ESBD_512615_1779385128235_TRS000615_Incidence Response Services RFP_Addendum 1.pdf

Teacher Retirement System of Texas (TRS)

Addendum Number: 1 to

Request for Proposals (“RFP”) Solicitation Name: Incident Response Services

Solicitation Number: TRS000615

Purpose: This Addendum is issued to make the changes listed below to the Solicitation document, answer to Respondent questions, and provide the pre-proposal conference attendees list.

Issued By:

Max Hernandez, Contract Specialist, CTCD/CTCM Date:

NOTE: VENDORS ARE REQUESTED TO ACKNOWLEDGE RECEIPT OF THIS ADDENDUM BY SIGNING

AND DATING BELOW AND INCLUDING WITH SUBMITTED RESPONSE. RESPONSE MAY BE

CONSIDERED NON-RESPONSIVE IF THIS COVER PAGE IS NOT SIGNED AND RETURNED.

Respondent Signature Date

TRS000615 Incident Response RFP Addendum 1

5/21/2026

Solicitation changes:

Solicitation Document TRS modified the Solicitation Document, IV. Price Form to:

1. Clarify TRS’s reimbursement for travel expenses.:

TRS revised the Price Form, made it a separate Excel file, and included it in the Documents tab in the PAVES solicitation record. Respondents will download, complete, and submit the file using the following file naming format:

RespondentName_Price Form_TRS000615.

The instructions for completing the Price Form are revised to:

Pricing is fully loaded, firm, and fixed or based on hourly rates that are inclusive of all costs of performance, including materials, equipment, labor, communication, and planning to successfully complete Services. Annual pricing is applied to any optional renewal term without price escalation. No amount will be paid for costs or charges incurred that are not listed on this form.

Respondents shall not include, embed, or otherwise incorporate travel expenses in in the Price Form’s sheet. Direct costs for travel expenses will be paid, provided prior written approval is obtained from TRS’ Contract Manager. Payment of travel costs will be reviewed on a case-by-case basis and is not guaranteed. If approved, travel costs shall be paid in accordance with State of Texas per diem rates and guidelines. Submitted invoices shall include itemized travel expenses to the extent applicable. Reimbursement is limited to direct costs (no indirect costs) on a case-by-case basis and requires prior written approval by TRS’ Contract Manager before the cost is incurred.

Respondent may propose additional services by adding rows to the bottom of the Incident Response Revised Price Form.

2. TRS updated the Item description from Incident Response Retainer to Incident Response Subscription. This change aligns with TRS’s intention to allow Respondents to propose their services through a subscription model. The subscription, wherein TRS would pay an annual fee, would necessarily include some specific services (the Tabletop Exercise, Incident Report – Executive Readout, Incident Response Fee, and/or number of support hours), above which TRS would incur additional costs tied to the Respondent’s pricing for those services in the Price Form

TRS000615 Incident Response RFP Addendum 1

NUMBER QUESTION ANSWER

1 What are the physical addresses of the regional offices located in: Austin, El Paso, London, and the Rio Grande Valley?

Alpha: 1900 Aldrich St., Suite 145 Austin, TX 78723 Bravo: 4655 Mueller Blvd. Austin, TX 78723 Regional Office - El Paso: 6611 Boeing Drive El Paso, Texas 79925 53/54 Grosvenor Street, 4th Floor West, Mayfair, London, W1K 3HU

2 Are there any other physical offices that will require IR personnel to visit? TRS is a functional pension system with an expanding catalog of remote service locations.

Primary work locations would be Alpha and Bravo locations in Austin, TX as applicable.

3 Does TRS require the IR team to be US cleared and based personnel? Yes 4 Does the vendor need to agree to the terms and conditions in the draft contract or is there room to negotiate?

Respondents will not have another opportunity to redline the TRS General Terms and Conditions so must submit any reservations or caveats with their proposals in the Initial Round.

5 Is TRS currently contracting IR Retainer services? No.

6 Does TRS have an IR plan in place today? Yes 7 Where is the draft contract? Please see the PAVES round solicitation documents.

8 When the vendor responds to an incident for TTRS it must employ an IR team that includes members with one of those certifications?

Yes

9 To provide accurate pricing for the proposed Tabletop Exercise under the IR Retainer, could you please clarify the intended scope, including expected duration, participant groups (e.g., technical teams vs. executive leadership), and desired level of scenario complexity (e.g., single-use case vs. enterprise crisis simulation)?

A tabletop to inform all collaborators both within and outside of the business on what to expect during a dispatch would be the goal. A tailored Executive presence as well as technical team leadership would be included.

10 Is the Tabletop Exercise expected to be included as part of the Incident Response Retainer (e.g., prepaid service), or priced independently as a standalone deliverable? Should it draw down from retainer dollars?

