TX-UNPS Access for Child Nutrition Programs

REQUEST FOR OFFER (RFO)

DATE ISSUED

8/6/2026

Respondent must submit sealed response no later than 3:00 PM CT on through 9/8/2026, to the following address:

Attention: bidroom@texasagriculture.gov For information contact:

Rhonda Gips Phone: (512) 463-7710 E-mail: Rhonda.Gips@TexasAgriculture.gov

RESPONSE (Respondent must fully complete)

ACKNOWLEDGMENT OF ADDENDA:

(Respondent acknowledges receipt of Solicitation addenda and related documents numbered and dated:

NAME AND ADDRESS

OF RESPONDENT:

SIGNATURE OF AUTHORIZED REPRESENTATIVE

NAME AND TITLE OF AUTHORIZED REPRESENTATIVE

CERTIFICATION, DISQUALIFICATION, AND REMEDIES. Respondent must submit its response electronically to Bidroom@texasagriculture.gov before the due date and time posted on posted on the Electronic State Business Daily (ESBD)

ATTENTION: It is the responsibility of interested parties to periodically check the above method for updates to this solicitation prior to submitting a response. Respondent’s failure to periodically check the method above will in no way release the selected Respondent (Contractor) from “addenda or additional information” resulting in additional costs to meet the requirements of this solicitation.

By signing this document, Respondent represents and warrants that all statements, certifications, and information submitted in response to this solicitation are true, current, complete, and accurate. Failure to sign will disqualify response. TDA may pursue and enforce any available remedies against Respondent for making false statements, including disqualifying Respondent’s response, immediately cancelling any Contract awarded to Successful Respondent, or recommending State of Texas debarment.

Page intentionally left blank.

Texas Department of Agriculture

PCO 805 RFx Template Version 5.3 Revision 06.26.2026

Table of Contents

PCO 805 RFX Template Page 2 of 2 Version 5.3 Revised 06.26.2026

SECTION I – INTRODUCTION AND STATEMENT OF WORK

INTRODUCTION

The Texas Department of Agriculture (TDA or Department), an agency of the State of Texas, issues this REQUEST FOR OFFER (RFO) to solicit responses from qualified Respondents for a web-based solution to process applications, claims, track compliance, perform reviews, etc., to manage twelve (12) United States Department of Agriculture (USDA) federal nutrition programs, as described in this Section I and in this solicitation. TDA’s objective is to obtain the services that represent the best value for TDA and the State of Texas, according to the terms and conditions of this solicitation.

Respondents to this solicitation must be capable of providing services for the existing Texas Unified Nutrition Programs System (TX-UNPS) system operations of TX-UNPS modules and must have a full software license for the existing software, or sufficient license as may be necessary to provide the services requested. Respondents must also be qualified as a vendor capable of hosting the software, providing current levels of system maintenance which align with customer’s support processes, and be capable of providing enhancements as necessary or upon customer’s request.

RESPONDENTS ARE CAUTIONED TO READ THE INFORMATION CONTAINED IN THIS SOLICITATION CAREFULLY AND TO SUBMIT A COMPLETE RESPONSE TO ALL REQUIREMENTS AND QUESTIONS AS DIRECTED.

All costs associated with the solicitation must be included in Respondent’s Offer. Solicitation responses that do not meet all the requirements or contain all the required documentation specified in this solicitation may be rejected as non-responsive.

BackGRound Established by the Texas Legislature in 1907, TDA was created to gather statistics on crops and livestock and to educate farmers on advanced farming methods and practices. Over time, TDA’s responsibilities expanded significantly, including the absorption of the Texas Department of Rural Affairs and the State Office of Rural Health in 2011.

TDA touches the lives of nearly every Texas citizen and is charged with protecting consumers by ensuring standards are upheld with licensed professionals and businesses. These standards provide an environment for consumers to conduct business with confidence with those licensees. TDA serves the public by providing public protection, consumer confidence and health protection.

The Department has regulatory responsibility to ensure licenses are appropriately issued and renewed. TDA strives to provide accessible and responsive services that strengthen public safety and consumer protection. Today, TDA performs a wide variety of regulatory, nutrition, economic development, and marketing activities, such as:

1) Regulating the production and transport of agricultural commodities and reviewing commodity board budgets;

2) Administering numerous federal and state nutrition assistance programs for children and adults;

3) Regulating agriculture-related activities in the marketplace to protect consumers, such as retail package content and weighting device calibration and the registration and use of agricultural, residential, and commercial site pesticide applications;

4) Providing financial assistance for agribusinesses and rural enterprises, rural healthcare facilities, and community infrastructure projects to promote economic development in rural Texas; and

5) Promoting Texas agricultural and rural products locally, nationally, and internationally.

