TEXAS CYBER COMMAND

Request for Offer 371-00014

Texas Networks Operational Maneuver

Commodity Item Commodity Item Description

257-78 Security Enhancement Equipment, Cyber

920-66 System, Network, Database, DBA Administration Services

920-15 Assessment and Profiling Services of Software

208-12 Architectural Software, Microcomputer

Issued: April 29, 2026

Responses Due: May 14, 2026 3:00pm CST

371-00014

Version 1.2 Page 2 of 31 Rev. 5/19/23

SOLICITATION CONTENTS

The list below contains a summary of the documents comprising this Request for Offer (RFO) issued by TXCC. The Vendor(s) are responsible for fulfilling all requirements contained in these documents.

RFO 371-00014 (this document)

a. Appendices

Appendix A Standard Terms and Conditions

b. Bid Package

Exhibit A: Vendor Information and Certifications Form (including Attachment 1, List of Vendor’s Canceled Contracts)

Exhibit A1: Exceptions Table

Exhibit B: Vendor History and Experience

Exhibit C: HUB Subcontracting Plan (HSP) Sample Form

Exhibit D: Pricing Schedule

Exhibit E: Vendor Reference

Exhibit F: Vendor Release of Liability

Exhibit G: Voluntary Product Accessibility Template (VPAT)

Version 1.2 Page 3 of 31 Rev. 5/19/23

TABLE OF CONTENTS

1. INTRODUCTION

1.1. Purpose

1.2. TXCC Vision and Desired Outcomes

1.2.1 Introduction

1.2.2 Background

2. SCOPE

2.1. Scope Overview

2.1.1 Minimum Requirements

2.2. Deployment and Infrastructure

2.2.1 TXCC will provide, as applicable:

2.2.2 The Vendor must:

2.3. Functional Capabilities

2.4. Visibility, Reporting, and Governance

2.5. Integration and Compatibility

2.6. Monitoring, Alerting, and Patch Management

2.7. Data Handling, Confidentiality, and Evidence Preservation

3. FUNCTIONAL AND TECHNICAL REQUIREMENTS

3.1. Core System-Wide Requirements

3.2. Cybersecurity Detection and Response Requirements

3.3. Performance and Availability Requirements

3.4. Acceptance Testing

4. DELIVERABLES

5. PROJECT WORK PLAN

6. REPORTS AND MEETINGS

7. SERVICE LEVEL AGREEMENT

7.1. System Availability

7.2. Performance

7.3. Incident Response and Resolution

8. PRICING

Version 1.2 Page 4 of 31 Rev. 5/19/23

9. ELECTRONIC AND INFORMATION RESOURCES (EIR) ACCESSIBILITY

10. TEXAS RISK AND AUTHORIZATION MANAGEMENT PROGRAM (TX-RAMP)

11. CONTRACT INFORMATION

11.1. Proposed Changes and Exceptions

11.2. Term of Contract

11.3. Option to Extend

11.4. Transition

12. GENERAL SOLICITATION INFORMATION

12.1. Point of Contact

12.2. Response Integrity

12.3. Schedule of Events

12.3.1 Written Questions and Official Answers

12.4. Veteran Heroes United in Business (VETHUB)

12.4.1 HUB Subcontracting Plan

12.5. HUB Continuing Performance

12.5.1 HUB Resources Available

12.6. Vendor(s) Qualifications

12.6.1 Federal Requirements

12.6.2 Vendor Performance and Debarment

12.6.3 Required Vendor and Subcontractor Current and Former State Employee Disclosures

12.6.4 Cybersecurity Training

12.6.5 Insurance Requirements

12.6.6 Financial Reports and Ability to Perform

12.7. Response Deadline and Submission Requirements

12.8. Response Instructions

12.8.1 Vendor Experience

12.8.2 No Marketing Materials Desired

12.8.3 Response Documents

12.8.4 Response Files

12.9. Rejection of Responses

12.10. Right to Amend or Withdraw RFO

Version 1.2 Page 5 of 31 Rev. 5/19/23

12.11. Pre-agreement Costs

12.12. Ownership of Responses

12.13. Public Information

12.14. News Release

13. EVALUATIONS, NEGOTIATIONS, AND AWARD

13.1. Evaluation of Responses

13.2. Evaluation Criteria

13.2.1 Pass/Fail Criteria

13.2.2 Weighted Evaluation Criteria

13.3. Revised Offer

13.4. Negotiations

13.5. Award of Contract

13.6. Protest Procedures

Version 1.2 Page 6 of 31 Rev. 5/19/23

Definitions The following terms and acronyms used in the Contract have the meanings given in this section unless the context indicates otherwise.

“Business Day” means Monday through Friday except for federal, state, and legal holidays observed by the State of Texas.

“Business Hours” means 8:00 a.m. to 5:00 p.m. Central Time.

“Date of Award” means the date the Contract is fully executed.

“Days” means calendar days unless otherwise specified.

“TXCC” means the Texas Cyber Command, a state agency in the executive branch created under Tex. Gov’t Code Ch. 2063.

“Vendor” means the individual, business entity, or organization at any stage in the procurement or contracting process (prior to response, during response, and after contract award).

Version 1.2 Page 7 of 31 Rev. 5/19/23

1. INTRODUCTION

1.1. Purpose

A. The objective of this Request for Offer (RFO) is to solicit Responses from potential Vendors to establish operational maneuver on Texas government networks.

B. As a result of this RFO, TXCC expects to receive and evaluate Responses and select one or more qualified Vendors with whom to enter into negotiations. RFO Section 9 EVALUATIONS, NEGOTIATIONS, AND AWARD contains more information regarding evaluation and Vendor selection process. TXCC reserves the right to make a single award or multiple awards from this RFO. All contract(s) awarded will be indefinite quantity contracts with no minimum guarantees of any purchases.

