ESBD_File_349370_RFO 304-24-1181KW Training Development SW.pdf

RFO # 304-24-1181KW: Training Development Subscription Software & Related Services Page 1 of 46

Texas Comptroller of Public Accounts

Glenn Hegar, Comptroller

Request for Offers Training Development Software Subscription and Related

Services

RFO No. 304-24-1181KW

February 6, 2024

Anticipated Schedule of Events

February 6, 2024 Issuance of RFO

February 13, 2024 Deadline for Submission of Questions (2:00 p.m., CT) February 16, 2024 Release of Official Responses to Questions

(Or as soon thereafter as practical) February 21, 2024 Deadline for Submission of Offers (2:00 p.m. CT)

Late Offers will not be considered

RFO # 304-24-1181KW: Training Development Subscription Software & Related Services Page 2 of 46

Table of Contents

I. Summary

II. Specifications

A. Introduction

B. Background

C. Definitions and Acronyms

D. Scope of Services

E. Contract Resulting From This Solicitation; Order of Priority

F. Warranty of Performance

G. Security Incident Notification

H. Insurance and Bonds

I. Criminal Background Investigation

J. Contract Term

K. Invoice Acceptance Criteria

L. Payments

M. Discounts

N. PO Addition and Deletion

O. HUB Subcontracting Plan Information

P. Respondent Documents

Q. Respondent Exceptions

R. Respondent’s Past Performance

III. Offer Submission Requirements

A. Delivery of Offer

B. Offer Content and Format

IV. Mandatory Price Sheet

V. Standard Terms and Conditions

VI. Execution of Offer

VII. Conflict of Interest/Disclosure Statement

VIII. Nondisclosure Agreement

IX. Confidential Treatment of Information Acknowledgment

X. Certification Regarding Public Nature of the Offer

XI. Respondent Exceptions Response Template

XII. Contractor Cybersecurity Training Attestation Form

RFO # 304-24-1181KW: Training Development Subscription Software & Related Services Page 3 of 46

I. Summary

1. Type of Solicitation: Request for Offers (RFO)

2. Issuing Office: Texas Comptroller of Public Accounts (CPA) Procurement Section Room 300, Attn: RFO No. 304-23-0575DAG 111 E. 17th Street Austin, Texas 78774

OR Texas Comptroller of Public Accounts Procurement Section Attn: RFO No. 304-23-0575DAG P.O. Box 12050 Austin, Texas 78711-2050

3. Additional Requirements/Qualifications: N/A

4. Responses to RFO: Sealed Competitive Offers

5. Deadline for Offers: In Issuing Office No Later Than:

February 21, 2024; 2:00 p.m., Central Time (CT)

6. Initial Contract Term: Date of Award – August 31, 2024

7. CPA Optional Contract Terms: September 1, 2024, through August 31, 2025 September 1, 2025, through August 31, 2026 September 1, 2026, through August 31, 2027

8. CPA Contact Person for this RFO: Kristy Willis, CTCD/CTCM Email: Kristy.Willis@cpa.texas.gov Email: bidcpa@cpa.texas.gov

9. Offers Submitted by Email: Required; See Section III, Part A

10. Offers Submitted by Fax: Not Accepted

11. Pre-Offer Conference: N/A

12. Pre-Offer Inspection: N/A

13. Letters of Intent to Submit an Offer: N/A

14. RFO Addenda: Notices of changes to items directly impacting the original RFO or solicitation process will be posted on the Electronic State Business Daily (ESBD) located at: http://www.txsmartbuy.com/esbd. CPA will post any amendment to this solicitation on the ESBD as an RFO Addendum. It is the responsibility of an interested party to check the ESBD for updates to this RFO before submitting an Offer. Each Respondent is solely responsible for verifying CPA’s receipt of its questions, if applicable, and its Offer by the deadlines specified in this RFO.

15. Questions and Answers: Questions regarding this RFO must be in writing and must be submitted to the CPA Contact Person specified in Part 8, no later than February 13, 2024; 2:00 p.m. CT. Telephone inquiries will not be accepted.

Questions may be submitted by email to the email address specified in Part 8. CPA intends to post answers to the questions received on the ESBD on February 16, 2024, or as soon thereafter as practical.

16. Respondent Presentations: N/A mailto:Kristy.Willis@cpa.texas.gov mailto:bidcpa@cpa.texas.gov http://www.txsmartbuy.com/esbd

RFO # 304-24-1181KW: Training Development Subscription Software & Related Services Page 4 of 46

CPA may request that Top-Scoring Respondents present an overview of the services and a demonstration of the software proposed in their Offers.

The presentations will be performed on or about February 26, 2024.

Presentation location (e.g., videoconference, onsite, etc.), date(s) and time(s) to be arranged. In its sole discretion, CPA will determine the number of Top-Scoring Respondents.

17. Evaluation of Offers. Offers will be evaluated under the Best Value Standard (Section 2157.003 of the Texas

Government Code):

Criteria Weight Respondent’s Past Performance, Qualifications & Experience 20% Compliance with CPA Specifications 40% Cost 40% Total: 100%

As applicable, the factors listed in Sections 2155.074, 2155.075, 2156.007, and 2157.003 of the Texas Government Code shall also be considered in making an award.

