ESBD_527755_1781636848657_RFO 454-26-0106-34274-BJM Final.pdf

Texas Department of Insurance

Request for Offers ImageRight Document Management Systems

RFO No. 454-26-0106-34274-BJM NIGP Class/Item Codes: 208-80, 920-14, and 920-30

June 16, 2026 Anticipated Schedule of Events

June 16, 2026 Issuance of Solicitation

June 23, 2026, 3:00 p.m., Central time Deadline for Submission of Questions

June 29, 2026 Release of Official Responses to Questions (or as soon thereafter as practical)

July 16, 2026, 3:00 p.m., Central time Deadline for Submission of Proposals Late Proposals will not be considered

Not Applicable Presentations by Top-Ranked Respondents (if presentations are requested)

August 7, 2026 Anticipated Award Date (or as soon thereafter as practical)

NOTE: Any Addendum that adds new language or replaces any language within this solicitation controls over the original version. It is the responsibility of all prospective Respondents to routinely check the Electronic State Business Daily (ESBD) during the posting period for this solicitation for any Addenda that may be posted. TDI will not make any other announcements regarding Addenda after the publication of this solicitation.

RFO No. 454-26-0106-34274-BJM

Table of Contents

I. Summary

II. Specifications

A. Introduction

B. Background

C. Qualifications

D. Definitions and Acronyms

E. Roles and Responsibilities

F. Scope of Work

G. Technical Specifications (Application Development and Operation, Technical Systems)

H. Security

I. Other Contract Requirements

J. Performance and Service Specifications

K. Schedule of Deliverables and Milestones

III. General Proposal Information

A. Contract Resulting from this Solicitation

B. Contract Term

C. Copyrighted Proposals

D. Unacceptable Terms in Respondent’s Proposal

E. Authority to Bind

F. Protest Procedures

G. Texas Public Information Act and Exchange or Creation of Information

H. VetHUB Subcontracting Plan Information

I. Respondent Documents

J. Respondent Exceptions and Assumptions

K. Service Additions or Deletions, Change Control

L. Acceptance Criteria

M. Payments and Invoice Instructions

IV. Proposal Submission Requirements

A. Time for Submission and TDI’s Email Address

B. Respondent Identification

C. No Alterations or Withdrawals of Proposal after Deadline

D. Tie Proposals

E. Pre-contract Costs

F. TDI’s Tax Exemption

G. Attachments

H. Evaluation Process

I. Proposal Content and Format

V. Mandatory Price Sheet

Definitions

A. Schedule 1 – ImageRight Licenses

B. Schedule 2 – ImageRight View-Only Concurrent Licenses (Optional)

C. Schedule 3 – Training (Optional)

D. Schedule 4 – Enhancements and Licensing (Optional)

E. Alternate Pricing

VI. Terms and Conditions

A. Clauses Required by the Texas Procurement and Contract Management Guide

B. Additional Texas Procurement and Contract Management Guide Provisions

C. Additional Provisions Required by TDI

VII. Execution of Proposal

VIII. Conflict of Interest/Disclosure Statement

A. Defined Terms

B. Disclosures

C. Continuing Duty to Disclose

D. Evaluation of Disclosures

IX. Certification Regarding Public Nature of the Proposal

Appendix A: Sample Contract

Appendix B: Tips for a Successful Submission

Appendix C: DCS Private and Public Cloud information

Appendix D –Solution Questionnaire

I. Summary

1. Type of Solicitation Request for Offers (RFO)

2. Issuing Office

Texas Department of Insurance Purchasing and Contract Administration

PO BOX 12030

Austin, TX 78711-2030

3. Responses to Solicitation Emailed Competitive Proposals

4. VetHSP Courtesy Review Not Applicable

5. Deadline for Proposals Emailed to Contracts@tdi.texas.gov no later than:

July 16, 2026, 3:00 p.m., Central time

6. Initial Contract Term September 1, 2026 – August 31, 2028

7. TDI Optional Terms Three (3) one-year renewal periods or one (1) three-year renewal period

8. TDI Contact Person for this Solicitation Barbara Martin, CTCD, CTCM contracts@tdi.texas.gov

9. Proposals Submitted by Email Submit to Contracts@tdi.texas.gov TDI will use the date and time stamp on TDI’s Microsoft Outlook mailbox to confirm receipt by the deadline.

10. Proposals Submitted by Mail Not Accepted

11. Proposals Submitted by Fax Not Accepted

12. Pre-Proposal Conference Not Applicable

13. Pre-Proposal Inspection Not Applicable

14. Letters of Intent to Submit a Proposal

Not Applicable

15. Solicitation Addenda Notices of changes to items directly impacting the original solicitation or Proposal process will be posted on the Electronic State Business Daily (ESBD) located at www.txsmartbuy.com/esbd. TDI will post any amendment to this solicitation on the ESBD as a solicitation Addendum. It is the responsibility of an interested party to periodically check the ESBD for updates to the solicitation prior to submitting a Proposal. Each Respondent is solely responsible for verifying TDI’s receipt of its questions, if applicable, and Proposal by the deadlines specified in this solicitation.