1.2. TXCC Vision and Desired Outcomes

1.2.1 Introduction

Texas Cyber Command (TXCC) seeks a managed Full Content Inspection (FCI) capability that extends defensive protection to TCP/IP network sessions traversing TXCC-designated boundaries. The solution must improve network visibility, threat detection, prevention, containment, and operational reporting across the TXCC environment.

The solution must provide inline, bi-directional inspection of designated network traffic at production scale while maintaining low latency and high availability. Equivalent architectures and technical approaches are acceptable if the Vendor demonstrates that the proposed solution meets or exceeds the requirements of this RFO.

1.2.2 Background

TXCC is building operational capability to prevent, detect, respond to, and recover from cybersecurity incidents affecting Texas state government and other environments within TXCC authority. This procurement supports TXCC's defensive mission by adding managed inline inspection, content analysis, automated protective actions, evidence preservation support, and actionable reporting for designated network boundaries.

This RFO is for a TXCC-managed defensive capability. It does not require any other governmental entity to purchase a specific cybersecurity product or service. Use of the solution outside of sister agencies outside of TXCC-controlled or TXCC-authorized environments is permitted only when expressly approved by TXCC and applicable law, and TXCC’s role in such use is limited strictly to monitoring telemetry and metadata – not the content of chats, emails, or other communications.

Version 1.2 Page 8 of 31 Rev. 5/19/23

The solution must support TXCC threat intelligence, incident response, digital forensics, and executive reporting functions by generating timely, reliable, and exportable operational data.

2. SCOPE

2.1. Scope Overview

The Vendor must deliver a turnkey managed FCI solution that includes all hardware, software, licenses, subscriptions, deployment services, documentation, monitoring, support, maintenance, and updates necessary to meet this RFO.

2.1.1 Minimum Requirements

a. Solution design, installation, configuration, integration, testing, and production cutover.

b. Provide 24x7 monitoring, alerting, support, maintenance, and operational tuning.

c. Threat detection content, signature, rule, and analytic updates.

d. Documentation, training, knowledge transfer, and transition-out support.

e. Maintain the required service levels stated in Section 7.

f. Respond to incidents, outages, and degradations in accordance with the severity-based response targets in this RFO.

g. Coordinate planned maintenance in advance with TXCC.

h. Provide ongoing tuning, rule maintenance, signature updates, and software updates.

i. Preserve TXCC data confidentiality.

j. Support evidentiary handling when directed by TXCC.

The solution must be limited to defensive cybersecurity activities authorized by TXCC, including monitoring, inspection, prevention, containment, sanitization, reporting, evidence preservation support, and restoration support. The Vendor must not perform offensive cyber activity, unauthorized monitoring, or any action outside the scope expressly approved by TXCC.

2.2. Deployment and Infrastructure

The FCI capability must be deployed within TXCC-designated data centers, cloud environments, or hosting environments approved in writing in advance by TXCC. Hybrid deployment is permitted only if the Vendor fully discloses each external component and TXCC approves the architecture.

Version 1.2 Page 9 of 31 Rev. 5/19/23

2.2.1 TXCC will provide, as applicable:

a. Rack or floor space, power, and cooling.

b. Network connectivity and approved insertion points.

c. Out-of-band management access and related network services.

d. Access to existing security, monitoring, and logging integration points.

2.2.2 The Vendor must:

a. Assess deployment locations and operational requirements

b. Validate compatibility with the existing TXCC network and security environment.

c. Install, configure, harden, and document all system components.

d. Maintain all components, including replacement of failed or degraded hardware.

e. Coordinate installation and change activity through TXCC change management procedures.

2.3. Functional Capabilities

At a minimum, the solution must:

a. Inspect full-session network traffic and associated content for TXCC-designated traffic classes.

b. Detect malicious content, exploit behavior, suspicious techniques, and other cyber threats using a combination of signatures, analytics, heuristics, and behavioral methods.

c. Provide configurable automated and analyst-approved defensive response options.

d. Generate detailed logs, alerts, dashboards, reports, and exportable telemetry.

e. Support IPv4 and IPv6 communications and configurations.

2.4. Visibility, Reporting, and Governance

The Vendor must provide TXCC staff with:

a. Access to dashboards for system health, performance, capacity, alerts, detections, and executed response actions.

b. Operational reports and audit logs sufficient for oversight, troubleshooting, and after-action review.

c. Monthly service reporting and quarterly governance reviews.

d. Reasonable transparency into detection logic categories, response policy status, and change history.

Version 1.2 Page 10 of 31 Rev. 5/19/23

2.5. Integration and Compatibility

The solution must integrate with TXCC systems and tools that may include:

a. Internet access points and boundary security controls.

b. Security Information and Event Management (SIEM), log management, monitoring, ticketing, and case management platforms.

c. Identity, access management, and administrative authentication controls.

d. Other TXCC-approved security tooling in use during the contract term.

Vendor must document supported integration methods, including syslog, Application Programming Interface (API), file export, and any standards-based exchange mechanisms available with the proposed platform.

2.6. Monitoring, Alerting, and Patch Management

The Vendor must provide continuous monitoring of the solution and generate near real-time notifications for critical events, service disruptions, threshold breaches, failed updates, and security incidents affecting the solution.

Critical security patches must be applied within 72 hours of public release, without exception for weekends, holidays, or non-business days, or sooner when active exploitation materially increases risk to the TXCC environment. Routine patches and updates must be applied through TXCC-approved change procedures.

