ESBD_570291_1792524752778_Scope of Services - Enterprise GRC.pdf

Enterprise GRC for TSTC Purpose Texas State Technical College (“TSTC”) is seeking proposals from qualified suppliers to provide an

Enterprise Governance, Risk, and Compliance (“GRC”) Platform to support institutional governance, audit, risk management, compliance tracking, policy and document management, workflow automation, reporting, and corrective action monitoring across applicable departments.

The purpose of this solicitation is to identify a solution that centralizes GRC-related processes, improves visibility into institutional risks and compliance obligations, supports standardized workflows, strengthens audit and remediation tracking, and provides secure, role-based access for authorized users.

The proposed solution should be scalable, configurable, user-friendly, and capable of supporting multiple functional areas, including Internal Audit, Legal, Policy Management, Information Technology, Risk

Management, and other departments as determined by TSTC.

● Centralization: Replace disparate manual workpapers with a unified platform for documentation and tracking.

● Efficiency: Automate repetitive tasks and evidence collection to reduce the duration of audit cycles.

● Continuous Monitoring: Shift from point-in-time assessments to real-time control monitoring and anomaly detection.

● Risk Mitigation: Improve visibility into institutional risks and automate the resolution of identified issues

Scope

1. Functional Scope and Required Modules

The Enterprise GRC Platform should support multiple functional areas within TSTC. Suppliers must identify which capabilities are included in the base solution, which require configuration, and which require additional modules, third-party tools, or custom development. The proposed solution should support, at minimum, the following functional areas:

● Internal Audit: Audit planning, risk assessment, work programs, evidence collection, testing documentation, findings, management action plans, remediation tracking, reporting, and continuous monitoring.

● Legal: Matter tracking, document management, task tracking, reporting, workflow routing, status tracking, and secure record retention.

● Policy Management: Policy and procedure lifecycle management, Statewide Operating

Standards management, document review, approval workflows, publication support, version control, and reporting.

● Information Technology / Security and Compliance: IT risk tracking, security compliance, control monitoring, issue tracking, remediation workflows, audit logs, access controls, and reporting.

● Enterprise Risk Management / Risk Management: Risk registers, risk scoring, risk ownership, mitigation plans, dashboards, reporting, and risk monitoring.

● Environmental Health and Safety, if applicable: Incident tracking, corrective action tracking, compliance monitoring, inspections, reporting, and documentation management.

The platform must support configurable workflows, dashboards, permissions, reporting, notifications, and document or record types by department or functional area.

2. Services: The selected supplier must deliver an Enterprise GRC Platform that includes, but is not limited to:

● Audit o Planning & Risk Assessment

▪ Risk Universe Integration: Connects audits to the company’s master list of risks to focus on high-priority areas

▪ Audit Scheduling: Builds annual or multi-year audit plans and assigns resources

▪ Scoping and Work Programs: Creates standardized testing steps and checklists for specific audit projects o Fieldwork & Execution:

▪ Evidence Collection: Requests and stores documents, data logs, and policy files securely inside the tool

▪ Testing and Documentation: Records test results, walkthrough notes, and control evaluations in real time

▪ Issue Tracking: Flags control failures or gaps immediately as "findings" or

"deficiencies."

o Reporting & Remediation

▪ Automated Reports: Generates audit reports, dashboards, and executive summaries with a single click

▪ Management Action Plans: Assigns corrective action tasks to responsible owners with defined deadlines.

▪ Status Tracking: Monitors whether corrective actions have been completed through automated reminders, status updates, and reporting.

o Continuous Monitoring

▪ Dashboard Views: Provides the ability to document, monitor, and report on action plans, risks, findings, compliance obligations, and other assigned activities.

▪ Data Analytics: Ability to record how assessment results were used to inform improvements.