6) TDA administers the USDA Nutrition Assistance Programs within the State of Texas. USDA established these programs to improve food access for children and adults in need. TDA uses TX-UNPS to unify and streamline its Food and Nutrition Programs by implementing an integrated, web-based solution to process applications, claims, track compliance, perform administrative reviews, and provide data reports for internal and external customers.

Legal Authority

This solicitation is issued pursuant to TDA's authority in Chapter 12 of the Texas Agriculture Code and pursuant to Texas Government Code, Section §2155.131 and Sections §§2156.121 – 2156.127, as well as 34 TAC §20.82. Competitive sealed Offers will be received before the deadline set forth below in this solicitation.

Definitions The words and terms listed below have the following meanings unless the context clearly indicates otherwise. These definitions shall apply to this solicitation, including the terms and conditions attached to the solicitation, and any Contract entered into by the parties as a result of this solicitation.

1) Addendum means a written clarification or revision to the solicitation issued by the TDA. Respondent must acknowledge receipt of any addenda in the submission of the Offer.

2) Amendment means the final written agreement signed and dated by TDA and Respondent(s) selected for an award as a result of this solicitation subsequent to the effective date of the Contract, which amends, changes, extends, modifies or revises the Contract.

3) Business Days means Monday through Friday except for federal, state, and legal holidays observed by the State of Texas.

4) Centralized Master Bidders List (CMBL) is a public website comprised of businesses interested in contracting with the state and maintained by the Texas Comptroller. It can be used by Respondents to identify potential respondents and VetHUBs.

5) Contract means the final written agreement signed and dated by TDA and the respondent(s) selected for an award as a result of this solicitation, and includes the solicitation and all attachments, the offer(s) of any respondent(s) selected for an award, any appendices, final offer(s), amendments to the solicitation, schedules, or special provisions incorporated into the Contract. This term also includes a purchase order. Purchase order is a legal document between two (2) parties to purchase and sell commodities and/or services.

6) Contractor means an entity or individual selected for an award as a result of this solicitation and that enters into a Contract to complete the Scope of Work described in this solicitation and the Contract.

7) Contract Manager means a person designated by TDA or Contractor that is responsible for invoicing and payment under the Contract, and for monitoring the overall progress of the Scope of Work required by the Contract. Either party may designate the same individual to be both the Contract Manager and the Project Manager.

8) Days means calendar days unless otherwise specified.

9) Effective Date means the date TDA's Deputy Commissioner or duly authorized designee signs and dates a Contract resulting from this solicitation.

10) Electronic State Business Daily (ESBD) means the public website for posting state contracting opportunities managed by the Texas Comptroller of Public Accounts (CPA)

11) Intellectual Property means worldwide legal rights or interests in intangible property evidenced by or embodied in: (1) any idea, design, concept, method, process, technique, apparatus, invention, discovery, or improvement that is capable of being patented; (2) any copyright or patent; (3) any work that is capable of being copyrighted, including moral rights or neighboring rights; (4) any trademark, service mark, certification mark, trade dress, trade name, or other indicia of source or origin; (5) any design, display, graphic design, letter or letter combination, logo, mark, number or number combination, phrase, word or word combination that indicates the origin, quality or source of goods or services and that is capable of being copyrighted; and (6) any rights, interests or property similar in kind or nature to the rights, interests or property created or resulting from this solicitation. The intellectual property of a party includes all worldwide intangible legal rights or interests that the party may have acquired by assignment or license with the right to grant sublicenses.

12) Project means the purpose, result, or work to be accomplished as a result of the Contract.

13) Project Manager means the person assigned by TDA or Contractor that is responsible for managing the day-to-day work of the Contract.

14) Proposal means a response submitted to TDA as a result of this solicitation.

15) Respondent means an entity or individual that submits a proposal or offer.

16) Scope of Work or Statement of Work (SOW) means the deliverables, services and work set out and defined in the Contract and described in this solicitation.

17) Solicitation means this REQUEST FOR OFFER (RFO).

18) Successful Respondent means the respondent awarded a Contract resulting from this solicitation.

19) TDA means the Texas Department of Agriculture. TDA may also be referred to as the "Department."

20) Veteran Heroes United in Business (VetHUB) Program refers to a statewide procurement program administered by the Texas Comptroller of Public Accounts pursuant to Chapter 2161 of the Texas Government Code and 34 Texas Administrative Code Part 1, Chapter 20.

Scope of Work/Specifications TDA is seeking an offer(s) from highly qualified Respondent to provide host, provide maintenance, ad hoc reporting support and enhancement of TDA’s web-based application, claiming and compliance system, TX-UNPS. Respondent chosen by TDA must be an experienced Contractor demonstrating a thorough understanding of the purpose and scope of the RFO herein. TDA will oversee all performance, as further described in this Statement of Work (SOW).

Goals and Objectives The goal of this solicitation is to obtain services from a Contractor who will provide TDA and its program participants with solutions meeting all of the following requirements and goals.

