversible, and approved by TXCC before production use. IP routing changes require TXCC-approved change control, rollback procedures, and proof of authority for the relevant address space.

3. FUNCTIONAL AND TECHNICAL REQUIREMENTS

3.1. Core System-Wide Requirements

The solution must:

a. Provide continuous, real‑time and near‑real‑time visibility into network communications across information technology and operational technology environments within TXCC authority.

b. Support deep‑packet inspection, traffic analysis, and network path analysis to detect, identify, and mitigate cyber threats, vulnerabilities, and anomalous activity.

c. Aggregate, normalize, enrich, and correlate data from distributed sensors, collection points, and external sources into a single, unified operational data environment.

d. Enable autonomous and analyst‑driven threat hunting, enforcement actions, and investigative workflows across monitored networks.

e. Operate at scale with high availability, resilience, and fault tolerance to support continuous mission operations without degradation of performance.

f. Support secure remote data collection, backhaul, processing, and storage sufficiently to sustain large‑scale network monitoring and analytics.

g. Provide strong security controls, including role‑based access, authentication, authorization, auditing, and data protection consistent with TXCC security requirements.

h. Be capable of integrating advanced analytics and artificial intelligence to rapidly identify vulnerabilities, anomalies, and malicious activity and accelerate detection and response timelines.

3.2. Performance and Availability Requirements

The solution must:

Version 1.2 Page 13 of 32 Rev. 5/19/23

a. Operate with minimal latency impact to network traffic and demonstrate measured performance during acceptance testing.

b. Maintain the uptime and response targets stated in Section 7.

c. Expose health, utilization, queue depth, and failure indicators sufficient for proactive monitoring and capacity planning.

d. Support scalable expansion to additional TXCC-approved sites or bandwidth tiers without architectural redesign.

3.3. Acceptance Testing

The Vendor must develop an Acceptance Test Plan for TXCC approval. TXCC acceptance will be based on demonstrated completion of, at a minimum, the following:

a. Installation and configuration of all contracted components.

b. Validated integration with required logging, monitoring, and alerting destinations.

c. Measured throughput and latency testing under the agreed traffic profile.

d. Failover testing for high-availability components.

e. Verification of response actions, dashboards, audit logging, and report generation.

f. Delivery of runbooks, administration procedures, and training materials.

4. DELIVERABLES

Unless otherwise approved by TXCC in writing, the Vendor must deliver the following milestones after award to the TXCC Contract Manager or the designated recipient, who will be identified on the Contract or Purchase Order at the time of award.

No. Deliverable Due Date

1 Kickoff meeting and final project contact roster Within 5 Business Days after award

2 Project management plan Within 10 Business Days after award

3 Solution design package and deployment architecture

Within 15 Business Days after award

4 Security, data handling, and access control plan Within 15 Business Days after award

5 Acceptance Test Plan Within 20 Business Days after award

Version 1.2 Page 14 of 32 Rev. 5/19/23

No. Deliverable Due Date

6 Installed hardware, software, and core integrations Within 45 Business Days after award

7 Runbooks, training materials, and admin procedures

Within 65 Business Days after award

8 Operational acceptance testing Within 70 Business Days after award

9 Production service commencement Within 75 Business Days after award

10 Monthly service report template Within 65 Business Days after award

11 Weekly Status Report By 5:00 pm each Monday for the prior week

12 Monthly Status Report No later than 10 days after the prior month’s end

13 Transition Plan, initial draft Within 30 Business Days after award

5. PROJECT WORK PLAN

The Vendor must develop and maintain a detailed Project Work Plan for TXCC approval.

The plan must specify the activities to be undertaken, task sequencing, major dependencies, resourcing, assumptions, risks, and the titles of Vendor personnel responsible for each major workstream.

At a minimum, the Project Work Plan must include:

a. Implementation approach and work breakdown.

b. Deployment schedule with milestones, dependencies, and decision points.

c. Resource requirements from both the Vendor and TXCC.

d. Testing, cutover, rollback, and contingency procedures.

e. Risk register and mitigation plan.

Version 1.2 Page 15 of 32 Rev. 5/19/23

6. REPORTS AND MEETINGS

During implementation, the Vendor must provide a weekly written status report and participate in a weekly status meeting with the TXCC Contract Manager or designee.