● Environmental Risk Management o Task Management

▪ Automate workflows: Turn recurring environmental checks, like water quality testing or waste disposal logs, into automated calendar tasks with assigned owners

▪ Track Remediation Progress: Monitor step-by-step progress on fixing an environmental hazard, such as a chemical spill clean-up or emission reduction goal

▪ Set Priority Alerts: Receive automated notifications for approaching regulatory deadlines to avoid costly state or federal penalties

▪ Link Risks to Controls: Connect specific operational tasks directly to compliance regulations, showing auditors how your team manages each risk o Email & Communication Tracking

▪ Centralized Correspondence: Forward critical emails from regulatory agencies or internal site managers directly into the GRC platform to attach them to specific risk files

▪ Automated workflows: Keep a time-stamped, unalterable record of who approved an environmental mitigation plan and when they signed off

▪ Convert Messages to Actions: Turn an email request from an external auditor or a local inspector into an active compliance task with one click

▪ Reduced Siloed Data: Keep all historical discussions about a specific hazard or permit renewal in a single shared workspace rather than in individual inboxes

● Policy Management o Policy Document Management System & Lifecycle

▪ Approval workflow for Documents: Handled by a customizable workflow engine. It routes documents through draft, peer review, legal/compliance approval, and sign-off stages based on pre-defined matrix roles

▪ Reporting on Editing Stages: The platform tracks the metadata of a document's lifecycle. It uses audit logs to generate bottleneck reports (e.g., time-in-stage) and pipeline metrics (e.g., total documents currently in

"Review")

▪ Filter Capabilities: Metadata tagging allowing users to filter the document inventory dynamically by date modified, current workflow stage, approval status, and owner department.

o Identity, Access, and Security Architecture

▪ Keep Procedures Behind a Firewall (TSTC Email ONLY): Instead of a physical network firewall, GRC platforms use Identity and Access Management (IAM) and Single Sign-On (SSO) integrations (like Azure AD or Okta). The platform must support identity and access management controls that require authentication using TSTC-approved credentials, including TSTC domain email authentication and single sign-on, to restrict access to authorized TSTC employees

▪ Publish Statewide Operating Standards (SOSs) to TSTC Website: Managed via an external-facing Content Management System (CMS) integration or a public API gateway. Once a document reaches the "Published" status in the

GRC tool, it automatically pushes to the public website.

o Search and Content Intelligence (AI Layers)

▪ Easily Searchable by Keyword: Powered by a standard enterprise search engine (like Elasticsearch) that indexes text, titles, and metadata tags for instant retrieval

▪ AI Searchable for Broken Links and Cross-Reference: Executed by an AI/NLP

Compliance Engine: This layer continuously crawls document bodies to verify hyperlink validity and cross-reference mapping. If a referenced standard changes or a link breaks, the AI flags it on a compliance dashboard for remediation.

o Collaboration and Cross-Platform Accessibility

▪ Multiple Users Able to Edit at the Same Time: Handled through Co-authoring integrations (such as Microsoft Office 365 or Google Workspace APIs) embedded directly within the GRC user interface.

▪ Browser Compatibility and Cross-Platform Access: The platform must be accessible through current versions of commonly used browsers, including

Chrome, Safari, Microsoft Edge, and other modern browsers.

▪ The platform must use a cloud-native, responsive web architecture built on standard web technologies, such as HTML5, CSS3, and

JavaScript, to support access across approved devices and browsers.

o Training, Attestation, and Evidence Collection

▪ Compliance Documentation That Staff Have Viewed Documents: Handled by an Attestation or Policy Acknowledgement Module. When a critical document is updated, the system pushes a notification to relevant staff. It tracks their digital signature or "read" confirmation, generating audit-ready compliance logs.

o Integrations

▪ Ability to integrate with SharePoint, Google, and Workday.

● IT Security & Compliance o Tracking Tasks in an Enterprise GRC Platform

▪ Centralized Ownership: Assigns specific security controls, risk remediations, and policy reviews to named task owners with hard deadlines.