18. Electronic Offers Only. Due to changed building access restrictions, Respondents will not be permitted to hand deliver

Offers to the Issuing Office. Respondents are required to submit Offers electronically via email in accordance with Section III, Part A.

19. Contact with CPA Staff: Upon issuance of this RFO, employees and representatives of CPA, other than the CPA Contact

Person identified in Part 8, will not discuss the contents of this RFO with any Respondent or its representatives. Failure of a Respondent or any of its representatives to observe this restriction may result in disqualification of any related Offer. This restriction does not preclude discussions between the parties to conduct business unrelated to this procurement or to obtain assistance completing Historically Underutilized Business (HUB) forms required by this RFO.

RFO # 304-24-1181KW: Training Development Subscription Software & Related Services Page 5 of 46

II. Specifications

A. Introduction

The Texas Comptroller of Public Accounts (CPA), an agency of the State of Texas, issues this Request for Offers (RFO) to solicit Offers from qualified vendors for Training Development Software Subscription and Related Services, as described in this Section II and in this RFO (Services). CPA’s objective is to obtain the Services that represent the best value for CPA and the State of Texas, according to the terms and conditions of this RFO.

CPA anticipates making a contract award to one (1) Successful Respondent for the Services. CPA reserves the right not to award a Contract for the performance of all or part of the Services. This RFO is not exclusive. CPA reserves the right to issue additional solicitations regarding the Services or similar services at any time. All Respondents are encouraged to always offer their best pricing.

All costs associated with the Services must be included in the Respondent’s Offer. Offers that do not meet all the requirements or contain all the required documentation specified in this RFO may be rejected as non-responsive.

B. Background

The Texas Comptroller of Public Accounts (CPA) requires continued access to software for agency training development.

Divisions within CPA currently use Articulate 360 software subscription for their training development needs. Articulate 360 has both desktop and cloud components and leverages a software portal for allocation of the agency’s seat licenses and transferring content between users. CPA has approximately 230 training courses or modules in completed or development status and currently uses 25 seat licenses. CPA is looking for software that meets or exceeds the functionality of current training software. The tables in Section IV (Mandatory Price Sheet) of the RFO itemize the Services that CPA requires for proposed solution.

C. Definitions and Acronyms

• Affiliates. A state agency or other entity designated by law or regulation to be under the authority or control of

CPA.

• Cloud Service Provider (CSP). An entity that provides to its customers internet-hosted services such as Software as a Service, Infrastructure as a Service, or Platform as a Service.

• CPA. Texas Comptroller of Public Accounts.

• CT. Central Time.

• E-Learning. A learning system based on formalized teaching but with the help of electronic resources.

• Error Correction. The correction of software malfunctions due to development, coding, or configuration issues that prevent the software from operating as designed.

• FEDRAMP. The Federal Risk and Authorization Management Program is a federal government program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.

• Fiscal Year. The State of Texas and CPA’s fiscal year that begins on September 1 and ends on August 31.

• Licensed Software. The version of the software application(s) provided under a contract resulting from this RFO in

Object Code form, any released Software Upgrades, Software Updates, Software Enhancements/Releases, Software Patches/Fixes, Error Corrections, and Customizations of such version.

• Object Code. The machine code that can be directly executed by a computer’s central processing unit.

• Offer. A response to this RFO.

• Software as a Service (“SaaS”): A cloud computing model where customers access the Licensed Software in the cloud on a subscription basis, and the Cloud Service Provider manages the software application(s), infrastructure, and platform(s).

• Software Enhancement/Release. A change to a software application, intended to increase functionality, productivity, compatibility, and/or improve the user interface.

• Software Maintenance and Related Services (Services). All the Licensed Software, Software Maintenance and Technical Support, Licensed Software Documentation, and other items listed in this Section and the RFO. The term includes, but is not limited to, fees, shipping, freight handling, and any other services associated with Successful Respondent’s performance under any contract resulting from this RFO.

• Software Patch/Fix. Addition to a piece of code, usually as an immediate remedy to an existing software application error or defect. A software patch or fix is usually a temporary measure until a more permanent solution is implemented with a Software Enhancement, Software Release, and/or version update.

RFO # 304-24-1181KW: Training Development Subscription Software & Related Services Page 6 of 46

• Software Update. Any (a) commercially available versions of the Licensed Software with a version number designated to the right of the decimal point such as 1.1, 1.2, 1.3, etc., and (b) any subsequent variation of the Licensed Software which provides essentially the same functionality and accomplished substantially the same tasks as the Licensed Software but which the software publisher releases under a different name or label.

• Software Upgrade. A commercially available new version of the Licensed Software typically designated by the number to the left of the decimal point such as 1.0, 2.0, 3.0, etc.

• SSH File Transfer Protocol, or Secure File Transfer Protocol (SFTP). A network protocol that provides file access, file transfer, and file management over any reliable data stream.

• State RAMP. State RAMP is a registered 501(c)(6) nonprofit membership organization comprised of service providers offering IaaS, PaaS, and/or SaaS solutions, third party assessment organizations, and government officials and is modeled after FedRAMP.

