ESBD_512003_1779294563124_454-26-0146-34060-YF Addendum No.1.pdf

Texas Department of Insurance

Request for Offers

Evidence Management Systems

RFO No. 454-26-0146-34060-YF

Addendum No. 1

Issue Date: May 20, 2026

A. Purpose of Addendum

1. Addendum Item 1: To publish answers to submitted questions.

2. Addendum Item 2: Section II, Part F, Scope of Work, is amended to require Respondents to provide a preliminary Project Schedule.

3. Addendum Item 3: Section II, Part L, Schedule of Deliverables and Milestones, is amended to include a preliminary Project Schedule.

B. Addenda Items

1. Questions and Responses

Questions are organized by inquiring party. Respondents are urged to read all questions and responses.

All typographical errors, errors in spelling, or incorrect or inaccurate references are in the original questions. Texas Department of Insurance (TDI) determined not to alter them.

Similar or similarly-asked questions are answered only at the first instance of the question. Each subsequent instance refers back to the question number containing the applicable response.

RFO No. 454-26-0146-34060-YF

Addendum No. 1

Where a simple “yes,” or “no,” response is given, TDI determined that no further qualification was needed.

No. Question Response

1 Since TDI utilizes an Ethernet topology and a managed Wide Area Network (WAN), will

TDI provision the required Virtual Cross

Connect (VXCs) for Public Cloud integration, or Respondent is expected to include the procurement, installation and associated costs in the implementation budget?

Section II, Part G, Item 3 / Appendix C;

Telecommunications Infrastructure / DCS

Public Cloud

Respondents should submit a proposal including the procurement, installation and associated costs for providing Virtual Cross

Connect (VXCs) for Public Cloud integration if relevant to their proposal.

2 If the proposed solution utilizes Oracle-based architecture within the DCS environment, will TDI provide the necessary

Enterprise Edition licenses and required

Management Packs, or is the Respondent expected to bundle the procurement costs into the licensing schedule?

Section II, Part G, Item 2.b; TDI’s Technical

Environment - Server Environment

If the proposed solution utilizes Oracle-based architecture within the DCS environment, the vendor should include their licensing cost in the proposal.

3 Given the high volume of digital media

(surveillance footage/forensic images), does

TDI have a required DCS SAN Storage Tier

(Tier 0–3) for the evidence repository to ensure adequate IOPS for concurrent playback and analysis?

Appendix C; Enterprise SAN Storage

The vendor’s proposal should include the recommended storage for the evidence repository to ensure adequate IOPS for concurrent playback and analysis.

4 Does TDI’s Active Directory infrastructure currently support federated identity protocols such as SAML 2.0, OIDC, OAuth

2.0, WS-Federation or is the requirement limited to legacy LDAP synchronization?

Section II, Part I, Item 3.j; Password

Guidelines and Requirements

SAML, OIDC and OAuth are supported in

Azure. WS-Federation is not used.

Addendum No. 1

No. Question Response

5 Will TDI provide API documentation (e.g., Swagger/OpenAPI files) to fulfil the preferred requirement of integrating with records and case management systems, to the awardee during the configuration phase?

Section II, Part F, Item 10.d; Preferred

Requirements

TDI does not have an RMS solution currently in place.

6 The RFO indicates that current evidence is stored in Word, Excel, and SharePoint. Does

TDI require a one-time migration of these legacy records into the new system? If so, what is the estimated data volume (in

Gigabytes/Terabytes) and what is the total record count?

Section II, Part B, Item 2 / Section II, Part F, Item 11; Project Overview / Software

Implementation

No, TDI does not require any data migration services.

7 What is the specific Xerox MFD model numbers, firmware versions, and local workstation driver versions currently deployed across TDI office locations? Does

TDI require the proposed barcode/RFID scanning hardware to integrate with existing

Xerox MFD scanning workflows or can the respondent provision have dedicated barcode/RFID scanning hardware independent of Xerox devices? If Xerox MFD integration is required, what scanning formats and file outputs specifications must be supported by the barcode/RFID scanning hardware?

Section II, Part G, Item 2.a; Enterprise Client

Computing Environment

No integration with Xerox MDFs is required.

Section II, Part F Vendors must provide all necessary hardware.

Addendum No. 1

No. Question Response

8 Given that TDI mobile devices are managed via an enterprise MDM solution, will TDI provide the test environment or hardware profile for the Respondent to validate application performance under current MDM security policies?

Section II, Part G, Item 2.a; Enterprise Client

Computing Environment

TDI will not provide a dedicated test environment but will work with the vendor for technical (depending upon the solution) and user acceptance testing.

