STATEMENT OF WORK

TxDOT 936-09-54010

DATED: June 2026

1 - 7

TEXAS DEPARTMENT OF TRANSPORTATION

Manitou Cloud Services

1. REQUIREMENTS

This SOW is to provide Manitou Cloud Licenses and ongoing maintenance and support services to ensure the software remains functional, secure, and updated.

1.1. Functional Specifications: Bold Group Fire Alarm Monitoring Application called Manitou Cloud Services shall provide continuous, 24x7 Fire Alarm monitoring application support services for receiving signals from TxDOT fire alarm systems statewide. Services shall include real‑time event detection, alarm notification, escalation, incident tracking, and operational reporting to ensure system availability, security, and operational continuity.

1.2. Installation and Configuration: Vendor must maintain application integrity and version control in alignment with TxDOT ITD Cyber Security requirements.

1.3. System Requirements: Vendor must specify the method that will be used to deliver the software, login requirements, special system requirements, or other requirements to ensure software is fully functional within the TxDOT environment.

1.4. Warranty: Vendor must specify the Publisher’s standard warranty, maintenance, and support period and service levels including any limitations.

1.5. Maintenance and Support. Vendor must:

1.5.1. Provide standard product maintenance and support services included with the standard license such as annual updates, patches, and fixes needed to improve functionality and keep the software in working order.

1.5.2. Propose additional or enhanced maintenance and support plan options if available. TxDOT will select the level of maintenance and support needed. Reference Pricing Schedule.

1.5.3. Follow agreed-upon Patching/Upgrade process and TxDOT CAB procedures.

1.5.4. Provide support documentation to include, but not be limited to:

Support Policies, FAQs, Support SLAs, and Online Guides.

1.6. Deliverables

1.6.1. Operational 24x7 Fire Alarm monitoring service.

1.6.2. Alarm configuration and escalation documentation.

1.6.3. Reports on demand for system incident and alarm logs.

1.6.4. Reports on demand for alarm notification and response records.

1.6.5. As needed – Bold Group support supplied manufacturer for alarm notification, response records, system reports and alarm logs.

1.6.6. Support documentation including SLAs, escalation procedures, and contact information.

1.7. Acceptance Criteria

2 - 7

1.7.1. Alarm Monitoring Activation: Fire Alarm monitoring application services are fully operational and active on all TxDOT‑approved workstations at the TxDOT Central Alarm Monitoring Station, located at the Stassney Campus Headquarters, 6230 E. Stassney Lane, Austin, TX 78744, on a continuous 24x7 basis, including weekends and holidays. All configured fire alarms are successfully detected, processed, and transmitted by the monitoring platform without loss to approved Central station monitoring workstations.

1.7.2. Real‑Time Alarm Notification: Fire alarms generate real-time notifications based on defined severity levels. Notifications are successfully delivered to designated TxDOT contacts through approved communication channels SLA timeframes, ensuring no unreasonable delay within agreed emergency awareness.

1.7.3. Manitou Application Support and Availability: The Bold Group Manitou monitoring application is supported 24 hours per day, 7 days per week and remains continuously operational to support fire alarm monitoring services.

1.7.3.1. Application Support shall include:

1.7.3.1.1. Continuous monitoring of application

health, performance, and connectivity.

1.7.3.1.2. Timely response to system faults, failures, or

degradation conditions.

1.7.3.1.3. Restoration of application functionality to

ensure uninterrupted alarm processing and signal transmission.

1.7.3.2. Application Support and Incident Response shall ensure:

1.7.3.2.1. Reliable reception, processing, and display of

alarm, supervisory, and trouble signals.

1.7.3.2.2. Continuous availability of communication

pathways supporting alarm transmission.

1.7.3.2.3. Prompt corrective action for any condition

impacting the ability of the monitoring platform to receive or process alarm signals.

1.7.3.2.4. All application-related incidents impacting

fire alarm monitoring are classified as critical life safety events, prioritized accordingly, and resolved within defined SLA timeframes.

1.7.4. Incident Tracking and Documentation: Each fire alarm is logged as a unique incident containing complete timestamps, response actions, escalation history, and current status. All alarm, supervisory, and trouble events are recorded without omission. No incidents remain open or unresolved without documented TxDOT approval.