16. Questions and Answers Questions regarding this solicitation must be in writing and must be submitted to the TDI Contact Person specified in item 9 no later than June 23, 2026, 3:00 p.m., Central time. Telephone inquiries will not be accepted. Questions must be submitted by email to the email address specified in Item 9. TDI intends to post on the ESBD answers to those questions received by the deadline on June 29, 2026, or as soon thereafter as practical.

17. Respondent Presentations TDI may request that Top-Scoring Respondents present an overview of the Services described in their Proposals.

The presentations will be online and in-person attendance is not requested. Presentation dates and times to be arranged. The number of Top-Scoring Respondents will be determined by TDI in its sole discretion.

18. Contact with TDI Staff Upon issuance of this solicitation, employees and representatives of TDI, other than the TDI Contact Person identified in Item 9, will not discuss the contents of this solicitation with any Respondent, Potential Respondent, or its representatives. Failure of a Respondent or any of its representatives to observe this restriction may result in disqualification of any related Proposal. This restriction does not preclude discussions between affected parties for the purpose of conducting business unrelated to this procurement.

19. Evaluation of Proposals under Best Value Standard

Criteria Points Cost 25 Respondent’s Qualifications and

Experience

Compliance with TDI Specifications 40 Past Performance and References 0 or -10 Proposal Content and Format 0 or -5 Financial Capability Pass/Fail Maximum Total Score 100

The factors listed in Sections 2155.074, 2155.075, 2156.007, 2157.003, and 2157.125 of the Texas Government Code shall be considered in making an award, when applicable.

The overall score for Proposals that fail to adhere to the format and content listed in Section IV Part I (Proposal Content and Format) may be deducted 5 points, the Proposal may be disqualified, or TDI may waive minor technicalities in accordance with Section III Part A (Contract Resulting from this Solicitation).

20. Basis for Automatic Disqualification Proposals submitted in response to the solicitation will be rejected as non-responsive and will be disqualified if they do not meet the following mandatory requirements. A disqualified Proposal will receive no further consideration.

1) Respondent must not be debarred from participation in state contracts.

2) Proposal must be submitted by the deadline stated in Item 5 above (Deadline for Proposals) of this Section.

3) The Title Page must be signed and submitted.

See Section IV Part I.

4) Each addendum to the solicitation must be included in its entirety, including the signed signature page. See Section IV Part I Item 11.

5) The Execution of Proposal must be signed and submitted. See Section VII.

6) The Conflict of Interest form must be completed, signed, and submitted. See Section

VIII.

7) The Certification Regarding Public Nature of the Proposal must be completed, signed, and submitted. See Section IX.

II. Specifications A. Introduction The Texas Department of Insurance (TDI), an agency of the State of Texas, issues this Request for Offers (solicitation) to solicit pricing from qualified vendors for ImageRight Document Management software licenses as described in this solicitation (“Services”). TDI’s objective is to obtain the Services that represent the best value for TDI and the State of Texas according to the terms and conditions of this solicitation. The Services and requirements described in this solicitation are mandatory unless specifically described as optional.

TDI anticipates making a Contract Award to one Successful Respondent (“Contractor”) for the Services required by the solicitation. TDI reserves the right not to award a Contract for the performance of all or part of the requirements of this solicitation. This solicitation is not exclusive and TDI reserves the right to issue additional solicitations regarding the Services described in this solicitation or similar services at any time.

All Respondents are encouraged to offer their best pricing at all times.

All costs associated with the Services, as defined by this solicitation, must be included in the Respondent’s Proposal. Proposals that do not meet all the requirements or contain all the required documentation specified in this solicitation will be rejected as non-responsive and will be disqualified.

TDI believes the requested items in this Request for Offers may be proprietary to one vendor under Section 2155.067 of the Texas Government Code; however, TDI strongly encourages offers from all qualified Respondents that may be able to provide the requested items.

B. Background

1. TDI Overview TDI regulates the state’s insurance industry, oversees the administration of the Texas workers’ compensation system, performs the duties of the State Fire Marshal’s Office, and provides administrative support to the Office of Injured Employee Counsel – a separate agency.

TDI’s vision is to be a dynamic leader in responsible state, national, and global regulation; consumer protection; and market viability.

2. Project Overview TDI has approximately four (4) Terabytes of data stored electronically in ImageRight. TDI uses ImageRight for document storage and workflow processing for multiple TDI business areas, including the Division of Workers’ Compensation. ImageRight is also the system of record for all electronic documents tied to the applications and workflows which utilize ImageRight. TDI uses Sircon as the system of record for information of the entities TDI regulates. Sircon interfaces with ImageRight.

The project scope includes ImageRight software subscription, including Optical Character Recognition (OCR), maintenance, support, and licensing, ImageRight concurrent licenses,, and training, TDI may request additional services related to ImageRight as needed for document management.

C. Qualifications Respondents must have the knowledge and expertise to provide the services described in this solicitation.

