ESBD_555357_1788298400961_Exhibit C Contract Marketing and Customer Support Plan.docx

Department of Information Resources Request for Offer COOP2026SOL-00009 End-User IT Outsourcing Services

Exhibit C Contract Marketing and Customer Support Plan

COOP2026SOL-00009

End-User IT Outsourcing Services

Exhibit C Response Instructions:

The information should be well organized and sufficiently detailed to answer each question.

The response to the entire Exhibit C may not be longer than 6 pages. Evaluators must be able to find the full answer to each question within its corresponding question. Answers cannot be cross‑referenced or reused across multiple questions.

Respondents may not reference information in a separate question/exhibit/attachment as part of their response to each question.

Information provided by the Respondent that goes beyond the 6-page limit will not be reviewed or considered during the evaluation of your response.

Respondents may not include links to external sites or links to other sections of their response within their response to any questions.

Respondents may not include marketing materials in their response.

Respondents may use non-marketing visuals in their answer to a question, but the entire response to, including any visuals, must remain within the 6-page limit to be reviewed and considered during the evaluation of your response.

Exhibit C – Org Chart and Exhibit C – SLA of Exhibit C are not included in the 6-page limit. Respondents may not include links to external sites or links to other sections of their response within their response to Exhibit C – Org Chart and Exhibit C – SLA. Respondents may not reference information in a separate question/exhibit/attachment as part of their response for Exhibit C – Org Chart and Exhibit C – SLA.

Contract Marketing

1) Contract Marketing Plan

Provide a comprehensive marketing strategy outlining how your company intends to promote and sell each of the proposed offerings included in this RFO to DIR Eligible Customers during the initial two (2) years as a DIR Master Cooperative Contract holder.

The marketing plan must include:

· Clearly defined target customer segments

· Which DIR Eligible Customers you are targeting (agencies, higher ed, local government, etc.).

· How these segments differ in needs of the services in this RFO Scope.

· Why these segments are strategically important.

· How the marketing approach will differ for each segment.

· Specific marketing activities with monthly timelines

· What specific marketing actions will occur each month (emails, campaigns, webinars, outreach, events).

· How these activities align with the RFO’s goals and DIR customer needs.

· The sequence and pacing of activities (not one‑time plans).

· How marketing and sales will work together across the timeline.

· The resources allocated to each activity;

· Who will do the work (roles, teams, or partners).

· How much staffing is assigned to each activity.

· What tools, platforms, or systems will be used.

· Whether the resource plan is realistic and sustainable.

· Measurable performance targets (e.g., number of engagements, conversion rates, campaign reach); and

· What metrics you expect to achieve each month.

· What “success” looks like in numbers (not just descriptions).

· How these metrics relate to adoption, utilization, and customer engagement.

· Whether the targets are realistic, meaningful, and tied to outcomes.

· The Key Performance Indicators (KPIs), the measurable values your company uses to track how well marketing activities are performing and whether strategic goals are being achieved, and reporting methods your company will use to track progress and validate results.

· What KPIs you will track to ensure the plan is working (pipeline, leads, response rates, utilization, etc.).

· How progress will be monitored (dashboards, monthly reports, reviews).

· How you will validate that the marketing plan is driving real customer usage and value.

For a complete list of DIR eligible customers, refer to the DIR website information on eligibility, located here: Customer Eligibility | Texas Department of Information Resources.

2) Current or Pending Contracts Impacting Marketing Capacity

Provide a clear, factual description of any current or forthcoming contracts that could affect your ability to market this DIR Master Cooperative Contract. If no such contracts exist, state this explicitly and outline your plan for managing future contracts that may impact your ability to market the DIR Master Cooperative Contract.

Your response must include:

· Customer segment type (State agency, Local government, etc.) and contract term (if applicable).

· Measurable resource requirements (e.g., staffing counts, hours per week, workload percentages).

· Key deadlines, renewal cycles, or major deliverables that may overlap with the DIR contract period.

Your overview must be specific, evidence based and limited to information that directly impacts marketing or resource availability should you be awarded a DIR Master Cooperative Contract.

Customer Support Plan

3) Sales Delivery, Order Processing, and Ongoing Support

Provide a detailed and measurable description of your company’s end‑to‑end processes for sales, order processing, and ongoing customer support for DIR Eligible Customers across Texas.

Your response must include:

· Defined team roles, staffing levels, and coverage models, including Texas‑specific support capacity.

