ESBD_514300_1778529684049_RFP 304-27-1701RG High-Security Customized Check Stock.pdf

RFP # 304-27-1701RG: High-Security Customized Check Stock Page 1 of 51 (Rev. 01/2026)

Texas Comptroller of Public Accounts

Request for Proposals High-Security Customized Check Stock

RFP No. 304-27-1701RG

May 11, 2026

Anticipated Schedule of Events

May 11, 2026 Issuance of RFP

May 18, 2026 Deadline for Submission of Questions (2:00 p.m., CT) May 21, 2026 Release of Official Responses to Questions

(or as soon thereafter as practical) June 1, 2026 Deadline for Submission of Proposals (2:00 p.m. CT)

Late Proposals will not be considered June 11, 2026 Presentations from Top-Ranked Respondents

(if presentations requested by CPA, dates and times to be scheduled) September 1, 2026 Services Commencement Date

(or as soon thereafter as practical)

RFP #304-27-1701RG: High-Security Customized Check Stock Page 2 of 51

Table of Contents

Contents I. Summary II. Specifications

A. Introduction B. Background C. Definitions and Acronyms D. Scope of Services E. Contract Resulting from this Solicitation; Order of Priority F. Warranty of Performance G. Security Incident Notification H. Insurance and Bonds I. Criminal Background Investigation J. Contract Term; Survival of Terms K. Acceptance Criteria L. Payments M. Discounts N. PO Addition and Deletion O. VetHUB Subcontracting Plan Information P. Respondent Documents Q. Respondent Exceptions R. Respondent’s Past Performance; Vendor Performance Tracking System

III. Proposal Submission Requirements A. Delivery of Proposal B. Proposal Content and Format

IV. Mandatory Price Sheet V. Standard Terms and Conditions VI. Execution of Proposal VII. Conflict of Interest/Disclosure Statement VIII. Nondisclosure Agreement IX. Confidential Treatment of Information Acknowledgment (CTIA) X. Certification Regarding Public Nature of the Proposal XI. Contractor Cybersecurity Training Attestation Form XII. Respondent Exceptions

RFP #304-27-1701RG: High-Security Customized Check Stock Page 3 of 51

I. Summary

1. Type of Solicitation: Request for Proposals (RFP)

2. Issuing Office: Texas Comptroller of Public Accounts (CPA) Procurement Section Room 300, Attn: RFP No. 304-27-1701RG 111 E. 17th Street Austin, Texas 78774

3. Additional Requirements/Qualifications: N/A

4. Responses to RFP: Sealed Competitive Proposals

5. Deadline for Proposals: In Issuing Office No Later Than:

June 1, 2026; 2:00 p.m., Central Time (CT)

6. Initial Contract Term: September 1, 2026 to August 31, 2027

7. CPA Optional Contract Terms: September 1, 2027 through August 31, 2028 September 1, 2028 through August 31, 2029 September 1, 2029 through August 31, 2030 and September 1, 2030 through August 31, 2031

8. CPA Contact Person for this RFP: Rene Gonzales, CTCD, CTCM

Email with delivery receipt requested to:

rene.gonzales@cpa.texas.gov; bidcpa@cpa.texas.gov

9. Proposals Submitted by Email: Required; See Section III, Part A

10. Proposals Submitted by Fax: Not Accepted

11. Pre-Proposal Conference: N/A

12. Pre-Proposal Inspection: N/A

13. Letters of Intent to Submit a Proposal: N/A

14. RFP Addenda: Notices of changes to items directly impacting the original RFP or solicitation process will be posted on the Electronic State Business Daily (ESBD) located at: http://www.txsmartbuy.com/esbd. CPA will post any amendment to this solicitation on the ESBD as an RFP Addendum. It is the responsibility of an interested party to check the ESBD for updates to this RFP before submitting a Proposal. Each Respondent is solely responsible for verifying CPA’s receipt of its questions, if applicable, and its Proposal by the deadlines specified in this RFP.

15. Questions and Answers: Questions regarding this RFP must be in writing and must be submitted to the CPA Contact Person specified in Part 8, no later than May 18, 2026; 2:00 p.m. CT. Telephone inquiries will not be accepted.

Questions may be submitted by email to the email address specified in Part 8. CPA intends to post answers to the questions received on the ESBD on May 21, 2026, or as soon thereafter as practical.

16. Respondent Presentations:

CPA may request that Top-Scoring Respondents present an overview of the services and a demonstration of the software proposed in their Proposals. The presentations will be performed on or about June 11, 2026. Presentation location (e.g., videoconference, onsite, etc.), date(s) and time(s) to be arranged. In its sole discretion, CPA will determine the number of Top-Scoring Respondents.

mailto:rene.gonzales@cpa.texas.gov http://www.txsmartbuy.com/esbd

RFP #304-27-1701RG: High-Security Customized Check Stock Page 4 of 51

17. Evaluation of Proposals under Best Value Standard (Section 2156.125 of the Texas Government Code):

Criteria Weight Cost 35% Quality and Security Features on the Check Stock 20% Respondent’s Past Performance, Qualifications, and Experience 20% Security and Chain-of-Custody Measures for Stock Integrity 15% Quality Control Measures 10% Total: 100%

As applicable, the factors listed in Sections 2155.074, 2155.075, 2156.007, and 2157.003 of the Texas Government Code shall also be considered in making an award. Best and Final Offers may be sought from Respondents whose Proposals are ranked most highly by the evaluation committee. However, CPA encourages Respondents to offer their best pricing at all times. CPA reserves the right in its sole judgment and discretion, and at any time upon failure of negotiations, to reissue or withdraw this RFP rather than continue with negotiations.