• Subscription Services and Related Services (Services). All the Licensed Software, subscription services, Maintenance and Technical Support, updates, upgrades, enhancements, patches, fixes, documentation, and other items listed in this Section and the RFO. These Services must include, but not be limited to, shipping charges, freight charges, and any other costs associated with Successful Respondent’s performance under any PO resulting from this RFO.

• Successful Respondent. The Respondent awarded a contract resulting from this RFO.

• Transition-In Services. Services provided by Successful Respondent to ensure an efficient and timely transition of the Services to Successful Respondent from CPA's incumbent contractor with minimal disruption to training development software end-users.

• TX-RAMP. The Texas Risk and Authorization Management Program is a program that provides a standardized approach for security assessment, authorization and continuous monitoring of third-party vendors that process the data of the state agency or public higher education institution in the State of Texas (Agencies). The Texas Department of Information Resources (DIR) developed and manages the program in compliance with Senate Bill 475.

D. Scope of Services

D.1 General.

a. Successful Respondent shall provide training development Licensed Software and Related Services as listed in Price Schedule 1 of the Mandatory Price Sheet located in Section IV of this RFO. All costs associated with Licensed Software, including, without limitation, costs for Software Maintenance and Technical Support and hosting applicable components of the Licensed Software in a cloud environment, must be included in Price Schedule 1.

b. CPA shall, in accordance with CPA policies and procedures, provide Successful Respondent reasonable access to the Licensed Software to perform Software Maintenance and Technical Support.

c. CPA shall retain all rights and ownership of all content (e.g., text, images, videos, etc.) that agency owns and uploads, imports, or develops in proposed Services. Successful Respondent shall not claim any ownership rights to agency content.

d. Successful Respondent shall be responsible for providing and performing all necessary activities to successfully deliver Transition-In Services and achieve the Services Effective Date to deliver the Services under any contract resulting from this RFO. Transition-In Services may include but are not limited to the following:

(1) Export/Import content such as existing completed and partially developed Articulate training modules and courses.

(2) Export/Import templates such as existing full and partial user-developed templates within Articulate

(3) Export/Import libraries such as existing full and partial user-developed files stored within Articulate libraries.

D.2 Licensed Software and Software Maintenance and Technical Support Services.

a) License Grant.

(1) Successful Respondent acknowledges that CPA is an agency of the State of Texas and CPA’s business operations include any activities consistent with its statutory authority.

(2) Under the contract, Successful Respondent grants CPA a non-exclusive, irrevocable, universal license to the

IP Rights for the purposes of (1) using, displaying and performing the Licensed Software in connection with CPA’s network; and (2) using, displaying and performing the Licensed Software in connection with backup and disaster recovery procedures in the event of destruction or corruption of the Licensed Software or

RFO # 304-24-1181KW: Training Development Subscription Software & Related Services Page 7 of 46 disasters or emergencies which require CPA or any of its Affiliates to initiate disaster recovery procedures;

CPA shall not permit any Licensed Software to be used by any other person, except for employees, agents, consultants, outsourcing companies and contractors who need to use the Licensed Software in the performance of their duties for CPA and who are authorized and enabled by CPA, under CPA’s written agreement, to access and utilize the Licensed Software.

b) Licensed Software Documentation.

Successful Respondent shall provide to CPA at least one (1) copy of the Licensed Software Documentation via online or hardcopy for each of the Licensed Software provided. Successful Respondent shall provide CPA either (1) written approval which authorizes CPA to make additional copies of the documentation at no charge or (2) access to additional copies of the documentation at no charge. CPA will restrict distribution of the Licensed Software Documentation to those users with a “Need to Know” classification. CPA shall not remove, deface, or otherwise obscure any copyright, patent, trademark, service mark, or other proprietary legend (Proprietary Legends) on the Licensed Software or the documentation. Furthermore, CPA shall include such Proprietary Legends in any reproductions of either the Licensed Software or the Licensed Software Documentation that CPA is permitted to make.

c) Software Maintenance and Technical Support.

(1) In its Offer, Respondent shall describe the Software Maintenance and Technical Support services that meet the requirements of this RFO.

(2) Software Maintenance and Technical Support Services must include, but are not limited to, the following:

telephone and on-line support, Error Corrections, Software Updates, Software Upgrades, Software Patches, Software Fixes, Software Enhancements, Software Releases, latest features, performance improvements, Licensed Software Documentation, unlimited support contacts, and unlimited annual incidents.

(3) Successful Respondent shall provide qualified personnel to be available to CPA by telephone, email, or website for the reporting of problems or issues with the Licensed Software or Software Maintenance and Technical Support Services. All such Software Maintenance and Technical Support Services must be unlimited during the term of any contract resulting from this RFO.

(4) Successful Respondent shall provide a help-desk toll-free telephone number, email, or website for the reporting of problems or issues with the Licensed Software. Successful Respondent shall provide support 24 hours a day, 7 days a week, 365 days a year.

(5) Response Times: Successful Respondent shall respond to service requests in accordance with the priority and within the maximum response times listed in Table 1 (Maximum Response Times). Response Time is defined as the period between Successful Respondent’s receipt of a service call from CPA and the time until Successful Respondent’s service technician responds with repair efforts underway. Repair Time is defined as the timeframe for Successful Respondent to complete the Software Maintenance and Technical Support Services required to return the affected systems to normal operations. CPA, in its sole discretion, will determine the service priority reporting of problems or issues with the Licensed Software.

