ESBD_536955_1784119284297_RFO 304-27-1020AM Element Learning Management Solutions SW and Svcs.pdf

RFO # 304-27-1020AM Element LMS SW & Svcs Page 1 of 45 Rev. 6/27/23

TEXAS COMPTROLLER OF PUBLIC ACCOUNTS

Request for Offers

Element Learning Management Solutions

Software License and Related Services RFO No. 304-27-1020AM

July 15, 2026

Anticipated Schedule of Events

July 15, 2026 Issuance of RFO July 21, 2026 Deadline for Submission of Questions (2:00 p.m., CT)

July 29, 2026 Release of Official Responses to Questions (or as soon thereafter as practical)

August 5, 2026 Deadline for Submission of Offers (2:00 p.m. CT) Late Offers will not be considered

September 1, 2026 Services Commencement Date (or as soon thereafter as practical)

RFO # 304-27-1020AM Element LMS SW & Svcs Page 2 of 45

Table of Contents

I. Summary II. Specifications

A. Introduction B. Background C. Definitions and Acronyms D. Scope of Services E. Contract Resulting From This Solicitation; Order of Priority F. Warranty of Performance G. Security Incident Notification H. Insurance and Bonds I. Criminal Background Investigation J. Contract Term K. Invoice Acceptance Criteria L. Payments M. Discounts N. PO Addition and Deletion O. VetHUB Subcontracting Plan Information P. Respondent Documents Q. Respondent Exceptions R. Respondent’s Past Performance

III. Offer Submission Requirements A. Delivery of Offer B. Offer Content and Format

IV. Mandatory Price Sheet V. Standard Terms and Conditions VI. Execution of Offer VII. Conflict of Interest/Disclosure Statement VIII. Nondisclosure Agreement IX. Confidential Treatment of Information Acknowledgment X. Certification Regarding Public Nature of the Offer XI. Respondent Exceptions Response Template

RFO # 304-27-1020AM Element LMS SW & Svcs Page 3 of 45

I. Summary

1. Type of Solicitation: Request for Offers (RFO)

2. Issuing Office: Texas Comptroller of Public Accounts Procurement Section Room 300, Attn: RFO No. 304-27-1020AM 111 E. 17th Street Austin, Texas 78774

OR Texas Comptroller of Public Accounts Procurement Section Attn: RFO No. 304-27-1020AM P.O. Box 12050 Austin, Texas 78711-2050

3. Additional Requirements/Qualifications: N/A

4. Responses to RFO: Sealed Competitive Offers

5. Deadline for Offers: In Issuing Office No Later Than:

August 5, 2026; 2:00 p.m., Central Time (CT)

6. Initial Contract Term: September 1, 2026 to August 31, 2027

7. CPA Optional Contract Terms: September 1, 2027 through August 31, 2028 September 1, 2028 through August 31, 2029, and September 1, 2029 through August 31, 2030

8. CPA Contact Person for this RFO: Alyssa Mangold, CTCM, CTCD Email: bidcpa@cpa.texas.gov with copy to Alyssa.Mangold@cpa.texas.gov

9. Offers Submitted by Email: Required; See Section III, Part A

10. Offers Submitted by Fax: Not Accepted

11. Pre-Offer Conference: N/A

12. Pre-Offer Inspection: N/A

13. Letters of Intent to Submit an Offer: N/A

14. RFO Addenda: Notices of changes to items directly impacting the original RFO or solicitation process will be posted on the Electronic State Business Daily (ESBD) located at: http://www.txsmartbuy.com/esbd. CPA will post any amendment to this solicitation on the ESBD as an RFO Addendum. It is the responsibility of an interested party to check the ESBD for updates to this RFO before submitting an Offer. Each Respondent is solely responsible for verifying CPA’s receipt of its questions, if applicable, and its Offer by the deadlines specified in this RFO.

15. Questions and Answers: Questions regarding this RFO must be in writing and must be submitted to the CPA Contact Person specified in Section I, Part 8, no later than July 21, 2026; 2:00 p.m. CT. Telephone inquiries will not be accepted.

Questions may be submitted by email to the email address specified in Part 8. CPA intends to post answers to the questions received on the ESBD on July 29, 2026, or as soon thereafter as practical.

16. Respondent Presentations: N/A

17. Evaluation of Offers. Offers will be evaluated under the Best Value Standard (Section 2157.003 of the Texas Government Code):

Criteria Weight Respondent’s Past Performance, Qualifications & Experience 20% Compliance with CPA Specifications 40% Cost 40% Total: 100% mailto:bidcpa@cpa.texas.gov mailto:Alyssa.Mangold@cpa.texas.gov http://www.txsmartbuy.com/esbd

RFO # 304-27-1020AM Element LMS SW & Svcs Page 4 of 45

As applicable, the factors listed in Sections 2155.074, 2155.075, 2156.007, and 2157.003 of the Texas Government Code shall also be considered in making an award.

18. Electronic Offers Only. Due to changed building access restrictions, Respondents will not be permitted to hand deliver Offers to the Issuing Office. Respondents are required to submit Offers electronically via email in accordance with Section III, Part A.