18. Email Submission Only. Due to changed building access restrictions, Respondents will not be permitted to hand deliver

Proposals to the Issuing Office. Respondents are required to submit Proposals electronically via email with delivery receipt requested in accordance with Section III, Part A.

19. Contact with CPA Staff: Upon issuance of this RFP, employees and representatives of CPA, other than the CPA Contact

Person identified in Part 8, will not discuss the contents of this RFP with any Respondent or its representatives. Failure of a Respondent or any of its representatives to observe this restriction may result in disqualification of any related Proposal. This restriction does not preclude discussions between the parties to conduct business unrelated to this procurement or to obtain assistance completing Veteran Heroes United in Business (VetHUB) forms required by this RFP.

RFP #304-27-1701RG: High-Security Customized Check Stock Page 5 of 51

II. Specifications

A. Introduction

The Texas Comptroller of Public Accounts (CPA), an agency of the State of Texas, issues this Request for Proposals (RFP) to solicit Proposals from qualified vendors for High-Security Customized Check Stock, as described in this Section II and in this RFP (Services). CPA’s objective is to obtain the Services that represent the best value for CPA and the State of Texas according to the terms and conditions of this RFP.

CPA anticipates making a Contract award to one (1) Successful Respondent for the Services. CPA reserves the right not to award a Contract for the performance of all or part of the Services. This RFP is not exclusive and CPA reserves the right to issue additional solicitations regarding the Services or similar services at any time. All Respondents are encouraged to offer their best pricing at all times.

All costs associated with the Services must be included in the Respondent’s Proposal. Proposals that do not meet all of the requirements or contain all of the required documentation specified in this RFP will be rejected as non-responsive.

B. Background

CPA is authorized by Texas Government Code, Section 403.060 to print Warrants from state treasury funds on behalf of all state agencies and institutions of higher education. A Warrant is a state of Texas check that is guaranteed for payment by the state treasury. CPA will use the requested high-security customized check stock to create secure Warrants.

C. Definitions and Acronyms

• Award Date. The Award Date is the earlier of the date an authorized representative of CPA (1) issues a Purchase Order (PO) or (2) signs a formal, written agreement.

• Business Day. Monday through Friday, 8:00 am to 5:00 pm CT, excluding weekends and State of Texas holidays, unless otherwise defined in Section II (Specifications).

• Calendar Day. Any day, including weekends and State of Texas holidays, unless otherwise defined in Section II (Specifications).

• Contract. The agreement described in Section II, Part E (Contract Resulting from this Solicitation; Order of Priority), if any.

• CT. Central Time.

• Dedicated Trailer. The vehicle dedicated to securely transport only blank Warrant stock and no other products.

• Effective Date. The date the Comptroller signs a formal written agreement after it is signed by the Successful

Respondent, or the date the PO is issued if no formal written agreement is signed by the parties.

• Fiscal Year. The State of Texas and CPA’s fiscal year begins on September 1 and ends on August 31.

• Long Grain. Paper that has fibers aligned parallel to its longest dimension, ideal for laser printing and high-speed printers.

• Low Dust. Specialized paper designed to minimize airborne fibers.

• MICR. (Magnetic Ink Character Recognition) A character-recognition technology used mainly by the banking industry to ease the processing and clearance of checks and other documents.

• Phantom Image. An intentionally printed, very faint or screen-back image within the body of a check.

• Proposal. A response to this RFP.

• Respondent. Any person or entity that submits a Proposal.

• Successful Respondent. The Respondent awarded a Contract, if any.

• Successful Respondent’s employee. Includes any individual who, on behalf of Respondent, will or may participate in the Contract and all officers, personnel, replacement personnel, agents, subcontractors and other representatives of Respondent regardless of how employed or contracted by Respondent.

• Warrant. A Comptroller-issued check where the funds are guaranteed, and the payment is drawn from the State of Texas treasury for goods and services rendered to the state.

D. Scope of Services

D.1. Successful Respondent Responsibilities http://www.statutes.legis.state.tx.us/Docs/GV/htm/GV.403.htm#403.060

RFP #304-27-1701RG: High-Security Customized Check Stock Page 6 of 51

D.1.1. General. Successful Respondent shall provide the paper listed in Section IV, Mandatory Price Sheet. CPA will submit a purchase order for quantity needed. See Respondent Requirements, D.3.

D.1.2. Pre-Print Proof Inspection Successful Respondent will provide CPA with an agreed-upon number of pre-print proofs for inspection. CPA will provide an example of a currently used void check (Warrant) to the Successful Respondent to perform the required pre-print proofs at or soon after the Effective Date. Successful Respondent must deliver via hand-delivery or overnight mail the pre-print proofs of the check stock to CPA no more than five (5) business days after receipt of the example. Successful Respondent must deliver such proofs to CPA at its own expense during normal business hours, 8:00 a.m. to 5:00 p.m., Central Time (CT), Monday through Friday, excluding federal and state holidays.

