Texas Department of Insurance

Request for Offers Evidence Management System RFO No. 454-26-0146-34060-YF NIGP Class/Item Codes: 208-57,920-00 May 4, 2026 Anticipated Schedule of Events

May 18, 2026 Release of Official Responses to Questions (or as soon thereafter as practical)

Late Proposals will not be considered

June 15, 2026 Presentations by Top-Ranked Respondents (if requested by TDI)

June 22, 2026 Anticipated Award Date (or as soon thereafter as practical)

Evidence Management System RFO No. 454-26-0146-34060-YF NOTE: Any Addendum that adds new language or replaces any language within this solicitation controls over the original version. It is the responsibility of all prospective Respondents to routinely check the Electronic State Business Daily (ESBD) during the posting period for this solicitation for any Addenda that may be posted. TDI will not make any other announcements regarding Addenda after the publication of this solicitation.

Table of Contents

Summary

2. Issuing Office

Texas Department of Insurance Purchasing and Contract Administration PO Box 12030 Austin, TX 78711-2030

June 4, 2026, 3:00 p.m., Central time

contracts@tdi.texas.gov

TDI will use the date and time stamp on TDI’s Microsoft Outlook mailbox to confirm receipt by the deadline.

14. Letters of Intent to Submit a Proposal

Not Applicable

26.

The overall score for Proposals that fail to adhere to the format and content listed in Section IV Part J (Proposal Content and Format) may be deducted 5 points, the Proposal may be disqualified, or TDI may waive minor technicalities in accordance with Section III Part A (Contract Resulting from this Solicitation).

1) Respondent must not be debarred from participation in state contracts.

2) Proposal must be submitted by the deadline stated in Item 5 above (Deadline for Proposals) of this Section.

3) The Title Page must be signed and submitted. See Section IV Part I.

4) Each addendum to the solicitation must be included in its entirety, including the signed signature page. See Section IV Part I Item 11.

5) The Execution of Proposal must be signed and submitted. See Section VII.

6) The Conflict of Interest form must be completed, signed, and submitted. See Section VIII.

7) The Certification Regarding Public Nature of the Proposal must be completed, signed, and submitted. See Section IX.

Specifications Introduction The Texas Department of Insurance (TDI), an agency of the State of Texas, issues this Request for Offers (solicitation) to solicit pricing from qualified vendors for Evidence Management System for the State Fire Marshal’s Office (SFMO) as described in this solicitation (“Services”). TDI’s objective is to obtain the Services that represent the best value for TDI and the State of Texas according to the terms and conditions of this solicitation. The Services and requirements described in this solicitation are mandatory unless specifically described as optional.

TDI anticipates making a Contract Award to one Successful Respondent (“Contractor”) for the Services required by the solicitation. TDI reserves the right not to award a Contract for the performance of all or part of the requirements of this solicitation. This solicitation is not exclusive and TDI reserves the right to issue additional solicitations regarding the Services described in this solicitation or similar services at any time. All Respondents are encouraged to offer their best pricing at all times.

All costs associated with the Services, as defined by this solicitation, must be included in the Respondent’s Proposal. Proposals that do not meet all the requirements or contain all the required documentation specified in this solicitation will be rejected as non-responsive and will be disqualified.

Background TDI Overview TDI regulates the state’s insurance industry, oversees the administration of the Texas workers’ compensation system, performs the duties of the State Fire Marshal’s Office, and provides administrative support to the Office of Injured Employee Counsel – a separate agency.

TDI’s vision is to be a dynamic leader in responsible state, national, and global regulation; consumer protection; and market viability.

Project Overview SFMO conducts investigations into fire-related crimes, generating substantial volumes of physical and digital evidence, including fire scene debris, lab samples, surveillance footage, forensic images, and case documentation. Currently, physical evidence is tracked using paper logs, Word documents, and Excel spreadsheets, while digital evidence is stored manually in SharePoint and network drives.

TDI seeks to purchase an Evidence Management system to manage both physical and digital evidence in a centralized, secure, and searchable system. The system must allow tracking of physical evidence from collection at the scene until it is no longer in the care, custody, and control of the SFMO as well as uploading and managing all digital evidence. The system must allow configurable workflows for evidence intake, transfer, retention, and disposition. TDI also requires implementation service of the proposed Evidence Management system.