1. Maintain the current system in full compliance with federal laws and USDA regulations, as regulations are updated or changed;

2. Support state-operated Food and Nutrition Programs;

3. Maintain all existing data currently in TX-UNPS;

4. Maintain all new data added to TX-UNPS;

5. Provide software maintenance and project management support;

6. Maintain the system’s hardware and operating systems (including making updates to accommodate changes in the volume and traffic of users and data);

7. Ensure that the development and test environments are in good operating condition;

8. Maintain the system application and database;

9. Provide access to the Data Warehouse database;

10. Provide system support in terms of training and system documentation;

11. Ensure the production environment is functional; and

12. Ensure user security administrative data integrates and provides a single point of sign-on access.

Deliverables The awarded Respondent, if any, will deliver the following, as noted in Contractor Requirements:

1. Maintenance Services,

2. Hosting Services,

3. Data Encryption,

4. Ad Hoc Reports,

5. System Enhancement,

6. Project Management Support,

7. USDA Regular Maintenance, and

8. Other Support Activities.

reporting Requirements Successful Respondent shall maintain records, collect data, and provide reports as requested by TDA. Any reports requested will be submitted via e-mail to designated TDA staff. TDA may utilize these reports as part of its review and oversight of Successful Respondent’s performance.

Successful Respondent shall submit to TDA its reports that contain all the following information:

1) Provide TDA a quarterly TX-UNPS Management Report that identifies work completed and work planned for the upcoming quarter.

2) Provide dedicated Project Management support to ensure successful implementation of all agreed upon services and deliverables. The Project Management must:

a) Provide weekly status reports including but not limited to defect status, build number, targeted build date, and priority to TDA related to the implementation of enhancements and bug fixes.

b) Keep agreed upon project plans up to date and accurate and share updated plans with TDA.

c) Schedule biweekly calls with TDA to coordinate system activities.

d) Ensure enhancement and bug ticketing systems are kept up to date and accurate.

PROJECT CALENDAR (Implementation) The proposed schedule will ensure the completion of deliverables by specified dates. Workflow and milestones such as training, deliverables, invoicing, and quality assurance activities should be included.

PROJECT PLAN – PRICE TO VALUE/BEST VALUE

While price is not the sole deciding factor, TDA expects the Cost Proposal to be based on the best value for the price proposed. This requires submission of a Project Plan that aligns costs, resources, and activities for an overall determination of best value for the price.

A draft Project Plan detailing how Respondent will provide or implement the requirements of this solicitation must be included within Respondent’s response.

The draft Project Plan must detail how Respondent would address the following:

1) A description of the project organization;

2) A breakdown and detailed description of the different deliverables of the Project;

3) Expected dependencies that exist within the Project Plan;

4) A schedule and work plan for the different deliverables of the Project;

5) Any dependencies, caveats, or risks associated with the schedule; and

6) The methodology Respondent will employ to ensure the schedule for each deliverable is met.

INVOICING AND PAYMENT

The following procedures apply to invoicing and payment in addition to those listed in Exhibit A, Execution of Offer, Affirmation of Terms and Conditions, and Proposal Preferences, Paragraph 11 and 12.

Invoice Submission Successful Respondent must submit invoices electronically to Texas Department of Agriculture, Accounts Payable, invoices@texasagriculture.gov , or mail to P.O. Box 12847, Austin, TX 78711-2847.

Invoices must include:

1) Name of Contractor: Exactly as shown on the Contract;

2) Texas Identification Number (TIN): Required for identification;

3) Correct "Remit to" address: Must be accurate for properly delivery;

Texas Department of Agriculture 1700 N. Congress Ave.

Austin, TX 78701

4) Contract/Purchase Order number: Essential for tracking and reference;

5) Description, quantity, and amount: Detailed information about the goods or services provided by unit of measure, unit price, extended price of each item;

6) Total price;

7) Discount, if applicable, extended and deducted to arrive at a NET TOTAL for invoice; and

8) Attach supporting documentation, if required.

Payment:

1) Payment will be made in accordance with the Texas Prompt Payment Act, Texas Government Code, Chapter 2251. Payment normally will be made to Contractor within thirty (30) days after receipt of a properly prepared invoice or the receipt of and the acceptance of services ordered, whichever is later. State agencies are required by Chapter 2251 to pay properly submitted invoices within thirty (30) days or Contractor may charge a late payment fee established by law. Any Contract resulting from this solicitation is contingent upon the continued availability of lawful appropriations by the Texas Legislature.