2.7. Data Handling, Confidentiality, and Evidence Preservation

The Vendor must comply with the following data handling requirements:

a. All TXCC traffic, files, metadata, logs, and derived outputs remain the property of

TXCC.

b. The Vendor must not use TXCC data for product training, benchmarking, marketing, or any purpose not expressly authorized in writing in advance by

TXCC.

c. Access to TXCC data must be limited to authorized personnel with a documented need to know.

d. Any data must be protected in transit and at rest using TXCC-approved methods and retained only for the period authorized by TXCC.

e. When requested by TXCC, the Vendor must preserve relevant artifacts, logs, and chain-of-custody documentation to support incident response, forensics, audit, or legal requirements.

Version 1.2 Page 11 of 31 Rev. 5/19/23

3. FUNCTIONAL AND TECHNICAL REQUIREMENTS

3.1. Core System-Wide Requirements

The solution must:

a. Inspect and, where authorized, remediate designated traffic types, including web, email, Domain Name System (DNS), and other approved protocols identified by TXCC during design and implementation.

b. Operate as a full-session proxy or an equivalent inline inspection architecture for the traffic classes designated by TXCC.

c. Support Transport Layer Security (TLS) inspection using TXCC-approved certificate issuance, storage, access control, and lifecycle management processes.

d. Parse and inspect supported file types identified in the Vendor's design package and approved by TXCC; unsupported file types must be explicitly documented with associated handling behavior.

e. Perform de-obfuscation, unpacking, or other inspection preparation for supported content types when technically available.

f. Operate inline and bi-directionally on TXCC-designated traffic paths.

g. Provide a minimum throughput capacity of 30 Gbps per direction with required inspection features enabled under the agreed acceptance test traffic profile.

h. Provide a high-availability architecture with no direct public internet exposure for the management plane.

i. Restrict the management plane to a closed, private, TXCC-approved out-of-band network.

j. Support a TXCC-approved fail-open or fail-close design by interface, traffic class, or deployment zone.

3.2. Cybersecurity Detection and Response Requirements

The solution must:

a. Detect malicious activity using commercially supported methods such as signatures, exploit indicators, Tactics, Techniques, and Procedures (TTP) analytics, heuristics, sandbox-related intelligence where applicable, and behavior-based analytics.

b. Support identification of known malicious indicators and suspicious behavior that may signal previously unknown or modified threats.

c. Provide response actions that may include alerting, blocking, quarantining, sanitizing, reconstructing supported content, rate limiting, virtual patching, and analyst-approved exceptions.

Version 1.2 Page 12 of 31 Rev. 5/19/23

d. Support custom detections, rules, signatures, analytic content, and reporting logic developed jointly with TXCC.

e. Continuously receive and apply vendor-provided detection content and threat intelligence updates.

f. Generate sufficient telemetry to support incident response, forensic analysis, threat hunting, and executive reporting.

3.3. Performance and Availability Requirements

The solution must:

a. Operate with minimal latency impact to network traffic and demonstrate measured performance during acceptance testing.

b. Maintain the uptime and response targets stated in Section 7.

c. Expose health, utilization, queue depth, and failure indicators sufficient for proactive monitoring and capacity planning.

d. Support scalable expansion to additional TXCC-approved sites or bandwidth tiers without architectural redesign.

3.4. Acceptance Testing

The Vendor must develop an Acceptance Test Plan for TXCC approval. TXCC acceptance will be based on demonstrated completion of, at a minimum, the following:

a. Installation and configuration of all contracted components.

b. Validated integration with required logging, monitoring, and alerting destinations.

c. Measured throughput and latency testing under the agreed traffic profile.

d. Failover testing for high-availability components.

e. Verification of response actions, dashboards, audit logging, and report generation.

f. Delivery of runbooks, administration procedures, and training materials.

4. DELIVERABLES

Unless otherwise approved by TXCC in writing, the Vendor must deliver the following milestones after award to the TXCC Contract Manager or the designated recipient, who will be identified on the Contract or Purchase Order at the time of award.

No. Deliverable Due Date

1 Kickoff meeting and final project contact roster

Within 5 Business Days after award

Version 1.2 Page 13 of 31 Rev. 5/19/23

No. Deliverable Due Date

2 Project Work Plan Within 10 Business Days after award

3 Solution design package and deployment architecture

Within 15 Business Days after award

4 Security, data handling, and access control plan

Within 15 Business Days after award

5 Acceptance Test Plan Within 20 Business Days after award

6 Installed hardware, software, and core integrations

Within 45 Business Days after award

7 Runbooks, training materials, and admin procedures

Within 65 Business Days after award

8 Operational acceptance testing Within 70 Business Days after award

9 Production service commencement Within 75 Business Days after award

10 Monthly service report template Within 65 Business Days after award

11 Weekly Status Report By 5:00 pm each

Monday for the prior week

12 Monthly Status Report No later than 10 days after the prior month’s end

13 Transition Plan, initial draft Within 30 Business Days after award

5. PROJECT WORK PLAN

The Vendor must develop and maintain a detailed Project Work Plan for TXCC approval.

The plan must specify the activities to be undertaken, task sequencing, major dependencies, resourcing, assumptions, risks, and the titles of Vendor personnel responsible for each major workstream.

Version 1.2 Page 14 of 31 Rev. 5/19/23

At a minimum, the Project Work Plan must include:

a. Implementation approach and work breakdown.

b. Deployment schedule with milestones, dependencies, and decision points.

c. Resource requirements from both the Vendor and TXCC.

d. Testing, cutover, rollback, and contingency procedures.

e. Risk register and mitigation plan.

6. REPORTS AND MEETINGS

During implementation, the Vendor must provide a weekly written status report and participate in a weekly status meeting with the TXCC Contract Manager or designee.