1.7.5. Monitoring System Availability: Monitoring systems must remain continuously available and fully functional. Any service interruption, 3 - 7 degradation, or communication failure is:

1.7.5.1. Fully documented including start time, duration, and impact reported to TxDOT in accordance with SLA requirements.

1.7.5.2. Managed in a manner that prevents loss of alarm or incident data.

1.7.5.3. Interruptions impacting alarm transmission or monitoring capability are treated as system impairments and handled with appropriate escalation and compensatory measures.

1.7.6. Reporting and Metrics: Monitoring reports shall accurately reflect alarm volume, severity, acknowledgement times, escalation actions, system availability, and response performance. Reports must be complete, verifiable, and delivered to TxDOT according to the agreed-upon reporting schedule.

1.7.7. Security and Compliance: Fire Alarm monitoring services comply with all TxDOT security policies and Authorization to Operate (ATO) requirements, ensuring:

1.7.7.1. Alarm and incident data is securely stored and transmitted.

1.7.7.2. Access is restricted to authorized personnel.

1.7.7.3. System and user activity is logged and auditable.

1.7.7.4. Data is available for audit compliance review and

incident investigation upon request.

1.7.7.5. The monitoring solution, including the Bold Group Manitou application and supporting infrastructure, shall maintain a current and valid independent penetration test (PEN test), with findings tracked and remediated in accordance with TxDOT.

1.7.8. Documentation and Deliverables: All required Fire Alarm monitoring documentation for the Bold Group Manitou application, including alarm definitions, escalation procedures, SLAs, impairment handling procedures, and operational processes, is delivered, complete, accurate, and aligned with the live monitoring configuration.

1.8. Training

Vendor must provide standard functional and system user training along with comprehensive documentation, including methods of delivery, at no additional cost. If specified in the pricing schedule, the vendor must:

1.8.1. Develop and present a detailed training plan outlining the training content, affected users or user groups, recommended training schedule to the designated TxDOT representative.

1.8.2. Create and provide curriculum for training sessions. The materials must be tailored specifically for TxDOT use and software configuration – no generic training curriculum unless approved by the designated TxDOT representative.

1.8.3. Conduct train-the-trainer or system user training sessions. The vendor

4 - 7 must include a thorough outline of the level of training support that will be required, including methods of delivery and outcomes for training.

Vendor must not invoice, and TxDOT will not pay any additional charges associated with training including travel costs, per diem expenses, or other non-reimbursable expenditures.

2. ADDITIONAL IT REQUIREMENTS

Licenses, maintenance, and support provided must comply with the requirements in Attachment A: Information Resources and Security Requirements.

3. DEFINITIONS OF TERMS AND ACRONYMS

3.1. ATO – Authorization to Operate (ATO) is a formal declaration by a Designated Approving Authority, TxDOT ITD InfoSec, that authorizes operation of a solution and explicitly accepts the risk to agency operations.

3.2. CAB – Change Advisory Board. Any information system solution that will be installed on any TxDOT-owned equipment or that will access TxDOT network or will be accessed by TxDOT personnel or use or transmit data created by TxDOT may be subject to review and approval by the ITD Change Advisory Board (“CAB”) prior to implementation or delivery.

3.3. Contract – Any Purchase Order (PO) or Blanket Purchase Order (BPO) resulting from this solicitation as listed in the Order of Precedence in the resulting PO or

BPO.

3.4. BPOR – Blanket Purchase Order Release. A written authorization to perform work under the contract listing the items of work to be performed and the cost based on the prices established in the BPO.

3.5. FLSA – Fair Labor Standards Act.

3.6. PM – Project manager.

3.7. POC – Point-of-contact.

3.8. TxDOT – Texas Department of Transportation.

4. APPLICABLE LAWS AND STANDARDS

The vendor shall provide the specified service requirements in accordance with all federal, state, and local applicable laws, standards, and regulations necessary to perform the services including, but not limited to:

4.1. Title 42 U.S.C. §§ 2000d-2000d-7, with the exception of sections 2000d-5 and 2000d-6, also known as – Title VI of the Civil Rights Act of 1964, including any amendments.

4.2. 1 TAC 206, aligns state web accessibility standards with the federal regulations set forth in Section 508 of the Rehabilitation Act of 1973.

4.3. 1 TAC 213 enacted state standards for procurement, development, or usage of EIR for people with disabilities, and also aligns accessibility standards with the federal regulations set forth in Section 508.

5. PRICING

5 - 7

Must be based on the pricing schedule.