2) Under no circumstances shall TDA be obligated to make any payment (whether a progress payment or final payment) to Contractor, if any of the following conditions exists:

a. Contractor is in breach of the Contract;

b. Any portion of a payment is for services that were not performed in accordance with the Contract provided, however, payment shall be made for those services which were performed in accordance with the Contract;

c. Contractor has failed to make payments promptly to consultants or other third parties used in connection with services for which TDA has made payment to Contractor;

d. If TDA, in good faith, determines that the balance of the unpaid fees is not sufficient to complete the services in accordance with the Contract; or if Contractor has failed to achieve a level of performance necessary to maintain the project schedule. No deductions shall be made from Contractor’s compensation on account of liquidated damages or other sums withheld from payments to other Contractors or on account of the cost of changes in the work other than those for which Contractor may be liable;

e. Payments for services purchased with state appropriated funds will be made through state warrants issued by the Texas Comptroller of Public Accounts. Payments by qualified ordering entities will be made through the entities’ local payment system;

f. Any additional expenses incurred by Contractor are the responsibility of Contractor and will not be paid by TDA; and

g. TDA will not pay any per diem, travel, hotel, equipment, phone calls, paper, reproduction services, office space, or other incidental expenses related to performing the services required by the Contract.

Performance and Service Level Expectations

7.1 TDA Responsibilities

TDA is responsible for planning, leading, and executing the work activities that are required for the completion of the Project. TDA will look solely to Respondent for the performance of all contractual obligations that may result from an award based on this solicitation.

Respondent shall not be relieved of its obligations for any nonperformance by its subcontractors.

TDA’s Project and Contract Manager shall be responsible for the following tasks:

1) TDA will provide a Project Manager to coordinate all major system activities with the Contractor.

2) TDA Project Manager will approve acceptance of all deliverables.

3) TDA will edit/approve timelines for all services/deliverables.

4) TDA will provide a first draft of all proposed enhancements for the Contractor to review (business requirements) and provide input during Joint Application Development (JAD) sessions to develop the final design.

5) TDA shall utilize the issue tracking system, provided by Contractor, for communication with Contractor related to questions, defects, and issues.

6) TDA shall perform robust User Acceptance Testing (UAT) activities to ensure all software issues are resolved prior to deployment into Production. Testing must occur in a timely manner. TDA’s testing of software changes, either defect correction or enhancements, must be completed within a mutually defined test period, based on the complexity of the defect or enhancement, in order to ensure that the TX-UNPS production environment is current, meets regulatory requirements, and does not allow for persistence of a defect that adversely impacts functionality of data.

7) Collaboratively, TDA and Contractor will determine defect/enhancement complexity with Contractor proposing initial estimates. Contractor understands that significant software modification may require an extension of the test period, upon mutual agreement and understanding of impact to other software components.

0. Contractor Responsibilities Contractor is responsible for planning, leading, and executing the work activities that are required for the completion of the Project. TDA will oversee the Contractor’s Project and Contract Manager shall be responsible for the following tasks:

1) Manage the Project consistent with the approved Project Plan;

2) Dedicate a Project Manager and Contract Manager, or assign both duties to a single staff member;

3) Respond to support requests and resolve escalated issues within agreed upon time frames.

4) Notify the TDA Project Manager of any requests for copies of records from third parties not party to the Contract.

Maintenance Services

1. Contractor must have a license for use or ownership of the software system used to operate TX-UNPS.

2. Maintain the hardware and operating system and ensure that the TX-UNPS development and test environments at Contractor’s facility are in good operating condition. These environments must be available to TDA 99% of the time.

3. Be responsible for ensuring the production environment of TX-UNPS is functioning 7x24x365 except during agreed upon maintenance windows.

4. Perform USDA Regulation Software Maintenance to modify and enhance TX-UNPS to be in compliance with state and federal laws and USDA regulations that result in needed modifications to existing screens in TX-UNPS. This includes updates to the system to ensure TDA can adjust Administrative Review questions to ensure compliance with state and USDA regulations on an annual basis. All regulatory updates must be completed by the implementation dates established by USDA.

5. Be responsible for maintaining the TX-UNPS application and database in the TX-UNPS UAT. Training and Production environments.

6. Perform database refresh activities in a timely manner.

7. Provide state agency users, as requested by TDA, access to the TX-UNPS Data Warehouse database via additional Microsoft SQL User IDs and database ports.

8. Correct all TX-UNPS errors and defects reported by TDA within thirty (30) calendar days.

9. Provide TDA a customer service and maintenance plan at the start of each Contract year.

· Plan must include a process to establish an orderly and effective procedure for tracking the submission, evaluation, categorization, and escalation/resolution for TX-UNPS software support issues.

· At a minimum, the service agreement should meet the below for bug resolution:

i. Level 1 Issue:

· Severe problem(s) affecting production, normal service has been disrupted for more than 25% of system users, or major system component inoperative (e.g. claims payment function) must be resolved within four (4) hours.

ii. Level 2 Issue:

· Problem has significant, to moderate impact, partial loss of critical business function during normal business hours, system operating with severe limitation, or business units unable to perform one (1) or more functions must be resolved within five (5) business days.

iii. Level 3 Issue:

· Problem has minor to low impact, TDA business units able to function with reduced capacity or function. Non-critical TDA group or system functionality impacted, or reasonable work-arounds exist must be resolved within 30 calendar days.