19. Contact with CPA Staff: Upon issuance of this RFO, employees and representatives of CPA, other than the CPA Contact Person identified in Section I, Part 8, will not discuss the contents of this RFO with any Respondent or its representatives. Failure of a Respondent or any of its representatives to observe this restriction may result in disqualification of any related Offer. This restriction does not preclude discussions between the parties to conduct business unrelated to this procurement or to obtain assistance completing VetHUB Subcontracting Plan forms required by this RFO.

RFO # 304-27-1020AM Element LMS SW & Svcs Page 5 of 45

II. Specifications A. Introduction

The Texas Comptroller of Public Accounts (CPA), an agency of the State of Texas, issues this Request for Offers (RFO) to solicit responses from qualified vendors for Element Learning Management Solutions Software License and Related Services as described in this RFO (Services). CPA’s objective is to obtain the Services that represent the best value for CPA and the State of Texas, according to the terms and conditions of this RFO.

CPA anticipates making a contract award to one (1) Successful Respondent for the Services. CPA reserves the right not to award a Contract for the performance of all or part of the Services. This RFO is not exclusive and CPA reserves the right to issue additional solicitations regarding the Services or similar services at any time. All Respondents are encouraged to offer their best pricing at all times.

All costs associated with the Services must be included in the Respondent’s Offer. Offers that do not meet all of the requirements or contain all of the required documentation specified in this RFO may be rejected as non-responsive.

CPA understands that the requested items in this RFO may be proprietary to one vendor under Section 2155.067 of the Texas Government Code; however, CPA strongly encourages Offers from all qualified Respondents that may be able to provide the Services.

B. Background

CPA’s Statewide Procurement Division (SPD) currently uses Element Learning Management Solutions’ cloud-hosted, Learning Management System (Element LMS) platform to provide contract development and contract management training, certification and continuing education to procurement and contract management specialists of Texas state agencies, eligible employees of Texas local governments and certain currently enrolled students or recent graduates of Texas universities and community colleges. CPA’s existing contract for Element LMS Software License and Related Services will expire August 31, 2026. CPA has identified a continuing need for using Element LMS products and services and seeks to meet this need through issuance of this RFO and a contract resulting therefrom

C. Definitions and Acronyms

• Award Date. The Award Date is the earlier of the date an authorized representative of CPA (1) issues a Purchase Order (PO) or (2) signs a formal, written agreement.

• Contract. The agreement, if any, described in Section II, Part E (Contract Resulting from this Solicitation/Order of Priority).

• CPA Contract Manager. The end-user division contact responsible for day-to-day contact with Successful Respondent; contact details to be provided by CPA after the Award Date and/or in the Contract.

• Customization. A modification to the source code of a commercially available software application that is specifically developed to meet the unique business requirements of one customer.

• Error Correction. The correction of software malfunctions due to development, coding, or configuration issues that prevent the software application from operating as designed.

• IP Rights. All intellectual property rights, including copyrights, patents, trade secrets, trademarks, and other proprietary rights that are embedded in or used in connection with the Licensed Software and the Licensed Software Documentation.

• Licensed Software. The version of the software application(s) provided by Successful Respondent under the Contract and any released Software Upgrades, Software Updates, Software Enhancements/Releases, Software Patches/Fixes, Error Corrections, Configurations and Customizations, as applicable, of such version(s).

• Licensed Software Documentation. The complete set of operating manuals necessary to enable CPA to properly install and use the Licensed Software, including but not limited to all updates, revisions, and corrections to the manuals.

• Offer. A response to this RFO.

• Respondent. Any person or entity that submits an Offer to this RFO.

• Software as a Service (SaaS). A software licensing and distribution model in which a software provider cloud-hosts, manages and supports the software applications on provider’s infrastructure and makes the software application available to users over the internet.

• Software Enhancement/Release. A change to a software product, intended to increase functionality, productivity, compatibility, and/or improve the user interface.

• Software License and Related Services. All of the Licensed Software, Software Maintenance and Technical Support Services, Hosting Services, Licensed Software Documentation and other items listed in this RFO. The term includes, RFO # 304-27-1020AM Element LMS SW & Svcs Page 6 of 45 but is not limited to, fees, shipping, freight handling, and any other services associated with Successful Respondent’s performance under the Contract.

• Software Patch/Fix. An addition to a piece of code, usually as an immediate remedy to an existing software error or defect. A Software Patch/Fix is usually a temporary measure until a more permanent solution is implemented with a Software Enhancement/Release and/or version update.

• Software Update(s). Any (a) commercially available versions of the Licensed Software with a version number designated to the right of the decimal point such as 1.1, 1.2, 1.3, etc., and (b) any subsequent variation of the Licensed Software which provides essentially the same functionality and accomplished substantially the same tasks as the Licensed Software but which the software publisher releases under a different name or label.

• Software Upgrade. A commercially available newer version of the Licensed Software typically designated by the number to the left of the decimal point such as 1.0, 2.0, 3.0, etc.

• Subscription License. A software fee and payment model in which customer pays provider a fee applicable to a specified contract term length for the customer’s rights to access and use the software application(s), with such fee also including provider’s delivery of Software Maintenance and Technical Support Services throughout the applicable contract term at no additional charge.

• Successful Respondent. The Respondent awarded a Contract.