Qualifications Respondents must have the knowledge and expertise to provide the services described in this solicitation. Each Respondent submitting a Proposal in response to this solicitation must describe in its Executive Summary how the Respondent meets the qualifications described below.

1) Respondent has a minimum of three (3) years’ experience providing evidence management systems described in this solicitation or comparable law enforcement records, digital evidence or case management systems.

2) Respondent has experience with at least five (5) individual engagements providing evidence management or services comparable to the services described in this solicitation. Preferably, the respondent will have experience with diverse law enforcement agencies with an emphasis on fire investigations and other large fire marshal offices.

3) Respondent must have qualified staff dedicated to the project. Respondent must specify in detail the qualifications, education, training, experience, and certifications of the key staff that will provide services under any contract resulting from this solicitation.

Definitions and Acronyms As used in this solicitation, the following capitalized terms will have the meaning specified below.

http://www.txsmartbuy.com/esbd.

Roles and Responsibilities

1. Agency Responsibilities Agency agrees to meet the following requirements during the Contract Term:

a) Designate an Agency representative to be the Agency Primary Contact for the purposes of monitoring Contractor performance and providing day-to-day interaction and instruction. The Agency Primary Contact will also be the designated Contract Administrator.

b) Provide technical staff to assist with coordination between Contractor and TDI.

c) Have final approval on all schedules and deliverables.

d) Work with Contractor on all product and performance related issues.

Contractor Responsibilities Contractor must meet all the following requirements during the Contract Term:

a) Designate a representative to be the Vendor Primary Contact for the purposes of scheduling, billing, contract management, and day-to-day management of Services under this solicitation.

b) Provide the necessary staff to fulfill deliverables and requirements in accordance with the agreed upon schedule or services.

c) Collaborate with TDI to ensure successful implementation and completion of the Services.

d) Be honest, open, courteous, respectful, and fair in all contact with TDI.

e) Identify and communicate any risks to the Service to the Agency Primary Contact.

Scope of Work

1. General Requirements Contractor must provide software that meets the following general requirements:

a) Tracks both physical and digital evidence in a centralized, searchable system

b) Supports barcode, Radio Frequency Identification (RFID), or other unique number tagging for physical evidence

c) Allows secure uploading, tagging, and digital media

d) Provides full chain of custody logging with timestamps and user activity

e) Retains all digital evidence metadata, such as recording device number, time and date stamp, location information, and GPS coordinates

f) Allow configurable workflows to support agency-specific evidence management processes

g) Automated notifications for pending audits or evidence disposition

h) Ensure system accessibility via mobile and tablet device with full functionality

i) Provide role-based user access and administrative controls in accordance with International Association for Property Evidence (IAPE) standards In its Business Proposal (see Section IV Part I Item 5), Respondent must describe how it will meet or exceed the requirements in this section.

Physical Evidence Management Contractor must provide the following functionality to track physical evidence:

a) Barcode, RFID, or other unique number identifier tagging

b) Storage location management, and evidence disposition coding

c) Maintain complete records of evidence movement and storage in accordance with International Association for Property Evidence (IAPE) standards

d) Provide role-based user access and administrative controls in accordance with IAPE standards

e) Audit trails by user, case number, and evidence location for adding and removing evidence records, and changes to information about physical evidence in the record.

In its Business Proposal (see Section IV Part I Item 5), Respondent must describe how it will meet or exceed the requirements listed in this section.

Digital Evidence Management Contractor must provide the following secure functionality for digital evidence:

a) Uploading, tagging, storing, managing, and viewing of digital evidence, including but not limited to surveillance footage, forensic images, audio recordings, and other digital media

b) Retain all required metadata, including recording device number, date and time of creation of evidence record, location information, and GPS coordinates, if available

c) Ability to catalog and manage large volumes of digital media

d) Allow multiple media types (including digital photographs, videos, and audio files and electronic documents) in various file formats (including but not limited to .jpeg, .jpg, .png, .gif, .tiff, .avi, .mp4, .mov, .avi, .wmv, .mpeg, .mpg, .pdf, .docx, .xlsx) for digital evidence

e) Audit trails by user, case number, and evidence location for adding and removing evidence records, and changes to information about digital evidence in the record.