· A precise map of the delivery organization: roles, headcount, skills/certifications, hours of coverage, and where people are located, especially any Texas‑based capacity.

· Documented workflows for sales intake, order processing, and support delivery.

· Quantifiable service‑level commitments (e.g., response‑time targets, resolution‑time targets, order‑processing timelines).

· The technology platforms used (CRM, ticketing, automation tools) and how each platform supports accuracy, throughput, and customer experience.

· The monitoring, reporting, and escalation processes used to ensure consistent service quality. Include what steps are taken to resolve customer issues.

4) Account Management Team Overview

Provide a clear, factual description of the team that will manage the DIR Master Cooperative Contract, should a contract be awarded. Include:

· The titles and functions of all proposed account management personnel.

· Relevant professional experience directly tied to contracts of similar size, scope, or complexity.

· Measurable staffing information such as FTE allocations, coverage hours, escalation responsibilities, and role specific duties.

Your description must demonstrate the team’s capacity and readiness to support DIR Eligible Customers.

5) Geographic Footprint and Support Locations

Describe your company’s physical and operational presence supporting this DIR Master Cooperative Contract. Your response must include:

· All office locations, work sites, partner facilities, and subcontractor sites.

· The specific services each location provides (e.g., service desk, field support, provisioning, escalation, program/project management).

· Measurable staffing levels or functional distributions per location.

This section must clearly show how each site contributes to statewide service delivery and contract performance.

6) Security Program, Controls, Certifications, and Data Protection Practices

Security Program Overview Provide a clear and factual description of your organization’s security program. Your response must include:

• The governance structure responsible for security oversight

• Defined roles and responsibilities for security operations, compliance, and incident management

• How security policies are developed, maintained, and reviewed (including frequency and approval authority) Your overview must present a measurable, evidence‑based description of the security framework your organization operates under.

Security Frameworks and Certifications Identify the specific security frameworks your company follows and the certifications you hold. Your response must include:

• Frameworks such as NIST, ISO 27001, SOC 2, or other recognized standards

• Certification details including scope, certification body, issue and renewal dates, and audit frequency

• Any third‑party assessment or audit evidence supporting ongoing compliance All items must be expressed using verifiable details (dates, certification numbers, renewal cycles, scope statements).

Core Security Controls and Operational Practices Describe the controls your organization uses to protect systems, services, and customer data. Your response must include:

• MFA requirements, encryption standards (at rest and in transit), endpoint hardening, patching cadences, and vulnerability management timelines

• Monitoring tools and processes used for threat detection, logging, alerting, and security analytics

• Defined SLAs for incident response and remediation (e.g., detection timeframes, containment targets, patching timelines) All controls must be measurable and stated in quantifiable terms.

Data Protection Across the Lifecycle Explain how your organization protects customer data through all stages of its lifecycle. Your response must include:

• Processes for data collection, classification, access control, and least‑privilege enforcement

• Safeguards for data at rest, in transit, and during processing

• Documented data‑retention schedules and secure‑disposal practices

• Encryption standards and key‑management procedures

· Governance and controls of Artificial Intelligence used by your organization to protect customer data Responses must be practical, evidence‑based, and supported by quantitative or policy driven requirements.

7) Formal Data Protection Policies and Security/Privacy Certifications

Data Protection Policy Framework Provide a clear and factual description of your organization’s formal data protection policies. Your response must include:

• The governance framework used to establish, approve, and maintain data protection policies

• Policy owners, oversight roles, and documented review cycles (e.g., annual updates, risk‑based revisions)

• Key policy components such as access control, data classification, retention, encryption, and acceptable use

• Measurable enforcement mechanisms (e.g., monitoring activities, compliance checks, audit frequency)

Your description must demonstrate a structured, evidence‑based policy environment aligned with recognized security and privacy standards.

Security and Privacy Certifications List and describe all security and privacy certifications your company holds. Your response must include:

• Each certification name (e.g., ISO 27001, SOC 2 Type II, GDPR compliance documentation)

• The certification or audit body responsible for issuing or validating the certification

• Issue dates, renewal dates, reporting periods, or surveillance audit timelines

• The specific systems, services, regions, or organizational units included in the certification scope

All certifications must be presented with verifiable, measurable details.