D. Scope of Services

D.1. General

a) CPA will only consider SaaS Subscription Licenses for the Software License and Related Services. Any Offers for on-premises products and services will not be considered.

b) Successful Respondent shall provide SaaS Subscription Licenses for the Software License and Related Services listed in Price Schedule 1, Section IV (Mandatory Price Sheet) and meeting or exceeding the following minimum required capabilities, features, and functionalities:

1) SaaS Premium Element LMS Annual License must include the following:

a. Certification and Compliance Manager,

b. Unlimited users,

c. Unlimited courses

d. A minimum of 50,000 active course registrations

e. Virtual online training

f. A minimum of 40GB storage,

g. A minimum of 40GB monthly data transfer, and

h. Software Maintenance and Technical Support Services.

2) SaaS Element LMS Certification and Compliance Manager annual license must include the following:

a. Unlimited managed unique users,

b. Unlimited certifications,

c. Unlimited email notifications

d. Software Maintenance and Technical Support Services.

3) Element E-Commerce Gateway Annual License must include the following:

a. WooCommerce payment integration for Texas NIC or other gateway,

b. Testing,

c. CPA validation,

d. Security lockdown, and

e. Software Maintenance and Technical Support Services.

c) Successful Respondent shall provide to CPA any Optional Features, Products and Services listed in Price Schedule 2, Section IV (Mandatory Price Sheet) that are accepted by CPA.

d) Successful Respondent shall provide hosting services for each SaaS Licensed Software application listed in Section IV (Mandatory Price Sheet) that are accepted by CPA.

1) Hosting services shall include a minimum Uptime of 99.5% during each calendar quarter of the Contract Term for each hosted Licensed Software application.

2) Successful Respondent shall provide to CPA a quarterly uptime report during each calendar quarter of the Contract for each hosted Licensed Software application.

RFO # 304-27-1020AM Element LMS SW & Svcs Page 7 of 45

3) Respondent’s Offer shall include any proposed Service Level Agreement (SLA) applicable to the hosting services (see Section II, Part P (Respondent Documents)).

4) Respondent’s pricing for each Software License and Related Services item listed in Price Schedule 1, Section IV (Mandatory Price Sheet) shall include all costs applicable to the required hosting services.

e) Successful Respondent must be the software publisher/manufacturer, or an authorized seller or authorized reseller of the Software License and Related Services required under the Contract.

1) An “authorized seller” or “authorized reseller” is an entity officially authorized by the software publisher/manufacturer to market, distribute, and sell the Software License and Related Services.

2) Prior to Contract award, CPA may require Respondent to provide written copy of valid authorization granted from the software publisher/manufacturer to Respondent that confirms Respondent’s status as an authorized seller or authorized reseller of the Software License and Related Services required under the Contract.

D.2. Licensed Software and Software Maintenance and Technical Support Services

a) License Grant.

1) Successful Respondent acknowledges that CPA is an agency of the State of Texas and CPA’s business operations include any activities consistent with its statutory authority.

2) Under the Contract, Successful Respondent grants CPA a non-exclusive, irrevocable, royalty-free, universal license to the IP Rights for the purposes of (1) using, displaying and performing the Licensed Software in connection with CPA’s network, and (2) using, displaying and performing the Licensed Software in connection with backup and disaster recovery procedures in the event of destruction or corruption of the Licensed Software or disasters or emergencies which require CPA or any of its affiliates to initiate disaster recovery procedures. CPA shall not permit any Licensed Software to be used by any other person, except for employees, agents, consultants, outsourcing companies and contractors who need to use the Licensed Software in the performance of their duties for CPA and who are authorized and enabled by CPA, under CPA’s written agreement, to access and utilize the Licensed Software.

b) Licensed Software Documentation. Successful Respondent shall provide to CPA at least one (1) copy of the Licensed Software Documentation via online or hardcopy for each of the Licensed Software products provided by Successful Respondent to CPA. Successful Respondent shall provide CPA either (1) written approval which authorizes CPA to make additional copies of the documentation at no charge, or (2) access to additional copies of the documentation at no charge. CPA will restrict distribution of the Licensed Software Documentation to those users with a “need to know” classification. CPA shall not remove, deface, or otherwise obscure any copyright, patent, trademark, service mark, or other proprietary legend (Proprietary Legends) on the Licensed Software or the Licensed Software Documentation. Furthermore, CPA shall include such Proprietary Legends in any reproductions of either the Licensed Software or the Licensed Software Documentation that CPA is permitted to make.

c) Software Maintenance and Technical Support Services.

1) General.

a. Successful Respondent shall provide Software Maintenance and Technical Support Services as defined in this RFO. Software Maintenance and Technical Support Services include, but are not limited to, the following: telephone and online support, Error Corrections, Software Updates, Software Upgrades, Software Patches/Fixes, Software Enhancements/Releases, latest features, performance improvements and Licensed Software Documentation.

b. Successful Respondent shall provide qualified personnel to be available to CPA by telephone, email, and/or website for the reporting of problems or issues with the Licensed Software and Software Maintenance and Technical Support Services. All such Software Maintenance and Technical Support Services must be unlimited during the Contract Term.

c. Successful Respondent shall provide a help desk toll-free telephone number, email, and/or website for the reporting of problems or issues with the Licensed Software. Successful Respondent shall provide support twenty-four (24) hours per day throughout the Contract Term. Successful Respondent shall allow a minimum of three (3) authorized CPA contacts to report problems or issues to Successful Respondent’s help desk. Upon request of Successful Respondent, CPA will provide a list of CPA’s authorized support staff.