Table 1 - Maximum Response Times

PRIORITY LEVEL DESCRIPTION

MAX

RESPONSE

TIME

S1: System Outage;

Production System

Outage

This includes the following scenarios:

• Product in production environment is unusable and is severely impacting other critical business functions, and no workaround is available.

• Outage of Successful Respondent’s Cloud Offerings is leading to service interruptions to production versions of APIs exposed on the platform.

2 Hours

S2: Key Functionality Impaired; No Workaround

The reported issue affects key functionality and/or causes some performance degradation, and no workaround is available. Other product features are still functional.

4 Business Hours

S3: Moderate Impact with Workaround

Issue has moderate or minor impact on usage, and product remains functional. This category may include provisioning/change management

8 Business Hours

RFO # 304-24-1181KW: Training Development Subscription Software & Related Services Page 8 of 46 requests, enhancement requests, common how-to questions, and any product issues with a viable workaround.

S4: Minor Impact Includes minor, cosmetic, or documentation-related issues, and enhancement requests that are not time-sensitive. There is no impact on the product’s existing features.

8 Business Hours.

(6) Escalation Protocol: In its Offer, Respondent must propose for CPA’s consideration an escalation protocol for collaboratively resolving issues encountered during the term of any contract resulting from this RFO. The proposed escalation process protocol must explain how issues or complaints are prioritized and resolved. This protocol shall include (1) an organization chart addressing topics such as specific steps to be taken on top priority issues or disputes arising due to untimely response to system down or critical malfunction remedial repair requests and (2) any other top priority service requirements of a contract resulting from this RFO which are not met.

D.3 Licensed Software Functional and Technical Requirements

Successful Respondent’s Training Development Licensed Software Subscription and Related Services must provide the ability to perform or have the following features:

a. Provide an electronic-learning (e-learning) training authoring tool to allow users the ability to develop training modules for agency training requirements.

b. Provide access controls/permissions to manage user data access.

c. Provide the ability to generate content (output) and/or incorporate the following, to include, but not limited to:

1. Articles

2. Audio

3. Images

4. Video

5. Slide and slide layers

6. Advanced interactive features, including but not limited to the following:

i. Animated slides

ii. Motion paths

iii. Variables and triggers

iv. Branching scenarios

v. Assessments

vi. Quizzes

vii. Tests

viii. Games

ix. Interactive videos

d. Employ intuitive, native training development and/or authoring tools, including but limited to the following:

1. Drag-and-drop functionality

2. Customized feedback

3. Library of customizable templates/themes

4. Responsive design to preview how content will look on an array of devices and displays

e. Provide compatibility to third-party applications/software, including but not limited to the following:

1. Microsoft Office

2. Microsoft Word

3. Microsoft PowerPoint

4. Microsoft Excel

f. Provide direct publishing to Agency Learning Management Systems, including but not limited to the following:

1. Cornerstone

2. Udemy

3. TEG

4. KnowBe4

5. Percipio

g. Provide an online publishing review site, including but not limited to the following features:

1. Tracks multiple versions of courses.

2. Ability to share course with any user.

3. Commenting and feedback functionality

h. Provide the ability to create and share content libraries amongst users.

RFO # 304-24-1181KW: Training Development Subscription Software & Related Services Page 9 of 46

i. Provide a centralized resource library for content authoring.

j. Provide content output utilizing all current standard eLearning formats, including but not limited to the following:

1. xAPI

2. SCORM

3. Cmi5

4. IMS

5. MP4

6. HTML5

7. AICC

8. Word

k. Provide an interactive dashboard which visualizes learning metrics for users.

l. Provide the ability to collaborate on content (e.g., comments, notes, editing, etc.).

m. Provide video creation tools, including but not limited to the following:

1. Video capture/transfer/import

2. Screen recording

3. Editing

4. File rendering

5. File output

6. Voice dictation

7. Closed captioning.

n. Provide audio creation tools, including but not limited to the following:

1. Audio record/transfer/import

2. Editing

3. Audio transcription

4. Closed captioning.

5. Text-to-speech support/audio generated voiceovers

o. Provide an online cloud based authoring tool option.

p. Provide cross-platform compatibility for different operating systems, browsers, and devices (e.g., MAC O/S, Windows, Google Chrome, Microsoft Edge, Safari, laptops, tablets, mobile devices, etc.)

q. Provide single sign-on capability via OKTA (SAML Connectivity)

r. Provide a customized and accessible course player.

D.4 Transition-In Services

a. In the event the Successful Respondent is not the incumbent contractor, the objective of the transition activities is to ensure an efficient and timely transition of the Services to Successful Respondent from CPA's incumbent contractor with minimal disruption to CPA end-users. Transition-In Services are a critical component under any contract resulting from this RFO; there cannot be a lapse or delay in the Services.

b. The Transition-In period begins on the effective date of the Contract. During the Transition-In period, the Successful Respondent shall:

1. Provide proposed Transition-In plan and schedule.

2. Plan, prepare for, and conduct the migration of any data or content that is available to migrate from incumbent system to Successful Respondent’s proposed solution.

