ESBD_556182_1788450023313_TxNET_Buildout_SOW_v3.docx

Texas Military Department | TxNET IL4 Enterprise Environment

Statement of Work (SOW) TxNET IL4 Enterprise Environment Contracted Support for a Secure, Cloud-Enabled Enterprise Network— Turn-Key Implementation

Prepared for: Texas Military Department (TMD) Procurement Vehicle: Texas Department of Information Resources (DIR) Solicitation Type: Deliverables-Based, Firm-Fixed-Price (Milestone) Document Status: FINAL / Clean Version with Integrated Revisions Date: May 2026

Table of Contents

1. Introduction and Background

2. Project Objectives

3. Scope of Work

3.1 Network Engineering / Architecture

3.2 Identity & Access Management (IAM) Engineering / Architecture

3.3 Azure Cloud Server / Platform Engineering / Architecture

3.4 Database Administration / GRC Management

3.5 Knowledge Management

3.6 Low-Code / No-Code Application Development

3.7 Enterprise Network Asset Management

3.8 AI Solutions Architecture & Agentic AI Readiness

3.9 Vendor Internal Contract Oversight & End-User Enablement

4. Compliance, Security, and Accreditation Requirements

5. Personnel Vetting and Background Requirements

6. Multi-Year Proposal Flexibility

7. Deliverables and Milestones

8. Period and Place of Performance

9. Pricing and Payment Schedule (Deliverables-Based)

10. Acceptance Criteria

11. Transition to Customer Sustainment (Turn-Key Handoff)

12. Assumptions and Constraints

12.1 Assumptions

12.2 Constraints

12.3 Service Level Objectives (SLO) and Service Level Agreements (SLA)

13. Evaluation Criteria and Proposal Instructions

13.1 Proposal Instructions

13.2 Evaluation Criteria

14. Signatures Appendix A — Definitions and Acronyms

1. Project Overview TxNET is a secure, cloud-enabled enterprise environment designed to support collaboration, operational coordination, and information sharing across the Texas Military Department (TMD), Texas state organizations, and federal mission partners. TMD routinely operates across three distinct operational and legal authorities — State Active Duty (SAD), Title 32 (T32), and Title 10 (T10) — and must collaborate seamlessly with civil authorities, state agencies, and Department of War (DoW)/Department of Defense (DoD) components during emergencies, contingencies, and steady-state operations.

Today, this collaboration is constrained by a structural interoperability gap. TMD's information systems operate either at Impact Level 2 (IL2) for state/civil collaboration or must reach into Impact Level 5 (IL5) DoD environments for federal missions, with no governed, accredited intermediate environment to bridge the two. This gap creates fragmented communications, inconsistent security controls, duplicated capabilities, and barriers to enterprise-wide integration — directly degrading mission agility during SAD/T32/T10 operations.

This Statement of Work (SOW) directs the design, build-out, configuration, accreditation support, and operational turn-over of a turn-key Impact Level 4 (IL4) Microsoft Azure enterprise environment that serves as the authoritative bridge between IL2 and IL5. This environment will be authorized to store, process, and transmit Controlled Unclassified Information (CUI) and will be engineered to support up to 4,850 concurrent enterprise users on average and surge to 6,700 concurrent users as necessary.

The intent of this engagement is unambiguous: deliver a fully operational, fully optimized IL4 enterprise environment that closes TMD's interoperability gap, maintains IL4 compliance, protects CUI, requires minimal ongoing management by TMD, can be cleanly transitioned to TMD sustainment, and is architected so that Agentic AI capabilities can be introduced whenever TMD elects to do so.

This is an implementation SOW. The Assessment and Recommendation activities common to advisory engagements are intentionally excluded. Vendors are expected to perform any discovery necessary to deliver the end state as part of their own mobilization at no separate charge, and to deliver a working, optimized, accredited environment rather than studies or recommendations.