Each Respondent submitting a Proposal in response to this solicitation must describe in its Executive Summary how the Respondent meets the qualifications described below.

1) Respondent must have a minimum of 10 years’ experience within ImageRight providing services comparable to the services described in this solicitation.

2) Respondent must have experience with at least three (3) individual engagements for services comparable to the services described in this solicitation.

D. Definitions and Acronyms As used in this solicitation, the following capitalized terms will have the meaning specified below.

Term Definition Agency The Texas Department of Insurance.

Agency Primary Contact The person designated by TDI to be the point of contact between TDI and Contractor for the purposes of monitoring Contractor performance and providing day-to-day interaction and instruction. Also referred to as “Contract Administrator.”

Contract The written agreement, if any, executed by the authorized representatives of the parties (the Agency and the Contractor) that formalizes the terms, provisions, covenants, and obligations, including but not limited to those contained in this solicitation, of the respective parties to the arrangement for provision of Services.

Contractor The individual or entity qualified to provide the goods and/or services sought by TDI pursuant to this solicitation and who is ultimately selected to carry out the requirements stipulated in this solicitation and any resulting Contract. Has the same meaning as “Vendor” and “Successful Respondent.”

Contract Administrator The person designated by TDI to be the point of contact between TDI and Contractor for the purposes of monitoring Contractor performance and providing day-to-day interaction and instruction. Also referred to as “Agency Primary Contact.”

Contract Award TDI’s notice of award to the Successful Respondent of TDI’s intent to execute a contract.

Contract Execution The date the Contract is fully executed by all Parties.

Contract Term The complete period of service including any extensions and renewals that are executed by Contract Amendment.

Data Breach A security incident in which sensitive, protected, or confidential data is copied, transmitted, viewed, stolen, or used by an individual or entity unauthorized to do so, whether or not the breach occurred in transit or at rest.

Days Calendar days unless otherwise specified.

Deliverable Unit or increment of work required by the Contract, including such items as goods, services, reports, or documents.

Term Definition Electronic State Business Daily (ESBD)

The public-facing website in which applicable government entities post certain competitive procurement solicitations.

http://www.txsmartbuy.com/esbd.

Employee, Contractor Employee

Any individuals who, on behalf of the Contractor, will or may participate in any Contract resulting from this solicitation. The term includes all officers, personnel, replacement personnel, agents, contractors, subcontractors, subcontractor employees, and other representatives of the Contractor, regardless of how employed or contracted by Contractor.

Financial Interest Receiving, or the right to receive, money or other valuable property or benefits under the actual or proposed Contract; holding a position in a business such as a principal, officer, director, trustee, partner, employee, or the like, or holding a position of management; holding any of the outstanding debt of a person directly involved in the proposed or resulting Contract; or owning stock or other interest in the business.

Fiscal Year (FY) The State of Texas and TDI’s fiscal year that begins September 1 and ends August 31.

Key Deliverable A key deliverable may have a payment associated with it and will likely have an associated liquidated damage.

Mandatory Required, compulsory, or obligatory.

Offer, Proposal, or Response The documents, including any exhibits or attachments, submitted by a prospective vendor in response to a solicitation. “Offer” has the same meaning as “Proposal” or “Response,” when such terms are applicable in the solicitation document so titled as Request for Proposal (RFP), Request for Offers (RFO), or an Invitation for Bid (IFB), respectively.

Party Entity who enters into a binding agreement with one or more other contracting parties and thus accepts the benefits and obligations specified therein.

Relative When referring to an individual, the term includes a current or former TDI employee’s spouse, father, mother, brother, sister, son or stepson, daughter or stepdaughter, mother-in-law, father-in-law, sister-in-law, brother-in-law, son-in-law, or daughter-in-law.

Respondent An individual or business entity submitting a Proposal in response to a solicitation, with an intent to contract with TDI.

Services All of the requirements, duties, schedules, locations, and other items listed in the solicitation. The term includes any other services associated with Contractor’s performance under any Contract resulting from this solicitation.

Security Incident An event that results in unauthorized, access, loss, disclosure, modification, or destruction of information resources, whether accidental or deliberate. An instance in which a user or other person circumvents or defeats the controls of a system to obtain unauthorized access to system resources or to information contained in the system.

State Holidays The State Agency Holiday schedule is defined on the Texas State Auditor’s website at www.hr.sao.texas.gov/Holidays/.

Term Definition Successful Respondent The individual or entity qualified to provide the goods and/or services sought by TDI pursuant to this solicitation and who is ultimately selected to carry out the requirements stipulated in this solicitation and any resulting Contract. Has the same meaning as “Vendor” and “Contractor.”

TDI The Texas Department of Insurance, the state agency responsible for the issuance of this solicitation.

Vendor The individual or entity qualified to provide the goods and/or services sought by TDI pursuant to this solicitation and who is ultimately selected to carry out the requirements stipulated in this solicitation and any resulting Contract. Has the same meaning as “Successful Respondent” or “Contractor.”