Each weekly report must include, at a minimum:

a. Work completed during the reporting period.

b. Work planned for the next reporting period.

c. Open issues, risks, dependencies, and required TXCC decisions.

d. Schedule status, action item status, and any variance from the approved plan.

After production service commencement, the Vendor must provide a monthly service report that includes:

a. Availability, incident, and ticket metrics.

b. Capacity and performance trends.

c. Detection and response activity summaries.

d. Maintenance completed, patches applied, and pending changes.

e. Recommendations for tuning, coverage expansion, or risk reduction.

The Vendor must also participate in quarterly governance reviews with TXCC to review service performance, material risks, roadmap considerations, and contract-level issues.

7. SERVICE LEVEL AGREEMENT

The Vendor must meet the following minimum service levels throughout the term of the contract.

7.1. System Availability

a. The FCI solution must maintain 99.9% monthly uptime, excluding TXCC-approved maintenance windows.

b. Scheduled maintenance must be coordinated with TXCC and performed during approved maintenance windows.

c. The Vendor must provide at least 72 hours’ advance notice for planned maintenance, unless TXCC approves a shorter window for risk-based reasons.

d. The Vendor must notify TXCC within 30 minutes of any unplanned outage, service degradation, or security-related service impact.

7.2. Performance

a. The solution must operate with minimal latency impact and must demonstrate measured performance under the TXCC-approved acceptance test profile.

Version 1.2 Page 16 of 32 Rev. 5/19/23

b. The solution must support high-throughput processing consistent with the contracted capacity and must expose metrics needed to identify degradation.

c. The Vendor must continuously monitor performance and proactively address degradation, saturation, and component failure.

7.3. Incident Response and Resolution

The Vendor must provide TXCC with incident reports, root-cause analysis, and corrective actions for any outage or performance degradation and must adhere to the following response and workaround or resolution targets:

Severity Description Initial Response

Workaround or Resolution Target

Critical System outage, major service failure, or material loss of required protective capability 1 hour 4 hours

High Significant degradation, partial outage, or repeated failure of required integrations or response actions

2 hours 8 hours

Medium Limited impact issue or degraded but usable functionality 4 hours 2 Business Days

Low Minor issue, routine service request, or documentation clarification

1 Business Day 5 Business Days

8. PRICING

A. Vendors proposed pricing must include costs, fees, licenses, and all expenses for Vendor’s delivery and performance of the solution requested. The final negotiated, contracted pricing and payment structure will represent Vendor’s sole compensation under the Contract. TXCC guarantees no minimum compensation under the Contract.

B. TXCC will negotiate pricing prior to award of the Contract if the pricing offered appears that it may not be best value to TXCC.

C. Vendor must deliver and provide the solution described in compliance with all requirements of the Contract on a no minimum, as needed, as requested basis.

Notwithstanding anything else to the contrary in the Contract, TXCC will not make any payments of any amount to Vendor or any other entity or person, and Vendor will not submit any invoices, until Vendor has received approval from TXCC’s Contract Manager specifically stating that TXCC accepts the solution and

Version 1.2 Page 17 of 32 Rev. 5/19/23

Vendor is authorized to submit an invoice. If TXCC does not accept the solution, the Contract will involve no payments of any type for any amount.

D. For the purposes of obtaining pricing and evaluating the responses to this RFO, the solution must be priced in the excel spreadsheet attached as Exhibit D, Pricing Schedule. Exhibit D includes one cost for the turnkey solution. Additional cost breakdown must be itemized in Vendor’s response. Failure to respond as instructed may result in Vendor’s response being disqualified from further evaluation.

9. ELECTRONIC AND INFORMATION RESOURCES (EIR) ACCESSIBILITY

Vendor must provide a completed Exhibit G, Voluntary Product Accessibility Template (VPAT) (including accessibility conformance reports or vendor accessibility development services questionnaire as applicable) and Section 508 and EIR compliance for all components of the proposed goods or services. See Tex. Gov’t Code Chapter 2054, Subchapter M; 1 Tex. Admin. Code Chapter 213; and 1 Tex. Admin. Code Chapter 206; and WCAG 2.0 AA (current and as subsequently amended). VPAT is a vendor-generated statement (using the required template) that provides relevant information on how a vendor’s product or service claims to conform to the Section 508 Standards.