RFO # 304-27-1020AM Element LMS SW & Svcs Page 8 of 45

d. Successful Respondent shall automatically send to CPA all Software Upgrades and Software Patches/Fixes. Electronic/overnight delivery of Software Updates, replacement software, and/or Software Patches/Fixes will be supplied in the event of Licensed Software failure.

2) Response Times. Successful Respondent shall respond to service requests in accordance with the priority and within the maximum response times listed in Table 1 (Maximum Response Times). Response Time is defined as the period between Successful Respondent’s receipt of a service call from CPA and the time until Successful Respondent’s service technician responds with repair efforts underway. Repair time is defined as the timeframe for Successful Respondent to complete the Software Maintenance and Technical Support Services required to return the affected systems to normal operations. CPA, in its sole discretion, will determine the service priority reporting of problems or issues with the Licensed Software.

Table 1 – Maximum Response Times Priority Level Description Maximum Response Time

Priority 1 – Critical

a. Total outage or an outage of a critical component that renders the software unusable or unable to perform pending critical tasks.

b. Security issue that affects the production environment.

2 hours

Priority 2 – High

a. Performance degradation or diminished processing, capacity, or functionality that affects multiple users within the production environment.

b. Issue that affects fulfillment of a pending deadline or causes staff to be idle.

12 hours

Priority 3 – Medium

a. Performance issue related to non-production environments, non-critical issue that is time sensitive, or non-impacting issue requiring additional troubleshooting.

b. Issue that does not affect current work but will affect customer’s ability to perform work within one business day.

c. Frequent issue of minor importance yet obviously affecting work efficiency.

48 hours

Priority 4 – Low

a. Scheduled maintenance outage.

b. Request for information prior to diminished processing, capacity, or functionality.

c. Low frequency error of marginal importance.

d. Minor problem that requires research, testing, or cooperative effort to resolve.

72 hours

d) Escalation Protocol. In its Offer, Respondent must propose for CPA’s consideration an Escalation Protocol for collaboratively resolving issues encountered during the Contract Term. The proposed Escalation Protocol must explain how issues or complaints are prioritized and resolved. Respondent’s Escalation Protocol shall include (1) an organization chart addressing topics such as specific steps to be taken on top priority issues or disputes arising due to untimely response to system down or critical malfunction remedial repair requests and (2) Respondent’s approach to resolving any other unmet top priority service requirements under the Contract.

D.3. Transition of Services. Upon termination of the Contract for any reason, Successful Respondent shall assist with and fully cooperate with CPA in good faith to ensure a timely and secure transition of Services to a new vendor delivering Services to CPA. This transition obligation shall be provided by Successful Respondent without additional costs or fees of any kind against CPA or the state of Texas. In accordance with this RFO, Successful Respondent shall deliver to CPA all completed, or partially completed, work and any and all documentation or other products and results of these Services. The timeframe required for completion of Transition of Services shall not exceed nine (9) months, or such other timeframe determined at the sole discretion of CPA.

D.4. CPA Data Safeguard Standards.

a) Defined Terms. The term “CPA Data” refers to CPA’s information as well as other entity information in the possession of CPA that is processed, stored, or transmitted by a computer. CPA Data includes all data that is generated by Successful Respondent in performance of a contract with CPA. The term “CPA Information System” refers to those devices, software, networks and related infrastructure that CPA owns, operates or has obtained for use to conduct CPA business. Devices include, but are not limited to, CPA-owned or managed storage, processing, and communications devices, as well as personally owned devices.

RFO # 304-27-1020AM Element LMS SW & Svcs Page 9 of 45

b) Access to CPA Data. Successful Respondent represents and warrants that it will implement, maintain, and use appropriate administrative, technical, and physical safeguards to preserve the confidentiality, integrity, and availability of CPA Data. Successful Respondent will not collect, access, use, disclose, or retain CPA Data other than as necessary to perform the services specified in a contract resulting from this solicitation or as otherwise authorized in writing by CPA. Successful Respondent will restrict access to CPA Data to only those personnel who must have the information on a “need to know” basis. Successful Respondent will not use CPA Data, or any information derived from CPA Data, for its own benefit or the benefit of any other person or entity. Successful Respondent will not share CPA Data with its parent company or other affiliate without CPA’s express written consent.

c) Web-Based Remote Access to CPA Information Systems. Successful Respondent may use third-party web-based remote access connections to CPA Information Systems to provide support services under the following conditions:

1) CPA shall affirmatively initiate and accept Successful Respondent’s connections to CPA Information Systems.

2) CPA shall monitor Successful Respondent’s connections to CPA Information Systems for the duration of the Services.

3) CPA shall terminate Successful Respondent’s connections to CPA Information Systems upon completion of the Services.

d) Reserved.

e) Reserved.

f) Location of CPA Data. Successful Respondent shall ensure that CPA Data (i.e., primary and backup) remains, at all times, within the continental United States. Successful Respondent shall receive, process, transmit, and store all CPA Data within the continental United States. Successful Respondent’s point of access to CPA Data shall be within the continental United States.

g) Encryption Standards.