6. ADDITIONAL INVOICING INSTRUCTIONS

6.1. Prior to submitting the invoice, the vendor must email documentation validating the invoice charges to the designated TxDOT representative to include, but not be limited to:

6.1.1. Hosting/Maintenance/Support service dates; or

6.1.2. Project Deliverable Review Summary Form (PDRSF).

6.2. Once TxDOT approves the deliverable(s) and sends the signed PDRSF to the Vendor, the invoice may be submitted.

6.3. Vendor must attach the signed PDRSF for deliverable(s) invoiced.

Invoices requiring correction must be resubmitted with the same invoice number and clearly marked “corrected.”

7. CONTRACT REMEDIES

In the event of a breach of contract or non-performance by the vendor, TxDOT may, at its sole discretion, require the vendor to pay damages not to exceed 10% of the total price for the line item referenced on the pricing schedule. Any line item more than 30 calendar days late will incur liquidated damages. Delays in deliverables caused by factors outside the vendor’s control are exempt from these liquidated damages.

This provision is for liquidated damages, not a penalty. If damages are assessed, the vendor may reimburse TxDOT by discounts, credits, refunds, or waived fees.

8. CONTRACT ADMINISTRATION

Administration of the contract is a joint responsibility of the TxDOT contract manager and TxDOT purchasing staff. Purchasing staff will be responsible for administering the contractual business relationship with the vendor.

8.1. Any proposed changes to work to be performed, whether initiated by TxDOT or the vendor, must receive final written approval in the form of a Purchase Order Change Notice signed by the authorized TxDOT purchasing agent.

8.2. Upon issuance of a contract, TxDOT will designate an individual to serve as the contract manager and point of contact between the agency and the vendor. The contract manager does not have any express or implied authority to vary the terms of the contract, amend the contract in any way, or waive strict performance of the terms or conditions of the contract. This individual’s contract management responsibilities include, but are not limited to:

8.2.1. Monitoring the vendor’s progress and performance and ensuring services conform to established specification requirements.

8.2.2. Managing the financial aspects of the contract including approval of payments.

8.2.3. Meeting with the vendor as needed to review progress, discuss problems, and consider necessary action.

8.2.4. Coordinate access to TxDOT facilities, systems, and staff required to

6 - 7 facilitate the work.

8.2.5. Other areas as identified by the State of Texas Procurement and Contract Management Guide version 4.0.

1 - 16

ATTACHMENT A

Information Resources and Security Requirements

1. TYPES OF DATA

“TxDOT Data” means TxDOT information, data, records, and information to which a Contractor-Related Entity has access, has possession, or is otherwise provided to a Contractor-Related Entity by TxDOT, whether or not intended under or for the purposes of the agreement, including, without limitation, data generated or collected under this agreement, intellectual property created as a work for hire under this agreement, and Personal

Identifying Information (as defined below).

TxDOT Data is classified into the four categories that control applicability of security standards: Public, Sensitive, Confidential, and Regulated. See

Section 4 for Definitions.

Any data that a Contractor-Related Entity accesses and downloads from a

TxDOT system, for use, manipulation, storage, or management is considered

Confidential Data unless otherwise specified in writing by TxDOT.

2. DATA REQUIREMENTS

2.1. Data, Data Dictionaries, and Data Flow Diagrams

Contractor shall ensure that all TxDOT Data that is generated, manipulated, transmitted, or stored, utilizes the TxDOT taxonomy, with documented data dictionaries, and data flow diagrams (including security protocols).

2 - 16

2.2. Data Transfer

a) At the completion of a deliverable, the Contractor shall transfer all

TxDOT Data generated and stored for that deliverable to TxDOT in a manner and format acceptable to TxDOT and approved by TxDOT’s

Information Technology Division (“ITD”).

b) All metadata associated with the TxDOT Data transferred must remain attached to that data.

c) Contractor shall maintain the appropriate level of data security throughout the transfer of the TxDOT Data.

2.3. Backup and Disaster Recovery

a) Contractor shall implement business continuity procedures to fulfill all requirements of this agreement that address, as a minimum, fire, theft, natural disaster, technical difficulty, workforce problems, equipment failure, or other disruption of business.

b) Contractor shall maintain a disaster recovery plan. Contractor is responsible for all project related costs of disaster recovery during the project except for costs associated with disasters beyond Contractor’s reasonable control, and for those costs included as part of the TxDOT infrastructure responsibilities.