2. Objectives

3. Scope of Work The Contractor shall deliver a complete, turn-key IL4 Azure enterprise environment. The scope is organized into functional areas executed across an implementation lifecycle of four (4) sequential and overlapping stages:

1. Mobilization & Environment Baseline — Stand-up of contractor team, security in-processing, access provisioning, and confirmation of design baseline. Any discovery the Contractor requires is performed here at no separate cost.

2. Build & Implementation — Construction, configuration, integration, and migration into the IL4 environment.

3. Optimization & Hardening — Performance, cost, resiliency, and security optimization; accreditation evidence packaging; validation and testing.

4. Transition & Handoff — Knowledge transfer, documentation, automation handover, and operational turn-over to TMD (or to a TMD-designated sustainment provider).

All implementations shall be performed to satisfy IL4 Authorization to Operate (ATO) requirements and shall protect CUI in accordance with applicable federal and state standards.

3.1 Network Engineering / Architecture

3.2 Identity & Access Management (IAM) Engineering / Architecture

3.3 Azure Cloud Server / Platform Engineering / Architecture

3.4 Database Administration / GRC Management

3.5 Knowledge Management

3.6 Low-Code / No-Code Application Development

3.7 Enterprise Network Asset Management

3.8 AI Solutions Architecture & Agentic AI Readiness

Agentic AI Readiness Requirement (Mandatory): The environment shall be architected so that Agentic AI (autonomous/semi-autonomous AI agents) can be introduced at a time of TMD's choosing without re-architecture. At minimum this includes: (a) AI-ready, well-governed and classified data; (b) identity scaffolding for non-human/agent identities with least-privilege and full auditability; (c) secure, IL4-bounded model hosting and API integration patterns; (d) logging, observability, and human-in-the-loop control points; and (e) a documented activation playbook.

3.9 Enterprise Network Asset Management

4. Compliance, Security, and Accreditation Requirements The Contractor shall design, build, and deliver the environment in compliance with the following. Where standards conflict, the most restrictive applicable control shall govern.

DoD Impact Level 4 (IL4): The environment shall be engineered to satisfy IL4 requirements per the DoD Cloud Computing Security Requirements Guide (SRG) and shall support an IL4 Authorization to Operate (ATO). The Contractor shall produce all security artifacts (SSP, control implementation, POA&M, etc.) necessary to support TMD/sponsoring authority accreditation.

The environment shall be licensed and architected to support up to 24,000 named users. The architecture must sustain an average of 4,850 concurrent users with surge capacity to 6,700 concurrent users during peak operations without performance degradation beyond agreed baselines. The Contractor shall conduct and document high-load/stress testing validating performance at scale, specifically simulating and confirming system stability and responsiveness with 6,700 concurrent users.

IL2↔IL4↔IL5 Bridging: The environment shall provide governed, accredited connectivity/data-exchange pathways enabling interoperability across IL2 (state/civil) and IL5 (DoD) for SAD/T32/T10 missions.

TxRAMP: Solution and underlying services shall be TxRAMP certified at the appropriate level for the data handled.

FedRAMP: Underlying cloud services shall be FedRAMP authorized (Moderate or High as appropriate to IL4); the Contractor shall identify the FedRAMP authorization status of all proposed services.

CUI Protection: The environment shall protect CUI in accordance with NIST SP 800-171 (and NIST SP 800-172 enhanced controls where directed), 32 CFR Part 2002, and applicable DFARS 252.204-7012 safeguarding and incident-reporting requirements.

CMMC Readiness: The environment and the Contractor's handling practices shall support CMMC readiness commensurate with CUI handling.

NIST SP 800-53: Security controls shall align to NIST SP 800-53 at the FedRAMP/IL4 Moderate-High baseline as applicable.

CJIS: Where Criminal Justice Information may traverse or reside in the environment, FBI CJIS Security Policy requirements shall be met.

State of Texas Requirements: Compliance with DIR standards, Texas Administrative Code (TAC) §202, and applicable Texas Government Code provisions.