1) Successful Respondent shall encrypt CPA Data in transit and at rest. Data in transit means data is moving via email, in applications, or through browsers and other web connections. Data at rest (including data backups) means data is stored in databases, the cloud, removable media, or mobile devices.

2) Successful Respondent shall utilize encryption standards that are FIPS 140-2 compliant or, upon the written approval of CPA’s Chief Information Security Officer, shall meet the intent of the standards as described in

FIPS 140-2.

3) The minimum cryptographic algorithm used by Successful Respondent must be Advanced Encryption Standard (AES) 128 or higher (256 AES is preferred).

4) Successful Respondent shall encrypt CPA Data transmitted over a public or private network. CPA approved data encryption transmission protocols include the following: (1) SFTP (FTP over SSH), (2) FTPS (FTP over TLS), (3) HTTPS (HTTP over TLS), and (4) virtual private network.

h) Reserved.

i) Auditable Information Security Framework. Successful Respondent shall secure its own and its third-party service providers’ systems (e.g., IT service provider, cloud service provider) in a manner consistent with an auditable information security framework e.g., National Institute of Standards and Technology (NIST), International Organization for Standardization (ISO) 27001.

j) Defects and Vulnerabilities. Upon Contract award and during the Contract Term, Successful Respondent shall provide CPA with prompt, written notice upon Successful Respondent’s discovery of any product defects and vulnerabilities of the proposed Licensed Software/Solution that allow an attacker to violate an explicit (or implicit) security policy to achieve some impact or consequence. Examples of vulnerabilities include defects that allow intruders to gain increased levels of access or interfere with the normal operations of information systems.

Vulnerabilities caused by insecure configurations, design choices, and changing environmental conditions are additional examples.

k) Supply Chain Risk Management. Successful Respondent shall provide CPA’s Contract Manager a description of how it manages supply chain risks. Specifically, Successful Respondent shall describe its established agreements and procedures with entities involved in the supply chain for the notification of supply chain risks, compromises, and the result of assessments or audits. During the Contract Term, Successful Respondent shall provide CPA’s

RFO # 304-27-1020AM Element LMS SW & Svcs Page 10 of 45

Contract Manager prompt, written notice of supply chain risks that impact the delivery of the products and services of the Contract. Examples of supply chain risks include supplier financial failure, production control/product quality, market supply and demand, labor disputes/shortages, cybersecurity threats, natural disasters. Successful Respondent shall notify CPA of a supply chain compromise and potential compromise in accordance with Section II, Part G (Security Incident Notification).

l) Independent Information Security Assessment. If Successful Respondent has access to a CPA Information System or receives, processes, transmits, or stores CPA Data, then Successful Respondent shall provide CPA’s Contract Manager with its most recent information security assessment conducted by an independent third-party (e.g., SSAE-18 SOC 2 Type II, ISO 27002) upon Contract award and annually thirty (30) days prior to the anniversary of the Award Date thereafter. CPA, in its sole discretion, may conduct a security assessment of any information system holding CPA Data or connected to a CPA Information System. CPA’s security assessment may consist of a review of the following: (i) independent third-party assessment(s) contracted by Successful Respondent (e.g., SSAE-18 SOC 2 Type II, ISO 27002) and (ii) Successful Respondent’s System Security Plan.

m) Media Sanitization. Successful Respondent shall sanitize information system media, both digital and non-digital, in accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization) when CPA Data in the custody of Successful Respondent is no longer required to be retained by contract with CPA. Successful Respondent must maintain a record documenting each sanitization procedure that, at a minimum, includes the following information: (i) date sanitization completed, (ii) description of the item(s), serial number(s), inventory control number(s), if applicable, and (iii) sanitization method used. No later than sixty (60) calendar days from contract expiration or termination or as otherwise specified in the Contract, Successful Respondent must either

(i) complete the sanitization and submit via email to the CPA Contract Manager all sanitization documentation or

(ii) submit a written statement via email to the CPA Contract Manager explaining the reason that destruction of CPA Data by Successful Respondent is technically impossible or impractical. Successful Respondent’s obligations set forth in this clause survive the termination or expiration of the Contract as long as Successful Respondent retains CPA Data.

n) Third-Party Service Providers. It is sole the responsibility of Successful Respondent to ensure that its access and the access Successful Respondent grants to its service providers to CPA Data or CPA Information Systems does not result in unauthorized access to CPA Data or CPA Information Systems.

o) Reserved.

p) State Agency Website Requirements. Successful Respondent shall comply with the requirements for state agency websites set forth in 1 Texas Administrative Code §206.

q) Reserved.

r) Prohibited Technology. Successful Respondent shall not use covered applications or prohibited technologies in its technology solutions or services provided to CPA. In addition, Successful Respondent represents and warrants that its system, software, components, and services do not use the covered applications or prohibited technologies listed on the Texas Department of Information Resources (DIR) Covered Applications and Prohibited Technologies website.

s) Use of Artificial Intelligence. Successful Respondent shall comply with all federal and state laws and regulations for artificial intelligence (AI). Successful Respondent shall implement and maintain the following.

1) Transparency. Disclose the AI that Successful Respondent embeds in its technology products and services and provide detailed information on the purpose of the AI, the specific AI model(s) in use, if the AI uses CPA Data to train AI model(s), the configuration settings and options to disable or opt out of using the AI.