Coverage and Application of Certifications Explain how each listed certification applies to the services proposed under this RFO. Your response must include:

• Which service components, data environments, or operational units fall under each certificate’s scope

• Any gaps or exclusions, along with mitigation strategies

• How certification controls support protection of DIR Eligible Customer data

This explanation must clearly map certification coverage to the systems and services delivered under this DIR Master Cooperative Contract.

Data Lifecycle Protection Measures Describe how your organization protects customer data throughout its lifecycle. Your response must Include:

• Data collection, access authorization, and least‑privilege enforcement

• Data storage protections (e.g., encryption standards, redundancy, access logging)

• Data transmission safeguards (e.g., TLS requirements, secure VPN, key management)

• Data retention schedules and secure‑disposal processes

All lifecycle controls must be documented using measurable, policy‑driven requirements.

Evidence of Compliance and Governance Maturity Provide measurable evidence demonstrating ongoing compliance with your policies and certifications. Your response must include:

• Recent audit results, compliance scores, or attestation summaries

• Monitoring and reporting tools used to track data protection compliance

• Incident‑response metrics (e.g., detection time, containment time, remediation timelines)

• Internal audit or third‑party validation processes

Your response must reflect a mature, well governed data‑protection posture supported by verifiable proof.

8) Backup, Disaster Recovery, Recovery Point Objective (RPO) and Recovery Time Objective (RTO) Commitments, and Performance Evidence

Backup Strategy and Architecture

Provide a clear and factual description of your company’s backup program. Your response must include:

• The systems, platforms, and storage locations used for backups (on prem, cloud, multi‑region)

• Backup frequencies for all relevant data types (e.g., hourly, daily, weekly)

• Backup automation processes, monitoring tools, and alerting mechanisms

• Retention schedules and versioning practices

Responses must rely on measurable details and operational evidence.

Disaster Recovery Framework Describe your organization’s disaster recovery (DR) capabilities and framework. Your response must include:

• DR sites or zones, failover architecture, and redundancy layers

• The tools, technologies, and processes used to orchestrate DR failover

• How DR scenarios are prioritized and executed based on incident impact

• Defined responsibilities and command structure during DR events

This section should clearly demonstrate an operationally mature and well documented DR program.

RPO and RTO Provide measurable commitments to RPO and RTO targets for services related to the DIR Master Cooperative Contract. Your response must include:

• Specific RPO values for each major data or system category

• Specific RTO values and associated service restoration expectations

• Any differences in RPO/RTO across service tiers or system classes

• Historical adherence rates or performance metrics demonstrating capability

All RPO/RTO statements must be quantified in minutes or hours.

Testing, Validation, and Evidence of Performance Explain how your organization tests and validates its backup and disaster recovery capabilities. Your response must include:

• Testing frequency (e.g., annual, semiannual, quarterly) and test types (tabletop, failover, full‑scale)

• Success criteria and validation processes

• Performance data from recent DR or backup tests (e.g., test success rates, actual recovery times, documented outcomes)

• Continuous improvement methods based on test results or post‑incident analysis

This section must include measurable, verifiable evidence of performance and readiness.

Data Integrity, Security, and Compliance Safeguards Describe how your organization protects backup and DR data. Your response must include:

• Encryption standards for data in transit and at rest

• Access controls, identity management, and privileged‑access restrictions

• Use of immutable backups, replication safeguards, or tamper‑prevention controls

• Compliance requirements relevant to backup/DR (e.g., retention mandates, audit requirements)

All safeguards must be described using factual, measurable, or policy‑driven requirements.

9) Security Training, Requirements, Frequency, and Compliance Tracking

Security Training Program Structure Provide a clear and factual description of your company’s security training program. Your response must include:

• Training requirements for all employees, contractors, and privileged‑access users

• The structure of onboarding security training for new hires

• The mandatory annual training cycle and any additional required recertifications

• Defined learning paths for technical staff, service desk personnel, or administrators

Your response must present a traceable, evidence‑based training framework.

Training Content and Curriculum Coverage Describe the specific content areas included in your security training. Your response must include:

• Core security topics (phishing, password/MFA use, data handling, incident reporting, endpoint security)

• Role‑based modules for employees handling sensitive data or elevated system access

• Scenario‑based or simulation‑based learning components

• Any regulatory or compliance driven content (e.g., privacy requirements, acceptable‑use obligations)

All elements must be described factually and tied to the scope of the RFO.