Each weekly report must include, at a minimum:

a. Work completed during the reporting period.

b. Work planned for the next reporting period.

c. Open issues, risks, dependencies, and required TXCC decisions.

d. Schedule status, action item status, and any variance from the approved plan.

After production service commencement, the Vendor must provide a monthly service report that includes:

a. Availability, incident, and ticket metrics.

b. Capacity and performance trends.

c. Detection and response activity summaries.

d. Maintenance completed, patches applied, and pending changes.

e. Recommendations for tuning, coverage expansion, or risk reduction.

The Vendor must also participate in quarterly governance reviews with TXCC to review service performance, material risks, roadmap considerations, and contract-level issues.

7. SERVICE LEVEL AGREEMENT

The Vendor must meet the following minimum service levels throughout the term of the contract.

7.1. System Availability

a. The FCI solution must maintain 99.9% monthly uptime, excluding TXCC-approved maintenance windows.

b. Scheduled maintenance must be coordinated with TXCC and performed during approved maintenance windows.

c. The Vendor must provide at least 72 hours’ advance notice for planned maintenance, unless TXCC approves a shorter window for risk-based reasons.

Version 1.2 Page 15 of 31 Rev. 5/19/23

7.2. Performance

a. The solution must operate with minimal latency impact and must demonstrate measured performance under the TXCC-approved acceptance test profile.

b. The solution must support high-throughput processing consistent with the contracted capacity and must expose metrics needed to identify degradation.

c. The Vendor must continuously monitor performance and proactively address degradation, saturation, and component failure.

7.3. Incident Response and Resolution

The Vendor must adhere to the following response and workaround or resolution targets:

Severity Description Initial Response

Workaround or Resolution Target

Critical System outage, major service failure, or material loss of required protective capability 1 hour 4 hours

High Significant degradation, partial outage, or repeated failure of required integrations or response actions

2 hours 8 hours

Medium Limited impact issue or degraded but usable functionality 4 hours 2 Business Days

Low Minor issue, routine service request, or documentation clarification

1 Business Day 5 Business Days

8. PRICING

A. Vendors proposed pricing must include costs, fees, licenses, and all expenses for Vendor’s delivery and performance of the solution requested. The final negotiated, contracted pricing and payment structure will represent Vendor’s sole compensation under the Contract. TXCC guarantees no minimum compensation under the Contract.

B. TXCC will negotiate pricing prior to award of the Contract if the pricing offered appears that it may not be best value to TXCC.

C. Vendor must deliver and provide the solution described in compliance with all requirements of the Contract on a no minimum, as needed, as requested basis.

Notwithstanding anything else to the contrary in the Contract, TXCC will not make any payments of any amount to Vendor or any other entity or person, and

Version 1.2 Page 16 of 31 Rev. 5/19/23

Vendor will not submit any invoices, until Vendor has received approval from TXCC’s Contract Manager specifically stating that TXCC accepts the solution and Vendor is authorized to submit an invoice. If TXCC does not accept the solution, the Contract will involve no payments of any type for any amount.

D. For the purposes of obtaining pricing and evaluating the responses to this RFO, the solution must be priced in the excel spreadsheet attached as Exhibit D, Pricing Schedule. Exhibit D includes one cost for the turnkey solution. Additional cost breakdown must be itemized in Vendor’s response. Failure to respond as instructed may result in Vendor’s response being disqualified from further evaluation.

9. ELECTRONIC AND INFORMATION RESOURCES (EIR) ACCESSIBILITY

Vendor must provide a completed Exhibit G, Voluntary Product Accessibility Template (VPAT) (including accessibility conformance reports or vendor accessibility development services questionnaire as applicable) and Section 508 and EIR compliance for all components of the proposed goods or services. See Tex. Gov’t Code Chapter 2054, Subchapter M; 1 Tex. Admin. Code Chapter 213; and 1 Tex. Admin. Code Chapter 206; and WCAG 2.0 AA (current and as subsequently amended). VPAT is a vendor-generated statement (using the required template) that provides relevant information on how a vendor’s product or service claims to conform to the Section 508 Standards.

10. TEXAS RISK AND AUTHORIZATION MANAGEMENT PROGRAM (TX-RAMP)

For hosted services using a third-party cloud services provider, Vendor must deploy in an environment authorized by TX-RAMP Level 2 or FedRAMP moderate or higher impact and maintain program compliance and certification throughout the term of the contract. See Appendix A, Standard Terms and Conditions, Section 9.4(B)(xxiv) for more information.

11. CONTRACT INFORMATION

11.1. Proposed Changes and Exceptions

A. Caution: Vendor’s Response may be disqualified if their exceptions are excessive.

B. Item 12 of Exhibit A1, Exceptions form contains the format for Vendor to note any exception to any provision, term, or condition specified in the RFO and Standard Terms and Conditions. Vendor should provide any proposed changes to contract language in redline in the “Proposed Language (redline)” column of the http://www.w3.org/TR/WCAG20/

Version 1.2 Page 17 of 31 Rev. 5/19/23 chart in Item 13 of Exhibit A1, Exceptions form. Failure to abide by these instructions may result in TXCC rejecting all exceptions submitted by the Vendor.

C. The Vendor must provide, as a separate Microsoft Excel document, a file entitled “ABC_371-00014_Exceptions.xlsx” where “ABC” is the Vendor entity’s name.

The name can be abbreviated/acronym format, but should be easily associated with the Vendor.