3. Provide data migration services to be included in the proposed pricing at no additional cost to CPA.

4. Ensure the Services are provided under this Scope of Work to the extent defined and agreed to under any contract resulting from this RFO.

5. Note assistance with data cleanup after migration shall be included in Transition-In Services.

D.5 Training Requirements

In its Offer, Respondent must describe in detail the training that would be provided to CPA including Respondent’s training approach, strategies, tools, and suggested timeframes. Respondent’s description should address, at a minimum:

a. Initial product training

b. System administration training, if required

c. Training manuals: Respondent shall describe the training materials and related documentation Respondent will provide to CPA in delivery of training and knowledge transfer activities.

d. Online webinars, on-demand training videos and a client community of discussion threads, best practices, and shared templates

RFO # 304-24-1181KW: Training Development Subscription Software & Related Services Page 10 of 46

D.6. CPA Data Safeguard Standards.

a. Defined Terms. The term “CPA Data” refers to CPA’s information as well as other entity information in the possession of CPA that is processed, stored, or transmitted by a computer. CPA Data includes all data that is generated by Successful Respondent in performance of a contract with CPA. The term “CPA Information System” refers to those devices, software, networks, and related infrastructure that CPA owns, operates, or has obtained for use to conduct CPA business. Devices include, but are not limited to, CPA-owned or managed storage, processing, and communications devices, as well as personally owned devices.

b. Access to CPA Data. Successful Respondent represents and warrants that it will implement, maintain, and use appropriate administrative, technical, and physical safeguards to preserve the confidentiality, integrity, and availability of CPA Data. Successful Respondent will not collect, access, use, disclose, or retain CPA Data other than as necessary to perform the services specified in a contract resulting from this solicitation or as otherwise authorized in writing by CPA. Successful Respondent will restrict access to CPA Data to only those personnel who must have the information on a “need to know” basis. Successful Respondent will not use CPA Data, or any information derived from CPA Data, for its own benefit or the benefit of any other person or entity. Successful Respondent will not share CPA Data with its parent company or other affiliate without CPA’s express written consent.

c. Web-Based Remote Access to CPA Information Systems. Successful Respondent may use third-party web-based remote access connections to CPA Information Systems to provide support services under the following conditions:

1. CPA shall affirmatively initiate and accept Successful Respondent’s connections to CPA Information Systems.

2. CPA shall monitor Successful Respondent’s connections to CPA Information Systems for the duration of the

Services.

3. CPA shall terminate Successful Respondent’s connections to CPA Information Systems upon completion of the

Services.

d. Reserved.

e. Reserved.

f. Location of CPA Data. Successful Respondent shall ensure that CPA Data (i.e., primary and backup) remains, always, within the continental United States. Successful Respondent shall receive, process, transmit, and store all CPA Data within the continental United States. Successful Respondent’s point of access to CPA Data shall be within the continental United States.

g. Encryption Standards.

1. Successful Respondent shall encrypt CPA Data in transit and at rest. Data in transit means data is moving via email, in applications, or through browsers and other web connections. Data at rest (including data backups) means data is stored in databases, the cloud, removable media, or mobile devices.

2. Successful Respondent shall utilize encryption standards that are FIPS 140-2 compliant or, upon the written approval of CPA’s Chief Information Security Officer, shall meet the intent of the standards as described in FIPS 140-2.

3. The minimum cryptographic algorithm used by Successful Respondent must be Advanced Encryption Standard (AES) 128 or higher (256 AES is preferred).

4. Successful Respondent shall encrypt CPA Data transmitted over a public or private network. CPA approved data encryption transmission protocols include the following: (1) SFTP (FTP over SSH), (2) FTPS (FTP over TLS),

(3) HTTPS (HTTP over TLS), and (4) virtual private network.

h. Reserved

i. Auditable Information Security Framework. Successful Respondent shall secure its own and its third-party service providers’ systems (e.g., IT service provider, Cloud Service Provider) in a manner consistent with an auditable information security framework e.g., National Institute of Standards and Technology (NIST), International Organization for Standardization (ISO) 27001.

j. Defects and Vulnerabilities. Upon Contract award and during the term of the Contract, Successful Respondent shall provide CPA with prompt, written notice upon Successful Respondent’s discovery of any product defects and vulnerabilities of the proposed Licensed Software/Solution/System that allow an attacker to violate an explicit (or implicit) security policy to achieve some impact or consequence. Examples of vulnerabilities include defects that allow intruders to gain increased levels of access or interfere with the normal operations of information systems.

Vulnerabilities caused by insecure configurations, design choices, and changing environmental conditions are additional examples.