Vendor Primary Contact The person designated by the Contractor to be the point of contact between Contractor and Agency for purposes of scheduling, billing, contract management, and day-to-day management of Services under this solicitation.

E. Roles and Responsibilities

1. Agency Responsibilities Agency agrees to meet the following requirements during the Contract Term:

a) Designate an Agency representative to be the Agency Primary Contact for the purposes of monitoring Contractor performance and providing day-to-day interaction and instruction.

The Agency Primary Contact will also be the designated Contract Administrator.

b) Provide technical staff to assist with coordination between Contractor and TDI.

c) Have final approval on all schedules and deliverables.

d) Work with Contractor on all product and performance related issues.

2. Contractor Responsibilities Contractor must meet all the following requirements during the Contract Term:

a) Designate a representative to be the Vendor Primary Contact for the purposes of scheduling, billing, contract management, and day-to-day management of Services under this solicitation.

b) Provide the necessary staff to fulfill deliverables and requirements in accordance with the agreed upon schedule or services.

c) Collaborate with TDI to ensure successful implementation and completion of the Services.

d) Be honest, open, courteous, respectful, and fair in all contact with TDI.

e) Identify and communicate any risks to the Service to the Agency Primary Contact.

F. Scope of Work The Scope of Work (SOW) describes the service requirements and deliverables Contractor must meet in performance of the Contract.

1. ImageRight Licenses Respondent must provide one (1) server licensing package including:

a) States Server Package – quantity 1

b) States Browser Server – quantity 1

c) Desktop & Browser Client File Access & Full Workflow Concurrent User – quantity 150

d) Enterprise Scanner Server – quantity 4

e) Enterprise Reporting Server – quantity 1

f) Export Module Server – quantity 1

g) Retention Management – quantity 1

h) Content Imports – quantity 1

i) Desktop API – quantity 1

j) Web Services Internet – quantity 1

k) Email Receiver (Unlimited) – quantity 1

l) Barcode Printer – quantity 1

m) Redaction and OCR Service – quantity 2

In its Business Proposal (see Section IV Part I Item 5), Respondent must describe how it will meet or exceed the requirements listed in this section.

2. ImageRight Software Maintenance and Support Respondent must provide annual maintenance and support for the software hosted on the Respondent’s cloud infrastructure. Maintenance and support includes, but is not limited to, the following:

a) Security patches and upgrades;

b) Regular ImageRight data backups;

c) Ongoing performance tuning and monitoring; and

d) Ad hoc support of configuration questions;

Maintenance and support costs must be included with software licenses.

In its Business Proposal (see Section IV Part I Item 5), Respondent must describe how it will meet or exceed the requirements listed in this section.

3. ImageRight View-Only Concurrent Licenses (Optional) Respondent must describe its ability to provide additional ImageRight licenses to accommodate new users and staff requiring view-only capability. If requested by TDI, Respondent must provide:

a) ImageRight concurrent licensing to accommodate active users accessing the system daily;

and

b) ImageRight concurrent licensing to accommodate view-only users accessing the system throughout the month.

In its Business Proposal (see Section IV Part I Item 5), Respondent must describe how it will meet or exceed the requirements listed in this section.

4. Training (Optional) Respondent must describe its ability to develop and conduct train-the-trainer classes for subject matter experts on all aspects of the ImageRight system. Respondent must also describe its ability to provide additional ImageRight software and related technical training. Upon TDI’s request, such training may be conducted onsite at TDI’s Austin headquarters or virtually. Training may include, but is not limited to:

Desktop client Web client Scanner client ImageRight Tools including;

o ImageRight PDF printer o ImageRight Connect o Auto redaction module o Auto retention module

Administrative functionality for the retention module A comprehensive list of APIs in the ImageRight API library, how they are used, and how to make modifications ImageRight workflow function coding

In its Business Proposal (see Section IV Part I Item 5), Respondent must describe how it will meet or exceed the requirements listed in this section. The services described in this section are optional.

5. Enhancements and Licensing (Optional) Respondent must describe its ability to provide enhancements and licensing to assist TDI with ImageRight activities including but not limited to ImageRight application programming interfaces (APIs) to interface, integrate, and troubleshoot third-party or in-house developed applications. TDI may request such enhancements and licensing and reserves the right to negotiate any associated costs. Any and all enhancements must be for perpetual use by TDI at no cost to TDI for the life of the system.

If any enhancements or licensing not specifically described in this solicitation are necessary for proper performance, functionality, or other ImageRight activities, such enhancements and licensing will be deemed as included within the scope of the maintenance and support of this RFO and any resulting Contract.

Upon TDI’s request, Respondent must provide an estimate of work hours and associated costs based on the hourly rate listed in Section V (Mandatory Price Sheet). TDI must provide written approval prior to project initiation.

In its Business Proposal (see Section IV Part I Item 5), Respondent must fully describe the proposed technical environment including all hardware, software, and any other technical infrastructure specifications or requirements needed to implement and operate the proposed solution. This must include any opensource, freeware, or software installed on a temporary basis to assist with the implementation of the solution. Respondent must clearly identify items that TDI is expected to provide and items that Respondent will provide. Financial responsibility for specific hardware and software needs may be negotiated before Contract Award.