In its Business Proposal, (see Section IV Part I Item 5), Respondent must describe how it will meet or exceed the requirements listed in this section.

Chain of Custody Records Contractor must provide automated chain of custody tracking of all digital and physical evidence in accordance with IAPE standards including, but not limited to, the following:

a) Handling activities

b) Receipt, transfer, access, storage, and disposition of evidence

c) Generation of time-stamped audit logs identifying users, case numbers, and evidence locations In its Business Proposal (see Section IV Part I Item 5), Respondent must describe how it will meet or exceed the requirements listed in this section.

Records Retention and Disposition Management Contract must provide records retention and disposition functionality including:

a) Allow staff to set retention schedules

b) Automated purging and archiving of records

c) Automated evidence disposition scheduling with alerts In its Business Proposal (see Section IV Part I Item 5), Respondent must describe how it will meet or exceed the records retention and disposition requirements listed in this section.

Law Enforcement – Specific Needs Contractor must provide an Evidence Management system that supports the following law enforcement-specific requirements:

a) Secure handling of digital evidence (e.g., surveillance footage, phone extractions, audio recordings) in accordance with IAPE standards

b) Secure portals or encrypted links for digital evidence transfer to district attorneys, courts, and external partner agencies

c) Ability for members of the public to submit digital evidence about criminal activities

d) Compliance with and support for International Association of Property and Evidence Technician processes, including:

1) Ability to generate audit reports for inventory inspections

2) Retain evidence location information, disposition coding, and retention schedule requirements for evidence records

3) Provide system alerts for required retention reviews of evidence records

4) Ability to record the results of evidence inventory

5) Ability to schedule inventory audits and inspections, including inventory status reports and notify users when required actions are due, such as inventory audits and inspections In its Business Proposal (see Section IV Part I Item 5), Respondent must describe how it will meet or exceed the requirements in this section and specifically identify whether each law enforcement–specific feature listed is included in the software.

Reporting Evidence Management system must provide reporting functionality including, but not limited to, the following:

a) Ability to monitor data storage amounts, including reports and automated alerts

b) Ability to generate audit reports for inventory inspections

c) Ability to run reports on number of evidence collected, disposed, or returned for both digital and physical evidence

d) Ability to run reports noting the types of evidence collected In its Business Proposal (see Section IV Part I Item 5), Respondent must describe how it will meet or exceed the requirements listed in this section.

Peripheral Hardware Contractor must provide all necessary hardware and equipment required to support functionality of the evidence management software.

In its Business Proposal (see Section IV Part I Item 5), Respondent must describe the hardware and consumables needed to operate the evidence management software including all specifications, availability, and warranties. Respondent must provide pricing for peripheral hardware on the Mandatory Pricing Sheet, Section V).

Preferred Requirements The following requirements are preferred:

a) Unlimited number of users at one software licensing cost

b) In-software viewing capability of digital evidence (images and video)

c) Life-time replacement for all peripheral hardware

d) Ability to integrate with records management and case management systems and accept files of key data elements, such as investigation case numbers, from a case management platform In its Business Proposal (see Section IV Part I Item 5), Respondent must specifically identify whether the preferred features listed in this section are included in the software, and describe the preferred features listed in this section.

Software Implementation Contractor must provide implementation services to include:

a) Integrate with TDI’s active directory for control of user profiles

b) Arrange dashboards to align with SFMO data field needs

c) Define user roles

d) Workflow configuration

e) Any other implementation services not able to be performed by TDI In its Business Proposal (see Section IV Part I Item 5), Respondent must identify any additional implementation services required to implement the solution and describe how it will meet or exceed the requirements listed in this section.

System Availability Contractor must ensure the system is available 24 hours per day, seven (7) days per week. The overall uptime and availability of the system must be 99.98%. Any exceptions to this availability must be mutually agreed upon in writing between TDI and Contractor.