D. If there are no exceptions, the Vendor must explicitly state the Vendor takes no exception to any part of this RFO.

E. Vendors may request exceptions to standard contract terms and conditions, provided that they provide a legally sustainable reason for the exception (i.e., NOT “My prior contract had the same exception”). If Vendor is unable to comply with these provisions, the Vendor’s Response may be subject to disqualification from further consideration. TXCC in its discretion may or may not accept the Vendor’s requested exceptions; exceptions submitted without a legally sustainable reason will not be considered. Material deviations (including excessive, additional, inconsistent, conflicting, or alternative terms) may render the Response non-responsive and may result in rejection of the bid. In addition to the explanation as to why the Vendor cannot comply with the provision, term, or condition, proposed alternative language must be included in the Response. If Vendor fails to note any exception, Vendor will not be allowed to request an exception at some later date.

F. TXCC reserves the right to make changes to the Contract or the Standard Terms and Conditions if it is in the best interest of the State to do so. Should this occur prior to the award of any Contract, any Vendor selected for negotiations will be notified.

11.2. Term of Contract

A. TXCC anticipates that the term of the Contract will be one year with three optional one-year renewals to be exercised by TXCC at its discretion.

B. RFO, Section 11.1 contains the format for Vendors to note any exception to any provision, term, or condition specified in the RFO.

C. Any objections or exceptions should be noted in keeping with RFO, Section 11.1.

Colleen Berkley @Stephanie Harrison do you want this to be the legal name which may be long or the three letter identifier (basically the initials of the entity or a shortened name)? Also, what is the XXX supposed to be replaced with? I think it can be removed.�

Stephanie Harrison updated�

Version 1.2 Page 18 of 31 Rev. 5/19/23

D. In the event of prolonged Contract negotiations due to the number or significance of exceptions taken, lack of responsiveness, or other failure to close Contract negotiations on the part of Vendor that are not due to a failure on the part of TXCC, TXCC may, in its sole discretion, bypass the Vendor and commence negotiations with the next-highest scoring Vendor, or continue with the current Vendor with a shorter contract term.

11.3. Option to Extend

The Vendor agrees that TXCC may require continued performance, beyond the initial or any renewal Contract term, of any of the within described services at the rates specified in the Contract. This option may be exercised more than once, but the total extension of performance hereunder will not exceed 180 calendar days. Such extension of services will be subject to the requirements of the Contract, with the sole and limited exception that the original date of termination will be extended pursuant to this provision. TXCC may exercise this option upon 30 calendar days written notice to the Vendor.

11.4. Transition

In the event that TXCC awards a subsequent competitive solicitation to a new vendor or if TXCC decides to perform the work itself, Vendor must work with TXCC and any new vendor to smoothly and seamlessly transition the contract. Vendor will develop a transition plan upon request by TXCC. TXCC must approve the transition plan before implementation. TXCC will not release the final invoice until Vendor returns all Work to

TXCC.

12. GENERAL SOLICITATION INFORMATION

12.1. Point of Contact

A. Ashley Lindholm, Chief Procurement Officer, is the sole point of contact for this procurement. Routine correspondence may be directed to txcc.procurement@txcc.texas.gov.

B. Vendors must make no contact concerning this RFO with other TXCC personnel, except as permitted by the point of contact. Failure to comply with this requirement at any point prior to contract award may result in disqualification. This restriction does not preclude discussions between affected parties for the purpose of conducting business unrelated to this procurement.

12.2. Response Integrity

A. To ensure the integrity of the competitive process, a Vendor may not directly or indirectly communicate any of the contents of its Response to:

mailto:txcc.procurement@txcc.texas.gov

Version 1.2 Page 19 of 31 Rev. 5/19/23

1. A competitor of the Vendor; or

2. Any other company, corporation, firm, partnership, individual, or related entities of the same parent company engaged in the same line of business as the Vendor; or

3. A related entity of the Vendor engaged in the same line of business as the Vendor.

B. This prohibition is in effect during the preparation of the offer and while the offer is pending with TXCC, including the negotiation and finalization of any resulting Contract. The term “related entities” includes affiliates, subsidiaries, associates, branches, and divisions. It does not include entities that may occasionally enter into teaming agreements with one another to provide services under a contract with a third party but otherwise have no legal relationship with each other.

C. When a related entity of the Vendor (whether related at the time that Responses are due or at any time thereafter) submits a competing offer, TXCC may require additional information to ensure each separate Response is independent. Failure to provide or fully disclose all such information may, at TXCC’s discretion, disqualify Vendor or result in the termination of any resulting contract. VENDOR

HAS AN ONGOING DUTY TO UPDATE ALL INFORMATION INCLUDED IN ITS

RESPONSE AT ANY TIME THAT SUCH INFORMATION CHANGES.

12.3. Schedule of Events

It is TXCC’s intention to comply with the following schedule for this RFO. These dates represent a tentative schedule of events. TXCC reserves the right to modify these dates at any time. Prospective Vendors will be notified of modifications to the schedule via the Electronic State Business Daily (ESBD) web site.

Date/Time Activity

4/29/2026 Publish RFO on Electronic State Business Daily

5/6/2026 3:00 PM (CT) Deadline for submitting questions

5/14/2026 3:00 PM (CT) Deadline for submitting responses to RFO

5/15/2026 – until completed Evaluation of responses, oral presentations (if requested), negotiations, and contract execution

12.3.1 Written Questions and Official Answers

Version 1.2 Page 20 of 31 Rev. 5/19/23

A. Vendors must submit all questions regarding this RFO to the official point of contact listed in RFO Section 12.1. Questions regarding this RFO will be accepted until the date and time specified above in 12.3 Schedule of Events.

B. Official answers will be posted as an Addendum to this RFO, on the Electronic State Business Daily (ESBD), available at http://www.txsmartbuy.com/esbd.