G. Technical Specifications (Application Development and Operation, Technical Systems)

1. Scalability and Flexibility Contractor’s solution must incorporate scalability and flexibility to accommodate changes due to technological improvements or enhancements, legislative mandates, and program changes that are within the scope of this solicitation. Contractor agrees to support modifications that TDI requests when the requested changes are necessary to maintain the accuracy, functionality, security, and integrity of the system. Any such revisions will be coordinated with Contractor and follow the change management process.

2. TDI’s Technical Environment

a) Enterprise Client Computing Environment TDI’s client computing environment is comprised of Intel-based desktops and laptops running a 64-bit Windows Operating System. Microsoft Edge, Mozilla Firefox, and Google Chrome are supported browsers. Microsoft Office 365, including SharePoint and the Office client suite, is standard for office automation needs such as email, word processing, spreadsheets, presentations, collaboration, file sharing, and small databases. A network faxing solution is also standard for e-fax capability. All workstations are managed through a directory service.

Agency-owned mobile devices are used by staff requiring additional mobility. These mobile devices are managed through an enterprise Mobile Device Management (MDM) solution.

Supported devices are iOS11 and up.

Xerox Multi-Function Devices (MFDs) are located throughout all agency sites for services including print, copy, fax, and scan. Staff that are not based in any agency sites use stand-alone multi-function or portable printers.

b) Server Environment TDI is a customer of the State Shared Technology Services (STS) Data Center Services (DCS) program overseen by the Texas Department of Information Resources (DIR). The agency utilizes a broad server environment, hosted by multiple STS contractors, which provides data center services including: hosting of agency systems both in an on-premise and cloud environment, data center security, operating system security patching, backup and monitoring of systems, and disaster recovery.

The TDI Server Environment consists of a combination of Windows and Linux, and AIX systems and consist of file sharing, application, database, and utility servers.

TDI provides web content to both public and internal employees via Microsoft Internet Information Security (IIS).

The current database standard is Oracle. Any database versions used with the third-party product(s) must fully support the current certified supported version. Microsoft SQL is used to support any third-party applications that will not run under Oracle.

c) Telecommunications Infrastructure All TDI offices are connected through an Ethernet topology and connect to the Texas State Data Center through a TDI-managed WAN network.

Agency phones and contact centers are connected through an internally managed VOIP system.

TDI has one main office building site located in the Austin area and multiple field office locations across the state. All field offices are directly connected through the agency WAN with circuits varying by number of staff and business functions performed in the office. All sites have both wired and wireless (Wi-Fi) connectivity.

3. Hosting Data Center Services (DCS) Infrastructure Requirements The Texas Legislature, by action of House Bill 1516, 79th Legislature (Regular Session), established the foundation of a shared technology infrastructure and directed Department of Information Resources (DIR) to coordinate a statewide program to consolidate infrastructure services. Section

2054.391 requires State agencies included in the Data Center Services (DCS) program to use such services, unless otherwise approved by DIR through a DCS Exemption. DIR currently has executed multi-vendor contracts to provide data center managed services for DIR Customers (state agencies).

All hosted solutions offered in response to this RFO (including custom developed application, COTS, and Portal or Website managed content) must host the application or solution in the DCS program, using either public or private cloud compute and DCS managed services provided.

Respondents should comprehensively list their infrastructure or compute requirements, to be hosted in either a DCS public or private cloud, for financial review by TDI. TDI will facilitate the process to request an estimate of the cost to host the solution within the DCS program.

If the Respondent intends to propose Software as a Service (SaaS), then the Respondent must demonstrate that the solution clearly meets the National Institute of Standards and Technology (NIST) standard definition of SaaS (NIST Definition of Cloud Computing Special Publication 800- 145). The solution must be Level 2 TX-RAMP certified (or equivalent substitution). TDI will be required to request and receive from DIR a DCS program exemption before a contract can be awarded to a Respondent if the solution is purchased outside of the DCS program.

Respondent must also complete and submit the Solution Questionnaire in Appendix D.

More details about the DCS Vendor Contracts, Master Services Agreements (MSAs) and Statements of Work (SOWs) may be found on DIR’s website at: www.dir.texas.gov.

Respondents should provide one technical solution: either SaaS or DCS hosted and managed. If your proposal is for a hosted solution, it will need to be hosted in the State’s DCS program, which offers both public and private cloud hosting options. This program provides all server management functions including system administration, operating system management and patching, base security services, dedicated local area network connectivity, storage services, backup services and disaster recovery services. Respondents should indicate whether it is proposing fully managed, or semi managed DCS infrastructure hosting and compute solutions required.

Respondents are not required to estimate the cost to host within the DCS program; however, Respondents are required to provide complete technical specifications in order for TDI to estimate.

Collectively, the DCS contracts provide participating state agencies mainframe and server operations, both public and private cloud services, disaster recovery, and bulk print and mail services.