10. TEXAS RISK AND AUTHORIZATION MANAGEMENT PROGRAM (TX-RAMP)

For hosted services using a third-party cloud services provider, Vendor must deploy in an environment authorized by TX-RAMP Level 2 or FedRAMP moderate or higher impact and maintain program compliance and certification throughout the term of the contract. See Appendix A, Standard Terms and Conditions, Section 9.4(B)(xxiv) for more information.

11. CONTRACT INFORMATION

11.1. Proposed Changes and Exceptions

A. Caution: Vendor’s Response may be disqualified if their exceptions are excessive.

B. Item 12 of Exhibit A1, Exceptions form contains the format for Vendor to note any exception to any provision, term, or condition specified in the RFO and Standard Terms and Conditions. Vendor should provide any proposed changes to contract language in redline in the “Proposed Language (redline)” column of the chart in Item 13 of Exhibit A1, Exceptions form. Failure to abide by these instructions may result in TXCC rejecting all exceptions submitted by the Vendor.

http://www.w3.org/TR/WCAG20/

Version 1.2 Page 18 of 32 Rev. 5/19/23

C. The Vendor must provide, as a separate Microsoft Excel document, a file entitled “ABC_371-00013_Exceptions.xlsx” where “ABC” is the Vendor entity’s name.

The name can be abbreviated/acronym format, but should be easily associated with the Vendor.

D. If there are no exceptions, the Vendor must explicitly state the Vendor takes no exception to any part of this RFO.

E. Vendors may request exceptions to standard contract terms and conditions, provided that they provide a legally sustainable reason for the exception (i.e., NOT “My prior contract had the same exception”). If Vendor is unable to comply with these provisions, the Vendor’s Response may be subject to disqualification from further consideration. TXCC in its discretion may or may not accept the Vendor’s requested exceptions; exceptions submitted without a legally sustainable reason will not be considered. Material deviations (including excessive, additional, inconsistent, conflicting, or alternative terms) may render the Response non-responsive and may result in rejection of the bid. In addition to the explanation as to why the Vendor cannot comply with the provision, term, or condition, proposed alternative language must be included in the Response. If Vendor fails to note any exception, Vendor will not be allowed to request an exception at some later date.

F. TXCC reserves the right to make changes to the Contract or the Standard Terms and Conditions if it is in the best interest of the State to do so. Should this occur prior to the award of any Contract, any Vendor selected for negotiations will be notified.

11.2. Term of Contract

A. TXCC anticipates that the term of the Contract will be one year with two optional one-year renewals to be exercised by TXCC at its discretion.

B. RFO, Section 11.1 contains the format for Vendors to note any exception to any provision, term, or condition specified in the RFO.

C. Any objections or exceptions should be noted in keeping with RFO, Section 11.1.

Version 1.2 Page 19 of 32 Rev. 5/19/23

D. In the event of prolonged Contract negotiations due to the number or significance of exceptions taken, lack of responsiveness, or other failure to close Contract negotiations on the part of Vendor that are not due to a failure on the part of TXCC, TXCC may, in its sole discretion, bypass the Vendor and commence negotiations with the next-highest scoring Vendor, or continue with the current Vendor with a shorter contract term.

11.3. Option to Extend

The Vendor agrees that TXCC may require continued performance, beyond the initial or any renewal Contract term, of any of the within described services at the rates specified in the Contract. This option may be exercised more than once, but the total extension of performance hereunder will not exceed 180 calendar days. Such extension of services will be subject to the requirements of the Contract, with the sole and limited exception that the original date of termination will be extended pursuant to this provision. TXCC may exercise this option upon 30 calendar days written notice to the Vendor.

11.4. Transition

In the event that TXCC awards a subsequent competitive solicitation to a new vendor or if TXCC decides to perform the work itself, Vendor must work with TXCC and any new vendor to smoothly and seamlessly transition the contract. Vendor will develop a transition plan upon request by TXCC. TXCC must approve the transition plan before implementation. TXCC will not release the final invoice until Vendor returns all Work to

TXCC.

12. GENERAL SOLICITATION INFORMATION

12.1. Point of Contact

A. Ashley Lindholm, Chief Procurement Officer, is the sole point of contact for this procurement. Routine correspondence may be directed to txcc.procurement@txcc.texas.gov.

B. Vendors must make no contact concerning this RFO with other TXCC personnel, except as permitted by the point of contact. Failure to comply with this requirement at any point prior to contract award may result in disqualification. This restriction does not preclude discussions between affected parties for the purpose of conducting business unrelated to this procurement.