C. By submission of a question, vendors acknowledge that the applicable question will be posted with each official answer and therefore vendors should not include any confidential or proprietary information in such questions. TXCC will not publish the identity of any vendor that submitted any particular inquiry.

12.4. Veteran Heroes United in Business (VETHUB)

A. A Veteran Heroes United in Business (VetHUB) is a business that is certified by the State of Texas that (1) is a small business owned by service-disabled veterans (SDV), regardless of race, sex, or ethnicity and will be referred to as Veteran Heroes United in Business, or VetHUB; (2) which includes veterans as defined by 38 U.S.C. § 101(2) who have suffered at least a 20% service-connected disability as defined by 38 U.S.C. § 101(16); and (3) has an owner residing in Texas who has a proportionate interest in the business and who actively participates in the control, operations and management of the entity’s affairs. See also 34 Tex.

Admin. Code § 20.282 Emergency Rules.

B. Vendor must make a good faith effort to comply with all state VETHUB requirements under Tex. Gov’t Code Chapter 2161 and the administrative rules, as applicable.

C. Vendor must submit a HUB Subcontracting plan (HSP) as part of its response and must comply with implementation of the HSP. The Vendor must seek written approval from TXCC prior to making any modifications to its HSP. Vendor must also comply with its approved HSP.

12.4.1 HUB Subcontracting Plan

A. All Vendors responding to this RFO, including those that are HUB certified or those who do not plan to subcontract, must complete an HSP in accordance with the State’s policy on utilization of HUBs. The HSP must be included as part of the response to this RFO. FAILURE TO COMPLETE THE HSP AS INSTRUCTED MAY

RESULT IN DISQUALIFICATION OF THE RESPONSE FROM CONSIDERATION.

B. The State’s policy on utilization of HUB’s and HSP forms are available at:

http://www.txsmartbuy.com/esbd

Version 1.2 Page 21 of 31 Rev. 5/19/23 https://comptroller.texas.gov/purchasing/vendor/hub/forms.php.

C. Please review the HSP forms carefully and allow sufficient time to identify and contact HUBs and allow them to respond. NOTE: Vendor must demonstrate a good faith effort to contract with new HUBs if currently proposed HUBs have performed as subcontractors to the Vendor for more than five years. If the Vendor does not plan to subcontract, Vendor must state that fact in their plan. A scan of the original, signed paper copy of the HSP must be submitted with the Response. The completed, approved plan will become a part of the Contract if the Vendor is selected to receive a contract as a result of this RFO.

12.5. HUB Continuing Performance

Any Contract includes reporting responsibilities related to HUB subcontracting. Vendor must not change any subcontractor without submitting a revised HSP. Any change to a subcontractor and revised HSP must be approved in writing by TXCC prior to implementation. TXCC is not required to pay for services received from subcontractors that are not part of an approved HSP.

12.5.1 HUB Resources Available

A. A list of certified HUBs is available on the Texas Comptroller of Public Accounts (CPA) Website at: https://mycpa.cpa.state.tx.us/tpasscmblsearch/index.jsp. For additional information, contact the CPA’s HUB program office at VetHUBProgram@cpa.texas.gov.

B. If Vendor knows of any businesses that may qualify for certification as a HUB, they should encourage those businesses to contact the CPA HUB program office.

12.6. Vendor(s) Qualifications

12.6.1 Federal Requirements

A. State agencies are prohibited from doing business with terrorists and terrorist organizations. Any Vendor listed in the prohibited Vendor list authorized by Executive Order #13224, "Blocking Property and Prohibiting Transactions with Persons Who Commit, Threaten to Commit, or Support Terrorism”, published by the United States Department of the Treasury, Office of Foreign Assets Control (Terrorism List) will not be awarded a Contract as a result of this RFO. Any Vendor awarded a Contract must agree that if at any time during the term of the Contract the Vendor is listed on the Terrorism List, the Vendor must promptly notify TXCC. As part of TXCC’s contract management, periodic checks will be https://comptroller.texas.gov/purchasing/vendor/hub/forms.php https://mycpa.cpa.state.tx.us/tpasscmblsearch/index.jsp mailto:StatewideHUBProgram@cpa.texas.gov

Version 1.2 Page 22 of 31 Rev. 5/19/23 performed to ensure Contract Holder remains in compliance with these Federal Requirements. TXCC will have the absolute right to terminate the Contract without recourse in the event the Vendor becomes listed on the Terrorism List.

B. Should any Vendor become suspended or debarred from doing business with the federal government as listed in the System for Award Management (SAM) maintained by the General Services Administration, the Vendors’s Contract will be terminated without recourse.

C. Vendors must comply with the requirements of the Immigration and Reform Act of 1986, the Illegal Immigration Reform and Immigrant Responsibility Act of 1996 ("IIRIRA"), and the Immigration Act of 1990 (8 U.S.C.1101, et seq.) regarding employment verification and retention of verification forms for any individual(s) hired on or after the effective date of the 1996 Act who will perform any labor or services under this Contract.