▪ Automated workflows: Triggers sequential follow-ups and secondary reviews automatically when a primary security task or control test is completed

▪ Status Visibility: Displays real-time dashboards showing open vulnerabilities, overdue remediation tasks, and compliance gaps across frameworks like ISO

27001 or NIST

▪ Evidence Linking: Requires users to attach logs, screenshots, or automated

API outputs directly to the task item for seamless audit readiness o Handling Emails & Notifications

▪ System Generated Alerts: Replaces informal manual emails with automated platform notifications that alert task owners when deadlines approach or evidence is rejected

▪ In-App Collaboration: Moves conversations about missing evidence or control failures out of standard email inboxes and directly into the audit record of the specific control

▪ Digest Reports: Sends automated weekly or monthly summary reports to managers highlighting stalled tasks and pending approvals rather than individual nagging emails o Data Segregation/WorkSpace Isolation

▪ Logical Data Segregation or Tenant Isolation. It ensures that even though

Audit, Legal, and Risk are using the exact same software tool, their workspaces function as completely independent "silos." This is the specific function of drawing a digital boundary around a department's data o Role-Based Access Control (RBAC) & Permissions

▪ The Audit Role: Your requirement specifies that permissions must be locked down so only users assigned the "Audit" role have both Read and Write

(view/edit) privileges over your modules.

▪ No Inheritance: This ensures other system administrators or corporate users do not automatically inherit viewing rights to sensitive internal audit documentation.

● Legal o Tracking Tasks

▪ Assign workflows: Create recurring tasks for contract reviews, regulatory filings, or policy updates

▪ Set Deadlines: Assign clear owners and due dates to prevent missed legal obligations

▪ Monitor Progress: Use visual dashboards to see which tasks are pending, in progress, or complete

▪ Automate Escalations: Trigger alerts to managers if a high-risk task passes its deadline

▪ Link to Risks: Connect specific tasks directly to underlying legal risks or compliance mandates o Tracking Emails

▪ Log Communications: Sync or forward important emails from outside counsel, regulators, or executives into the platform

▪ Attach to Matters: Tie specific email threads directly to the relevant legal case, contract, or risk profile

▪ Create Audit Trails: Maintain a permanent, searchable record of decisions and approval

▪ Reduce Silos: Allow team members to view shared correspondence without searching through private inboxes

▪ Protect Privilege: Restrict sensitive email access to authorized legal personnel only o Key Benefits

▪ Complete Visibility: Leaders see all ongoing legal work in a single view

▪ Audit Readiness: All history, tasks, and communications stay stored for easy review

▪ Fewer Mistakes: Automated reminders cut down on missed deadlines and lost messages

● Enterprise Integrations

The proposed Enterprise GRC Platform must support secure, reliable integrations with TSTC systems and technology environments. The supplier must describe available integration methods, including APIs, SFTP, connectors, middleware, webhooks, public API gateways, identity management integrations, or other standard integration options.

Policy and Document Management Integrations

The platform should support Policy Management-related workflows, policy management, document lifecycle management, and publication processes, including but not limited to:

o Integration with TSTC’s public-facing website or content management process to support publication of approved Statewide Operating Standards (SOSs), procedures, policies, or related documents.

o Workflow routing for drafting, review, approval, publication, revision, archival, and retirement of documents.

o Metadata tagging and searchable document repositories by owner department, document type, approval status, workflow stage, effective date, review date, and related compliance area.

o Version control, change history, audit logs, and approval history for policy and document records.

o Collaborative editing or document review capabilities compatible with TSTC’s primary Google Workspace environment and secondary Microsoft 365 environment.

o Search functionality, including keyword search, metadata search, and AI-enabled search or cross-reference identification if available.

o Broken link detection, cross-reference validation, and notification of documents requiring review or remediation, if available.

o Reporting on document status, workflow bottlenecks, pending approvals, review deadlines, and publication activity.

● Office of Information Technology (OIT) Integrations

The platform should support OIT requirements for secure authentication, user management, data exchange, and technical administration, including but not limited to:

o Single sign-on and identity management integration with TSTC-approved authentication systems.

o Support for role-based access controls, user groups, permission profiles, and department-level access restrictions.

o Compatibility with TSTC’s Google Workspace environment and Microsoft 365 environment, where applicable.

o Integration capability with Workday or other enterprise systems through API, SFTP, or other approved integration methods, if needed.

o Ability to support secure data imports and exports in standard formats.

o Audit logging for user activity, administrative changes, workflow approvals, data access, and configuration changes.

o Support for security monitoring, incident response, data retention, backup, disaster recovery, and business continuity requirements.

o Ability to segregate departmental workspaces, workflows, dashboards, and records while supporting enterprise-level reporting.