RFO # 304-24-1181KW: Training Development Subscription Software & Related Services Page 11 of 46

k. Supply Chain Risk Management. Successful Respondent shall provide CPA’s Contract Manager a description of how it manages supply chain risks. During the term of the contract, Successful Respondent shall provide CPA’s Contract Manager prompt, written notice of supply chain risks that impact the delivery of the products and services of the Contract. Examples of supply chain risks include supplier financial failure, production control/product quality, market supply and demand, labor disputes/shortages, cybersecurity threats, natural disasters.

l. Independent Information Security Assessment. If Successful Respondent has access to a CPA Information System or receives, processes, transmits, or stores CPA Data, then Successful Respondent shall provide CPA’s Contract Manager with its most recent information security assessment conducted by an independent third-party (e.g., SSAE-18 SOC 2 Type II, ISO 27002) upon Contract award and annually thirty (30) days prior to the anniversary of the Contract award date thereafter. CPA, in its sole discretion, may conduct a security assessment of any information system holding CPA Data or connected to a CPA Information System. CPA’s security assessment may consist of a review of the following:

(i) independent third-party assessment(s) contracted by Successful Respondent (e.g., SSAE-18 SOC 2 Type II, ISO 27002) and (ii) Successful Respondent’s System Security Plan.

m. Media Sanitization. Successful Respondent shall sanitize information system media, both digital and non-digital, in accordance with NIST Special Publication 800-88 (Guidelines for Media Sanitization) when CPA Data in the custody of Successful Respondent is no longer required to be retained by contract with CPA. Successful Respondent must maintain a record documenting each sanitization procedure that, at a minimum, includes the following information:

(i) date sanitization completed, (ii) description of the item(s), serial number(s), inventory control number(s), if applicable, and (iii) sanitization method used. No later than sixty (60) calendar days from contract expiration or termination or as otherwise specified in the Contract, Successful Respondent must either (i) complete the sanitization and submit via email to the CPA Contract Manager all sanitization documentation or (ii) submit a written statement via email to the CPA Contract Manager explaining the reason that destruction of CPA Data by Successful Respondent is technically impossible or impractical. Successful Respondent’s obligations set forth in this clause survive the termination or expiration of the contract if Successful Respondent retains CPA Data.

n. Third-Party Service Providers. It is Successful Respondent’s sole responsibility to ensure that its access and the access Successful Respondent grants to its service providers to CPA Data or CPA Information Systems does not result in unauthorized access to CPA Data or CPA Information Systems.

o. Reserved.

p. Reserved.

q. Reserved.

r. State Authorization and Risk Management Program (TX-RAMP). Successful Respondent shall obtain TX-RAMP certification in accordance with the Department of Information Resources (DIR) Program Manual. CPA requires the following TX-RAMP certification based-on Agency criteria:

1. _X_ None. Product is out of scope/low impact in accordance with the DIR TX-RAMP Manual.

2. __ Level 1 Certification. The product will administer Agency public data.

3. __ Level 2 Certification. The product will administer Agency sensitive, confidential, and/or regulated data.

s. Service Provider, Outsourced, and Cloud Computing. Regardless of TX-RAMP certification, the following requirements apply if Successful Respondent is a Service Provider or Cloud Service Provider (CSP) or contracts with a CSP or other Data Center to receive, process, transmit, or store CPA Data.

1. Security Control Verification. Successful Respondent shall provide to CPA evidence that it has implemented security controls correctly, the controls are operating as intended, and the controls are producing the desired outcome with respect to meeting security requirements for the information system. Acceptable documentation includes:

• SSAE-18 SOC 2 Type II Report (or the updated, equivalent report).

• FedRAMP certification (CPA preferred option for CSP).

• Level Two: Cloud Security Alliance (CSA) Security, Trust & Assurance Registry (STAR) Attestation.

• Level Two: CSA STAR Certification.

• Level One: CSA STAR Self-Assessment.

• Completed CSA Cloud Controls Matrix (CCM) and CSA Consensus Assessment Initiative Questionnaire.

• CSA CCM.

• Successful Respondent information security plan; and

RFO # 304-24-1181KW: Training Development Subscription Software & Related Services Page 12 of 46

• Successful Respondent information security policies and procedures.

2. Penetration Test. Successful Respondent shall ensure that information system(s) that receive, process, transmit, or store CPA Data undergo an independent third-party annual penetration test. Successful Respondent shall provide a summary of the penetration test results to CPA annually thirty (30) days prior to the anniversary of the Contract award date. Successful Respondent shall coordinate with CPA to schedule the initial penetration test and subsequent annual penetration tests during the term of the Contract.

3. Information System(s) Architecture. For information system(s) that receive, process, transmit, or store CPA Data, Successful Respondent shall develop and maintain a comprehensive architectural diagram that identifies the information system (s) components and environment, including ports, protocols, and services. Successful Respondent shall protect the architectural diagram from unauthorized access, disclosure, modification, and /or destruction. Successful Respondent shall provide the diagram to CPA annually.

4. Configuration Minimum Requirements.

a. Successful Respondent shall implement (SAML) an XML-based standard (CPA preferred) or OpenID

Connect (OIDC) for exchanging authentication and authorization data for identity management of CPA internal users. If Successful Respondent is technically incapable of integrating with CPA’s identity services provider, Successful Respondent shall ensure identifier and authenticator controls are consistent with CPA standards.

b. Successful Respondent shall remove root access, where feasible, to information system(s) that receive, process, transmit, or store CPA Data.

c. Successful Respondent shall prohibit Privileged User access to CPA data on information system(s) that receive, process, transmit, or store CPA data.

d. Successful Respondent shall employ multifactor authentication for Privileged Users who support information system(s) that receive, process, transmit, or store CPA Data when accessing CPA Information System(s).

