Co-Sourced Agreement for Specialized Information Technology Auditing Services

The Texas Department of Criminal Justice (TDCJ) is seeking proposals to establish a co-sourced agreement for specialized information technology auditing services, with an anticipated contract value ranging from $500,000 to $2,000,000. The engagement aims to support the Office of the Independent Auditor (OIA) in conducting comprehensive IT audits aligned with the Fiscal Year 2026 Annual Audit Plan. The scope encompasses evaluating IT governance, cybersecurity practices, system implementations, data security, and risk management, adhering to a broad array of standards including NIST frameworks, ISO 27001, and federal and state privacy laws such as HIPAA, FERPA, and GDPR. The vendor will provide expert assistance across various audit phases—planning, fieldwork, and reporting—working closely with OIA officials to define specific deliverables for each engagement, which may include risk assessments, internal audits, and consulting services. Contract administration will be based on billable hours, with detailed hourly rate schedules and invoicing subject to approval by the OIA. The agreement emphasizes strict data ownership, confidentiality, and security protocols, requiring vendors and their personnel to comply with TDCJ’s IRSP-Policy, undergo background checks, and sign nondisclosure agreements. Data must be protected through encryption, retention, and secure transfer procedures, with restrictions on external system connections and data sharing. Use of artificial intelligence or machine learning technologies in performing contracted services is prohibited unless explicitly authorized in writing. The contract also mandates adherence to applicable security, privacy, and regulatory standards, including TX-RAMP certification for cloud services, and specifies that all data generated or obtained remains the property of the OIA, with strict controls on disclosure and disposal upon contract completion. The procurement process requires comprehensive proposals demonstrating relevant experience, methodology, personnel qualifications, and cost-effectiveness, with evaluations based on qualifications, approach, past performance, and compliance with the Statement of Work.