2) Artificial Intelligence Inventory. Successful Respondent shall implement and maintain an inventory of the AI used in Successful Respondent’s solution, software, system components, and services provided to CPA. CPA is required to report an inventory of AI in biennial statutorily required reports and Successful Respondent shall support CPA’s compliance by providing the inventory information upon CPA’s written request.

3) Monitoring. Successful Respondent shall monitor AI for query attacks, malicious inputs, and perturbations for model manipulation, theft, data poisoning, and data drift. Successful Respondent shall establish model integrity validation checks and data poisoning detection capabilities. Successful Respondent shall implement processes for detecting personally identifying information (PII) in the model and removing PII from the model, as appropriate to ensure the AI cannot provide PII to Successful Respondent’s other customers or outside the boundaries of the CPA Information System.

4) Disclosure Notice. Successful Respondent shall disclose to the public prior to system use, the use of AI in systems that interact with the public and receive, process, transmit, or store CPA Data.

https://dir.texas.gov/information-security/covered-applications-and-prohibited-technologies https://dir.texas.gov/information-security/covered-applications-and-prohibited-technologies

RFO # 304-27-1020AM Element LMS SW & Svcs Page 11 of 45

5) Data Ownership. Successful Respondent shall acknowledge that CPA owns CPA Data. If Successful Respondent uses generative AI to provide services to customers of a CPA Information System, Successful Respondent shall ensure that the AI cannot provide CPA Data to Successful Respondent’s other customers or outside the boundaries of the CPA Information System(s).

t) State Risk and Authorization Management Program (TX-RAMP). Successful Respondent shall obtain TX-RAMP certification in accordance with the DIR Texas Risk and Authorization Management Program (TX-RAMP) Manual. CPA requires the following TX-RAMP certification based-on Agency criteria:

1) X None. Product is out of scope/low impact in accordance with the DIR TX-RAMP Manual.

2) Level 1 Certification. The product will administer Agency public data.

3) Level 2 Certification. The product will administer Agency sensitive, confidential, and/or regulated data.

Upon Contract award, Successful Respondent shall maintain compliance with the immediately preceding TX- RAMP requirements and certification throughout the Contract Term. Successful Respondent shall notify the CPA Contract Manager immediately if such TX-RAMP certification is revoked or otherwise removed.

If Successful Respondent uses a cloud service provider to host (i.e., Infrastructure as a Service or IaaS) or build (i.e., Platform-as-a-Service or PaaS) a custom-developed CPA Information System or application, Successful Respondent shall ensure its cloud service provider obtains TX-RAMP certification in accordance with the DIR TX-RAMP Manual. If applicable, CPA requires the following TX-RAMP certification based-on Agency criteria:

4) X None. Product is out of scope/low impact in accordance with the DIR TX-RAMP Manual.

5) Level 1 Certification. The product will administer Agency public data.

6) Level 2 Certification. The product will administer Agency sensitive, confidential, and/or regulated data.

Upon Contract award, Successful Respondent shall ensure its cloud service provider used to host or build a custom-developed CPA Information System or application maintains compliance with the immediately preceding TX-RAMP requirements and certification throughout the Contract Term. Successful Respondent shall notify the CPA Contract Manager immediately if such TX-RAMP certification is revoked or otherwise removed.

u) Reserved.

v) Reserved.

w) Service Provider, Outsourced, and Cloud Computing. Regardless of TX-RAMP certification, the following requirements apply if Successful Respondent is a service provider or cloud service provider (CSP) or contracts with a CSP or other data center to receive, process, transmit, or store CPA Data.

1) Security Control Verification. Upon Contract award and annually thereafter, Successful Respondent shall provide to CPA evidence that it has implemented security controls correctly, the controls are operating as intended, and the controls are producing the desired outcome with respect to meeting security requirements for the information system. Acceptable documentation includes:

• SSAE-18 SOC 2 Type II Report (or the updated, equivalent report);

• FedRAMP certification (CPA preferred option for CSP);

• Level Two: Cloud Security Alliance (CSA) Security, Trust & Assurance Registry (STAR) Attestation;

• Level Two: CSA STAR Certification;

• Level One: CSA STAR Self-Assessment;

• Completed CSA Cloud Controls Matrix (CCM) and CSA Consensus Assessment Initiative

Questionnaire;

• CSA CCM;

• Successful Respondent information security plan; and

• Successful Respondent information security policies and procedures.

2) Department of Information Resources Security Controls Standards Catalog. At a minimum, Successful Respondent shall comply with the control baselines established by the DIR Security Controls Standards Catalog, all CPA specific security requirements, and any other applicable federal or statutory requirements.