10. Maintain general available support hours and access to Contractor Project Manager support Monday through Friday from 6:00am to 6:00pm CST.

11. Maintain access to an issue tracking system to submit, monitor, track, and resolve issues.

12. Maintain a routine maintenance schedule and backups are required for the system to perform optimally and provide the ability to recover from a disaster.

13. Ensure the help feature within TX-UNPS system is always up to date and accurate. Help Feature must reflect actual functionality of the system and include system updates.

Hosting

1. Contractors must manage testing, training, and production environments.

2. Provide corrective maintenance activities associated with the maintenance of the TX-UNPS technology environment including hardware, operating system, and connectivity.

3. Perform a daily full backup that is available for TDA personnel to access from the Data Warehouse database server.

4. Provide all software licensing specific to the TX-UNPS application.

5. Provide application monitoring including TX-UNPS environment, including network activity, database, and website.

6. Install upgrades as part of the pre-existing enhancement and/or problem ticket process.

7. Hardware environment will be reviewed annually to ensure that the configuration is sufficient to satisfy the activity and data demands of the system.

8. Full backups must be performed daily during the scheduled window of 10:00pm and 4:30am CST each evening.

9. Work with a Hosting provider to ensure that appropriate patches are implemented, as needed.

10. 99% availability service level must be maintained, excluding allocated maintenance windows. All reported issues must be corrected within one (1) business day.

11. Servers must be monitored 24 hours a day, every day of the year, in 5-second intervals. A blend of third-party products, in-house developed solutions, and 24x7x365 staff monitoring, Central Processing Unit (CPU), and memory usage, and other items to ensure the stability and reliability of the network, servers, and websites.

12. Monthly patch and fix management must be automatically pre-scheduled for any operating system, database software, and support software that is part of the dedicated server. There are two (2) options in this area. Patches and fix activities are performed on a scheduled basis, generally once per month. For patching that is deemed low risk/minimal time, the Contractor is authorized to perform the required activities during a pre-set scheduled outage window. For patches that the Contractor deems “significant”, TDA will be notified and formally schedules a window for the patching to occur. At any time, the Contractor/TDA could decide to not allow a patch to be implemented if there is a concern that the patch may adversely impact the operational environment.

13. A scheduled task must be set up to defragment the server’s file system twice per month. In addition, manual defragmentation will occur if fragmentation is at or over 10%.

14. Review the hardware and its configuration in order to ensure that it satisfies the data and network traffic demands it is encountering on an annual basis. In addition, if system software has experienced a major release (n+1), Contractor will work with TDA to determine if there is a desire to upgrade the system’s operational software (i.e., operating system, database management system, etc.).

15. Put disaster recovery procedures in place to provide a process for recovery from a catastrophic outage of hosting facility. In the event such an outage occurs, the Contractor will re-host the production application to a different location immediately.

16. Maintain a copy of the production website at all times. This copy mirrors the website production copy will be available immediately when re-hosting the application.

17. Contractor must obtain nightly backups of the production database. In the case of a catastrophic failure at the hosting facility, the Contractor will notify the Contract Manager and use the most recent nightly backup when re-hosting the application.

18. Provide firewall and anti-virus protection activities.

19. Network availability 99% of time must be maintained.

20. The target availability of the WAN and virtual LAN environment is 99.0% excluding scheduled maintenance windows. The network is scheduled to be available 24x7x365 excluding scheduled maintenance windows. Network availability includes external access to TX-UNPS As well as TDA access to TX-UNPS.

21. Packet loss of greater than 5% and/or a transmission latency of greater than 1,000 milliseconds, round trip time between any data centers.

22. Provide system backup including sufficient storage and frequency.

Data Encryption

1. All data and documents uploaded into the system must be encrypted. This includes data encryption at rest.

System Enhancements

1. The Contractor must implement agreed upon changes and enhancements according to a documented project schedule at the start of each Contract year. The Contractor must be able to meet agreed upon delivery due dates including the delivery of design documents, UAT date, and production date established each quarter. The schedule must allocate windows of time to allow for bug builds to ensure bugs are resolved according to the above schedule.

2. TDA is responsible for providing a high-level overview of business needs for any desired system enhancements to the Contractor.

3. Contractor is responsible for providing TDA detailed requirement in the form of a design document for changes during the contract period and a cost for said modifications will be determined by Contractor. The design document must include additional detail outside of the business requirements provided by TDA and must outline the functionality that will accomplish desired business needs. The enhancement must be implemented according to an agreed upon schedule by TDA and the Contractor. Agreed upon design documents must be signed by both parties prior to any enhancement work beginning. Design documents should provide a detailed solution approach, identifying requirements across the solution components and represent design options to meet the business functional requirements including:

· Data flow diagrams, system mockups/designs of program.