● State Agency IT, Security, Privacy, and Accessibility Requirements

The supplier must provide a solution that complies with applicable Texas state agency, higher education, security, privacy, and accessibility requirements. At a minimum, the supplier must address the following:

o TX-RAMP: For cloud-based services, the supplier must identify its Texas Risk and

Authorization Management Program (TX-RAMP) certification status and provide documentation of certification, provisional status, or the plan and timeline to achieve applicable TX-RAMP requirements.

o FERPA: The supplier must maintain appropriate safeguards for education records and institutional data subject to the Family Educational Rights and Privacy Act (FERPA), as applicable.

o Accessibility: The solution must comply with applicable Electronic and Information

Resources (EIR) accessibility requirements, including Texas Administrative Code

Chapters 206 and 213 and WCAG 2.1 AA standards.

o Data Security: The supplier must describe data encryption, access controls, audit logging, vulnerability management, backup and recovery, disaster recovery, and incident response procedures.

o Data Privacy: The supplier must describe how TSTC data is protected, stored, accessed, retained, returned, and destroyed.

o Identity and Access Management: The platform must support role-based access, single sign-on, multi-factor authentication, and TSTC-approved identity management processes.

o Security Incidents: The supplier must describe its process for identifying, reporting, managing, and resolving security incidents, unauthorized access, data breaches, or compliance violations.

o Subcontractors: The supplier must identify any subcontractors or third-party hosting providers that may access, process, store, or transmit TSTC data.

● User Access and Licensing Assumptions

TSTC anticipates the platform may require multiple user types and permission levels.

Suppliers must describe the available licensing model and identify how pricing applies to each user category. At a minimum, the proposal should address the following user types:

o System Administrators: Users responsible for system configuration, security settings, workflows, templates, permissions, integrations, reporting, and platform administration.

o Department Administrators / Power Users: Users responsible for managing department-specific workspaces, workflows, records, dashboards, and reporting.

o Contributors / Workflow Participants: Users responsible for submitting information, completing assigned tasks, reviewing documents, responding to audit or compliance requests, and participating in workflows.

o Approvers: Users responsible for reviewing and approving policies, documents, corrective actions, risk items, findings, or other assigned records.

o Read-Only / Reporting Users: Users who need access to dashboards, reports, records, or documents without editing permissions.

o External or Limited-Access Users: Users such as external auditors, consultants, or third parties who may require limited, time-bound, or restricted access, if applicable.

TSTC will provide estimated user counts during the solicitation process or implementation planning, as applicable. Suppliers must clearly identify whether pricing is based on named users, concurrent users, modules, departments, enterprise access, or another licensing structure.

3. Pricing and Fees: The proposal should include a transparent pricing model with detailed breakdowns of all costs associated with the proposed Enterprise GRC Platform, including but not limited to:

● Software licensing, subscription, or SaaS fees.

● User-based, role-based, module-based, or enterprise-wide pricing.

● Implementation, configuration, and project management fees.

● Data migration, data conversion, and legacy system transition costs.

● Integration costs, including APIs, SFTP, middleware, connectors, or custom development.

● Training costs for end users, application administrators, workflow owners, and train-the-trainer participants.

● Ongoing maintenance, technical support, customer success, and account management fees.

● Optional modules, premium features, AI-enabled functionality, reporting tools, or add-on services.

● Hosting, storage, security, backup, disaster recovery, and environment fees, if applicable.

● Travel, onsite support, or other reimbursable expenses, if applicable.

● Renewal pricing, annual escalation rates, and any minimum contract term requirements.

● Cost-saving opportunities, including educational discounts, volume discounts, bundled pricing, rebates, incentives, or cooperative purchasing options.