DCS Public and Private Cloud Compute and Software Acquisition As a participating entity in the DCS program, TDI is required to acquire all in-scope infrastructure compute, services, and software through the DCS program. Respondents must include complete compute and software infrastructure requirements in their response in order for TDI to estimate DCS costs.

The Successful Respondent is required to participate in the procurement process, including participating in the requirements gathering session, and validating any DCS created solution proposals. Proper long-range planning is required in order to ensure compute is provisioned to meet project schedules.

DCS Process Management The Successful Respondent may be asked to participate in the defined DCS processes for incident management, problem management, change management, release management, configuration management, and request management. In the management plans described in this RFO Section II Part G, the Respondent must describe its interactions with the DCS program (For the agency: The DCS Services Management Manual is available for you to post in your data room for respondents.

Please contact DIR to request a copy).

DCS Public Cloud Industry leading public cloud services available from DIR Shared Technology Services are hardened public cloud virtual data center solutions with a focus on aligning the DCS Operating Model with Industry Best Practices, technical and security assurances, and onboarding of public cloud services through Amazon Web Services (AWS), Azure, and Google.

Leveraging Cloud Native tooling, the DCS Cloud Service model is poised to align to the value of Cloud Service Providers by evolving capabilities with investment in Service Evolution of the Public Cloud. Our expanded Public Cloud model delivers Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and SaaS services with products and tooling built for and within the Public Cloud to leverage the full benefits of Public Cloud services with the security assurances of DCS. For more information on the DCS Public Cloud see Appendix C – Additional DCS Hosting Information.

DCS Private Cloud The Data Center Services program maintains two consolidated data centers geographically separated in order to provide disaster recovery. The Texas Private Cloud (TPC) provides technology infrastructure compute and storage based on standard reference models and managed services options. For details see Appendix C – Additional DCS Hosting Information.

Functions Retained by TDI – Not Provided by Data Center Services

For clarity, the following services are not provided by DCS Service Providers. In developing your response, the Respondent should clearly understand that the requestor (agency) performs these functions as needed.

• End-user computing, including desktop, mobile, and LAN-attached multi-function devices.

• Network support, including WAN/LAN support outside of the State data centers, voice/phone support.

• Help desk (Level I – all services).

• Expert troubleshooting and support for all non-DCS services.

• Technology planning, strategies, and visioning.

• Project management.

• Disaster recovery planning and testing for all retained services.

• Business continuity planning for agency processes.

• Packaged imaging systems (scanners, servers, optical disks, etc.).

• Coordination of data center print services, including coordinating form changes with business units, volume trending.

• Data security, security design and policy development, systems access requests

(directory/file, ID creation and removal, determination of access rights).

• Logical database administration.

• Application development, support, maintenance, and monitoring.

• Electronic payment processing services.

• Data import and export to the environment (FTP services).

• Reporting services.

For additional details, see Appendix C – Additional DCS Hosting Information.

4. Change/Configuration Management Contractor must establish a change or configuration management process that complies with Texas Administrative Code Title 1, Section 202. The change management process controls modifications to hardware, software, firmware, plans, policies, procedures, logic, operations, technical guides, and any other agreed upon project element(s) to ensure that the information resources are protected against improper modification before, during, and after System implementation. Changes may be initiated by Contractor or TDI.

Contractor must use a change request form to document all change requests. The change request form is subject to TDI approval and must include, at a minimum, the following information:

description of the change, including the need/benefit, date identified, and who initiated the change request;

list of the TDI data, functions, or protocols affected by the change;

potential risks associated with the change (both with implementing the change and not implementing the change);

start date;

completion date (as determined by mutual agreement of Contractor and TDI);

staff allocation;

installation plan;

test plan;

back-out plan; and estimated hours of work.

Contractor must not perform any work, alter any functions or protocols, or implement any changes to the TDI data without submitting a change request to TDI and obtaining explicit approval for the change before the work begins.

Contractor must ensure that appropriate planning and resources are applied to complete changes by the planned completion date. In the event of delays to the planned completion date, Contractor must provide timely written notice to TDI detailing why the date cannot be met and what, if any, additional time, or resources are needed to complete the change request. TDI will approve, in writing, the new completion date if the revised date and justification are acceptable to TDI. Changes not completed by the agreed upon completion date will be deemed to be a failed change.

Contractor’s inability to correct or fix a known issue, deficiency, malfunction, or bug will be deemed by TDI to be a failed change. TDI, in its sole discretion, may assess actual damages, retroactively from the point that the known issue, deficiency, malfunction, or bug was identified. Such costs will be computed separately and either deducted from any monies due to the Contractor under the Contract resulting from this solicitation or paid to TDI within 30 calendar days of the failed change request. All changes must be completed to the satisfaction of TDI.

5. Maintenance and Support Contractor must ensure the functionality and operational effectiveness of the system and TDI data during the Contract Term. The Contractor will provide the following types of program maintenance and support for the system and any enhancements, modifications, or customizations that are required and completed by Contractor for the Services provided under this solicitation:

a) Maintenance Contractor must provide the program maintenance listed below.