Hardening: Systems shall be hardened to applicable DISA STIGs and CIS Benchmarks.

User Scale: The enterprise network and all supporting services shall be designed, tested, and validated to support 4,850 concurrent users on average with surge capacity up to 6,700 concurrent users with appropriate performance, availability, and scalability.

5. Personnel Vetting and Background Requirements All Contractor personnel performing work under this SOW must be vetted and authorized to meet both federal and state requirements to work within state agency networks and within DoW/DoD networks classified at IL2 and IL4. At a minimum:

Background Investigations: All personnel shall undergo background checks satisfying State of Texas agency requirements and the standard required for access to DoD IL2/IL4 systems (e.g., favorable Tier 3 / Moderate Risk Public Trust (MBI) or higher; IT-I / IT-II (ADP-I/ADP-II) position-sensitivity equivalents based on system access).

Citizenship: Personnel with access to CUI and to IL4 environments shall be U.S. persons / U.S. citizens as required by the applicable authorizing official; no foreign nationals shall have access absent explicit written authorization.

Texas-Specific Vetting: Personnel shall meet TMD/DIR onboarding, fingerprint-based criminal history checks (including CJIS fingerprinting where applicable), and any TMD-specific suitability requirements.

CUI Training & Acknowledgment: All personnel shall complete CUI handling training and sign required non-disclosure and rules-of-behavior agreements prior to access.

Security Awareness & Role-Based Training: Annual security awareness training and role-based privileged-user training as required by NIST 800-171/IL4.

Drug Screening: Where required by TMD or applicable authority.

Continuous Vetting / Insider Threat: Personnel shall be subject to continuous evaluation and removal upon any disqualifying determination.

Personnel Roster & Replacement: The Contractor shall maintain a current roster of cleared personnel and shall ensure any replacement personnel are fully vetted prior to assignment, at no impact to milestone schedules or cost.

Key Personnel: The Contractor shall designate key personnel (e.g., Program Manager, Lead Cloud/Security Architect, Lead IAM Engineer, ISSO/Security Lead) and shall not substitute key personnel without TMD approval.

The Contractor is encouraged to identify any additional certifications or vetting it deems necessary (e.g., DoD 8570/8140 baseline certifications such as Security+, CISSP, CCSP; Microsoft Azure certifications such as AZ-104, AZ-305, AZ-500, SC-100) and to describe how its workforce exceeds these minimums.

6. Multi-Year Proposal Flexibility This procurement may or may not result in a multi-year contract. To allow Offerors to propose the approach they believe best achieves the desired end state, the following applies:

Offerors may propose a single-period turn-key implementation or a multi-year, phased approach (e.g., Base Period plus Option Years) if the Offeror believes a multi-year structure best achieves a fully operational, optimized, and transferable IL4 environment.

Multi-year proposals shall clearly delineate each period's milestones, deliverables, firm-fixed milestone prices, and the operational capability achieved at the end of each period.

Any multi-year proposal must preserve the deliverables-based payment model (Section 9) and must include a defined path to seamless transition to TMD sustainment.

Offerors are invited to "sell themselves" to TMD — to differentiate their solution, accelerators, IL4/CUI experience, managed-service constructs, automation, and ability to minimize TMD's ongoing management burden. TMD will evaluate the degree to which each proposal delivers a truly turn-key, low-management, transferable, and AI-ready environment.

7. Deliverables and Milestones Payment is tied to formal acceptance of milestone deliverables (Section 9). Milestones may be decomposed into sub-deliverables to enable intermittent payment across the life of the contract. Timelines below are illustrative; Offerors shall propose their own milestone schedule (single- or multi-year).

8. Period and Place of Performance

9. Pricing and Payment Schedule (Deliverables-Based) This is a firm-fixed-price, deliverables-based engagement. The contract is not labor-hour or time-and-materials based. TMD pays for accepted deliverables, not for hours.