· Items that will affect other parts of the system as well as internal/external interfaces.

· Limitations of the system and what are not feasible along with an alternative workable solution and if the need could be included in other programs.

4. Contractor must attend quarterly joint application design sessions at TDA to determine the purpose and scope of enhancement design.

5. Contract must provide enhancement specifications to state agency staff prior to the testing of changes and enhancements. Contractor shall appropriately document all new functionalities and changes, whether maintenance, regulatory or custom changes. Contractor shall provide TDA with copies of such documentation including user manual updates where applicable. For new functionalities and changes. Contractor shall provide technical specifications and database mapping, as appropriate. Contractor shall provide release notes for defect fixes.

6. Requested TDA enhancements must include thorough testing by the Contractor, including regression testing to ensure product received by TDA requires minimal edits.

7. Contractor must provide Release Notes prior to deployment of enhancements or updates to the production environment. Release Notes should include:

· Structured programming concepts,

· Quality Assurance (QA) development system integration testing results,

· Security updates,

· Updates made to any other components not defined in the design document.

Project Management

1. Provide TDA a quarterly TX-UNPS Management Report that identifies work completed and work planned for the upcoming quarter.

2. Provide dedicated Project Management support to ensure successful implementation of all agreed upon services and deliverables. The Project Management must:

· Provide weekly status reports including but not limited to defect status, build number, targeted build date, and priority to TDA related to the implementation of enhancements and bug fixes.

· Keep agreed upon project plans up to date and accurate and share updated plans with TDA.

· Schedule biweekly calls with TDA to coordinate system activities.

· Ensure enhancement and bug ticketing systems are kept up to date and accurate.

Ad Hoc Data Reports

1. Provide ad hoc data queries as requested by TDA and according to an agreed upon deliverable.

Other Support Activities

1. Provide an updated detailed and user-friendly manual related to the use of the system on an annual basis.

2. Contractor must provide TDA with an annual unqualified Systems and Organization Controls (SOC) 2, Type 2 Report for Service Organizations related to services provided by both Colyar system security, process and application controls and any third-party controls such as hosting services and controls; SOC report must be completed by a third-party independent accounting audit firm. SOC report must be provided to TDA upon completion. In the event a qualified opinion is issued in the SOC report due to a material weakness or significant deficiency, the vendor will promptly advise TDA of its plan for remedying the noted weaknesses and deficiencies and mitigate any potential adverse consequences resulting from the material weakness or significant deficiency. In lieu of a SOC 2 report, Contractor may obtain and maintain FedRamp certification.

3. Provide disaster recovery plan that ensures ongoing operation of the system to TDA annually. Plan must be provided to TDA upon completion.

4. On occasion, Contract may be required to participate in a TDA requested audit. Contractor and any subcontractor must be prepared to provide support related to audit inquiries. Contractor will be provided with requested documentation. Generally, ten (10) calendar days notification of the audit is required to ensure that the audit activities are properly scheduled, and sufficient time is allocated to researching and responding to audit requests.

5. Provide Security Audits and Assessments of accessibility, vulnerability, and interface security within fifteen (15) days notification of any request by TDA.

6. Contractor staff with front end access to TX-UNPS must take cybersecurity training on an annual basis, as directed by TDA.

7. Provide a Data Dictional to TDA with associated technical specifications and screen to database mappings (where applicable) for new functionalities and changes, including detailed functional and logical (including relational mappings to the existing data model) descriptions of all new fields and/or tables added to the database before items are moved from the User Acceptance Testing (UTA) environment to the Production environment. Functional Data Dictionary must be provided as a separate document from the Technical Data Dictionary. Functional Data Dictionary will be a tool for program users and must be understandable to non-technical users.

8. Provide TX-UNPS support to TDA through Contractor Help Desk during all TDA work hours (Monday through Friday, 6:00 am to 6:00 pm), with same day response to all issues.

9. Provide a web-based issue tracking system which provides TDA the ability to submit, review, and process TDA identified issues related to the TX-UNPS for TDA staff as deemed required by TDA. Contractor must maintain records to the we-based tracking system according to TDA record retention schedules.

10. Provide up to forty (40) hours of applicable training regarding changes to TX-UNPS for TDA staff as deemed required by TDA. Training will be geared toward end-users (not technical training).

11. Provide an Annual System Security Plan related to TX-UNPS and gives a general overview of how the vendor manages:

· Disaster Recovery

· Risk Management

· Physical Security

· Access Control

· Change Management

· Vulnerability Testing and Remediation

· Incident Response information Security Requirements Contractor shall adhere to the Texas Department of Information Resources’ (DIR) Information Resources Security and Risk Management Policy, Standards and Guidelines as published in Texas Administrative Code, Title 1, Part 10, Chapter 202 and as authorized by the Information Resources Management Act, Chapter 2054, of the Texas Government Code. (See Exhibit K, Data Security Requirements)

Contractor shall ensure that security controls for Information Resources (including all data and reports associated with the background checks conducted under any Contract awarded under this solicitation, hereinafter "IR'') are not bypassed or disabled.