Part of the retainer. TRS updated the Item description from Incident Response Retainer to Incident Response Subscription . This change aligns with TRS’s intention to allow Respondents to propose their services through a subscription model. The subscription, wherein TRS would pay an annual fee, would necessarily include some specific services (the Tabletop Exercise, Incident Report – Executive Readout, Incident Response Fee, and/or number of support hours), above which TRS would incur additional costs tied to the Respondent’s pricing for those services in the Price Form

11 Are Tabletop Exercises performed annually? Yes 12 Does TTRS perform annual Vulnerability Scanning and Penetration Testing services? Yes

13 Does TTRS have a defined Incident Response scope of work that can be shared, particularly as it relates to informing pricing and service assumptions?

No

TRS000615 Incident Response RFP

14 What deliverables are expected from the Tabletop Exercise (e.g., executive summary, detailed findings report, maturity assessment, remediation roadmap)?

Summary, findings, and proposed remediation

15 What is the preferred delivery model for the Tabletop Exercise (in-person, virtual, or hybrid), and are there any location or travel assumptions we should account for?

Alpha/Bravo hybrid is preferred

16 Should the Tabletop Exercise be aligned with broader Incident Response Preparation activities (e.g., plan review, playbook validation, environment familiarization), or treated as a discrete workshop?

discrete workshop

17 Is the expectation that the Tabletop Exercise is conducted annually (as indicated by quantity = 1), or should vendors propose a broader IR readiness program approach?

Annually

18 Can TRS confirm whether “team members” refers to any qualified IR personnel, or must they specifically be the individuals identified in the proposal as Key Personnel?

All conditions in the RFP and SOW regarding personnel should be honored

19 Does TRS require physical presence for every incident, or only when explicitly requested by

TRS?

when requested

20 Can IR personnel working in London access U.S.-based systems remotely, as long as data is not transferred outside the U.S.?

yes

21 How will TRS notify contractors of new regional office locations, and what lead time will be provided before enforcing the 24‑hour onsite deployment requirement for those future sites?

via email

22 Can TRS confirm whether subject-matter experts (SMEs) who provide analysis but do not directly engage in containment or onsite response must also be full-time employees?

All conditions in the RFP and SOW regarding personnel should be honored

23 Can TRS clarify whether subcontractors are permitted for non‑IR‑team activities such as project management, reporting, or administrative tasks?

All conditions in the RFP and SOW regarding personnel should be honored

24 Can TRS provide any historical data on the number and type of incidents responded to per year to help estimate resource requirements?

An incident that has required outside augmentation as intended by this RFP has not yet occurred.

25 Can TRS share typical or expected annual volume of forensic hosts analyzed? This is an incident specific metric. There is not a clearly defined annual expectation.

26 Does TRS expect proactive hours (e.g., training, readiness activities) to be included in the retainer, or is the retainer strictly for access/availability?

The tabletop would be considered a training readiness activty and any additional would be availability

27 Can TRS provide expectations for the scope, duration, frequency, and number of participants for each tabletop exercise?

Approximately 40 TRS participants and the representation needed from the contractor to be successful. Once a year.

28 Are reports required for all incidents or only for major/severity‑level events? Reports are required for all incidents in which the contractor is requested to participate in.

TRS000615 Incident Response RFP

29 Does TRS have predefined severity levels or classification criteria for incidents, and if so, can TRS provide them?

None, Low, Moderate, and High

30 Can TRS provide the expected depth of environment documentation required (network maps, asset inventories, identity architecture, etc.)?

TRS does have documentation as outlined in the examples. Network maps, Identity architecture, etc. and will provide access to the contractor when needed as part of incident response activities.

31 Will TRS provide system and application architecture diagrams during onboarding? Access to our living documents outlining architecture can be provided after personnel is onboarded.

32 Can TRS confirm that all required attachments, including pricing form and documentation, must be uploaded in PAVES only, and that no email submission is permitted?

Yes, proposals must be submitted in PAVES. No email submissions will be accepted.

33 Does TRS anticipate significant changes to the draft contract, or should respondents assume minimal ability to negotiate terms? Will TRS allow exceptions or redlines to its standard contract during negotiations?

No, TRS does not anticipate significant changes to the draft contract and included this statement in the RFP: "Please note that TRS may not award a vendor a contract due to excessive redlines to TRS Terms and Conditions. " Respondents will not have another opportunity to redline the TRS General Terms and Conditions so must submit any reservations or caveats with their proposals in the Initial Round.

34 For the three optional renewal years, can TRS confirm that pricing must remain flat with absolutely no escalation, even if service volumes increase?