In its Business Proposal (see Section IV Part I Item 5), Respondent must describe how it will meet or exceed the requirements listed in this section.

Training and Training Materials Contractor must provide on-line training for designated State Fire Marshal’s Office personnel within two (2) weeks of go-live on a date and time mutually agreed upon by TDI and the Contractor to ensure staff is proficient in the use, administration, and maintenance of the evidence management software. Training sessions must focus on general user training on system functionality including, but not limited to the following topics:

a) Procedures for uploading, storing, and tagging

b) Retrieving and viewing digital evidence

c) Physical evidence intake, tracking, transfer and deposition processes

d) User roles, permission and security controls

e) Chain of custody management and audit trail review

f) Reporting and data retrieval functions

g) Troubleshooting and technical support procedures Training materials must include, but are not limited to, training manuals, training videos, instructional guides, Frequently Asked Questions (FAQs), and any other relevant resources beneficial for training purposes. Contractor must provide all training materials for SFMO review and approval 30 days prior to the training being conducted.

In its Business Proposal (see Section IV Part I Item 5), Respondent must describe how it will meet or exceed the requirements listed in this section.

Service Transition / Turnover Turnover is defined as those activities at the end of the Contract Term to transition services to a subsequent vendor or TDI. Contractor must work with TDI to ensure a successful transition without a loss of services.

Six (6) months after the system becomes operational, and updated annually thereafter during the Contract Term, Contractor must provide TDI a Turnover Plan that details the processes, activities, and schedule to transfer services. The Turnover Plan must include, at a minimum:

· a process to transfer data and information as applicable, including any source code, software, data formats, and file sizes, as applicable;

· an entity relationship diagram of the data tables used in the application, if applicable;

· logic flow diagrams mapping application layers and the flow information between application, database, and other server components, if applicable;

· if applicable, a detailed listing of all third-party tools, plugins, or utilities used by the application, called through the application code. This will detail whether they are available as open source, the current version installed or supported, and any additional known or suspected concerns about future upgrades to the object;

· listing and description of written documentation developed for TDI related to the services, including any technical documentation and data dictionaries;

· process workflows and business rules; and

· training for TDI staff as appropriate to continue services.

The Turnover Plan is subject to TDI review and approval.

Technical Specifications

1. Scalability and Flexibility Contractor’s solution must incorporate scalability and flexibility to accommodate changes due to technological improvements or enhancements, legislative mandates, and program changes that are within the scope of this solicitation. Contractor agrees to support modifications that TDI requests when the requested changes are necessary to maintain the accuracy, functionality, security, and integrity of the system. Any such revisions will be coordinated with Contractor and follow the change management process.

1. TDI’s Technical Environment

a) Enterprise Client Computing Environment TDI’s client computing environment is comprised of Intel-based desktops and laptops running 64-bit Windows Operating System. Microsoft Edge, Mozilla Firefox, and Google Chrome are supported browsers. Microsoft Office 365, including the Office client suite, is standard for office automation needs such as email, word processing, spreadsheets, presentations, and small databases. A network faxing solution is also standard for e-fax capability. All workstations are managed through a directory service.

Agency-owned mobile devices are used by staff requiring additional mobility. These mobile devices are managed through an enterprise Mobile Device Management (MDM) solution. Supported devices are iOS11 and up.

Xerox Multi-Function Devices (MFDs) are located throughout all agency sites for services including print, copy, fax, and scan.

b) Server Environment TDI is a customer of the State Technology Services (STS) Data Center Services (DCS) program overseen by the Texas Department of Information Resources (DIR). The agency consists of a broad server environment, hosted by a STS contractor, which provides data center services including: hosting of agency systems both in an on-premises and cloud environment, data center security, operating system security patching, backup and monitoring of systems, and disaster recovery.

The TDI Server Environment consists of a combination of Windows, and Linux systems and consists of file sharing, application, database, and utility servers.

TDI provides web content to both internal employees and the public via Microsoft Internet Information Security (IIS).