12.6.2 Vendor Performance and Debarment

In accordance with 34 Texas Administrative Code, Chapter 20, Subchapter C, a Vendor that is debarred from doing business with the State of Texas will not be awarded a Contract. The list of debarred vendors is located on the CPA Web site at:

https://comptroller.texas.gov/purchasing/programs/vendor-performance-tracking/debarred-vendors.php

12.6.3 Required Vendor and Subcontractor Current and Former State Employee Disclosures

Vendor must disclose, for itself and on behalf of all of its Subcontractors, in its response to Exhibit A, Vendor Information and Certifications Form, Section F, Ethics and Conflict of Interest, all of the following:

A. Any current or former employees of Vendor who will spend 20% or more of their time on the Contract and are current or former employees of TXCC within the past five years;

B. Any proposed Vendor personnel assigned to work directly on the Contract 20% or more of their time who are related within two degrees of consanguinity of any current or former employees of TXCC. Disclosure of former state employees may be limited to the last five years; and

C. Vendor will certify that they are in compliance with Texas Government Code, Title https://comptroller.texas.gov/purchasing/programs/vendor-performance-tracking/debarred-vendors.php https://comptroller.texas.gov/purchasing/programs/vendor-performance-tracking/debarred-vendors.php

Version 1.2 Page 23 of 31 Rev. 5/19/23

6, Subtitle B, Section 669.003, relating to contracting with the executive head of a state agency. If Section 669.003 applies, Vendor will complete the following information in order for the Response to be evaluated: Name of Former Executive, Name of State Agency, Date of Separation for State Agency, Position with Vendor, and Date of Employment with Vendor.

12.6.4 Cybersecurity Training

In accordance with Texas Government Code Section 2063.104 for any contract with a state agency or institution of higher education, if the Vendor, or a subcontractor, officer, or employee of the Vendor, will have access to a state computer system or database, then the Vendor must ensure that such officer, employee, or subcontractor must complete a cybersecurity training program certified under Texas Government Code Section 2063.102 as selected by TXCC. The cybersecurity training program must be completed by such officer, employee, or subcontractor during the term of the contract and during any renewal period. Vendor must verify to TXCC completion of the program by each such officer, employee, or subcontractor.

12.6.5 Insurance Requirements

Unless otherwise specified in this Contract, TXCC’s Standard Terms and Conditions or any other exhibit or attachment, Vendor will acquire and maintain, for the duration of this Contract, insurance coverage necessary to ensure this Contract’s proper performance and cover any potential liabilities with financially sound and reputable insurers licensed by the Texas Department of Insurance, in the type and amount customarily carried within the industry or as determined by TXCC. Vendor will provide evidence of insurance upon request by TXCC.

If any policy is determined by TXCC to be deficient and does not comply with the terms of this Contract, Vendor will secure such additional coverage as required by TXCC, law, regulation, or customary practice. If coverage expires during the term of this Contract, Vendor must produce renewal certificates for each type of coverage.

12.6.6 Financial Reports and Ability to Perform

A. Vendor must provide evidence of its financial resources and its ability to provide the solution for which Vendor is submitting a response. This includes information Vendor believes is pertinent to demonstrate its financial capability, financial solvency, and capacity to fulfill the requirements of this solicitation.

B. Evidence of financial stability include providing audited financial statements for each of the last two years of Vendor’s operations or, in the alternative, financial

Version 1.2 Page 24 of 31 Rev. 5/19/23 statements compiled, reviewed, and attested by an independent certified public accountant or certified public accounting firm. Vendor may submit a copy of its Dun & Bradstreet (D&B) Business Information Report. If a D&B Report is submitted the report must include Vendor’s Viability Score and the Portfolio Comparison Score or similar ratings.

C. Vendor must provide documentation and any other financial information reasonably requested by TXCC consistent with the services provided by Vendor or otherwise required by the then applicable TXCC policies for similar contracts.

D. Selected Vendor must also submit to the Contract Manager its financial rating information within 120 days after the end of Vendor’s fiscal year.

E. TXCC reserves the right to investigate and determine the financial integrity and responsibility of a Vendor and to reject a response on the grounds of Vendor’s lack of financial soundness, or if Vendor reasonably concludes, after reviewing the information submitted by Vendor as well as all other relevant information obtained by TXCC, that significant issues exist that could jeopardize Vendor’s full and timely performance. Vendor also reserves this same right throughout the life of the Contract, including before executing any optional renewal with Vendor.

12.7. Response Deadline and Submission Requirements

A. Vendors are required to submit Responses in accordance with the requirements outlined in this document. Responses must be received by TXCC on or before the date and time specified in RFO, Section 12.3, Schedule of Events. No late Responses will be reviewed.

12.8. Response Instructions

A. Vendor will follow the instructions set forth in the following Exhibits and Attachments to this RFO.

B. Each section, Exhibit, and Attachment of this RFO, along with any other associated files, contains individual detailed instructions regarding the required format of the Vendor’s Response. The Vendor is required to respond according to the instructions contained in each section of this RFO.

C. Vendor’s Response must be consistent with the structure, sequencing, and terminology used in this RFO.

12.8.1 Vendor Experience

A. Vendor must complete Exhibit B, Vendor Experience, providing information regarding its past relevant experience.

B. Vendor must not refer to information provided elsewhere in the RFO

Version 1.2 Page 25 of 31 Rev. 5/19/23

Response or reference website links.

12.8.2 No Marketing Materials Desired

Unnecessarily elaborate brochures or other presentations beyond those requested and sufficient to present a complete Response are not desired.

12.8.3 Response Documents

12.8.3.1 Vendor References

Vendor must complete the top portion of and send Exhibit E, Vendor Reference Form to a minimum of three companies or government agencies who are capable of providing comment on the Vendor’s ability to provide the solution described in this RFO and who are willing to do so. Reference should be able to comment on work performed by the Vendor in the past five years. Instructions are included in Exhibit E, Vendor Reference Form. TXCC is not responsible for undeliverable e-mails or for non-responsive references. Vendor’s references will be considered in accordance with RFO Section 13.2.2, Weighted Evaluation Criteria. References must respond directly to TXCC on the form provided by the due date in order to be considered for evaluation.

Exhibit E, Vendor Reference Form must be submitted by the reference directly to the point of contact listed in the Reference Form. The Vendor may not submit the reference form to TXCC. Completed Exhibit E, Vendor Reference Forms submitted by the Vendor will NOT be considered. TXCC may contact References for clarification at TXCC’s discretion.