TDI uses laptops and workstations with

Windows 11 operating systems. TDI uses iPhones and iPads with the most current iOS.

9 The RFO mandates compliance with controlled penetration tests. Will these tests be executed by the Texas Department of

Information Resources (DIR), and what is the anticipated testing frequency (e.g., annual or per release)?

Section II, Part I, Item 6.e; Data and

Information Security

Penetration tests would be managed and paid for by TDI, on an as-needed basis or resulting from a security incident or to implement new legislation/regulations.

11 The RFO requires FIPS 140-3 validated modules for data in transit. Does TDI require the cryptographic boundary to terminate at the DCS Gateway or within the specific

Application Load Balancer of the solution?

Section II, Part I, Item 7; Data Encryption

TDI prefers the use of an Application Load

Balancer.

12 For physical documents stored on portable drives, is there a specific AES encryption standard (e.g., 256-bit) required to satisfy

TDI’s document security and chain of custody protocols?

Section II, Part I, Item 11; Document Security and Chain of Custody

N/A - Our systems encrypt any external device via internal security systems

(Bitlocker).

Addendum No. 1

No. Question Response

13 Page 48 suggests that the system will have

40 users. How many of these users might be logged in at the same moment in time?

Should we assume or allow for all 40?

The number of concurrent users is currently unknown. The vendor’s proposal should clearly describe the potential adverse outcomes from exceeding the number of concurrent users at any given moment.

14 Regarding the 40 users. Our system does not allow unlimited users (although you can have as many users as you want in the system). Our licensing is based on concurrency. That is, how many users are logged in at the same moment in time. Our proposal pricing will be quite different if only 10 users need to login simultaneously vs all40 of them. That is to say, the system will be 1/4 the price if only 10 need to be logged in concurrently.

The number of concurrent users is currently unknown. The vendor’s proposal should include pricing for each tier of concurrent user licenses up to 40 users.

15 Page 11 requests a system using barcode or

RFID technology. Will a system without

RFID even be considered? Has anyone researched the limitations and problems with RFID tagging?

Section II, Part F, Item 1.b, General

Requirements states:

Supports barcode, Radio Frequency

Identification (RFID), or other unique number tagging for physical evidence.

16 For the digital evidence component of the system, is there any guidance on the maximum file size that can be stored? or the total amount of digital evidence that might be stored in the system? There is a very big difference between 1 TB of data and 1 PB of data. We need some guidelines on this.

Each investigation is different. A typical fire investigation may have 5 physical evidence collections, 500-1000 photos, body cam videos, ring/home surveillance, videos, 911 caller audio recordings, and audio recordings of interviews. This can increase based on the complexity of the investigation. For example we obtained 6

TB of data on one firefighter fatality investigation. The vendor’s proposal should include pricing for each tier of storage used.

Addendum No. 1

No. Question Response

17 On page 12, it suggests 'multiple media types'. Does the system need to store codecs for file types that your browser doesn't natively handle? Or will all file types be native to the browser? For example, .mpg files are handled natively within all browsers. But .heic files (as an example) might not. How will you handle non-native file types?

The solution should include a stored codec for each file supported by the software. The vendor’s proposal should specify the file types supported by the solution.

18 Page 13 9c. What is your definition of lifetime? I can't imagine any vendor fully replacing all hardware forever.

Section II, Part F, Item 9, Preferred

Requirements.

This is a preferred feature and not a mandatory requirement.

19 Page 16 - "Contractor must not perform any work, alter any functions or protocols, or implement any changes to the TDI data without submitting a change request to TDI and obtaining explicit approval for the change before the work begins." Does this include any updates to the system?

Whether bug fix or new features? I'm just trying to confirm if TDI expect control over system updates or enhancements.

No, TDI does not expect control over system updates and enhancements. This is precautionary language for ensuring our data isn’t overwritten or changed.

20 In your on premise hosted solution (DCS) you seem to tie damages to any downtime.

What if the downtime is on your side? How would we prove or dispute this?

Network and application logs from your environment would demonstrate the functionality of your system. Downtime due to circumstances outside the vendor’s control would not be considered a missed performance standard.

21 You suggest that hardware should be included in the proposal, and also a lifetime replacement warranty, but not hardware is defined. What hardware do you need and in what quantity? And if RFID is going to be a part of the proposal, you could get very large variances in pricing.

See Section II, Part F, Item 8, Peripheral

Hardware.

Hardware is defined as ‘…all necessary hardware and equipment required to support functionality of the evidence management software.’

Respondent must describe the hardware and consumables needed to operate the evidence management software including all specifications, availability, and warranties.