The current database standard is Oracle. Any database versions used with the third-party product(s) must fully support the current certified supported version. Microsoft SQL is used to support any third-party applications that will not run under Oracle.

c) Telecommunications Infrastructure All TDI offices are connected through an Ethernet topology and connect to the Texas State Data Center through a TDI-managed wide area network (WAN).

Agency phones and contact centers are connected through an externally managed VOIP system.

TDI has one main office building site located in Austin and over 20 field office locations across the state. All field offices are directly connected through the agency WAN with circuits varying by number of staff and business functions performed in the office. All sites have both wired and wireless (Wi-Fi) connectivity.

1. Change/Configuration Management Contractor must establish a change or configuration management process that complies with Texas Administrative Code Title 1, Section 202. The change management process controls modifications to hardware, software, firmware, plans, policies, procedures, logic, operations, technical guides, and any other agreed upon project element(s) to ensure that the information resources are protected against improper modification before, during, and after System implementation. Changes may be initiated by Contractor or TDI.

Contractor must use a change request form to document all change requests. The change request form is subject to TDI approval and must include, at a minimum, the following information:

· description of the change, including the need/benefit, date identified, and who initiated the change request;

· list of the TDI data, functions, or protocols affected by the change;

· potential risks associated with the change (both with implementing the change and not implementing the change);

· start date;

· completion date (as determined by mutual agreement of Contractor and TDI);

· staff allocation;

· installation plan;

· test plan;

· back-out plan; and

· estimated hours of work.

Contractor must not perform any work, alter any functions or protocols, or implement any changes to the TDI data without submitting a change request to TDI and obtaining explicit approval for the change before the work begins.

Contractor must ensure that appropriate planning and resources are applied to complete changes by the planned completion date. In the event of delays to the planned completion date, Contractor must provide timely written notice to TDI detailing why the date cannot be met and what, if any, additional time, or resources are needed to complete the change request. TDI will approve, in writing, the new completion date if the revised date and justification are acceptable to TDI. Changes not completed by the agreed upon completion date will be deemed to be a failed change.

Contractor’s inability to correct or fix a known issue, deficiency, malfunction, or bug will be deemed by TDI to be a failed change. TDI, in its sole discretion, may assess actual damages, retroactively from the point that the known issue, deficiency, malfunction, or bug was identified. Such costs will be computed separately and either deducted from any monies due to the Contractor under the Contract resulting from this solicitation or paid to TDI within 30 calendar days of the failed change request. All changes must be completed to the satisfaction of TDI.

1. Maintenance and Support Contractor must ensure the functionality and operational effectiveness of the system and TDI data during the Contract Term. The Contractor will provide the following types of program maintenance and support for the system and any enhancements, modifications, or customizations that are required and completed by Contractor for the Services provided under this solicitation:

a) Maintenance Contractor must provide the program maintenance listed below.

1) Corrective Maintenance – to correct processing, performance, or implementation faults of the program.

2) Adaptive Maintenance – to adapt to changes in environment, such as new hardware or the next release of an operating system, to protect the system and adapt to external threats, such as viruses. Adaptive maintenance does not lead to changes in the program functionality.

3) Preventive Maintenance – to maintain the system in satisfactory operating condition by providing for systematic inspection, detection, and correction of initial failures either before they occur or before they develop into major defects.

4) Performance Tuning – to perfect the program for its performance, processing efficiency, maintainability, or accommodation of new or changed user requirements.

5) Emergency Maintenance – to correct system emergencies affecting processing and performance of the program. All scheduled and planned outages must be scheduled with a minimum of 72 hours of advance notice to TDI and must occur only during non-peak hours unless otherwise agreed upon by TDI and Contractor.

b) Technical Support Contractor must provide technical assistance to TDI or system users with technical issues including connectivity problems and password changes, if applicable. At minimum, technical support must be available, during TDI business hours, 8am to 5pm, Central time, Monday – Friday. TDI prefers technical support is available 24/7, 365 days a year Contractor must provide TDI with contact information for emergencies that occur during non-business hours.

1. Testing Within 60 calendar days of Contract Execution, Contractor must provide a detailed test plan that describes the scope, approach, strategy, resources, risks, assumptions, and schedule of intended test activities. Test activities will include test cases, test design, parallel testing, security testing, exit criteria, and quality assurance. The test plan is subject to TDI review and approval.