Successful Respondent must deliver all pre-print proofs to CPA’s authorized representative designated in the PO, at the following address:

Texas Comptroller of Public Accounts Fiscal Management Division, Room 1010.3, 10th floor Attn: Pamela Martinez 111 East 17th Street Austin, TX 78774

CPA will review the pre-print proofs of the check stock and, if revisions are necessary, CPA will return the revised proofs to Successful Respondent. Upon receipt of the CPA-revised proofs, Successful Respondent will make the necessary corrections and deliver at its own expense the corrected proofs to CPA no more than five (5) business days after CPA delivers the revised proofs to Successful Respondent. CPA will review the corrected proofs and either: (1) provide written approval of the proofs for publication or (2) return the proofs to Successful Respondent with additional revisions in accordance with the procedure set forth above. This procedure will continue until CPA provides written approval of the proofs. CPA will not unreasonably withhold approval.

Successful Respondent must provide the typesetting and artwork for the proofs that it provides to CPA. Successful Respondent shall not invoice and CPA shall not pay for any costs associated with pre-print proof inspection, e.g., shipping, typesetting, artwork.

D.1.3. Security Requirements

1. General Requirements. Due to the critical and sensitive nature of check stock designed specifically for the state, Successful Respondent must ensure that check stock and all image carriers, devices, and plates used in the production of the check stock are secure at all times.

2. Custody of Image Carriers, Devices, or Plates and Existing Check Stock. During the printing of the check stock, Successful Respondent must have custody of specifications, image carriers, devices, or plates, and all other property or equipment that may provide a means of printing CPA’s check stock. Also, upon CPA’s request, CPA or CPA’s Authorized Personnel must be permitted to observe the printing and processing of the check stock and to inspect all finished check stock prior to deliveries. Successful Respondent is responsible for securely storing and destroying all defective stock. Upon CPA’s request, Successful Respondent must provide CPA access to all defective stock before its destruction. Successful Respondent must provide at least ten (10) business days’ written notice to CPA detailing when the defective check stock will be destroyed so that CPA may supervise the stock destruction if CPA so chooses in its sole discretion. Successful Respondent may not keep any check stock not intended for a specific CPA order on hand (“stockpiling”).

3. Image Carriers, Devices, or Plates and Existing Check Stock. Image carriers, devices, or plates; existing check stock;

and any item used in connection with the printing of check stock will become CPA’s property. Upon CPA’s written request and for no additional charge, Successful Respondent must deliver all of these items to CPA or destroy them at CPA’s option. When these items are not in use, they must be stored securely in accordance with the security controls described in the Successful Respondent’s statement in this RFP. Successful Respondent must return image carriers, devices, or plates; existing check stock; and any item used in connection with the printing of check stock to secure storage after completion of a specific order.

D.1.4. Location of Performance Successful Respondent must perform all Services strictly within the domestic premises of the Successful Respondent located in the continental United States. Successful Respondent must not assign, subcontract, outsource, sublet out, or perform in or on any other premises any part of the Services without prior written consent of CPA.

RFP #304-27-1701RG: High-Security Customized Check Stock Page 7 of 51

D.1.5. Sample Testing Prior to the first shipment of Warrant stock successful, Respondent must securely deliver to CPA 1,000 sheets of sample test stock (in person or overnight shipping), packaged in accordance with the requirements set forth in Section II, Part D.1.7 at Successful Respondent’s expense for sample testing no more than five (5) business days after CPA issues its written approval of the pre-print proofs of the check stock. All samples must contain all the requirements listed in Part D.2. Successful Respondent must print the stock as non-negotiable. Successful Respondent must number the samples with a control number;

CPA will provide the numbering sequence for the control numbers at the time the samples are requested. Successful Respondent must produce the sample test stock on the same printing equipment at the same location that will be used for production of the check stock.

If Successful Respondent has a backup location for stock production, Successful Respondent must produce 500 sheets on the backup printing equipment and deliver these sheets to CPA numbered with control numbers provided by CPA. Successful Respondent must provide all samples to CPA at no additional cost. Successful Respondent must deliver the samples to CPA’s Authorized Personnel designated in the PO at the following address:

Fiscal Management Division, Room 1010.3, 10th floor Attn: Pamela Martinez 111 East 17th Street Austin, TX 78774

Due to building access procedures, Successful Respondent is encouraged to allow additional time to deliver samples to CPA.

CPA Security Desk personnel at the entrance to the LBJ Building will not deliver items to, or accept items for, the Fiscal Management Division. Delivery persons must present a valid, current photo identification card to the Security Desk personnel to obtain a visitor’s pass and CPA staff escort.

CPA will review the test samples, make any changes or corrections, and return the test samples with corrections to Successful Respondent. CPA anticipates that the types of corrections at this stage would be for technical specification issues such as incorrect paper composition that causes printer gumming, paper tearing, or lack of toner anchorage.

Successful Respondent must securely deliver the corrected samples no more than five (5) business days after the receipt of the CPA’s corrected test samples at Successful Respondent’s expense. After Successful Respondent has corrected the test samples, CPA will review the corrected test samples. This process will continue until CPA has given written approval for such test samples. CPA will not unreasonably withhold approval.