2.4. Open Records Requests

Contractor shall not release Information in response to an open record request related to this agreement request unless TxDOT has approved the release in writing.

2.5. Encryption

For Sensitive, Confidential, and Regulated TxDOT Data, the Contractor shall ensure TxDOT Data is encrypted while in-transit and while at-rest in accordance with the TxDOT Controls Catalog Standard SC-13, Cryptographic

3 - 16

Protection and SC-08, Transmission Confidentiality and Integrity security requirements.

2.6. Accessibility

Contractor shall ensure all products provided under this agreement comply with the State of Texas Accessibility requirements for Electronic and

Information Resources specified in 1 Texas Administrative Code (TAC)

Chapters 206 and 213.

3. INFORMATION RESOURCE AND SECURITY REQUIREMENTS

3.1. Information Security Safeguards

a) Contractor shall implement appropriate administrative, physical, and technical safeguards, in accordance with TxDOT’s security requirements, that reasonably and appropriately protect the confidentiality, integrity, and availability of TxDOT Data.

b) Contractor shall conform its policies and procedures relating to the implementation of security safeguards to comply with TxDOT's

Information Resources security program pursuant to the TxDOT and

DIR’s Information Security Controls Catalog Standards.

3.2. Potential Cybersecurity Incident or Breach Notification

Contractor shall immediately report to TxDOT via the Report Cybersecurity

Incident Page on TxDOT.gov, any potential cybersecurity incident or breach involving TxDOT Data (See Section 4, Definitions).

3.3. Demonstrating Compliance with Information Security

Requirements

If required by TxDOT, prior to contract award, at renewal, and on a recurring basis, Contractor shall provide a TxDOT Security Questionnaire as documented in the contract. Additionally, upon reasonable notice to the

Contractor, and if TxDOT determines that the Contractor has violated this

4 - 16 agreement, TxDOT, directly or through its agent, may request an attestation, which may include additional attestations, and evidence that Contractor is in compliance with applicable laws, regulations, and standards outlined in 3.5.

3.4. Security Training

In accordance with Section 2054.5192 of the Texas Government Code, each

Contractor-Related Entity that will access a TxDOT computer system or database must complete a TxDOT approved cybersecurity training program that is certified under Section 2054.5192 of the Texas Government Code.

The training program must be completed during the term of the contract and during any renewal period. The Contractor shall provide verification of completion of the cybersecurity training program in a method designated by

TxDOT.

3.5. Applicable Laws, Regulations, and Standards

Contractor shall perform the services in accordance with the following standards, notify TxDOT of situations where compliance is not achievable, and assist TxDOT with the prevention of security gaps or conflicts that could impair security performance. Contractor shall comply with all applicable federal, state, and local laws and regulations necessary to perform the services. A non-exhaustive list of federal, state, and local laws and regulations that might be applicable includes the following.

1) DIR Security Controls Standard Catalog and applicable TxDOT Security

Requirements

A) For Public Data, TxDOT and DIR Security Controls Standards

Catalog low baseline and applicable TxDOT security requirements.

B) For Sensitive Data TxDOT and DIR Security Controls Standards

Catalog low baseline with Sensitive overlay and applicable TxDOT security requirements.

5 - 16

C) For Confidential Data, TxDOT and DIR Security Controls Standards

Catalog moderate baseline and applicable TxDOT security requirements.

D) For Regulated Data, TxDOT and DIR Security Controls Standards

Catalog moderate baseline, applicable TxDOT security requirements, and applicable regulated security requirements.

2) TX-RAMP Requirements

A) Contractor shall ensure that any Contractor-Related Entities providing a Cloud Computing Service to TxDOT that creates, accesses, transmits, uses, or stores TxDOT Data must be authorized in the Texas Risk and Authorization Management

Program (“TX-RAMP”) if TxDOT determines TX-RAMP is required.

B) TxDOT may approve the use of a TX-RAMP provisional status in lieu of a TX-RAMP certification. This approval is not effective unless approved in writing by the TxDOT Chief Information Security Officer

(“CISO”) and DIR.