Addendum No. 1

No. Question Response

22 You are scoring pricing as 25% of the overall score. This might not be a question but you will get wildly different pricing and almost no scope is defined. If you are expecting vendors to provide a scope, maybe based on similar experience, you are penalizing vendors for providing solutions that might be better and also more expensive.

Section III, Part I – Respondent Exceptions and Assumptions. Respondents may offer alternate terms for consideration by following the Exceptions and Assumptions portion of the RFO.

23 The “Work Product / IP Ownership” Clause is

Aggressive The contract language basically says: all work product belongs to TDI perpetual rights source code implications derivative works rights

That is far too broad for a commercial SaaS platform.

If unmodified, it could theoretically imply:

ownership claims over customizations ownership claims over workflows ownership claims over configurations possibly broader software rights arguments

Is my interpretation of these areas correct?

Are these negotiable prior to final agreement?

Section III, Part I – Respondent Exceptions and Assumptions. Respondents may offer alternate terms for consideration by following the Exceptions and Assumptions portion of the RFO.

24 We would like some language wrapped around the "2-Day Vulnerability

Remediation Requirement". Not every situation can be resolved that quickly. I feel the language is just too broad.

Section III, Part I – Respondent Exceptions and Assumptions. Respondents may offer alternate terms for consideration by following the Exceptions and Assumptions portion of the RFO.

25 What is the expected timeline for vendor to meet and deploy DOI requirements listed after Execution of Award? Project Go-Live

The vendor’s proposal should include proposed project timeline for implementation. TDI will work with the successful vendor to refine the timeline after contact execution.

26 Is TXRAMP [H.1.] mandatory for Execution of

Award, or can vendor commit to or be in the process of attaining

Section II, Part H.2 Contractor-Hosted

Solution

The awarded solution must be Tx-Ramp

Level 1 certified or under a provisional status.

Addendum No. 1

No. Question Response

27 Does TDI have a strong preference for on premise or cloud storage

The vendor’s proposal should include the storage options that the solution supports.

28 In 9c, can you clarify what is meant by "Life-time replacement for all peripheral hardware"?

Reference response above for lifetime question

29 Can you confirm Property Rights [28] or work for hire does not include products or IP of vendor but to work done specifically for this project.

Correct.

30 Is there any legacy data to be migrated, and if so, what is the existing size of the legacy data set to be migrated, and what format is the legacy data currently in?

See response to Question 6.

31 Who will do the initial data entry for the physical property items to be submitted to the property room? The personnel collecting the evidence, or designated Property Clerks in the property room?

The initial evidence entry will be done by the collecting investigator who will then submit the evidence to the evidence room technician.

32 Understanding that the State prefers licensing for Unlimited Users, can the State still please confirm how many personnel are in the property room(s)?

The vendor’s proposal should include hardware and software licensing costs for up to 40 personnel.

33 Understanding that the State prefers licensing for Unlimited Users, can the State still please confirm how many users INSIDE the property room(s) will be receiving and managing physical evidence?

There will be 5 staff with access to the evidence room.

34 Understanding that the State prefers licensing for Unlimited Users, can the State still please confirm, separate from the property room personnel, how many

Administrative or IT users will access the system?

TDI estimates 6 administrators.

Addendum No. 1

No. Question Response

35 Understanding that the State prefers licensing for Unlimited Users, can the State still please confirm how many users, OUTSIDE of the property room(s), will need basic access to the system for adding digital evidence, viewing, etc.?

There would be a total of about 40 users who will be uploading and checking in evidence, whether digital or physical.

36 Within the State’s jurisdiction, is property retention based on crime/charge/offense, by item type (gun/cash/auto, etc.) or something else (or some combination of factors)?

Please clarify property retention guidelines.

Each case is different, based on the crime and whether there is a fatality involved.

We would like to assign our own retention timeline for the particular evidence. The retention can be from a couple years from completion of the investigation up to retention for life. In general, retention laws are based off statute of limitations for different crimes, and the state has a retention schedule pertaining to TDI on the states records retention schedule which further outlines retention periods.

37 Are there multiple locations that physical property will be stored and inventoried at? If so, how many different locations?

Physical evidence will be stored in one location that is retained by the SFMO. In some situations, local agencies may retain evidence, but it would still need to be tracked internally to show it is retained by another agency and the location of that agency.

38 How many existing systems (Records

Management, Case Management, etc.) does the State want the proposed solution to integrate to? What are those systems?

TDI does not have an RMS solution in place.

39 Understanding that the State is requesting all peripheral hardware (barcode scanners, printers, etc.) included in the proposal, is the

State open to procuring their own peripheral hardware based on contractor recommended models and specifications?