D.1.6 Liquidated Damages In submitting a Proposal, Respondent agrees that the measure of damages in the event of a default or breach by Successful Respondent may be difficult or impossible to calculate. In the event Successful Respondent fails to perform Services or complete the obligations under the Contract in a timely manner, CPA may require Successful Respondent to pay, as liquidated damages and not as a penalty, an amount equivalent to two percent (2%) of the total cost for Services or obligations not completed as required by the Contract per calendar day of delay. CPA may impose, but is not obligated to impose, these liquidated damages in lieu of any monetary damages available to CPA under the Contract or applicable law.

Successful Respondent must ensure the security of all rejected or substandard stock and must pay for the cost of destruction of such rejected or substandard stock. See Section II, Part D.1.10 for destruction guidelines. CPA may require proof of destruction.

D.1.7. Packaging Successful Respondent must package the stock as follows:

1. Each ream must contain 500 sheets, with chipboard top and bottom for each ream.

2. Each ream must be individually shrink-wrapped to ensure moisture integrity.

3. Each carton shall contain 5 reams per carton for a total of 2,500 sheets per carton.

4. Each ream must be individually labeled with the control numbers for the sheets contained in that ream, with the lowest control number sheet on the top of each ream.

5. Each carton must be securely banded.

6. Each carton must be clearly labeled on one end showing the following information:

a) Addressed to CPA’s delivery address in Section II, Part D.1.9.

RFP #304-27-1701RG: High-Security Customized Check Stock Page 8 of 51

b) Consecutive numbers beginning with number one in a bold, 1” font and the carton labeled number one should contain the lowest control-numbered stock. Each successive carton should contain the consecutive control stock numbers to the end of the order.

c) Each label will reflect the beginning and ending control numbers contained within each carton.

d) Successful Respondent’s name.

e) CPA’s PO number.

D.1.8. Palletized Successful Respondent must stack all cartons on pallets and load the pallet with the lowest carton numbers on bottom and the highest carton numbers on top. The pallet containing the lowest carton number must be the first pallet loaded into the truck, and the highest numbered carton must be the last pallet loaded onto the truck. Each pallet must contain 32 cartons with 8 boxes per layer and 4 layers high. Each pallet must have 4 heavy duty cable zip ties and shrink-wrapped. Each pallet must have control number range outside the shrink-wrap. Shipping pallet dimensions must not exceed a standard pallet size of 48” L x 40” W.

Successful Respondent must ensure that cartons remain on the pallets as they are being unloaded and received by CPA. Cartons should remain on pallets in the same manner they are packaged.

D.1.9. Shipping Successful Respondent must ship all check stock in plastic shrink-wrapped cartons in a sealed, CPA-Dedicated Trailer and deliver the cartons to CPA between 2:00 p.m. and 4:00 p.m. CT on the shipment due date. If Successful Respondent wants to deviate from this delivery time, CPA must approve the deviation in advance and in writing CPA reserves the right in its sole discretion to reject Successful Respondent’s request for an alternate delivery time.

Delivery location:

L.B.J. State Office Building, Loading Dock Attn: Fiscal Management 111 E. 17th Street Austin, Texas 78774

Successful Respondent must give CPA twenty-four (24) hour notice prior to EACH delivery and must give such notice to CPA’s Authorized Personnel. If the notice of delivery is not received in the manner described, CPA may not accept the shipment on that date. CPA Authorized Personnel must break the truck carton seal. An itemized packing list that provides the beginning and ending control numbers for the order and the total number of cartons must accompany each shipment. CPA will unload all stock and unwrap some cartons (or all cartons at its discretion) while the truck is at the loading dock to verify the quality of the stock.

CPA reserves the right in its sole discretion to refuse the entire shipment if (1) delivery is made in a non-Dedicated Trailer, (2) delivery is made in a trailer without a seal or with a broken seal, or (3) upon visual inspection there is damage to at least one carton. CPA will not be responsible for any costs associated with refused deliveries.

D.1.10. Errors or Poor-Quality Stock Any shipping errors caused by Successful Respondent and deemed unacceptable by CPA which necessitates reshipping of any part or all of the check stock, shall be at the expense of Successful Respondent and CPA shall not be charged in any form.

Successful Respondent must replace and reship to CPA an agreed-upon partial shipment not more than ten (10) business days from the original delivery date and remaining shipment within ten (10) business days from the original delivery date.

To ensure high-quality check stock, Successful Respondent must have the necessary equipment and the highest quality standards. If Successful Respondent delivers check stock with poor quality workmanship identified by CPA at time of delivery, CPA will reject the entire order upon delivery in its sole discretion in accordance with Section II, Part D.1.9. Successful Respondent must reprint the order and deliver to CPA, at Successful Respondent’s expense, an agreed-upon partial shipment not more than five (5) business days from the original delivery date with the remaining shipment to be delivered within ten

(10) business days from the original delivery date.

If, after acceptance of delivery, CPA identifies poor quality workmanship in the stock, Successful Respondent must pay for the substandard stock to be securely shipped back to Successful Respondent. CPA reserves the right to securely destroy the substandard stock locally at Successful Respondent’s expense. Successful Respondent must reprint all substandard stock and deliver to CPA, at Successful Respondent’s expense, an agreed-upon partial shipment not more than five (5) business days from the date of CPA’s notification of substandard stock with the remaining shipment to be delivered within ten (10) business

RFP #304-27-1701RG: High-Security Customized Check Stock Page 9 of 51 days from the date of CPA’s notification of substandard stock. CPA reserves the right to be granted a credit for substandard stock rather than reprints if volume of substandard stock is minimal.