12.2. Response Integrity

A. To ensure the integrity of the competitive process, a Vendor may not directly or indirectly communicate any of the contents of its Response to:

mailto:txcc.procurement@txcc.texas.gov

Version 1.2 Page 20 of 32 Rev. 5/19/23

1. A competitor of the Vendor; or

2. Any other company, corporation, firm, partnership, individual, or related entities of the same parent company engaged in the same line of business as the Vendor; or

3. A related entity of the Vendor engaged in the same line of business as the Vendor.

B. This prohibition is in effect during the preparation of the offer and while the offer is pending with TXCC, including the negotiation and finalization of any resulting Contract. The term “related entities” includes affiliates, subsidiaries, associates, branches, and divisions. It does not include entities that may occasionally enter into teaming agreements with one another to provide services under a contract with a third party but otherwise have no legal relationship with each other.

C. When a related entity of the Vendor (whether related at the time that Responses are due or at any time thereafter) submits a competing offer, TXCC may require additional information to ensure each separate Response is independent. Failure to provide or fully disclose all such information may, at TXCC’s discretion, disqualify Vendor or result in the termination of any resulting contract. VENDOR

HAS AN ONGOING DUTY TO UPDATE ALL INFORMATION INCLUDED IN ITS

RESPONSE AT ANY TIME THAT SUCH INFORMATION CHANGES.

12.3. Schedule of Events

It is TXCC’s intention to comply with the following schedule for this RFO. These dates represent a tentative schedule of events. TXCC reserves the right to modify these dates at any time. Prospective Vendors will be notified of modifications to the schedule via the Electronic State Business Daily (ESBD) web site.

Date/Time Activity

4/29/2026 Publish RFO on Electronic State Business Daily

5/6/2026 3:00 PM (CST) Deadline for submitting questions

5/14/2026 3:00 PM (CST) Deadline for submitting responses to RFO

5/15/2026 – until completed Evaluation of responses, oral presentations (if requested), negotiations, and contract execution

Version 1.2 Page 21 of 32 Rev. 5/19/23

12.3.1 Written Questions and Official Answers

A. Vendors must submit all questions regarding this RFO to the official point of contact listed in RFO Section 12.1. Questions regarding this RFO will be accepted until the date and time specified above in 12.3 Schedule of Events.

B. Official answers will be posted as an Addendum to this RFO, on the Electronic State Business Daily (ESBD), available at http://www.txsmartbuy.com/esbd.

C. By submission of a question, vendors acknowledge that the applicable question will be posted with each official answer and therefore vendors should not include any confidential or proprietary information in such questions. TXCC will not publish the identity of any vendor that submitted any particular inquiry.

12.4. Veteran Heroes United in Business (VETHUB)

A. A Veteran Heroes United in Business (VetHUB) is a business that is certified by the State of Texas that (1) is a small business owned by service-disabled veterans (SDV), regardless of race, sex, or ethnicity and will be referred to as Veteran Heroes United in Business, or VetHUB; (2) which includes veterans as defined by 38 U.S.C. § 101(2) who have suffered at least a 20% service-connected disability as defined by 38 U.S.C. § 101(16); and (3) has an owner residing in Texas who has a proportionate interest in the business and who actively participates in the control, operations and management of the entity’s affairs. See also 34 Tex.

Admin. Code § 20.282 Emergency Rules.

B. Vendor must make a good faith effort to comply with all state VETHUB requirements under Tex. Gov’t Code Chapter 2161 and the administrative rules, as applicable.

C. Vendor must submit a HUB Subcontracting plan (HSP) as part of its response and must comply with implementation of the HSP. The Vendor must seek written approval from TXCC prior to making any modifications to its HSP. Vendor must also comply with its approved HSP.

12.4.1 HUB Subcontracting Plan

A. All Vendors responding to this RFO, including those that are HUB certified or those who do not plan to subcontract, must complete an HSP in accordance with the State’s policy on utilization of HUBs. The HSP must be included as part of the response to this RFO. FAILURE TO COMPLETE THE HSP AS INSTRUCTED MAY

RESULT IN DISQUALIFICATION OF THE RESPONSE FROM CONSIDERATION.

http://www.txsmartbuy.com/esbd

Version 1.2 Page 22 of 32 Rev. 5/19/23

B. The State’s Policy on Utilization of Historically Underutilized Businesses and HSP forms are available at:

https://comptroller.texas.gov/purchasing/vendor/hub/forms.php.