TDI requires a minimum of 14 business days to complete user acceptance tests and identify any deficiencies. TDI will provide a list of deficiencies within 7 business days of the completed test. TDI will not consider a deliverable complete until user acceptance tests are completed to TDI’s satisfaction. TDI will provide acceptance of each deliverable in writing.

1. Electronic and Information Resources Accessibility Standards Texas government statutes and rules require that electronic and information resources (EIR) used, developed, procured, or maintained by Texas agencies and institutions of higher education are accessible to people with disabilities. See Texas Government Code Chapter 2054 Subchapter M.

a) If Respondent’s solution includes commercial off-the-shelf (COTS) software or online services, Respondents must complete a Voluntary Product Accessibility Template (VPAT) for each item and submit the results with Respondent’s Business Proposal. Alternately, Respondent may provide the URL to completed VPATs or equivalent reporting templates.

b) If Respondent’s solution includes development services for software, websites, web applications, etc., Respondent’s Business Proposal must include credible evidence of its capability or ability to produce accessible EIR products and services. Such evidence may include, but is not limited to, internal accessibility policy documents, contractual warranties for accessibility, accessibility testing documents, and examples of prior work results.

1. Licenses and Enhancements Contractor’s solution must specify the type of license TDI will receive, e.g., perpetual, site, concurrent, or other type included with their solution; and must also specify any enhancements, modifications, or customizations completed by Contractor for the Services provided under this solicitation. All enhancements must be for perpetual use by TDI at no cost to TDI for the life of the system.

At the end of the Contract Term, TDI must have the option to execute a new Contract for maintenance and support for the product and any enhancements, modifications, or customizations completed by Contractor for the Services provided under this solicitation.

In its Business Proposal (see Section IV Part I Item 5), Respondent must fully describe the proposed technical environment including all hardware, software, and any other technical infrastructure specifications or requirements needed to implement and operate the proposed solution. This must include any open-source, freeware, or proprietary software installed on a temporary basis to assist with the implementation of the solution. Respondent must clearly identify items that TDI is expected to provide and items that Respondent will provide. Financial responsibility for specific hardware and software needs may be negotiated before Contract Award.

Hosting

1. Data Center Services (DCS) Infrastructure Requirements The Texas Legislature, by action of House Bill 1516, 79th Legislature (Regular Session), established the foundation of a shared technology infrastructure and directed Department of Information Resources (DIR) to coordinate a statewide program to consolidate infrastructure services. Section 2054.391 requires State agencies included in the Data Center Services (DCS) program to use such services, unless otherwise approved by DIR through a DCS Exemption. DIR currently has executed multi-vendor contracts to provide data center managed services for DIR Customers (state agencies).

All hosted solutions offered in response to this RFO (including custom developed application, COTS, and Portal or Website managed content) must host the application or solution in the DCS program, using either public or private cloud compute and DCS managed services provided.

Respondents should comprehensively list their infrastructure or compute requirements, to be hosted in either a DCS public or private cloud, for financial review by TDI. TDI will facilitate the process to request an estimate of the cost to host the solution within the DCS program.

If the Respondent intends to propose Software as a Service (SaaS), then the Respondent must demonstrate that the solution clearly meets the National Institute of Standards and Technology (NIST) standard definition of SaaS (NIST Definition of Cloud Computing Special Publication 800-145). The solution must be TX-RAMP level 2 certified (or equivalent substitution). TDI will be required to request and receive from DIR a DCS program exemption before a contract can be awarded to a Respondent if the solution is purchased outside of the DCS program.

Respondent must also complete and submit the Solution Questionnaire in Attachment 1.

More details about the DCS Vendor Contracts, Master Services Agreements (MSAs) and Statements of Work (SOWs) may be found on DIR’s website at: www.dir.texas.gov.

Respondents should provide one technical solution: either SaaS or DCS hosted and managed. If your proposal is for a hosted solution, it will need to be hosted in the State’s DCS program, which offers both public and private cloud hosting options. This program provides all server management functions including system administration, operating system management and patching, base security services, dedicated local area network connectivity, storage services, backup services and disaster recovery services. Respondents should indicate whether it is proposing fully managed, or semi managed DCS infrastructure hosting and compute solutions required.