D.1.11. Price Changes Allowed for Paper Successful Respondent may request a price increase based on the performance of the RISI Paper Trader Index (Index).

Successful Respondent must reflect any decrease in the cost of paper that occur based on the performance of the Index on its invoice(s). Successful Respondent will perform these Index reviews annually within 30 days of any optional terms if the Contract is renewed.

In its Proposal, Respondent must submit copies of invoices for its current paper costs on its paper supplier’s letterhead. For purposes of any Contract, paper will be assumed to be 45% of the total cost unless the Respondent indicates otherwise in its Proposal.

Notwithstanding anything to the contrary in this RFP, the maximum price increase allowable for paper will be determined by the following formula:

Maximum Price Increase = Price on Original Proposal x New Carton Weight Total (CWT)/Original CWT submitted with Proposal

For each submitted invoice, Successful Respondent must provide CPA with a copy of its current paper costs for printing Services on its supplier’s letterhead. The amount of decrease in price will be determined by the same formula as above. Any such decreases must be detailed in Successful Respondent’s invoices and must be reflected as a discount. Decreases may exceed the amount calculated by the formula.

D.2. Check Stock Requirements

CPA will use the requested high-security customized check stock to create secure Warrants. Successful Respondent must deliver to CPA high-security customized check stock that meets or exceeds the following minimum requirements:

1. Security virgin bond paper with the following qualities must be used:

a. 24 lb. weight.

b. Moisture shall equal 5.5% or below, with an average of 4.5%.

c. Long grain.

d. High-speed laser printer compatible.

e. Low dust.

f. Ink Color must be Pantone Matching System (PMS) 349 with 10% saturation for the face of the stock on the lower third of the front of the sheet.

2. Phantom Image. Check Stock must include a phantom image of the Texas State Capitol Building. This image should be located on the lower third front of the sheet (green with white reversed out) and the image must be visible at all times, even on photocopies. CPA will provide Phantom Image to Successful Respondent.

3. Endorsement Area. The endorsement area of each check shall be screened in Pantone Cool Gray 4 ink with a contrasting darker ink for text. The endorsement area must accommodate approximately 500 characters (including spaces) of text. CPA will provide the required text to Successful Respondent at contract award Successful Respondent may use greeked text (such as Lorem ipsum) or other placeholder text on the samples until CPA provides the required text.

4. Micro Printing. Micro printing must be used for endorsement line on the back of the check.

5. Watermark. An industry-standard watermark must be incorporated onto the back of the 8½” x 11” sheet on the “stub” portion and the watermark must be visible in regular light.

6. Control numbers. An 8-digit control number must be printed on the back of each check in the endorsement area. This number must be 3/16” and must be in black ink with a saturation level that does not allow for the number to be seen from the front of the check.

a. CPA will supply the numbering sequence to Successful Respondent at contract award.

7. Perforations. Each cut sheet must have one full length perforation at 3½” from the bottom of the sheet. The perforation must be 12 teeth per inch (TPI) with a tie of .032 inches. Perforations should permit easy separation but should not tear or catch in ordinary handling or feeding. Perforations must not cause excessive peaking or tenting of the paper.

RFP #304-27-1701RG: High-Security Customized Check Stock Page 10 of 51

8. MICR band. A ½”-wide white band is required at the bottom portion of the check for MICR printing.

9. Paper. The paper must be chemically reactive, solvent-reactive color spotting, designed to make chemical alteration evident, including bleach and oxidizer reactivity.

10. Toner adhesion. Coatings applied to the finished paper must securely anchor toner to the paper.

11. Invisible fluorescent fibers. Invisible fibers in the paper must “glow” under ultraviolet light.

12. Backer warning box. Backer warning box on back of the check shall include an extensive list of security features alerting the recipient and/or teller to validate these features before cashing or processing. CPA will provide text to be included to Successful Respondent.

13. Security screen backer. The security screen backer on the back of the check shall use the words “Original Document” that will fade, distort, or disappear if the check has been copied or scanned by traditional means.

14. Thermochromic heat-reactive ink. Check must be printed with temperature-sensitive ink that changes colors when exposed to heat (such as held in hand).

15. Anti-splice backer. Anti-splice backer must be provided so that lines and words printed on the back of the check to make it difficult to alter information using a cut-and-paste method

16. UV dull paper. Paper shall be UV dull paper with lower reflective properties from reducing the brighteners in the paper.

D.3. Respondent Requirements

D.3.1. Cost of Delivering Paper Respondent must include all costs for delivering paper, as defined by this RFP, on the Mandatory Price Sheet unit prices located in Section IV of this RFP. Each line item must be priced individually, according to the unit of measure listed on the Mandatory Price Sheet with no price bearing on other line items listed by Respondent for this RFP.

D.3.2. Minimum and Maximum Amounts Limiting the Order Respondent must explain in its Proposal whether there are any minimum amounts required per order or any maximum amounts limiting the order. In its Proposal, Respondent must also describe whether any associated costs will differ with an order that is not in the increments shown in the Mandatory Pricing Sheets D.3.3. Sample Checks In its Proposal, Respondent must submit a minimum of 25 sheets of sample check stock for CPA’s consideration that meet the requested and required minimum features listed below in section D.2-Check Stock Requirements, except for item c. Phantom Image.