e. Pursuant to Section 2054.192 of the Texas Government Code, Privileged Users that have access to a CPA Information System shall complete the CPA-Required Security Awareness Training.

f. Secure Baseline Configuration. Successful Respondent shall develop secure baseline configurations for information system(s), components, or services that receive, process, transmit, or store CPA Data in accordance with industry best practices (e.g., U.S. Government Configuration Baseline (USGCB), Center for Internet Security (CIS) Benchmarks). In the absence of an industry defined secure configuration, Successful Respondent shall develop a baseline for information system(s), components, or services in collaboration with

CPA.

g. Audit Information. For information system(s) that receive, process, transmit, or store CPA Data, Successful Respondent shall enable information system(s) auditing to the greatest extent necessary to capture access, modification, and deletion of data by each unique user and Privileged User system access and actions. Audit controls shall ensure the movement of sensitive, confidential, and regulated data is traceable throughout the data lifecycle. Audit records shall contain date, time, type, source, and outcome of system event, the user account involved, service account, service, or process responsible for initiating the system event, and other information that facilitates reconstruction of events. Successful Respondent shall protect audit information from unauthorized access and modification. Successful Respondent shall share audit information with CPA upon request.

h. Successful Respondent shall configure information system(s) that receive, process, transmit, or store CPA Data to deny local network mapping and prevent copy and paste from the information system(s) to unapproved workstations, laptops, or terminals.

5. Configuration Management Plan. Successful Respondent shall develop a Configuration Management Plan for information system(s) that receive, process, transmit, or store CPA Data. The Configuration Management Plan must include a comprehensive description of the roles, responsibilities, policies, and procedures that apply when managing the configuration of products and systems. The Configuration Management Plan may be an all-inclusive, stand-alone document or may be comprised of more broadly defined configuration management procedures contained in multiple documents. CPA shall review and approve the Configuration Management Plan annually during the contract term. Successful Respondent shall treat the Configuration Management Plan as confidential CPA information and protect the Configuration Management Plan from unauthorized disclosure and modification.

6. Data Center Resiliency, Environmental Protections, and Physical Security. Successful Respondent shall provide multiple geographic regions and availability zones to ensure resiliency in the event of natural disasters, common equipment failures, or information system failures. The data center(s) shall ensure electrical power systems are fully redundant and maintainable without interruption to continuous operations. Data center(s) shall provide backup power through various mechanisms including, but not limited to, UPS batteries. Data center(s) backup power shall supply consistently reliable power protection during utility brownouts, blackouts, over voltage, under voltage, and out-of-tolerance frequency conditions. The data center(s) shall use generators to provide power to critical equipment and customer loads. Trained security personnel shall staff the data center(s) twenty-four (24)

RFO # 304-24-1181KW: Training Development Subscription Software & Related Services Page 13 of 46 hours a day, seven (7) days a week. Data center(s) shall use a security organization responsible for physical security functions to monitor its data center(s). The data center(s) shall have state-of-the-art electronic surveillance and multi-factor access control systems. Successful Respondent and/or CSP shall authorize physical access to its data center(s) strictly on a least privilege basis and access control systems shall log unauthorized activity and failed access attempts.

7. Roles and Responsibilities. Successful Respondent and CPA shall define and document CPA oversight and user roles and responsibilities regarding the outsourced and/or CSP information system(s) that receive, process, transmit, or store CPA Data.

8. Vulnerability Assessment and Continuous Monitoring. For information system(s) that receive, process, transmit, or store CPA Data, Successful Respondent shall employ vulnerability scanning tools and techniques to identify information system(s) flaws, improper configurations, and vulnerabilities. Successful Respondent shall conduct information system(s) scans at least monthly and remediate and mitigate vulnerabilities in accordance with the National Institute of Standards and Technology National Vulnerability Database Common Vulnerability Scoring System (CVSS). Successful Respondent shall report vulnerability assessment results and remediation efforts to CPA monthly.

9. Court and Administrative Orders. Except as otherwise required by law, the Successful Respondent and/or CSP shall promptly notify CPA of any subpoena, judicial, or administrative order that it receives and that relates to CPA Data held by the CSP or other data center.

10. Transition of CPA Data. Following termination of the Services, Successful Respondent shall, for no additional compensation, aid in the timely and secure transition of CPA Data to CPA or CPA’s designated service provider in a secure agreed file format usable without the outsourced information system or cloud service.

D.7 Optional Features, Products or Services. Respondents are encouraged to submit and describe in detail in their Offers optional features, products or services that would benefit CPA but are not part of the minimum requirements of this RFO. Optional features, products, or services, may include additional training, additional maintenance, perpetual software licenses, increased service levels, etc. In its Offer, Respondent must describe with specificity any proposed optional features, products, or services. For pricing associated with optional items that exceed the minimum requirements of this RFO, Respondent must include the line item cost associated with each proposed optional feature, product, or service in the “Optional Features, Products, or Services” pricing portion of Section IV (Mandatory Price Sheet) of this RFO.