C. Please review the HSP forms carefully and allow sufficient time to identify and contact HUBs and allow them to respond. NOTE: Vendor must demonstrate a good faith effort to contract with new HUBs if currently proposed HUBs have performed as subcontractors to the Vendor for more than five years. If the Vendor does not plan to subcontract, Vendor must state that fact in their plan. A scan of the original, signed paper copy of the HSP must be submitted with the Response. The completed, approved plan will become a part of the Contract if the Vendor is selected to receive a contract as a result of this RFO.

12.5. HUB Continuing Performance

Any Contract includes reporting responsibilities related to HUB subcontracting. Vendor must not change any subcontractor without submitting a revised HSP. Any change to a subcontractor and revised HSP must be approved in writing by TXCC prior to implementation. TXCC is not required to pay for services received from subcontractors that are not part of an approved HSP.

12.5.1 HUB Resources Available

A. A list of certified HUBs is available on the Texas Comptroller of Public Accounts (CPA) Website at: https://mycpa.cpa.state.tx.us/tpasscmblsearch/index.jsp. For additional information, contact the CPA’s HUB program office at VetHUBProgram@cpa.texas.gov.

B. If Vendor knows of any businesses that may qualify for certification as a HUB, they should encourage those businesses to contact the CPA HUB program office.

12.6. Vendor Qualifications

12.6.1 Federal Requirements

A. State agencies are prohibited from doing business with terrorists and terrorist organizations. Any Vendor listed in the prohibited Vendor list authorized by Executive Order #13224, "Blocking Property and Prohibiting Transactions with Persons Who Commit, Threaten to Commit, or Support Terrorism”, published by the United States Department of the Treasury, Office of Foreign Assets Control (Terrorism List) will not be awarded a Contract as a result of this RFO. Any Vendor awarded a Contract must agree that if at any time during the term of the Contract the Vendor is listed on the Terrorism List, the Vendor must promptly https://comptroller.texas.gov/purchasing/vendor/hub/forms.php https://mycpa.cpa.state.tx.us/tpasscmblsearch/index.jsp mailto:StatewideHUBProgram@cpa.texas.gov

Version 1.2 Page 23 of 32 Rev. 5/19/23 notify TXCC. As part of TXCC’s contract management, periodic checks will be performed to ensure Vendor remains in compliance with these Federal Requirements. TXCC will have the absolute right to terminate the Contract without recourse in the event the Vendor becomes listed on the Terrorism List.

B. Should any Vendor become suspended or debarred from doing business with the federal government as listed in the System for Award Management (SAM) maintained by the General Services Administration, the Vendor’s Contract will be terminated without recourse.

C. Vendors must comply with the requirements of the Immigration and Reform Act of 1986, the Illegal Immigration Reform and Immigrant Responsibility Act of 1996 ("IIRIRA"), and the Immigration Act of 1990 (8 U.S.C.1101, et seq.) regarding employment verification and retention of verification forms for any individual(s) hired on or after the effective date of the 1996 Act who will perform any labor or services under this Contract.

12.6.2 Vendor Performance and Debarment

In accordance with 34 Texas Administrative Code, Chapter 20, Subchapter C, a Vendor that is debarred from doing business with the State of Texas will not be awarded a Contract. The list of debarred vendors is located on the CPA Web site at:

https://comptroller.texas.gov/purchasing/programs/vendor-performance-tracking/debarred-vendors.php

12.6.3 Required Vendor and Subcontractor Current and Former State Employee Disclosures

Vendor must disclose, for itself and on behalf of all of its Subcontractors, in its response to Exhibit A, Vendor Information and Certifications Form, Section F, Ethics and Conflict of Interest, all of the following:

A. Any current or former employees of Vendor who will spend 20% or more of their time on the Contract and are current or former employees of TXCC within the past five years;

B. Any proposed Vendor personnel assigned to work directly on the Contract 20% or more of their time who are related within two degrees of consanguinity of any current or former employees of TXCC. Disclosure of former state employees may be limited to the last five years; and https://comptroller.texas.gov/purchasing/programs/vendor-performance-tracking/debarred-vendors.php https://comptroller.texas.gov/purchasing/programs/vendor-performance-tracking/debarred-vendors.php

Version 1.2 Page 24 of 32 Rev. 5/19/23

C. Vendor will certify that they are in compliance with Texas Government Code, Title 6, Subtitle B, Section 669.003, relating to contracting with the executive head of a state agency. If Section 669.003 applies, Vendor will complete the following information in order for the Response to be evaluated: Name of Former Executive, Name of State Agency, Date of Separation for State Agency, Position with Vendor, and Date of Employment with Vendor.