D.3.4. Optional Security Features In its Proposal, Respondent may also include the line-item cost for any Optional Additional Security Features on the Mandatory Price Sheets in Section IV that are not previously mentioned in Part D.1 Respondent should clearly describe any Optional Additional Security Features in its Proposal.

D.3.5. Security Feature Stock Respondent must provide 25 sheets of sample stock to CPA, at no charge, of these Optional Additional Security Features priced on the Mandatory Price Sheets or included in Respondent’s Proposal.

D.3.6. Value-Added Features Respondent may include value-added features that Respondent proposes to include at no charge to CPA in its Proposal.

Respondent may provide an additional 25 sample sheets of stock that show those value-added features in its Proposal and must clearly describe them in its Proposal.

D.3.7. Quality Respondents shall describe in their Proposals the quality control aspects of their product processing to make certain processing errors such as duplicated control numbers and mislabeled reams and cartons do not occur.

RFP #304-27-1701RG: High-Security Customized Check Stock Page 11 of 51

D.3.8. Express Delivery Stock Orders In its Proposal, Respondent must explain its ability to provide and ship an express delivery quantity of stock. Express Delivery being defined as not a standard delivery and urgent in nature. An express delivery shipment to CPA would consist of two hundred and fifty thousand (250,000) sheets of stock within five to ensure (5) business days of CPA's written request.

Successful Respondent must package the express delivery stock in the manner outlined in Section II, Part D.1.7 of the RFP, and ship the stock within the five (5) business days to a location within the continental United States that CPA determines. In meeting this requirement, Respondent must provide a high-level description in its Proposal of how it will continue to comply with Section II, Part D. Respondent must list the costs for this express delivery stock in the Mandatory Price Sheets in Section

IV.

Respondent shall explain its ability to produce and deliver an express delivery, secured as outlined in Section II, Part C.9 of the RFP, of a smaller quantity (less than 250,000 sheets) within a 48-hour timeframe. If possible, state the quantity and outline any additional costs in the Mandatory Pricing Sheets.

D.3.9. Business Continuity Plan Respondent must provide a high-level description of its current business continuity plan in the event that Respondent is unable to print check stock. The description shall include, but not be limited to, backup facility to print check stock, backup strategy for making delivery, and ability to meet CPA requirements in the face of required supply shortages.

D.3.10. Security In its Proposal, Respondent must submit a separate, detailed statement fully explaining the Respondent’s physical and logical security controls for protecting and destroying check stock, image carriers, devices, and plates. In its Proposal, Respondent must describe the systems utilized by the Respondent to ensure that Respondent carefully guards check stock and image carriers, devices, and plates during printing and storage. These systems may include the use of an alarm system, video surveillance system, key card access to restricted areas, least privilege access to processing systems and printing equipment, and secure storage. Respondent may describe such systems and security controls with enough detail to give Comptroller confidence that appropriate controls are in place for protecting and destroying the check stock, image carriers and plates, but without disclosing confidential network or configuration information. Physical security descriptions can be high level, without exact amounts or locations. Respondent may mark such sections of its Proposal as “Confidential” and if a Texas Public Information Act request is received, CPA will comply with Section V, Parts 35 (Confidential Information; Nondisclosure Agreement) and 36 (Texas Public Information Act).

D.3.11. CPA Discretion Regarding Optional Additional Security Features CPA, in its sole discretion, may choose to include one or more Optional Additional Security Features listed in Respondent’s proposal as part of the check stock order. If CPA decides to use any or all of these Optional Additional Security Features for a particular order, CPA will provide written notice to Successful Respondent on the PO identifying the features that CPA chose.

D.3.12. Inspections of Facilities CPA, in its sole discretion, may conduct on-site inspections of Successful Respondent’s printing facilities. An authorized CPA representative will notify Successful Respondent at least twenty-four (24) hours prior to the on-site inspection check and must be provided access to Successful Respondent’s facilities used for creating the CPA checks during normal business hours, 8:00 a.m. to 5:00 p.m. CT, Monday through Friday, not including federal and state holidays. During any visit, CPA may perform random quality assurance tests.

D.3.13. Quantity of Orders CPA reserves the right in its sole discretion to order check stock on an as-needed basis during the term of any PO. Consequently, CPA does not guarantee the procurement of any minimum or maximum quantities of check stock. However, it is likely that CPA will purchase a minimum of one million (1,000,000) sheets per year based on past purchasing history. Typically, CPA will order quantities of 400,000 Warrant stock sheets of shipment.

CPA provides the tables below as a reference for information regarding CPA’s prior usage and current and estimated future usage. The amounts listed for the initial FY2023 term are estimates based on annual quantity. CPA may, in its discretion, split the amounts ordered into multiple shipments throughout a Contract year, such as ordering quarterly shipments.

Prior Usage Prior Usage

FY 2024 TOTALS FY 2025 TOTALS

First Quarter 565,666 First Quarter 585,595 Second Quarter 504,226 Second Quarter 517,067 Third Quarter 513,172 Third Quarter 538,754

RFP #304-27-1701RG: High-Security Customized Check Stock Page 12 of 51

Fourth Quarter 1,091,118 Fourth Quarter 488,613

TOTAL 2,674,182 TOTAL 2,130,029

D.3.14. Overruns CPA will accept sheet overruns (up to 3,000 sheets more) at no cost to CPA. CPA will not accept overruns for more than 3,000 sheets per delivery. Successful Respondent must destroy all overruns that are not delivered to CPA in accordance with Section II, Part D. With reasonable advance notice, CPA will accept underruns. Successful Respondent is responsible for ensuring that each invoice submitted to CPA correctly reflects the actual quantity of check stock (e.g., overruns and underruns) delivered to

CPA.