4. Implementation and Support The supplier must:

● Develop and execute an implementation plan in collaboration with TSTC

● Provide training to relevant TSTC Staff (End User), Application Administrators, and Train the

Trainer.

● Offer ongoing maintenance and technical support

● Ensure prompt troubleshooting and issue resolution within defined SLA

Requirements for Proposal

Criteria One: Support and Service Capability

1. Provide a detailed proposal addressing all aspects of this Scope of Work, including the supplier’s approach to implementation, configuration, training, support, and ongoing platform maintenance.

2. Describe how the supplier will support TSTC in implementing and maintaining an Enterprise

Governance, Risk, and Compliance (GRC) Platform across applicable departments and statewide locations.

a. Include an implementation timeline with key milestones, major deliverables, responsible parties, and anticipated TSTC resource requirements.

3. Describe the supplier’s customer support model, including help desk availability, support channels, response times, escalation procedures, and service level agreements (SLAs).

4. Provide details on training options for end users, application administrators, workflow owners, and train-the-trainer participants.

5. Describe the supplier’s process for post-implementation support, system updates, release management, issue resolution, and ongoing account management.

Criteria Two: Security and Compliance with Integration and Functional Requirements

1. Describe the supplier’s ability to provide an Enterprise GRC Platform that supports governance, risk management, audit, compliance, policy/document management, issue tracking, corrective action tracking, reporting, dashboards, workflow automation, and role-based access.

2. Describe the supplier’s compliance with applicable security, privacy, and accessibility requirements, including TX-RAMP, FERPA, TAC 206, TAC 213, WCAG 2.1 AA, and other applicable state and federal requirements.

3. Identify the supplier’s current TX-RAMP certification status and provide supporting documentation, if applicable.

4. Describe how the platform protects institutional data, including encryption, access controls, audit logging, data retention, breach notification procedures, disaster recovery, and business continuity capabilities.

5. Describe the platform’s ability to integrate with TSTC systems, including but not limited to

Workday, Google Workspace, Microsoft 365, identity/access management tools, public-facing websites, document repositories, and other applicable enterprise systems.

6. Describe the supplier’s approach to configuring workflows, permissions, reporting, dashboards, and department-specific workspaces for multiple functional areas.

7. Describe the supplier’s process for resolving security incidents, compliance violations, system outages, and critical support issues.

Criteria Three: Cost Effectiveness

1. Provide a detailed breakdown of fees, including transaction fees, equipment costs, monthly service charges, Implementation, and any other applicable costs.

2. Explain any available pricing models (e.g., interchange-plus, tiered pricing) and how they benefit

TSTC.

3. Identify any cost-saving opportunities such as volume discounts, rebates, or incentives for educational institutions.

Criteria Four: Experience in Sector

1. Provide examples of the supplier’s experience providing Enterprise GRC Platforms or substantially similar governance, risk, compliance, audit, policy management, or enterprise workflow solutions for higher education institutions, public sector entities, or similarly complex organizations.

2. Describe successful implementations involving multiple departments, role-based permissions, workflow automation, policy/document management, audit tracking, risk management, compliance monitoring, and executive reporting.

3. Describe the supplier’s experience supporting institutions with geographically distributed operations, multiple stakeholder groups, and complex approval workflows.

4. Detail measurable outcomes achieved for similar clients, such as improved reporting, reduced manual tracking, enhanced compliance visibility, streamlined policy review, improved audit readiness, or improved corrective action tracking.

5. Provide at least three relevant client examples or references that demonstrate the supplier’s ability to deliver and support an Enterprise GRC Platform of similar size and complexity.

Evaluation Criteria The evaluation of the proposals shall be based on the requirements described in this RFP. All properly submitted proposals will be reviewed, evaluated, and ranked by TSTC in accordance with the evaluation criteria set forth below:

Criteria to be Evaluated Points

Criteria One: Support and Service Capability 35

Criteria Two: Security and Compliance with Integration and Functional Requirements 30

Criteria Three: Cost Effectiveness 20

Criteria Four: Experience in Sector 15

Evaluation Criteria