12.6.4 Cybersecurity Training

In accordance with Texas Government Code Section 2063.104 for any contract with a state agency or institution of higher education, if the Vendor, or a subcontractor, officer, or employee of the Vendor, will have access to a state computer system or database, then the Vendor must ensure that such officer, employee, or subcontractor must complete a cybersecurity training program certified under Texas Government Code Section 2063.102 as selected by TXCC. The cybersecurity training program must be completed by such officer, employee, or subcontractor during the term of the contract and during any renewal period. Vendor must verify to TXCC completion of the program by each such officer, employee, or subcontractor.

12.6.5 Insurance Requirements

Unless otherwise specified in this Contract, TXCC’s Standard Terms and Conditions or any other exhibit or attachment, Vendor will acquire and maintain, for the duration of this Contract, insurance coverage necessary to ensure this Contract’s proper performance and cover any potential liabilities with financially sound and reputable insurers licensed by the Texas Department of Insurance, in the type and amount customarily carried within the industry or as determined by TXCC. Vendor will provide evidence of insurance upon request by TXCC.

If any policy is determined by TXCC to be deficient and does not comply with the terms of this Contract, Vendor will secure such additional coverage as required by TXCC, law, regulation, or customary practice. If coverage expires during the term of this Contract, Vendor must produce renewal certificates for each type of coverage upon request by

TXCC.

12.6.6 Financial Reports and Ability to Perform

A. Vendor must provide evidence of its financial resources and its ability to provide the solution for which Vendor is submitting a response. This includes information Vendor believes is pertinent to demonstrate its financial capability, financial solvency, and capacity to fulfill the requirements of this solicitation.

Version 1.2 Page 25 of 32 Rev. 5/19/23

B. Evidence of financial stability include providing audited financial statements for each of the last two years of Vendor’s operations or, in the alternative, financial statements compiled, reviewed, and attested by an independent certified public accountant or certified public accounting firm. Vendor may submit a copy of its Dun & Bradstreet (D&B) Business Information Report. If a D&B Report is submitted the report must include Vendor’s Viability Score and the Portfolio Comparison Score or similar ratings.

C. Vendor must provide documentation and any other financial information reasonably requested by TXCC consistent with the services provided by Vendor or otherwise required by the then applicable TXCC policies for similar contracts.

D. Selected Vendor must also submit to the Contract Manager its financial rating information within 120 days after the end of Vendor’s fiscal year.

E. TXCC reserves the right to investigate and determine the financial integrity and responsibility of a Vendor and to reject a response on the grounds of Vendor’s lack of financial soundness, or if Vendor reasonably concludes, after reviewing the information submitted by Vendor as well as all other relevant information obtained by TXCC, that significant issues exist that could jeopardize Vendor’s full and timely performance. Vendor also reserves this same right throughout the life of the Contract, including before executing any optional renewal with Vendor.

12.7. Response Deadline and Submission Requirements

A. Vendors are required to submit Responses in accordance with the requirements outlined in this document. Responses must be received by TXCC on or before the date and time specified in RFO, Section 12.3, Schedule of Events. No late Responses will be reviewed.

12.8. Response Instructions

A. Vendor will follow the instructions set forth in the following Exhibits and Attachments to this RFO.

B. Each section, Exhibit, and Attachment of this RFO, along with any other associated files, contains individual detailed instructions regarding the required format of the Vendor’s Response. The Vendor is required to respond according to the instructions contained in each section of this RFO.

C. Vendor’s Response must be consistent with the structure, sequencing, and terminology used in this RFO.

12.8.1 Vendor Experience

A. Vendor must complete Exhibit B, Vendor Experience, providing information regarding its past relevant experience.

Version 1.2 Page 26 of 32 Rev. 5/19/23

B. Vendor must not refer to information provided elsewhere in the RFO Response or reference website links.

12.8.2 No Marketing Materials Desired

Unnecessarily elaborate brochures or other presentations beyond those requested and sufficient to present a complete Response are not desired.