D.4. CPA Responsibilities – Post-award

D.4.1. Pre-print Proofs CPA will provide an example of a currently used void check (Warrant) to the Successful Respondent to perform the required pre-print proofs at or soon after the Effective Date.

D.4.2. Endorsement Area of Checks CPA will provide the required text for the endorsement area of the check to the Successful Respondent. See D.2.3.

D.4.3. Backer Warning Box CPA will provide text to be included on the backer warning box to Successful Respondent.

D.4.4. Numbering Sequence CPA will supply the numbering sequence for the control number to be printed on the back of the Warrant stock to Successful Respondent at contract award.

D.5 CPA Data Safeguard Standards.

a. Defined Terms. The term “CPA Data” refers to CPA’s information as well as other entity information in the possession of CPA that is processed, stored, or transmitted by a computer. CPA Data includes all data that is generated by Successful Respondent in performance of a contract with CPA. The term “CPA Information System” refers to those devices, software, networks and related infrastructure that CPA owns, operates or has obtained for use to conduct CPA business. Devices include, but are not limited to, CPA-owned or managed storage, processing, and communications devices, as well as personally owned devices.

b. Access to CPA Data. Successful Respondent represents and warrants that it will implement, maintain, and use appropriate administrative, technical, and physical safeguards to preserve the confidentiality, integrity, and availability of CPA Data. Successful Respondent will not collect, access, use, disclose, or retain CPA Data other than as necessary to perform the services specified in a contract resulting from this solicitation or as otherwise authorized in writing by CPA. Successful Respondent will restrict access to CPA Data to only those personnel who must have the information on a “need to know” basis. Successful Respondent will not use CPA Data, or any information derived from CPA Data, for its own benefit or the benefit of any other person or entity. Successful Respondent will not share CPA Data with its parent company or other affiliate without CPA’s express written consent. If communications with Contractor necessitate the access or use of confidential Comptroller information, upon Comptroller’s written consent, Contractor shall require each individual who will require access to or may be exposed to Comptroller’s confidential information to sign the Confidential Treatment of Information Acknowledgment (CTIA) form (Attachment I).

c. Web-Based Remote Access to CPA Information Systems. Successful Respondent may use third-party web-based remote access connections to CPA Information Systems to provide support services under the following conditions:

1. CPA shall affirmatively initiate and accept Successful Respondent’s connections to CPA Information Systems.

2. CPA shall monitor Successful Respondent’s connections to CPA Information Systems for the duration of the

Services.

3. CPA shall terminate Successful Respondent’s connections to CPA Information Systems upon completion of the

Services.

d. Reserved.

e. Reserved.

f. Location of CPA Data. Successful Respondent shall ensure that CPA Data (i.e., primary and backup) remains, at all times, within the continental United States. Successful Respondent shall receive, process, transmit, and store all CPA

RFP #304-27-1701RG: High-Security Customized Check Stock Page 13 of 51

Data within the continental United States. Successful Respondent’s point of access to CPA Data shall be within the continental United States.

g. Encryption Standards.

1. Successful Respondent shall encrypt CPA Data in transit and at rest. Data in transit means data is moving via email, in applications, or through browsers and other web connections. Data at rest (including data backups) means data is stored in databases, the cloud, removable media, or mobile devices.

2. Successful Respondent shall utilize encryption standards that are FIPS 140-2 compliant or, upon the written approval of CPA’s Chief Information Security Officer, shall meet the intent of the standards as described in FIPS 140-2.

3. The minimum cryptographic algorithm used by Successful Respondent must be Advanced Encryption Standard (AES) 128 or higher (256 AES is preferred).

4. Successful Respondent shall encrypt CPA Data transmitted over a public or private network. CPA approved data encryption transmission protocols include the following: (1) SFTP (FTP over SSH), (2) FTPS (FTP over TLS),

(3) HTTPS (HTTP over TLS), and (4) virtual private network.

h. Reserved.

i. Auditable Information Security Framework. Successful Respondent shall secure its own and its third-party service providers’ systems (e.g., IT service provider, Cloud Service Provider) in a manner consistent with an auditable information security framework e.g., National Institute of Standards and Technology (NIST), International Organization for Standardization (ISO) 27001. In its response to this solicitation, Successful Respondent shall disclose its adopted information security framework.

j. Defects and Vulnerabilities. Upon Contract award and during the term of the Contract, Successful Respondent shall provide CPA with prompt, written notice upon Successful Respondent’s discovery of any product defects and vulnerabilities of the proposed Licensed System/Software/Solution that allow an attacker to violate an explicit (or implicit) security policy to achieve some impact or consequence. Examples of vulnerabilities include defects that allow intruders to gain increased levels of access or interfere with the normal operations of information systems.