3) Penetration Test. Successful Respondent shall ensure that information system(s) that receive, process, transmit, or store CPA Data undergo an independent third-party annual penetration test. Successful Respondent shall provide a summary of the penetration test results to CPA annually thirty (30) days prior to the anniversary of the Contract award date. Successful Respondent shall coordinate with CPA to schedule the initial penetration test and subsequent annual penetration tests during the Contract Term.

https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdir.texas.gov%2Fresource-library-item%2Ftexas-risk-and-authorization-management-program-manual-30&data=05%7C02%7CJason.Frizzell%40cpa.texas.gov%7C9b22e092447c41d9816108dd30f4dbc3%7C2055feba299d4d0daa5a73b8b42fef08%7C0%7C0%7C638720550387877709%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=dFBcq3mGLKSAe5BKAYCH%2FFcMW6eaImJiVx85PviOPho%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdir.texas.gov%2Fresource-library-item%2Ftexas-risk-and-authorization-management-program-manual-30&data=05%7C02%7CJason.Frizzell%40cpa.texas.gov%7C9b22e092447c41d9816108dd30f4dbc3%7C2055feba299d4d0daa5a73b8b42fef08%7C0%7C0%7C638720550387877709%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=dFBcq3mGLKSAe5BKAYCH%2FFcMW6eaImJiVx85PviOPho%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdir.texas.gov%2Fresource-library-item%2Ftexas-risk-and-authorization-management-program-manual-30&data=05%7C02%7CJason.Frizzell%40cpa.texas.gov%7C9b22e092447c41d9816108dd30f4dbc3%7C2055feba299d4d0daa5a73b8b42fef08%7C0%7C0%7C638720550387877709%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=dFBcq3mGLKSAe5BKAYCH%2FFcMW6eaImJiVx85PviOPho%3D&reserved=0 https://gcc02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdir.texas.gov%2Fresource-library-item%2Ftexas-risk-and-authorization-management-program-manual-30&data=05%7C02%7CJason.Frizzell%40cpa.texas.gov%7C9b22e092447c41d9816108dd30f4dbc3%7C2055feba299d4d0daa5a73b8b42fef08%7C0%7C0%7C638720550387877709%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=dFBcq3mGLKSAe5BKAYCH%2FFcMW6eaImJiVx85PviOPho%3D&reserved=0 https://dir.texas.gov/resource-library-item/security-controls-standards-catalog https://dir.texas.gov/resource-library-item/security-controls-standards-catalog

RFO # 304-27-1020AM Element LMS SW & Svcs Page 12 of 45

4) Information System(s) Architecture. For information system(s) that receive, process, transmit, or store CPA Data, Successful Respondent shall develop and maintain a comprehensive architectural diagram that identifies the information system (s) components and environment, including ports, protocols, and services.

Successful Respondent shall protect the architectural diagram from unauthorized access, disclosure, modification, and /or destruction. Successful Respondent shall provide the diagram to CPA annually.

5) Configuration Minimum Requirements.

a. Successful Respondent shall implement (SAML) an XML-based standard (CPA preferred) or OpenID Connect (OIDC) for exchanging authentication and authorization data for identity management of CPA internal users. If Successful Respondent is technically incapable of integrating with CPA’s identity services provider, Successful Respondent shall ensure identifier and authenticator controls are consistent with CPA standards.

b. Account Management. Successful Respondent shall administer accounts as follows:

i. Remove root access, where feasible, to information system(s) that receive, process, transmit, or store

CPA Data.

ii. Prohibit Privileged User access to CPA data on information system(s) that receive, process, transmit, or store CPA data.

iii. Employ multifactor authentication for Privileged Users who support information system(s) that receive, process, transmit, or store CPA Data when accessing CPA Information System(s).

Multifactor authentication shall be consistent with the current version of the National Institute of Standards and Technology (NIST) Digital Identity Guidelines Identity Authentication Level 2 (IAL2) and Authentication Assurance Level 2 (AAL2).

iv. Require multifactor authentication for CPA customers who access an information system(s) that receive, process, or store CPA data. Multifactor authentication shall be consistent with NIST Digital Identity Guidelines IAL2 and AALs.

v. Require passwords to be a minimum of 15 characters and PINs to be a minimum of 8 characters.

Successful Respondent shall allow Users to select random numbers, letters, and symbols, including blank spaces to create passwords and pins. Successful Respondent shall not impose specific complexity requirements, such as at least one capital letter, one number, and one symbol. Successful Respondent shall provide all Users password education that helps Users create strong passwords using passphrases and/or password strength meter tools.

vi. Use automated controls to deactivate/disable inactive accounts to ensure only authorized users access CPA Information Systems. Successful Respondent shall establish account reactivation procedures that are consistent with NIST Digital Identity Guidelines Identity Assurance Level 2 and authentication must be consistent with NIST Digital Identify Guidelines Authentication Assurance Level 2.

c. Pursuant to Section 2063.104 of the Texas Government Code, Privileged Users that have access to a CPA Information System shall complete the CPA-Required Security Awareness Training described in Part D.4.e) above.

d. Secure Baseline Configuration. Successful Respondent shall develop secure baseline configurations for Secure Baseline Configuration. Successful Respondent shall develop secure baseline configurations for information system(s), components, or services that receive, process, transmit, or store CPA Data in accordance with industry best practices (e.g., U.S. Government Configuration Baseline (USGCB), Center for Internet Security (CIS) Benchmarks). In the absence of an industry defined secure configuration, Successful Respondent shall develop a baseline for information system(s), components, or services in collaboration with CPA.

e. Audit Information. For information system(s) that receive, process, transmit, or store CPA Data, Successful Respondent shall enable information system(s) auditing to the greatest extent necessary to capture access, modification, and deletion of data by each unique user and Privileged User system access and actions. Audit controls shall ensure the movement of sensitive, confidential, and regulated data is traceable throughout the data lifecycle. Audit records shall contain date, time, type, source, and outcome of system event, the user account involved, service account, service, or process responsible for initiating the system event, and other information that facilitates reconstruction of events. Successful Respondent shall protect audit information from unauthorized access and modification. Successful Respondent shall share audit information with CPA upon request.

f. Successful Respondent shall configure information system(s) that receive, process, transmit, or store CPA Data to deny local network mapping and prevent copy and paste from the information system(s) to unapproved workstations, laptops, or terminals.