C) Applicable Contractor-Related Entities must achieve the following levels of authorization by the following dates for any new contract or renewal of existing contract:

a) TX-RAMP Level 1 Status no later than January 1, 2024

b) TX-RAMP Level 2 Status no later than January 1, 2022

3) State Laws and Regulations:

A) Texas Administrative Code, Chapter 202 – Information Security

Standards

B) Texas Administrative Code, Chapter 206 – State Websites

C) Texas Administrative Code, Chapter 213 – Electronic and

Information Resources

D) Texas Government Code, Chapter 552 – Public Information

E) Texas Government Code, Chapter 2054 – Information Resources

6 - 16

F) Texas Penal Code, Chapter 33 – Computer Crimes

G) For Confidential data, Texas Business and Commerce Code, Chapter

521 –Unauthorized Use of Identifying Information

H) For Confidential data containing Protected Health Information, Texas Health and Safety Code, Chapter 181 – Medical Records

Privacy

I) For Regulated data containing Payment Card Industry (“PCI”) information, the Payment Card Industry Data Security Standards

(“PCI-DSS”)

J) For Regulated data containing Criminal Justice Information (“CJI”), the Criminal Justice Information Services (“CJIS”) Security Policy

3.6. Information Resources Technology

a) Any proposed information resources technology that will be installed on any TxDOT owned equipment or that will access any TxDOT network must be reviewed and approved by the ITD Architectural

Review Board (“ARB”) prior to any development or design.

b) Any proposed information resources technology that will be installed on any TxDOT owned equipment or that will access any TxDOT network must be reviewed and approved by the ITD Change Advisory

Board (“CAB”) prior to implementation or delivery.

3.7. Information Resources Technology (“IRT”) Procurements

ITD must approve all procurements of:

1) Information Resources Technology that will be owned by TxDOT.

2) IT services for any environment that provides processing, storage, networking, management, and distribution of data to ensure alignment with Texas Government Code, Chapter 2054, Subchapter L.

7 - 16

3.8. Prohibited Technologies

In accordance with the Texas Statewide Plan for Prohibited Technologies, Contractor shall not provide services, equipment, or systems to TxDOT determined to be a Prohibited Technology by TxDOT. The Cybersecurity

Resources page contains a list of the entities currently determined to be

Prohibited Technologies.

3.9. Background Checks Required for Access to TxDOT Data and

TxDOT Systems

a) The contractor shall ensure that a Background Check is performed on each Contractor-Related Entity prior to that person receiving access to any TxDOT system.

b) Contractor shall ensure that a Background Check is performed on each

Contractor-Related Entity prior to that person receiving access in a

Contractor-Related Entity Environment to TxDOT Data that requires a

Moderate or High Security Baseline

c) A “Background Check” must include the following:

1) Verification of Social Security number;

2) All true alias names and counties;

3) Federal and county level checks for felony and misdemeanor arrest and convictions for the past seven years, including sentences of deferred adjudication – all names;

4) Search of national criminal database – all names;

5) Search of state and national sex offender registry – all names; and

6) Search of the government sanction registry listings.

d) Contractor shall not allow any Contractor-Related Entity for which

Contractor received any unfavorable result when conducting a

Background Check to access TxDOT Data or any TxDOT System.

8 - 16

e) TxDOT may make exceptions to 3.9(d) on a case-by-case basis. Any exception granted by TxDOT must be in writing to be effective.

f) Upon request by TxDOT, Contractor shall provide documentation that demonstrates to TxDOT’s satisfaction that Background Checks have been conducted as required and that no Contractor-Related Entity with one or more unfavorable results has received access to TxDOT Data or any TxDOT System.

g) Contractor shall immediately notify TxDOT if it learns of any change in status that might cause a Contractor-Related Entity to receive an unfavorable result from a Background Check.

h) If Contractor fails to meet the requirements of 3,9, TxDOT may terminate this contract immediately with no further liability to the

Contractor.

3.10. Interconnection of TxDOT and Contractor-Related Entity

Environment

If a Contractor-Related Entity has or will have one or more interconnections between an Information System in that Contractor-Related Entity’s

Environment and a TxDOT System or Systems, the Contractor shall execute or cause to be executed an Interconnection Security Agreement (“ISA”) for each interconnection. An executed ISA must be provided to TxDOT for each new interconnection prior to connection.

3.11.

Upon request by TxDOT, the Contractor shall provide any additional information or documentation that TxDOT determines is necessary to confirm a Contractor-Related Entity’s compliance with this section. If

Contractor fails to provide requested information as required, TxDOT may terminate this contract immediately with no further liability to the

Contractor.

9 - 16

3.12.