CPA has identified the following for Respondents’ consideration as optional features, products, or services:

• Formal Training Services

• Additional Subscription Licenses

• Additional User Licenses

• Annual Software Maintenance and Technical Support for each Additional Subscription License

• Annual Software Maintenance and Technical Support for each Additional User License

D.8 Accessibility Compliance. Successful Respondent shall provide Licensed Software that complies with the applicable, statutorily required accessibility standards for the State of Texas. If the Licensed Software does not meet or exceed the applicable statutorily required accessibility standards for the State of Texas, Successful Respondent shall provide technical support and Licensed Software documentation necessary to enable CPA to comply with the State of Texas reporting requirements outlined in 1 Texas Administrative Code Chapters 206 and 213. Such assistance includes, but is not limited to, Successful Respondent providing a Voluntary Product Accessibility Template (VPAT) or a similar report in substantially the same format as a VPAT. Successful Respondent shall respond to all written inquiries from CPA regarding the Licensed Software’s compliance with requisite accessibility standards within five (5) business days of receiving such request.

D.9 Liquidated Damages. In submitting an Offer, Respondent agrees that the measure of damages in the event of a default or breach of contract by Successful Respondent may be difficult or impossible to calculate. In the event Successful Respondent fails to perform Services or complete the obligations under the Contract in a timely manner, CPA may require Successful Respondent to pay, as liquidated damages and not as a penalty, an amount equivalent to two percent (2%) of the total cost for Services or obligations not completed as required by the Contract per calendar day of delay.

CPA may impose, but is not obligated to impose, these liquidated damages in lieu of any monetary damages available to CPA under the Contract or applicable law.

E. Contract Resulting from This Solicitation; Order of Priority.

Respondent’s Offer is a legal offer to contract based upon the terms, conditions, and specifications set forth in this RFO.

A contract award by CPA may be by (1) valid PO or (2) a formal, written agreement between CPA and Successful Respondent. The Contract is effective as of the Award Date and will be between CPA and the Successful Respondent. The

RFO # 304-24-1181KW: Training Development Subscription Software & Related Services Page 14 of 46 entire Contract between CPA and Successful Respondent shall consist of the following documents, which shall control in the following order of priority, except as otherwise provided in the formal signed agreement or PO: (1) the PO and PO Change Notices, if any; (2) the formal, signed agreement, if any; (3) this RFO; and (4) Successful Respondent’s Offer (collectively, the “Contract”).

F. Warranty of Performance

Successful Respondent represents and warrants that its performance under the Contract shall be conducted conscientiously in a professional and workmanlike manner to the full extent of Successful Respondent’s talents and capabilities with due diligence and in full compliance with the highest professional standards of practice in the industry applicable to the Services.

G. Security Incident Notification

Successful Respondent shall have policies and procedures for the effective management of Security Incidents, which shall be made available to CPA upon written request. Within twenty-four (24) hours of Successful Respondent’s discovery or reasonable belief that there has been an event which results in the accidental or deliberate unauthorized access, loss, disclosure, modification, disruption, or destruction of confidential CPA information (“Security Incident”), Successful Respondent shall provide notice to CPA by calling (800) 531-5441 EXT 34357. Until the investigation is complete, Successful Respondent shall submit, on a daily basis or as otherwise agreed by CPA, a written report via encrypted email to security.alerts@cpa.texas.gov that includes, at a minimum, the following:

• Date and time incident occurred,

• Date and time incident detected,

• Date and time incident contained,

• Address where incident occurred,

• Name of person(s) that discovered incident,

• Description of how Successful Respondent discovered incident,

• Type of CPA information involved,

• Description of the nature of the incident,

• Description of the steps Successful Respondent has taken or will take to investigate incident,

• Description of the steps Successful Respondent has taken or will take to mitigate any negative impacts of incident,

• Information technology involved (e.g., laptop, server, mainframe),

• Description of steps taken to preserve computer evidence and maintain chain of custody, and

• Description of corrective action Successful Respondent has taken or will take to prevent future incidents.

Successful Respondent shall coordinate all media or other breach notifications with CPA in advance of such notification(s), unless expressly prohibited by law. Subject to review and approval of CPA, Successful Respondent shall provide notice at its own cost that satisfies the requirements of applicable law to individuals whose information was compromised or likely compromised because of the Security Incident. If CPA, in its sole discretion, elects to send its own separate notice, then all costs associated with preparing and providing the notice shall be reimbursed to CPA by Successful Respondent. If Successful Respondent does not reimburse such costs within thirty (30) days of CPA’s written request, then CPA shall have the right to collect such costs. CPA reserves the right to conduct an independent investigation of any Security Incident, and should CPA choose to do so, Successful Respondent shall cooperate fully with CPA and assume responsibility at its own expense for making personnel, resources, and systems access available to CPA and CPA’s authorized representative(s).

H. Insurance and Bonds

Successful Respondent represents and warrants that it shall obtain and maintain the following coverages throughout the term of the Contract and that all coverages shall be with companies licensed in Texas with an “A” rating from A.M. Best Co. authorized to provide the required coverages:

• Blanket Employee Dishonesty Bond or Employee Dishonesty Coverage under a liability insurance policy with a minimum $25,000 for each individual who will provide Services. A rider or endorsement shall name the Texas Comptroller of Public Accounts as loss payee or additional named insured under the respective bond or policy.

• Standard Workers Compensation Insurance covering all individuals who will provide Services.

• Commercial General Liability Insurance:…