6) Configuration Management Plan. Successful Respondent shall develop a Configuration Management Plan for information system(s) that receive, process, transmit, or store CPA Data. The Configuration Management

RFO # 304-27-1020AM Element LMS SW & Svcs Page 13 of 45

Plan must include a comprehensive description of the roles, responsibilities, policies, and procedures that apply when managing the configuration of products and systems. The Configuration Management Plan may be an all-inclusive, stand-alone document or may be comprised of more broadly defined configuration management procedures contained in multiple documents. CPA shall review and approve the Configuration Management Plan annually during the contract term. Successful Respondent shall treat the Configuration Management Plan as confidential CPA information and protect the Configuration Management Plan from unauthorized disclosure and modification.

7) Data Center Resiliency, Environmental Protections, and Physical Security. Successful Respondent shall provide multiple geographic regions and availability zones to ensure resiliency in the event of natural disasters, common equipment failures, or information system failures. The data center(s) shall ensure electrical power systems are fully redundant and maintainable without interruption to continuous operations.

Data center(s) shall provide backup power through various mechanisms including, but not limited to, UPS batteries. Data center(s) backup power shall supply consistently reliable power protection during utility brownouts, blackouts, over voltage, under voltage, and out-of-tolerance frequency conditions. The data center(s) shall use generators to provide power to critical equipment and customer loads. Trained security personnel shall staff the data center(s) twenty-four (24) hours a day, seven (7) days a week. Data center(s) shall use a security organization responsible for physical security functions to monitor its data center(s). The data center(s) shall have state-of-the-art electronic surveillance and multi-factor access control systems.

Successful Respondent and/or CSP shall authorize physical access to its data center(s) strictly on a least privilege basis and access control systems shall log unauthorized activity and failed access attempts.

8) Roles and Responsibilities. Successful Respondent and CPA shall define and document CPA oversight and user roles and responsibilities with regard to the outsourced and/or CSP information system(s) that receive, process, transmit, or store CPA Data.

9) Vulnerability Assessment and Continuous Monitoring. For information system(s) that receive, process, transmit, or store CPA Data, Successful Respondent shall employ vulnerability scanning tools and techniques to identify information system(s) flaws, improper configurations, and vulnerabilities. Successful Respondent shall conduct information system(s) scans at least monthly and remediate and mitigate vulnerabilities in accordance with the National Institute of Standards and Technology National Vulnerability Database Common Vulnerability Scoring System (CVSS). Successful Respondent shall report vulnerability assessment results and remediation efforts to CPA on a monthly basis.

10) Security Control Testing and Plan of Action and Milestones. Successful Respondent shall coordinate with CPA information security analysts to observe or conduct manual or automated testing of the controls Successful Respondent implements on the CPA Information System(s). The end goal of coordination between Successful Respondent and CPA’s information security analysts is to produce a System Security Plan for CPA’s Information System that validates cybersecurity controls are implemented correctly and operating as intended, and to document system findings and track remediation in a Plan of Action and Milestones throughout the Contract Term.

11) Cybersecurity Controls. Successful Respondent shall implement and maintain appropriate preventive, deterrent, detective, corrective, compensating, and directive cybersecurity controls to protect the CPA Information System and CPA Data from malicious actors and security incidents. The cybersecurity controls of this section apply to the Successful Respondent’s cloud service providers and subcontractors who have access to any CPA Information System and the environment in which the CPA Information System is hosted.

Successful Respondent shall provide a detailed description of the preventive, deterrent, detective, corrective, compensating, and directive cybersecurity controls that it will implement and maintain to protect CPA Information System(s). Successful Respondent shall structure the description as follows:

a. Preventive Controls. Successful Respondent shall ensure it employs appropriate preventive controls to protect CPA Information System infrastructure and application(s) from threats and attacks. Preventative controls include but are not limited to system and application hardening, firewalls, an intrusion prevention system, antivirus software, regular software updates, and account management policies, and a security and privacy awareness training program.

b. Deterrent Controls. Successful Respondent shall ensure it employs appropriate deterrent controls to reduce the likelihood of attacks and ensure staff practice good cyber hygiene. Deterrent controls include but are not limited to warning signs, login banners, security guards, lighting, and security policies.

c. Detective Controls. Successful Respondent shall ensure it employs appropriate detective controls to identify when an event has occurred that impacts a CPA Information System. Detective controls include but are not limited to security incident event management tools (SIEM), intrusion detection system, motion detectors, and video surveillance cameras.

RFO # 304-27-1020AM Element LMS SW & Svcs Page 14 of 45

d. Corrective Controls. Successful Respondent shall ensure it employs appropriate corrective controls to reverse damage to a CPA Information System caused by a security incident and return the CPA Information System to normal operations as soon as…