If completion of any of the requirements in this section requires obtaining information and/or action from a Contractor-Related Entity or other non-party entity, Contractor shall obtain the required information or action from that entity. For example, if the Contractor is a reseller of a Contractor-

Related Entity’s product or service, the Contractor is responsible for completing the TxDOT Security Questionnaire and the Contractor must obtain all the information or actions from the Contractor-Related Entity necessary for the Contractor to complete the questionnaire.

3.13. SOC 1 Type 2 and SOC 2 Type 2 Requirements

If a Contractor-Related Entity is determined to be providing a function that is a key internal financial control or has a material financial impact on the

TxDOT financial statements, then the following are applicable:

a) Provide an Annual Report – Contract-Related entity must provide

TxDOT the audit SSAE 18 Results within 15 days of Contract-Related receipt of final report from independent auditor. Licensor will engage a third party (the “Service Provider”) to conduct an examination in accordance with Statement on Standards for Attestation Engagements

No. 18, as established by the American Institute of Certified Public

Accountants (AICPA), and commonly referred to as a Service

Organization Controls (SOC) 1, relevant to controls related to the solution, and prepare a SOC 1 Type 2 report with respect thereto (the

“SOC 1 Report”).

b) In addition, Licensor will engage a Service Provider to conduct an examination in accordance with AT Section 101 of the Statement on

Standards for Attestation Engagements to report on controls at a

Service Organization relevant to security and availability, established by the AICPA (“AICPA Standards”) and, subject to AICPA Standards, 10 - 16 prepare a Type 2 service organization controls report with respect thereto (the “SOC 2 Report”). Once the SOC 1 Report and SOC 2

Report are each available, upon written request from Licensee, Licensor must make available Licensor personnel to discuss with

TxDOT the reports. Other report types will not be considered to meet these requirements.

3.14. TxDOT Virtual Desktop Infrastructure Requirements

If Contractor-Related Entity is provided with a user account to access

TxDOT Virtual Desktop Infrastructure (“TxDOT VDI”), Contractor shall ensure that Contractor-Related Entity complies with the following TxDOT

VDI requirements unless otherwise explicitly authorized in the

Agreement:

a) Data Residency. All TxDOT Data must remain solely on TxDOT systems located within the United States of America. Contractor-Related

Entities must not store, process, or transmit TxDOT data outside the

United States without express written approval from TxDOT.

b) Remote Access Security. Access to TxDOT VDI must be performed using Contractor-managed devices. Upon request, Contractor shall provide written attestation that such devices meet TxDOT security requirements.

c) Data Transfer Restriction. Contractor shall ensure that Contractor-

Related Entities do not transfer, copy, or move any TxDOT data from a

TxDOT System to any other environment without express written approval of TxDOT.

11 - 16

4. DEFINED TERMS

4.1. Baseline

“Baseline” means the set of minimum-security controls defined for a low-impact, moderate-impact, or high-impact information system. Information on applicable baselines is available on the Cybersecurity Resources page.

4.2. Breach

“Breach” means “breach of system security” as defined in Section

521.053(a) of the Texas Business and Commerce Code, which defines breach of system security as “the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information maintained by a person, including data that is encrypted if the person accessing the data has the key required to decrypt the data.”

4.3. Cloud Computing Service

“Cloud Computing Service” means a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. Cloud computing is referenced in Texas Government Code Title 10, Subtitle D, Chapter 2157, Subchapter A, Section 2157.007 and is defined in NIST 800-145.

4.4. Confidential Information

“Confidential Information” has the meaning provided in 1 Texas

Administrative Code § 202.1(5), which states the confidential information means “information that must be protected from unauthorized disclosure or public release based on published laws or legal agreements.” Information that is Confidential Information under this definition includes:

12 - 16

a) Dates of birth of living persons

b) Driver’s license numbers

c) License plate numbers

d) Credit card numbers

e) Insurance policy numbers

f) Attorney-Client communications

g) Drafts of policymaking documents

h) Information related to pending litigation

i) Audit working papers

j) Competitive bidding information before contract awarded

k) Personal Identifiable Information

l) Sensitive Personal Information

m) Regulated data

n) Information excepted from disclosure requirements of Chapter 552 of the Texas Government Code (“Texas Public Information Act”) or other applicable state or federal law

o) Compliance reports for which the Texas Attorney General has granted permission to withhold

p) Investigative working papers and draft reports excepted from disclosure under Section 552.116 of the Texas Government Code

4.5. Contractor-Related Entity

“Contractor-Related Entity” means Contractor; subcontractors; their employees, agents and officers; and all other persons for whom Contractor might be legally or contractually responsible.