1) Corrective Maintenance – to correct processing, performance, or implementation faults of the program.

2) Adaptive Maintenance – to adapt to changes in environment such as new hardware of the next release of an operating system to protect the system and adapt to external threats, such as viruses. Adaptive maintenance does not lead to changes in the program functionality.

3) Preventive Maintenance – to maintain the system in satisfactory operating condition by providing for systematic inspection, detection, and correction of initial failures either before they occur or before they develop into major defects.

4) Performance Tuning – to perfect the program for its performance, processing efficiency, maintainability, or accommodation of new or changed user requirements.

5) Emergency Maintenance – to correct system emergencies affecting processing and performance of the program. All scheduled and planned outages must be scheduled with a minimum of 72 hours of advance notice to TDI and must occur only during non-peak hours unless otherwise agreed upon by TDI and Contractor.

b) Technical Support Contractor must provide technical assistance to TDI or system users with technical issues including connectivity problems and password changes, if applicable. Technical support must be available during TDI business hours, 7:00 am to 7:00 pm, Central time, Monday – Friday.

Contractor must provide TDI with contact information for emergencies that occur during non-business hours.

6. Electronic and Information Resources Accessibility Standards Texas government statute and rules require that electronic and information resources (EIR) used, developed, procured, or maintained by Texas agencies and institutions of higher education are accessible to people with disabilities. See Texas Government Code Chapter 2054 Subchapter M.

a) If Respondent’s solution includes commercial off-the-shelf (COTS) software or online services, Respondents must complete a Voluntary Product Accessibility Template (VPAT) for each item and submit the results with Respondent’s Business Proposal. Alternately, Respondent may provide the URL to completed VPATs or equivalent reporting templates.

b) If Respondent’s solution includes development services for software, websites, web applications, etc., Respondent’s Business Proposal must include credible evidence of its capability or ability to produce accessible EIR products and services. Such evidence may include, but is not limited to, internal accessibility policy documents, contractual warranties for accessibility, accessibility testing documents, and examples of prior work results.

Respondent must submit the latest SOC II Type II report and if the proposed solution uses cloud services, describe the proposed hosting as outlined in this Section II, Part G.

H. Security

1. General Security Requirements Personally Identifiable Information (PII) refers to information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. Examples of PII include but are not limited to:

name, such as full name, maiden name, mother’s maiden name, or alias;

date of birth;

personal identification numbers, such as a driver’s license number;

address information, such as a street address or email address; and all future additions to PII as stipulated by the laws, statutes, rules, and rulings that govern Texas data.

a) Security Incidents TDI defines a “Security Incident” as an event that results in unauthorized, access, loss, disclosure, modification, or destruction of information resources, whether accidental or deliberate. An instance in which a user or other person circumvents or defeats the controls of a system to obtain unauthorized access to system resources or to information contained in the system. A Security Incident may or may not turn into a Data Breach. Contractor and any subcontractors who have a reasonable belief that a Security Incident has occurred must notify TDI immediately

(within one hour) upon discovery or detection. Within 24 hours of a Security Incident, Contractor will provide a Security Incident report that includes, at a minimum:

The facts surrounding the incident;

What mitigating actions have already been taken;

Whether the incident is an ongoing security threat and whether additional actions or resources are needed to stop it;

Types of information involved;

Classification of information involved;

The number of individuals whose information is affected;

Whether the information was encrypted;

Whether information systems were affected, and Other relevant information under the circumstances.

b) TDI Actions as a Result of Contractor’s Failure to Safeguard TDI Data TDI, in its sole discretion, reserves the right to conduct an independent investigation of all Security Incidents; Contractor will be responsible for the costs of any such investigation. In the event TDI has a reasonable belief that Contractor has not safeguarded the PII, TDI may enact the actions listed below.

1) Disconnect or suspend, in whole or in part, services provided under the Contract until Contractor has remediated all issues to the satisfaction of TDI.

2) Require Contractor, at its own cost, to provide notice that satisfies the requirements of the Texas Business and Commerce Code Section 521.053.

3) If TDI elects to send a separate notice, Contractor will reimburse TDI the costs associated with the notice. TDI reserves the right to collect such costs from Contractor if Contractor fails to reimburse TDI within 30 calendar days of TDI’s written request.

4) At TDI’s request, require Contractor to purchase, at its own cost, an identity theft protection service for all individuals whose information was disclosed without authorization. The protection service must cover each individual for a two-year period from the effective date of the identity theft protection service for each individual, must include automatic fraud alerts to the individual, and must include monitoring services. Contractor will be responsible for all costs.

2. Criminal Background Check Each employee of the Contractor that would require access to Texas State agency systems pursuant to this solicitation must undergo a fingerprint-based computerized criminal history search (CCH) of both the Texas Department of Public Safety (DPS) Criminal Information System (TCIC), or equivalent Criminal History Records Information System for their home state, and the Federal Bureau of Investigation (FBI) database of crimes committed within the United States and that includes a “rap back” function. The criminal background check must be conducted at Contractor’s expense. For existing employees, the criminal background check must be conducted within 30 calendar days of Contract Execution. For employees hired during the Contract Term, the criminal background check must be conducted within seven (7) calendar days of the employee’s start date.