Training Frequency, Cadence, and Completion Requirements Explain the timing and cadence of your security training program. Your response must include:

• Onboarding training timelines

• Annual refresher or recertification timelines

• Additional periodic trainings (e.g., quarterly micro‑modules, targeted campaigns, phishing simulations)

• Completion deadlines and consequences for non‑compliance

All timelines and requirements must be stated in measurable terms.

Tracking, Monitoring, and Compliance Enforcement Describe how your organization tracks and ensures completion of required training. Include:

• The systems used to track participation and completion (e.g., Learning Management System (LMS), which manages training programs, and a Human Resources Information System (HRIS), which manages employee data and HR processes)

• Reporting cycles, dashboards, or automated reminders

• Completion metrics (e.g., workforce compliance percentages, privileged‑account training rates)

• Enforcement mechanisms for overdue or incomplete training

Responses must include measurable or verifiable methods.

Evidence of Training Effectiveness Provide measurable indicators demonstrating the effectiveness of your security training program. Your response must include:

• Recent completion‑rate statistics (e.g., overall workforce, privileged users, contractors)

• Phishing‑simulation results (e.g., click‑rate trends, failure‑rate reductions)

• Remediation programs for repeat offenders

• Continuous improvement processes (e.g., updates triggered by incidents or audit findings)

Your response must be factual and supported by quantitative or performance‑based evidence.

Exhibit C - Organizational Structure, Roles, and Contract Support Model

Label as Exhibit C – Org Chart. This requirement does not count toward the overall page limit for Exhibit C.

Organizational Chart

Provide an organizational chart clearly identifying the team that will support the DIR Master Cooperative Contract. Clearly label and identify the following. Where necessary to convey the ability to support the contract with the staff and resources allocated, provide a narrative of that position/team’s direct responsibility on the contract.

Your Organizational Chart must clearly include and be labeled to identify:

· All organizational units involved in delivering the contract.

· The chain of command and reporting hierarchy.

· Defined lines of accountability for service delivery, resource sourcing, and contract management.

· Positions that will support the scope of the RFO.

Exhibit C - Service Level Agreement (SLA) Requirements and Operational Commitments

Label as Exhibit C – SLA. This requirement does not count toward the overall page limit for Exhibit C.

Provide one Sample Service Level Agreement (SLA) from a current customer (customer names must be redacted)

Or

Provide a sample SLA that reflects your organization’s standard service commitments. The SLA must be complete, contract‑ready, and must clearly address each of the following required service areas:

1. Onboarding Process for New Users

• Step‑by‑step onboarding procedures

• Defined timelines for account creation, provisioning, and equipment readiness

• Any verification, approval, or communication steps

• Measurable onboarding SLAs (e.g., hours, business days)

2. Data‑Breach Response and Recovery Steps

• Breach detection, reporting, and notification timeframes

• Containment, remediation, and recovery processes

• Escalation roles, communication requirements, and documentation steps

• Measurable commitments for all response stages

3. Service Request Intake and Handling

• How service requests are submitted (phone, portal, email, automated alerts)

• Prioritization rules and triage workflows

• Response and resolution KPIs by severity level

• Any customer‑facing communication expectations

4. Escalation Process for High‑Priority Issues

• Escalation tiers with corresponding roles and authority

• Triggers that initiate escalation

• Measurable timelines for escalation at each level

• Communication and status‑update requirements

5. Hours of Operation

• Standard operating hours

• Extended or after‑hours coverage, if applicable

• Holiday or emergency coverage rules

• On‑call expectations or commitments

6. On‑Site Service Request Management

• On‑site dispatch processes and response areas

• Measurable dispatch and arrival‑time commitments

• Coordination steps between field teams and service desk

• Any constraints, geographic coverage notes, or prerequisites

7. Guaranteed Response and Resolution Times

• Response times by severity level

• Resolution or workaround timelines

• SLA adherence targets (percentages)

• Reporting cadence (monthly, quarterly)

8. Contract Management and Service Continuity Requirements

• The roles responsible for contract management and service quality oversight

• Ongoing monitoring and performance‑management processes

• Defined workflows and timelines for transferring or reassigning user subscriptions within a DIR customer entity

• Measurable safeguards ensuring that subscription changes occur without any service interruption

• Escalation and communication steps tied to continuity events

<END OF EXHIBIT C >

Exhibit C Contract Marketing Customer Support Plan for Services Page 2 of 8 Version 1.0 Rev. 6/01/26