12.8.3.2 Canceled Contract References

Using Exhibit A, Vendor Information and Certifications Form, Attachment 1, Canceled Contracts (included as part of Exhibit A), Vendor must provide the name, title, contact number and description of services provided for any contract that was canceled or prematurely terminated in the past five years. Vendor must include details on the reason for the cancelation and the Vendor’s position relevant to the cancelation, including the final resolution of the contract cancelation. For each company or entity listed, Vendor must provide a signed RFO Exhibit F, Vendor Release of Liability.

Failure to disclose canceled contracts may lead to a Vendor not being considered for award.

12.8.3.3 Addenda to the RFO

Vendors are encouraged to acknowledge receipt of all Addenda by providing a completed and signed version of “page one” of each Addendum with their Response.

Version 1.2 Page 26 of 31 Rev. 5/19/23

Vendors will be held to all terms and requirements of each Addenda regardless of the provision of a signed “page one.” Vendors will also be held to all terms and requirements of any Addenda issued after their submission of a response to this solicitation.

12.8.4 Response Files

The following table summarizes the files to be submitted to TXCC in order to be considered a complete Response, with the corresponding file names.

RFO Reference Form of Response

Exhibit A: Vendor Information and Certifications Form – MUST BE SIGNED

“ABC_371-00014_Exhibit A.docx”

Exhibit B: Vendor History and Experience “ABC_371-00014_Exhibit B.docx” Vendor’s Proposed Solution “ABC_371-00014_Offer.pdf” Exhibit C: HUB Subcontracting Plan (HSP) - MUST BE COMPLETED and SIGNED

“ABC_371-00014_HSP.pdf”

Exhibit D: Pricing Schedule “ABC_371-00014_Pricing.xlsx” Exhibit E: Vendor Reference Exhibit F: Vendor Release of Liability “ABC_371-00014_Exhibit F.docx” Exhibit G: VPAT “ABC_371-00014_VPAT.docx” Exhibit A1: Exceptions - Any Exceptions requested or Affirmative Statement that Vendor takes no Exceptions

“ABC_371-00014_Exceptions.xlsx”

Redlined version of Appendix A Standard Terms and Conditions, if applicable

“ABC_371-

00014_Exceptions_Redline.docx”

Signed Addenda to the RFO (not required) “ABC_371-00014_Addenda” (.docx or .pdf)

Financial Documentation “ABC_371-00014_Financials.pdf” Manufacturer Letters of Authorization (if applicable) “ABC_371-00014_LOA_Brand.docx”

*include the actual “Brand” name in the document naming convention*

Version 1.2 Page 27 of 31 Rev. 5/19/23

12.9. Rejection of Responses

TXCC has sole discretionary authority and reserves the right to reject any and all Responses received as a result of this RFO. Responses that do not comply with the mandatory submission requirements may be rejected. In addition, TXCC reserves the right to accept or reject, in whole or in part, any Responses submitted, and to waive minor technicalities when in the best interest of the State.

12.10. Right to Amend or Withdraw RFO

A. TXCC reserves the right to alter, amend, or modify any provision of this RFO, or to withdraw this RFO, in whole or in part, at any time prior to the award of a Contract if doing so is in the best interest of the State. TXCC reserves the right to re-solicit for like or similar products and services whenever it determines re-solicitation to be in the best interest of the State.

B. Any changes or additional information regarding this RFO will be posted as an Addendum on the ESBD, at http://www.txsmartbuy.com/esbd. It is the responsibility of Vendors to monitor the web site for Addenda. Vendor's failure to periodically check the ESBD will in no way release the Vendor from Addenda or additional information resulting in additional costs to meet the requirements of the RFO.

12.11. Pre-agreement Costs

TXCC will not be responsible or liable for any cost incurred by any Vendor in the preparation and submission of its Response to this RFO or for other costs incurred by participating in this procurement process.

12.12. Ownership of Responses

All Responses become the property of TXCC. TXCC reserves the right to use any information or materials presented in response to this RFO. Disqualification of a Vendor’s Response does not eliminate this right.

12.13. Public Information

A. TXCC is a government agency subject to the Texas Public Information Act.

Responses submitted to TXCC as a result of this RFO are subject to release as public information. Vendor(s) Response will be published on TXCC’s website after contracts are executed, and all other Responses are subject to release upon completion of the procurement or if the procurement is terminated.

B. If a Vendor believes that its Response, or parts of its Response, may be exempted from disclosure under Texas law, Vendor must submit both a redacted and http://www.txsmartbuy.com/esbd

Version 1.2 Page 28 of 31 Rev. 5/19/23 unredacted copy of its Response. In the unredacted copy, Vendor must specify page-by-page and line-by-line the parts of the Response that it believes are exempt. Vendor may not mark its complete Response “copyrighted” or mark every page as proprietary or confidential. In addition, the Vendor must specify which exception(s) are applicable and provide detailed reasons substantiating the exception(s). TXCC may publish or release the redacted copy of the Response without notice to or consent from Vendor.

C. If a Vendor fails to provide redacted and unredacted copies of its Response, or fails to specifically identify information that Vendor believes to be excepted from disclosure within its Response, then Vendor waives any claims against TXCC for the release of such information, regardless of whether TXCC provided prior notice to Vendor of such release.

D. Pursuant to Texas Government Code Section 2252.907, Vendor is required to make any information created, exchanged with the state pursuant to this Contract, and not otherwise excepted from disclosure under the Texas Public Information Act, available in a format that is accessible by the public at no additional charge to the state.

E. The Office of the…