Contractor shall ensure that:

1. Security awareness is continually emphasized, reinforced, updated, and validated;

2. The user must keep any data used in an IR system confidential and secure;

3. Contractor must take appropriate steps to ensure the integrity and security of all programs and data files created by, or acquired for, computer applications that will be utilized to perform the services requested by this solicitation;

4. TDA reserves the right to immediately terminate the Contract and cease all payment for services if Contractor does not comply with these security guidelines; if Contractor's IR security does not comply with industry standards; or if TDA does not consider Contractor's IR to be adequately secure;

5. The sale or release of data, reports or lists generated as a result of the services contemplated by this solicitation, to any entity, organization, or person other than TDA is strictly prohibited;

6. Contractor shall carefully assess the risk of unauthorized alteration, unauthorized disclosure or loss of the data for which it is responsible. Contractor shall immediately disclose any alterations, losses or risks to TDA in writing;

7. Contractor must have backup and contingency plans for disaster recovery based on risk assessment and business requirements;

8. Contractor is responsible for all, but not necessarily limited to, the following: the maintenance, monitoring and procurement of all computers, electronic devices, computer or network systems, contracts, leases, licenses, consulting arrangements or other agreements necessary for Contractor to deliver the services required by this solicitation; and

9. Contractor shall adhere to all other guidelines, laws, policies, practice standards, procedures and regulations promulgated by DIR, TDA, or the state that affect the Scope of Work contemplated by this solicitation.

TDA is solely responsible for data security, once the reports contemplated by this solicitation have been delivered to TDA, and the underlying data has been completely and permanently removed from Contractor's computers, electronic devices, networks, and/or systems.

1.

2.

3.

4.

5.

6.

7.

7.1.

7.2.

7.3.

7.3.1. Information Security Breach Requirements

In the event of a security breach with any sensitive or back-up data, Contractor shall immediately (within 24 hours) notify the following individuals:

· Chris Bunton, Chief Information Officer at Chris.Bunton@TexasAgriculture.gov or 512-475-0124 and

· Lena Wilson, TDA Assistant Commissioner, Food and Nutrition Division at Lena.Wilson@TexasAgriculture.gov or 512-463-8583.

Contractor shall provide the foregoing contact person(s) with all of the following information:

a) A description of the nature of the Security Incident;

b) The type of TDA information involved;

c) Who may have obtained the TDA information;

d) What steps Contractor has taken or will take to investigate the Security Incident;

e) What steps Contractor has taken or will take to mitigate any negative effect of the Security Incident; and

f) A point of contact for additional information.

Each day thereafter until the investigation is complete, Contractor shall provide TDA’s Information Security Officer with a written report regarding the status of the investigation and the following additional information as it becomes available:

a) Who is known or suspected to have gained unauthorized access to the TDA information;

b) Whether there is any knowledge if the TDA information has been abused for compromised;

c) What additional steps Contractor has taken or will take to investigate the Security Incident;

d) What steps Contractor has taken or will take to mitigate any negative effect or the Security Incident; and

e) What corrective action Contractor has taken or will take to prevent future similar unauthorized use or disclosure.

Contractor shall confer with TDA’s Information Security Officer regarding the proper course of the investigation and risk mitigation. TDA reserves the right to conduct an independent investigation of any Security Incident and should TDA choose to do so, Contractor shall cooperate fully by making resources, personnel, and systems access available to TDA and TDA’s authorized representative(s). Subject to review and approval of TDA’s Information Security Officer, Contractor, at its own cost, shall provide notice that satisfies the requirements of applicable law to individuals whose personal, confidential, or privileged data were compromised or likely compromised as a result of the Security Incident. If TDA, in its sole discretion, elects to send its own separate notice then all costs associated with preparing and providing notice shall be reimbursed to TDA by Contractor. If Contractor does not reimburse such costs within 30 days of TDA’s written request, then TDA shall have the right to collect such costs.

1. Ensure the production environments for TX-UNPS are functioning 24x7x365, except during agreed upon maintenance windows.

2. Correct all TX-UNPS system errors and defects in the entire system within current Service Level Agreements (SLAs).

3. Provide enhancement specifications to state agency staff prior to the testing of changes and enhancements. (An enhancement is any product change or upgrade that increases software capabilities beyond original system design).

4. Provide release updates to TDA for new functionalities and changes, including detailed functional and logical descriptions of all new fields and/or tables added to the database before items are moved from the UAT environment to the Production environment and/or Training environment.

5. Provide TX-UNPS support to users during all TDA work hours, with same day response to all issues. Ensure customer issues are logged, tracked, and available to TDA via access to the mutually agreed upon issue tracking system and reports.