Pricing for retainer should remain flat. Work orders will be issued for service engagements

35 How does the organization align continuity of operations with information technology and cybersecurity at this time?

Technology assets are part of our continuity of operations.

36 Who currently handles your Security Operations Center? Is it in-house or a third party? It is an in-house operation with MSP oversight in specific applications.

37 What Endpoint Detection and Remediation (EDR) software do you have in place currently? Access to our living documents outlining architecture can be provided after personnel is onboarded.

38 Do you have any remote forensic collections tooling already in place or is it expected of the response vendor?

Access to our living documents outlining architecture can be provided after personnel is onboarded.

39 How many endpoints are covered by the EDR and how many are not? All network assets that run full operating systems are intended to be protected by EDR.

40 Is there a preferred form/format for submission of Redline/Exceptions to the TRS General Terms and Conditions?

The Draft Contract document that contains the TRS General Terms and Conditions is in Word; Respondents will redline that document using TrackChanges.

41 Can TRS provide the anticipated implementation timeline, including key milestones, decision dates, and expected go-live requirements?

Please see the scope of work for defined deliverables and timelines

42 Will TRS share the current-state architecture, integrations, and major third-party dependencies relevant to this solicitation?

Access to our living documents outlining architecture can be provided after personnel is onboarded.

TRS000615 Incident Response RFP

43 What are the State’s highest-priority success metrics and performance outcomes for the selected vendor during the first 12 months?

This solicitation is for Teachers Retirement System of Texas a State agency, not the state.

44 Are there incumbent vendors currently providing similar services, and if so, will transition support and knowledge transfer be required?

There are no incumbent vendors

45 Can TRS clarify any mandatory security, compliance, or audit frameworks that must be demonstrated beyond the requirements listed in the solicitation?

As a state agency TRS is reuired to meet TAC 202 and the DIR Security Controls Catalog

46 Will TRS require onsite resources, hybrid support, or fully remote delivery, and are there minimum staffing expectations by role?

All conditions in the RFP and SOW regarding personnel should be honored

47 Can TRS provide estimated transaction volumes, user counts, data storage requirements, or projected growth assumptions relevant to sizing the solution?

This is an incident specific metric. There is not a clearly defined annual expectation.

48 What evaluation weighting or scoring emphasis will be placed on technical approach, pricing, past performance, and innovation?

Please refer to the RFP document and the solicitation in PAVES

49 Are there any anticipated contract amendments, addenda, or scope clarifications expected prior to proposal submission?

Yes, this addendum 1 is the first

50 What reporting cadence, SLA expectations, and governance requirements will the awarded contractor be expected to maintain throughout the contract term?

All conditions in the RFP and SOW regarding communication cadence should be honored

51 Can we utilize subcontractor to fulfil minimum requirements of the proposal, or the delivery is expected only from one firm?

All conditions in the RFP and SOW regarding personnel should be honored

52 Can subcontractor’s experience and references be utilized to respond to this opportunity? All conditions in the RFP and SOW regarding personnel should be honored

53 Is there a preference for local vendors? None specified 54 What is the annual budget allocated for this RFP? Respondents are encouraged to submit their best pricing for the services described in the solicitation 55 Work will be onsite or remote? All conditions in the RFP and SOW regarding personnel availability should be honored 56 Can vendor provide entire services from offshore location (outside US geography) No

57 Who are previous incumbents on this project? There are no incumbent vendors 58 We kindly request a 1-2 week extension of the proposal submission deadline to ensure a thorough and high-quality response.

TRS does not plan to extend the June 5, 2026 proposal due date.

59 What is the total budget for this contract? Respondents are encouraged to submit their best pricing for the services described in the solicitation

60 Can TRS provide additional detail regarding the expected activities under:

○ Kickoff and Environment FamiliarizaƟon

○ Incident Response PreparaƟon

○ Cybersecurity Incident Response Services?

The level of detail available can be found in the SOW and solicitation documents.

TRS000615 Incident Response RFP

61 Does TRS expect the selected vendor to provide only reactive incident response services, or also proactive advisory and readiness improvement recommendations?

This is a request for incident response retention. Contractor is expected to provide information through each annual tabletop and when engaged during an incident.

62 Are tabletop exercises expected to be technical-only, executive-level, or hybrid exercises? hybrid

63 Are ransomware negotiation support services expected as part of the IR capability? not expected

64 Is malware reverse engineering expected within scope? Malware reverse engineering would be needed up to supporting the incident containment and reporting needed when engaged.

65 Are cloud incident response services included within scope (M365, Azure, AWS, SaaS platforms)?

Yes

66 Are insider threat investigations expected to be supported under this engagement? If a incident in which the contractor is engaged includes an insider threat, yes.