12.8.3 Response Documents

12.8.3.1 Vendor References

Vendor must complete the top portion of and send Exhibit E, Vendor Reference Form to a minimum of three companies or government agencies who are capable of providing comment on the Vendor’s ability to provide the solution described in this RFO and who are willing to do so. Reference should be able to comment on work performed by the Vendor in the past five years. Instructions are included in Exhibit E, Vendor Reference Form. TXCC is not responsible for undeliverable e-mails or for non-responsive references. Vendor’s references will be considered in accordance with RFO Section 13.2.2, Weighted Evaluation Criteria. References must respond directly to TXCC on the form provided by the due date in order to be considered for evaluation.

Exhibit E, Vendor Reference Form must be submitted by the reference directly to the point of contact listed in the Reference Form. The Vendor may not submit the reference form to TXCC. Completed Exhibit E, Vendor Reference Forms submitted by the Vendor will NOT be considered. TXCC may contact References for clarification at TXCC’s discretion.

12.8.3.2 Canceled Contract References

Using Exhibit A, Vendor Information and Certifications Form, Attachment 1, Canceled Contracts (included as part of Exhibit A), Vendor must provide the name, title, contact number and description of services provided for any contract that was canceled or prematurely terminated in the past five years. Vendor must include details on the reason for the cancelation and the Vendor’s position relevant to the cancelation, including the final resolution of the contract cancelation. For each company or entity listed, Vendor must provide a signed RFO Exhibit F, Vendor Release of Liability.

Failure to disclose Canceled Contracts may lead to a Vendor not being considered for award.

Version 1.2 Page 27 of 32 Rev. 5/19/23

12.8.3.3 Addenda to the RFO

Vendors are encouraged to acknowledge receipt of all Addenda by providing a completed and signed version of “page one” of each Addendum with their Response. Vendors will be held to all terms and requirements of each Addenda regardless of the provision of a signed “page one.” Vendors will also be held to all terms and requirements of any Addenda issued after their submission of a response to this solicitation.

12.8.4 Response Files

The following table summarizes the files to be submitted to TXCC in order to be considered a complete Response, with the corresponding file names.

Table 4: Response Files

RFO Reference Form of Response

Exhibit A: Vendor Information and Certifications Form – MUST BE COMPLETED AND SIGNED

“ABC_371-00013_Exhibit A.docx”

Exhibit B: Vendor History and Experience “ABC_371-00013_Exhibit B.docx” Vendor’s Proposed Solution “ABC_371-00013_Offer.pdf” Exhibit C: HUB Subcontracting Plan (HSP) - MUST BE COMPLETED and SIGNED

“ABC_371-00013_HSP.pdf”

Exhibit D: Pricing Schedule “ABC_371-00013_Pricing.xlsx” Exhibit E: Vendor Reference Exhibit F: Vendor Release of Liability “ABC_371-00013_Exhibit F.docx” Exhibit G: VPAT “ABC_371-00013_VPAT.docx” Exhibit A1: Exceptions - Any Exceptions requested or Affirmative Statement that Vendor takes no Exceptions

“ABC_371-00013_Exceptions.xlsx”

Redlined version of Appendix A Standard Terms and Conditions, if applicable

“ABC_371-

00013_Exceptions_Redline.docx”

Signed Addenda to the RFO (not required) “ABC_371-00013_Addenda” (.docx or .pdf)

Financial Documentation “ABC_371-00013_Financials.pdf” Manufacturer Letters of Authorization (if applicable) “ABC_371-00013_LOA_Brand.docx”

*include the actual “Brand” name in the document naming convention*

Version 1.2 Page 28 of 32 Rev. 5/19/23

12.9. Rejection of Responses

TXCC has sole discretionary authority and reserves the right to reject any Responses received as a result of this RFO. Responses that do not comply with the mandatory submission requirements may be rejected. In addition, TXCC reserves the right to accept or reject, in whole or in part, any Responses submitted, and to waive minor technicalities when in the best interest of the State.

12.10. Right to Amend or Withdraw RFO

A. TXCC reserves the right to alter, amend, or modify any provision of this RFO, or to withdraw this RFO, in whole or in part, at any time prior to the award of a Contract if doing so is in the best interest of the State. TXCC reserves the right to re-solicit for like or similar products and services whenever it determines re-solicitation to be in the best interest of the State.

B. Any changes or additional information regarding this RFO will be posted as an Addendum on the ESBD, at http://www.txsmartbuy.com/esbd. It is the responsibility of Vendors to monitor the web site for Addenda.