No payment shall be made until the associated milestone deliverable(s) are completed and formally accepted in writing by the designated TMD representative.

Milestones may be decomposed into sub-deliverables so that the Contractor may invoice and be paid intermittently as discrete sub-deliverables are accepted throughout the life of the contract.

Vendor-internal contract oversight, project management, and quality control are not separately payable; these costs shall be incorporated into milestone pricing.

The Offeror shall propose a milestone-based payment schedule mapping each payment to a specific accepted deliverable or sub-deliverable.

Contract Modifications: The SOW and resulting contract are structured to minimize modifications. Because payment is deliverables-based and discovery is the Contractor's responsibility, scope is fixed to the delivered end state. Any change shall be processed only through formal, mutually agreed change control with corresponding deliverable/price adjustment.

10. Acceptance Criteria Acceptance of deliverables shall be based on successful completion of agreed milestone tasks and operational outcomes. Deliverables will be reviewed by designated TMD/TxNET stakeholders and accepted when they meet functional, technical, security, and operational requirements. Acceptance criteria include, but are not limited to:

Completion of all Build, Optimization, and Transition activities for the milestone;

Delivery of required documentation: as-built architecture, SSP and control implementation statements, SOPs/runbooks, IaC repositories, POA&M, and training materials;

Successful implementation and validation of configurations, integrations, automation, monitoring, and security controls within the IL4 environment;

Verified compliance with IL4 (DoD SRG), TxRAMP, FedRAMP, NIST SP 800-171 (CUI), CJIS (where applicable), NIST 800-53, DISA STIG, DIR/TAC §202, and applicable DoD/State policies;

Demonstrated functionality, performance, resiliency, and validated scalability to 6,700 concurrent users;

Demonstrated Agentic AI readiness per Section 3.8;

Completion of knowledge transfer, administrator training, and operational handoff enabling seamless TMD sustainment;

Submission and approval of test results, validation reports, and operational readiness documentation;

Formal written acceptance by an authorized TMD representative.

Deficiencies will be documented for remediation; deliverables are accepted upon written TMD approval or completion of mutually agreed corrective actions.

11. Transition to Customer Sustainment (Turn-Key Handoff) To ensure sustainment can be transferred to TMD as easily and seamlessly as possible with minimal ongoing TMD management, the Contractor shall deliver a Transition-Out / Turn-Key Handoff Package, including at minimum:

Complete as-built documentation and architecture diagrams;

Infrastructure-as-Code (IaC) repositories and policy-as-code enabling full environment reproducibility;

Operational runbooks and SOPs for all functional areas (network, IAM, platform, data/GRC, KM, low-code, asset management, AI foundation);

Automation for routine operations, patching, scaling, backup/DR, and monitoring/alerting to minimize manual administration;

Administrator and end-user training with recorded sessions and reference materials;

Accreditation/ATO sustainment package (SSP, control evidence, POA&M, continuous monitoring plan);

Agentic AI activation playbook (Section 3.8);

A 30/60/90-day post-handoff support/warranty period (Offeror to propose) and an optional sustainment proposal, at TMD's discretion;

Intellectual Property & Licensing Plan: A comprehensive document detailing the ownership of all custom-developed components (which shall transfer to TMD) and a complete inventory and transfer/re-assignment plan for all third-party proposed solutions required for TMD to sustain and operate the system independently.

12. Assumptions and Constraints

12.1 Assumptions

TMD will provide timely access to required personnel, facilities, accreditation authorities, and technical environments necessary for build, testing, and transition;

TMD will identify POCs with decision-making authority for technical approvals and deliverable acceptance;

Required access approvals, administrative permissions, and security authorizations will be granted per policy to allow vetted personnel to perform authorized tasks;

TMD will support scheduled maintenance windows and testing periods required for implementation;

Underlying enterprise licensing and cloud subscriptions will be available or procured as specified in the resulting contract;

TMD will secure and provide formal Data Sharing Agreements (DSAs) or equivalent authorizations with all designated civil-partner source-system owners to guarantee Contractor access for integration, where required.