67 What are the primary security technologies currently deployed within the environment (SIEM, EDR/XDR, SOAR, email security, identity platforms)?

Access to our living documents outlining architecture can be provided after personnel is onboarded.

68 does TRS currently operate a centralized SOC capability? Yes 69 What percentage of endpoints and servers are covered by EDR tooling? All network assets that run full operating systems are intended to be protected by EDR.

70 Are there any restricted or unsupported systems that responders may not access directly? Access to systems will be granted in a timely fashion related to the incident in which a contractor is responding.

71 Are cloud environments included within the response scope? Yes 72 Does TRS maintain centralized log retention, and if so, what is the typical retention period? Yes, 6 years

73 Are there any current tooling restrictions for forensic collection or incident response activities?

Access to our living documents outlining architecture can be provided after personnel is onboarded.

74 Does TRS expect the responder to use TRS tooling where available, or provide tooling as part of the service?

Use tooling where availabile.

75 Can TRS clarify expected SLA targets for:

○ IniƟal response

○ Remote engagement

○ Onsite engagement

○ ExecuƟve communicaƟons?

The level of detail available can be found in the SOW and solicitation documents.

76 Does TRS require all responders to be US-based? Yes 77 Will TRS require responders to obtain any additional background checks or clearance requirements?

All conditions in the RFP and SOW regarding personnel should be honored

TRS000615 Incident Response RFP

78 Are after-hours and emergency response activities expected to be fully covered under the retainer, or billed separately under emergency hourly rates?

The Incident Response (IR) retainer RFP establishes a contractual relationship between the contractor and the agency. No incident response services are performed unless and until the agency formally engages the contractor.

79 Can TRS clarify expected communication cadence during active incidents? All conditions in the RFP and SOW regarding communication cadence should be honored

80 Does TRS expect onsite presence for all Priority 1 incidents? All conditions in the RFP and SOW regarding personnel availability should be honored

81 For the “per-incident response fee,” can TRS clarify the expected activities covered under this fee versus hourly response services?

The Incident Response (IR) retainer RFP establishes a contractual relationship between the contractor and the agency. No incident response services are performed unless and until the agency formally engages the contractor.

82 Can TRS provide estimated average incident volumes based on prior years to support accurate resource planning?

This is an incident specific metric. There is not a clearly defined annual expectation.

83 Are travel expenses expected to be pre-approved per incident engagement? Yes.

84 Can TRS clarify whether pricing should include forensic tooling/licensing costs if required during an investigation?

The respondent must provide incident response work as indicated in the SOW, without requiring TRS to use a specific technical solution.

85 Is there an anticipated annual cap on IR labor consumption? No

TRS000615 Incident Response RFP

Attended participants 35 Start time 5/13/26, 9:59:31 AM End time 5/13/26, 11:13:29 AM Meeting duration 1h 13m 58s Average attendance time 30m 21s

Name Email Beaulieu, Joe Joseph.Beaulieu@crowe.com Michael Richardson MichaelR@globalsolgroup.com Andy Kmiecik AndyK@globalsolgroup.com Eric Salomon esalomon@thundercattech.com Brown, Adam Adam.B@dell.com Marquez Colton marquez.colton@trellix.com Milliken, Rosemary S rosemary.milliken@cgi.com Phelix Oluoch info@phelixcyber.com ANAND CHOUTHAI Anand.Chouthai@kyndryl.com Reyes, Joseph Joseph.Reyes@Dell.com Minha @ V Group minhab@vgroupinc.com Jimmie ZimmermaN jizimmerman@paloaltonetworks.com Panicker, Kurian G kurian.panicker@cgi.com Nancy Patterson npatterson@centextech.com Douglas Leach Douglas.leach@tryfacta.com Navya Jain NavyaJ@globalsolgroup.com Sunit Patke Sunit.Patke@kyndryl.com Molly Agarwal molly.agarwal@tryfacta.com Vikas Arora @ Elegant Solutions bids@elegantsolutions.us Justin Klekar Justin.Klekar@kyndryl.com Priya Jeyaram Priya@delunecorp.com Ashan Gamage Ashan@delunecorp.com Jeff Collentro jeff.collentro@trellix.com Oliver, Cory Cory.Oliver@trs.texas.gov Sarah Hameed sarah.hameed@delunecorp.com

PARTICIPANTS

Meeting title: Pre-proposal Conference: TRS000615 - Incident Response Services - RFP

TRS000615 Incident Response RFP Addendum 1 mailto:marquez.colton@trellix.com mailto:info@phelixcyber.com mailto:jizimmerman@paloaltonetworks.com mailto:bids@elegantsolutions.us