See Section II, Part F, Item 8, Peripheral

Hardware.

Contractor must provide all necessary hardware and equipment required to support functionality of the evidence management software.

Addendum No. 1

No. Question Response

40 Can the State please confirm the total quantity of peripheral hardware desired:

a. Wired barcode scanners

b. Wireless barcode scanners

c. Barcode label printers

d. Mobile devices for inventory receiving, check-in/out, inventory

See Section II, Part F, Item 8, Peripheral

Hardware. Contractor must provide all necessary hardware and equipment required to support functionality of the evidence management software.

41 Has budget already been set aside for this project? If so, how much?

Respondents should provide their best value pricing based on the requirements described in the solicitation.

42 Given the numerous requests for additional information and clarification, will the State consider extending the deadline of the RFO close date?

No.

2. Section II, Part F, Scope of Work, is amended to include Item 14 – Project Schedule.

14. Project Schedule

Contractor must provide a preliminary Project Schedule with its response to this solicitation.

Contractor will submit a final Project Schedule to the Agency Primary Contact within 30 calendar days of Contract Execution. The Project Schedule must include, at a minimum, deliverables and milestones with planned dates, durations, and dependencies.

TDI will work with the Contractor to finalize the Project Schedule and planned deadlines.

TDI will provide written approval of the finalized Project Schedule within 10 business days of receipt.

Changes to the Project Schedule will follow the Change Control process described in

Section II Part J Item 6 (Change Control).

In its Business Proposal (see Section IV Part I Item 5), Respondent must submit a preliminary Project Schedule as described in this section.

3. Section II, Part L is deleted in its entirety and replaced with the following:

L. Schedule of Deliverables and Milestones

The Schedule of Deliverables and Milestones will be finalized after Contract Execution and included as an attachment to the Contract. Key deliverables are noted with a checkmark

Addendum No. 1

Key Deliverable Item Solicitation

Section Due Date Due To

Training and Training

Materials

Section II

Part F Item

30 days prior to training

TDI Contract Administrator

Deliverables@tdi.texas.gov

Service

Transitions/Turnover

Section II

Part F Item

Six (6) months after go-live and updated annually during

Contract Term

TDI Contract Administrator

Contracts@tdi.texas.gov

Test Plan Section II

Part G Item 5

Within 60 calendar days after Contract

Execution

Deliverables@tdi.texas.gov

Security Incident Report Section II

Part I Item 1a

Within 24 hours of incident

TDI Contract Administrator

ISO@tdi.texas.gov

Password Guidelines and

Requirements

Section II

Part I Item 2

Annually TDI Contract Administrator

Deliverables@tdi.texas.gov

ISO@tdi.texas.gov

Vulnerability Assessments Section II

Part I Item 5

Quarterly Deliverables@tdi.texas.gov

ISO@tdi.texas.gov

Data and Information

Security Updates

Section II

Part I Item 5

Within 24 hours of incident

TDI Contract Administrator

Deliverables@tdi.texas.gov

ISO@tdi.texas.gov

List of Contractor’s

Employees for

Cybersecurity Training

Section II

Part I Item 12

Upon Contract

Execution;

and within five (5) business days of adding a new employee to the project

TDI Contract Administrator

ISO@tdi.texas.gov

Proof of Insurance

Certificate must list TDI as the certificate holder and must list the TDI Contract

Number.

Section II

Part J Item 7

Five (5) business days following Contract

Execution;

and prior to expiration of current policy during Contract Term

TDI Contract Administrator mailto:Deliverables@tdi.texas.gov mailto:Contracts@tdi.texas.gov mailto:Deliverables@tdi.texas.gov mailto:ISO@tdi.texas.gov mailto:Deliverables@tdi.texas.gov mailto:ISO@tdi.texas.gov mailto:Deliverables@tdi.texas.gov mailto:ISO@tdi.texas.gov mailto:Deliverables@tdi.texas.gov mailto:ISO@tdi.texas.gov mailto:ISO@tdi.texas.gov

Addendum No. 1

Key Deliverable Item Solicitation

Section Due Date Due To

Non-Disclosure

Agreement (NDA)

Contractor must sign the

NDA incorporated with the

Contract and adhere to the requirements outlined in the

NDA.

Section II

Part J, Item 8

Upon Contract

Execution

TDI Contract Administrator

Project Schedule Section II, Part L

Within 30 calendar days of Contract

Execution

C. Acknowledgement of Receipt of Addendum No. 1

Signature of Authorized Representative Date Signed

Printed Name and Title of Authorized Representative

Respondent Company Name