Respondents are not required to estimate the cost to host within the DCS program; however, Respondents are required to provide complete technical specifications in order for TDI to estimate.

Collectively, the DCS contracts provide participating state agencies mainframe and server operations, both public and private cloud services, disaster recovery, and bulk print and mail services.

DCS Public and Private Cloud Compute and Software Acquisition As a participating entity in the DCS program, TDI is required to acquire all in-scope infrastructure compute, services, and software through the DCS program. Respondents must include complete compute and software infrastructure requirements in their response in order for TDI to estimate DCS costs.

The Successful Respondent is required to participate in the procurement process, including participating in the requirements gathering session and validating any DCS-created solution proposals. Proper long-range planning is required in order to ensure compute is provisioned to meet project schedules.

DCS Process Management The Successful Respondent may be asked to participate in the defined DCS processes for incident management, problem management, change management, release management, configuration management, and request management. In the management plans described in this RFO Section x, the Respondent must describe its interactions with the DCS program (For the agency: The DCS Services Management Manual is available for you to post in your data room for respondents. Please contact DIR to request a copy).

DCS Public Cloud Industry leading public cloud services available from DIR Shared Technology Services are hardened public cloud virtual data center solutions with a focus on aligning the DCS Operating Model with Industry Best Practices, technical and security assurances, and onboarding of public cloud services through Amazon Web Services (AWS), Azure, and Google.

Leveraging Cloud Native tooling, the DCS Cloud Service model is poised to align to the value of Cloud Service Providers by evolving capabilities with investment in Service Evolution of the Public Cloud. Our expanded Public Cloud model delivers Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and SaaS services with products and tooling built for and within the Public Cloud to leverage the full benefits of Public Cloud services with the security assurances of DCS. For more information on the DCS Public Cloud see Appendix C – Additional DCS Hosting Information.

DCS Private Cloud The Data Center Services program maintains two consolidated data centers geographically separated in order to provide disaster recovery. The Texas Private Cloud (TPC) provides technology infrastructure compute and storage based on standard reference models and managed services options. For details see Appendix C – Additional DCS Hosting Information.

Functions Retained by TDI – Not Provided by Data Center Services For clarity, the following services are not provided by DCS Service Providers. In developing your response, the Respondent should clearly understand that the requestor (agency) performs these functions as needed.

For additional details, see Appendix C – Additional DCS Hosting Information.

Contractor-Hosted Solution If Respondent’s proposed solution is a Contractor-hosted (cloud-based) system, Respondent’s Business Proposal must describe the solution and detail services that Contractor assumes TDI will provide. If the proposed solution is a Contractor-hosted solution and cannot be hosted in the DCS government cloud, Respondent must include Attachment 1 - Solution Questionnaire with the Proposal.

Pursuant to Section 2054.0593(d)-(f) of the Texas Government Code, relating to cloud computing state risk and authorization management program, Contractor represents and warrants that it complies with the requirements of the state risk and authorization management program and Contractor agrees that throughout the term of the contract it shall maintain its certifications and comply with the program requirements in the performance of the contract. The Contractor will meet TXRAMP certification level 1 or be under provisional status. TDI must approve any cloud services proposed by Contractor.

If cloud services will be used, Contractor must provide the latest SOC II Type II reports before Contract Execution and annually during the Contract Term.

Respondent must detail services that Contractor assumes TDI will provide in the table shown in Section III, Part J (Respondent Exceptions and Assumptions).

In its Business Proposal (see Section IV Part I Item 5), Respondent must submit the latest SOC II Type II report if proposed solution uses cloud services, and describe the proposed hosting as outlined in this Section II, Part H.

Security

1. General Security Requirements Personally Identifiable Information (PII) refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. Examples of PII include but are not limited to:

· name, such as full name, maiden name, mother’s maiden name, or alias;

· date of birth;

· personal identification numbers, such as a driver’s license number;

· address information, such as a street address or email address; and

· all future…