Citrix Renewal

The Ohio Department of Transportation (ODOT) is seeking to renew its Citrix software licensing, specifically procuring 5,500 licenses for Citrix Lifetime RMA for SDC and 5,500 licenses for Citrix Universal for Hybrid Multi Cloud. This procurement is focused on maintaining the state's technology infrastructure and requires potential vendors to comply with comprehensive data security and privacy terms. Contractors must adhere to strict information security standards, including implementing multi-factor authentication, encrypting data at rest and in transit, and maintaining physical and technical safeguards aligned with NIST 800-53 and ISO 27001 guidelines. The contract opportunity was posted on September 18, 2025, with proposals due by October 3, 2025. Vendors must complete an Affirmation and Disclosure Form that details their primary business locations, service performance locations, and data storage management sites, with a critical requirement that all services and data must be located within the United States.

The procurement opportunity includes specific set-aside considerations, emphasizing participation from Minority Business Enterprises (MBE) and Encouraging Diversity, Growth and Equity (EDGE) vendors. Potential contractors must undergo rigorous background investigations for personnel with data access and provide annual security audits such as SOC 2 Type 2 or FedRAMP authorization. While specific award values are not explicitly stated in the documentation, the scale of 5,500 licenses suggests a significant technology investment. Vendors must also disclose and receive approval for any generative artificial intelligence usage, with strict prohibitions on using confidential state data for AI model training. The contract terms include comprehensive provisions for payment (typically net 30 days), electronic funds transfer preferences, and detailed technology service level agreements with specific response time and support classifications. Importantly, ODOT reserves the right to terminate the contract if services are performed or data is stored outside the United States without a formal waiver.