Vulnerabilities caused by insecure configurations, design choices, and changing environmental conditions are additional examples.

k. Supply Chain Risk Management. Successful Respondent shall provide CPA’s Contract Manager a description of how it manages supply chain risks. Specifically, Successful Respondent shall describe its established agreements and procedures with entities involved in the supply chain for the notification of supply chain risks, compromises, and the result of assessments or audits. During the term of the contract, Successful Respondent shall provide CPA’s Contract Manager prompt, written notice of supply chain risks that impact the delivery of the products and services of the Contract. Examples of supply chain risks include supplier financial failure, production control/product quality, market supply and demand, labor disputes/shortages, cybersecurity threats, natural disasters. Successful Respondent shall notify CPA of a supply chain compromise and potential compromise in accordance with the Section G Security Incident Notification.

l. Reserved.

m. Media Sanitization. Successful Respondent shall sanitize information system media, both digital and non-digital, in accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization) when CPA Data in the custody of Successful Respondent is no longer required to be retained by contract with CPA. Successful Respondent must maintain a record documenting each sanitization procedure that, at a minimum, includes the following information:

(i) date sanitization completed, (ii) description of the item(s), serial number(s), inventory control number(s), if applicable, and (iii) sanitization method used. No later than sixty (60) calendar days from contract expiration or termination or as otherwise specified in the Contract, Successful Respondent must either (i) complete the sanitization and submit via email to the CPA Contract Manager all sanitization documentation or (ii) submit a written statement via email to the CPA Contract Manager explaining the reason that destruction of CPA Data by Successful Respondent is technically impossible or impractical. Successful Respondent’s obligations set forth in this clause survive the termination or expiration of the contract as long as Successful Respondent retains CPA Data.

n. Third-Party Service Providers. It is Successful Respondent’s sole responsibility to ensure that its access and the access Successful Respondent grants to its service providers to CPA Data or CPA Information Systems does not result in unauthorized access to CPA Data or CPA Information Systems.

o. Reserved.

RFP #304-27-1701RG: High-Security Customized Check Stock Page 14 of 51

p. Reserved.

q. Reserved.

r. Prohibited Technology. Successful Respondent shall not use covered applications or prohibited technologies in its technology solutions or services provided to Comptroller. In addition, Successful Respondent represents and warrants that its system, software, components, and services do not use the covered applications or prohibited technologies listed on the Department of Information Resources (DIR) Covered Applications and Prohibited Technologies website.

s. Use of Artificial Intelligence. Successful Respondent shall comply with all federal and state laws and regulations for artificial intelligence. Successful Respondent shall implement and maintain the following.

a. Transparency. Disclose the artificial intelligence (AI) that Successful Respondent embeds in its technology products and services and provide detailed information on the purpose of the AI, the specific AI model(s) in use, if the AI uses CPA data to train AI model(s), the configuration settings and options to disable or opt out of using the AI.

b. Artificial Intelligence Inventory. Successful Respondent shall implement and maintain an inventory of the AI used in Successful Respondent’s solution, software, system components, and services provided to Comptroller. Comptroller is required to report an inventory of artificial intelligence in biennial statutorily required reports and Successful Respondent shall support Comptroller’s compliance by providing the inventory information upon Comptroller’s written request.

c. Monitoring. Successful Respondent shall monitor AI for query attacks, malicious inputs, and perturbations for model manipulation, theft, data poisoning, and data drift. Successful Respondent shall establish model integrity validation checks and data poisoning detection capabilities. Successful Respondent shall implement processes for detecting personally identifying information (PII) in the model and removing PII from the model, as appropriate to ensure the AI cannot provide PII to Successful Respondent’s other customers or outside the boundaries of the Comptroller’s systems.

d. Disclosure Notice. Successful Respondent shall disclose to the public prior to system use, the use of AI in systems that interact with the public and receive, process, transmit, or store CPA data.

e. Data Ownership. Successful Respondent shall acknowledge that Comptroller owns CPA data. If Successful Respondent uses generative AI to provide services to customers of a CPA system, Successful Respondent shall ensure that the AI cannot provide CPA data to Successful Respondent’s other customers or outside the boundaries of the Comptroller’s systems.

t. Reserved.

D.6 Optional Features, Products or Services.

If Respondent believes there are additional features, products or services that would benefit CPA under this RFP, Respondent may describe such features, products or services and include pricing for such features, products or services in the Mandatory Price Sheet. Optional features, products or services are not scored as part of the evaluation process.

E. Contract Resulting from this Solicitation; Order of Priority

Respondent’s Proposal is a legal offer to contract based upon the terms, conditions, and specifications set forth in this RFP.

“Contract” means (1) a valid PO issued by CPA or (2) a formal, written agreement between CPA and Successful Respondent, if any. The Contract is effective as of the Award Date and will be between CPA and the Successful Respondent. Successful Respondent shall be solely responsible to CPA for all performance by Successful Respondent’s employees, representatives, agents, subcontractors, suppliers, third-party service providers, and similar entities (“Persons” for purposes of this sentence) and for ensuring that all such Persons comply with applicable provisions of this RFP and the Contract. The entire Contract between CPA and Successful Respondent shall consist of the following documents, which shall control in the following order of priority, except as otherwise provided in the formal, signed agreement between the parties or CPA’s PO: (1) the PO and PO Change Notices (POCN), if any; (2) the formal, signed agreement, if any; (3) this RFP; and (4) Successful Respondent’s Proposal (collectively, these documents constitute the “Contract”).

F. Warranty of Performance

Successful Respondent represents and warrants that its performance under the Contract shall be conducted…