12.1 Constraints

Work touching IL5 or other restricted environments may require additional coordination, escort, or access approvals;

Procurement lead times and licensing constraints may affect schedule and must be reflected in the Offeror's milestone plan;

Production-impacting changes must follow established change management;

AI/Agentic AI capabilities are delivered as a ready foundation; full agent deployment occurs at TMD's election;

Scope changes after award require formal change control (Section 9).

13. Service Level Objectives (SLO) and Service Level Agreements (SLA) The following SLOs/SLAs apply during the Optimization & Hardening stage, the post-handoff support/warranty period, and any proposed sustainment period. Offerors shall confirm their ability to meet or exceed these targets and may propose enhanced levels as a differentiator. Where the Contractor proposes a managed-service or sustainment option, these SLAs shall be binding for that period.

Maintenance Windows: Approved, scheduled maintenance shall be excluded from availability calculations and coordinated with TMD in advance. Service Credits: Offerors shall propose a service-credit or remediation framework for SLA breaches applicable to any managed-service/sustainment period.

14. Evaluation Criteria and Proposal Instructions

14.1 Proposal Instructions

Offerors shall submit a proposal that demonstrates a complete, turn-key solution and a clear path to a fully operational, optimized, accredited, transferable, and AI-ready IL4 environment. Proposals shall include, at minimum:

Technical Solution Narrative — How the Offeror will design, build, integrate, optimize, harden, and transition the IL4 environment across all functional areas in Section 3, including the IL2↔IL4↔IL5 interoperability bridge;

Compliance & Accreditation Approach — How the Offeror will achieve and document IL4 (DoD SRG), TxRAMP, FedRAMP, NIST SP 800-171/CUI, CMMC readiness, CJIS (if applicable), NIST 800-53, and DISA STIG compliance, including the accreditation/ATO evidence package;

Personnel & Vetting Plan — Key personnel, certifications (e.g., DoD 8570/8140, Azure AZ-104/AZ-305/AZ-500/SC-100, CISSP/CCSP), and how all personnel will meet federal and state IL2/IL4 vetting requirements (Section 5);

Milestone & Deliverables Plan — Proposed milestones/sub-deliverables, schedule, and deliverables-based payment mapping (Section 9), including any single- or multi-year structure (Section 6);

Turn-Key & Minimal-Management Approach — Automation, IaC, managed-service constructs, and runbooks that minimize TMD's ongoing management burden;

Transition / Transferability Plan — How sustainment will be transferred to TMD as seamlessly as possible (Section 11);

Agentic AI Readiness Approach — How the architecture will be pre-wired so TMD can introduce Agentic AI on demand without re-architecture (Section 3.8);

Pricing — Firm-fixed milestone pricing consistent with Section 9;

Past Performance — Relevant experience delivering IL4/CUI/FedRAMP/TxRAMP environments of comparable scale (up to 6,700 concurrent users);

Differentiators ("Sell Yourself") — Accelerators, tooling, references, and value-adds. Offerors are expressly invited to differentiate themselves and demonstrate why their approach best achieves TMD's desired end state.

14.2 Evaluation Criteria

Proposals will be evaluated on a best-value basis. TMD reserves the right to weight criteria as set forth in the solicitation. The following criteria and illustrative weights apply (final weights to be confirmed in the solicitation):

Total

100%

TMD may conduct oral presentations, demonstrations, or clarifications. TMD reserves the right to make award without discussions and to select the proposal representing the best overall value.

15. Signature The DIR signature below serves solely to verify that the scope of services outlined in the Solicitation falls within the scope of the DIR contract being utilized. The DIR signature does not make DIR a party to the Contract or to any constituent document.

TMD Representative

Name:

Title:

Date:

Respondent Representative

Name:

Title:

Date:

DIR Representative

Name:

Title:

Date:

Appendix A — Definitions and Acronyms