4.6. Contractor-Related Entity Environment

“Contractor-Related Entity Environment” means an Environment for which

TxDOT does not manage or control the system environment, servers, 13 - 16 operating systems, or storage with the exception of user-specific configuration settings.

4.7. Data

“Data” means the representation of facts; as the raw material of information that is used as a basis for reasoning, decision-making, discussion, or calculation.

4.8. Data Dictionary

“Data Dictionary” means a directory of the definitions, purpose, policies and structure about data. It is a compilation of information about the data owned by the enterprise. It describes every data item in a database in enough detail for users and application developers to know what the data is and how to make use of it.

4.9. Environment

“Environment” means an aggregate of procedures, conditions, and objects affecting the development, operation, and maintenance of an information system.

4.10. Information

“Information” means data, regardless of form, that is created, contained in, or processed by information resources facilities, communications networks, or storage media.

4.11. Information Resources Technology

“Information Resources Technology” means data processing and telecommunications hardware, software, services, supplies, personnel, facility resources, maintenance and training that are employed, designed, built, operated, and maintained to collect, record, process, store, retrieve, display, and transmit information.

14 - 16

4.12. Information System

“Information System” means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information. An Information System normally includes, but is not limited to, hardware, software, network infrastructure, information, applications, communications, and people.

4.13. Personal Identifying Information

“Personal Identifying Information” means information that alone or in conjunction with other information identifies an individual, including an individual's:

a) Name, social security number, date of birth, or government-issued identification number;

b) Mother's maiden name;

c) Unique biometric data, including the individual's fingerprint, voice print, and retina or iris image; and

d) Unique electronic identification number, address, or routing code.

4.14. Potential Cybersecurity Incident

“Potential Cybersecurity Incident” means an event which may result in the accidental or deliberate unauthorized access, loss, disclosure, modification, disruption, or destruction of information or information resources.

4.15. Public Data

“Public Data” means Data that is subject to public disclosure pursuant to the

Texas Public Information Act and freely and without reservation made available to the public.

4.16. Public Information

“Public information” means information written, produced, collected, assembled, or maintained by or for a governmental body, including

15 - 16 information held by individual officers or employees of a governmental body, in connection with the transaction of official TxDOT business. This includes information that is held by contractors and consultants and that TxDOT owns, to which TxDOT has a right of access, or on which public money was spent for the purpose of writing, producing, collecting, assembling, or maintaining the information. Public information includes any electronic communication created, transmitted, received, or maintained on any device if the communication is in connection with the transaction of official business. Public information may be stored in any medium and may exist in forms such as books, papers, letters, documents, e-mails, Internet postings, text messages, instant messages, printouts, photographs, maps, drawings, and audio and video recordings. Public information does not include tangible items, such as computers or guardrails.

4.17. Regulated Data

“Regulated Data” means information for which the use and protection of is dictated by a state or federal agency or by third party agreements.

4.18. Sensitive Data

“Sensitive Data” means information that could be subject to release under an open records request, but should be controlled to protect third parties, and should be vetted and verified before release. At TxDOT, this could include operational information, personnel records, research, or internal communications.

4.19. Sensitive Personal Information

“Sensitive Personal Information” has the meaning provided by Section

521.002(2) of the Texas Government Code, which defines sensitive personal information as:

16 - 16

a) An individual’s first name or first initial and last name in combination with any one or more of the following items, if the name and item are not encrypted:

1) Social Security Number

2) Driver’s license number or government-issued identification number; or

3) Account number or credit or debit card number in combination with any required security code, access code, or password that would permit access to an individual’s financial account; or

b) Information that identifies an individual and relates to:

1) The physical or mental health or condition of the individual;

2) The provision of health care to the individual; or

3) Payment for the provision of health care to the individual.

4.20. TxDOT Security Questionnaire

“TxDOT Security Questionnaire” means a cybersecurity and privacy questionnaire that provides TxDOT ITD necessary information for third party attestation in accordance with TxDOT requirements.

4.21. TxDOT System

“TxDOT System” means an Information System that is owned, managed, or maintained by TxDOT or on behalf of TxDOT.