As part of its background check procedures, Contractor will be responsible to obtain any authorization necessary to complete the background check and to also obtain the employee’s authorization to release the results of the background check to TDI. Contractor will treat any employee who does not sign an authorization to share the background check results with TDI as being unqualified to provide Services under the Contract.

a) If the criminal background check is clear, Contractor must provide the results and documentation to the Agency Primary Contact within three (3) business days of the completed criminal background check.

b) If the background check reveals a conviction or indictment for a criminal offense, Contractor must immediately remove the employee from the project and restrict all access to TDI data and information. Contractor must provide the criminal background check results and related information to the Agency Primary Contact for review. TDI will determine whether the employee will be allowed to perform work for TDI under the Contract and will notify Contractor of its decision within three business days of receipt of the information.

Contractor will not send TDI any background check results for an employee unless it has obtained the employee’s written authorization to do so.

During the Contract Term, if Contractor becomes aware of a change in an employee’s criminal history, Contractor must provide TDI with notification of that change within three (3) business days.

3. Password Guidelines and Requirements Contractor must provide a unique ID and password for each individual to access the system and must implement password policies that adhere to the standards listed below. Respondent’s Business Proposal must include a description of how Respondent will meet the requirements listed in this item.

a) Password policies and standards must be the same for all users.

b) Contractor must maintain a comprehensive password policy to include the methods of password storage and transmission, password composition, documentation of authorized users, applicable mandates, regulations, and all guidelines that Contractor uses for password management. The password policy document must include all Contractor’s password guidelines and methods, if applicable.

c) At a minimum, passwords must meet or exceed NIST 800-63B rev. 3 requirements.

d) Password security efforts and standards must allow for continuous, ongoing security measures and improvements to respond to any current and future security threats throughout the Contract Term. Any proposed changes to existing standards must be approved by TDI.

e) Contractor must maintain and update the password policies and standards on an annual basis.

f) The solution must support single sign on (SSO) and support the most common, widely used protocols that enable SSO relationship such as SAML, OpenID Connect, OAuth 2, and WS- Federation.

4. Security Standards Contractor must adhere to the security requirements and standards below to the extent possible.

Contractor must maintain current knowledge of the listed standards and apply updates to the solution to remain current with the security standards.

a) Texas Administrative Code Title 1 Chapters 202, 203, and 206;

b) National Institute of Standards and Technology (NIST);

c) Payment Card Industry Data Security Standards (PCI DSS); and

d) International Organization for Standardization (ISO) 27001.

Contractor must comply with the Texas Business and Commerce Code Chapter 521 to the extent applicable.

5. Data and Information Security Contractor will ensure TDI data is protected against unauthorized access, disclosure, modification, or destruction, whether accidental or deliberate, and ensure the availability, integrity, and confidentiality of information.

a) Contractor must employ a certified Information Security Officer (ISO) or equivalent position at all times. The ISO must be certified as a Certified Information System Security Professional (CISSP) or a comparable certification from one of the following organizations:

International Information System Security Certification Consortium, or (ISC2) Information Systems Audit and Control Association (ISACA) International Council of Electronic Commerce Consultants (EC Council) SANS Institute, or Computer Technology Industry Association (CompTIA).

b) To prevent unauthorized access, Contractor must, at a minimum:

restrict physical and electronic access to all data provided by TDI;

verify individual access authorizations before granting access;

obtain prior approval from TDI for remote access to the system;

authorize, monitor, and control all methods of remote access to the system;

grant users only the minimum access and privileges required to perform their duties;

track and monitor user accounts by implementing a formal documentation process that details the changes to users’ accounts;

use security and network monitoring logs to identify unauthorized activities and anomalous activities;

apply updates and patches to all information resource assets on a monthly basis;

implement procedures to ensure a user’s access rights and privileges are adjusted within 24 hours whenever there is a change in a user’s status; and only grant access to legitimate user accounts assigned to specific individuals;

generic or shared accounts are not permitted.

c) Contractor must conduct quarterly vulnerability assessments or scans to reduce and mitigate any security risks for TDI data. Contractor is responsible for the costs associated with the quarterly vulnerability assessments or scans. Contractor must resolve any security vulnerabilities with a CVE score greater than 7 within thirty (30) business days of discovery and any vulnerabilities that would allow unauthenticated remote code execution within (15) calendar days. TDI may request proof that the quarterly assessment was performed.

d) Contractor must comply with any request by TDI to submit to a controlled penetration test and must comply with all requests to make corrections as a result of such testing within the time constraints required by TDI.

e) TDI data must not be transmitted or maintained outside the continental United States of America.

6. Data Encryption Contractor will use the latest industry accepted encryption standards for data encryption at rest and in transit.