6. Provide a web-based issue tracking system (i.e. Colyar Customer Hub site), which provides TDA the ability to submit, review, and process TDA identified issues related to the products. (The Colyar Customer Hub issue tracking system is developed and maintained by the vendor).

7. Perform database refresh activities in a timely manner (within five (5) business days of request).

8. Test and implement all changes to TX-UNPS required to keep TDA and all users up to date.

9. Provide TDA a quarterly TX-UNPS system Issue Reports that identifies work completed and work planned for the upcoming quarter.

10. Provide dedicated Project Management support for bi-weekly conference calls and any implementation efforts in support of the Contract period.

11. Provide Security Audits and Assessments of accessibility, vulnerability, and interface security within fifteen (15) days notification of any request by TDA.

12. Comply with the following Information Security Requirements:

Information Security Requirements

1. Contractor shall comply with all applicable state and federal laws and regulations regarding confidentiality, privacy, and security pertaining to TDA confidential information.

2. Access to sensitive or confidential TDA information. Contractor represents and warrants that it will take all necessary and appropriate action within its abilities to safeguard sensitive or confidential TDA information and to protect it from unauthorized disclosure. If communications with Contractor necessitate the release of confidential TDA information, a Nondisclosure Agreement must be signed by each individual who will require access to or may be exposed to that information. Contractor shall access TDA’s systems and sensitive or confidential TDA information only for the purposes for which it is authorized.

Contractor shall ensure that any sensitive or confidential TDA information in the custody of Contractor is properly sanitized or destroyed when the information is no longer required to be retained by TDA or Contractor in accordance with the Contract. Electron media used for storing any confidential TDA information must be sanitized by clearing, purging or destroying in accordance with National Institute of Standards and Technology (NIST) Special Publication 800-88 Guidelines for Media Sanitization. Contractor must maintain a record documenting the removal and completion of all sanitization procedures with the following information:

· Date and time of sanitization/destruction;

· Description of the items(s) and serial number(s) if applicable;

· Inventory number(s); and

· Procedures and tools used for sanitization/destruction.

No later than sixty (60) days from Contract expiration or termination or as otherwise specified in the Contract, Contractor must complete the sanitization and destruction of the data and provide to TDA all sanitization documentation.

Contractor shall not access, process, store or transmit Internal Revenue Service (IRS) Publication 1075 requirements if it accesses, processes, stores, or transmits IRS Federal Taxpayer Information.

3. Access to Internal TDA Network and Systems As a condition of gaining remote access to any internal TDA network and systems, Contractor must comply with TDA’s policies and procedures. TDA’s remote access request procedures will require Contractor to submit a Remote Access Request form for TDA’s review and approval. Remote access technologies provided by Contractor must be approved by TDA’s Information Security Officer. Individuals shall not access internal TDA network and systems from outside the United States. Individuals who are provided with access to the TDA network or systems will be required to participate in the TDA’s Security Awareness Training on at least an annual basis. The State of Texas and TDA’s Fiscal Year begins on September 1 and ends on August 31. Contractor shall maintain records of all individuals who have completed the TDA required security training for the duration of the individual’s employment with Contractor plus five (5) years. Upon TDA’s written request, Contractor shall provide copies of the certificates of completion for the TDA’s Security Awareness Training. On November 1 of each year, Contractor shall submit a list to TDA which identifies all individuals who have current access to TDA network or systems as well as the most recent training completion date for each individual. TDA, in its sole discretion, may deny network or system access to any individual that does not complete the TDA required training with thirty (30) calendar days following the date of TDA’s grant of access under the Contract.

TDA reserves the right to audit the security measures in effect on Contractor’s connected systems without prior warning. Contractor must secure its own connected systems in a manner consistent with an auditable information security framework. TDA’s audit can consist of a review of third-party audit results of Contractor’s security measures (e.g. (SAS) No. 70, ISO 27002 assessment). TDA also reserves the right to immediately terminate network and system connections not meeting such requirements.

TDA data shall not be accessed from, stored at, or transported to, locations outside of the United States. Where applicable, encryption shall conform to or exceed Federal Information Processing Standard (FIPS) 140-2:

· Backup media containing TDA data shall be encrypted at all times; and

· Transmission of TDA data across public networks shall be protected by encryption methods such as Virtual Private Network (VPN), Secure Shell File Transfer Protocol (SFTPS), or File Transfer Protocol over SSL/TLS (FTPS).

4. Duty to Disclose If circumstances change or additional information is obtained regarding any of the representations and warranties or any other disclosure statements provided by Contractor subsequent to the date of the Contract, Contractor shall so inform TDA. Contractor’s duty to disclose continues throughout the term of the Contract.

Project Change Management Any proposed changes to be made within the Contract, whether initiated by TDA or Contractor, must receive final written approval in the form of a Contract amendment and/or Purchase Order Change Notice (POCN).

Change in Scope All change orders are subject to…