Cyber Incident Response Services

The Teacher Retirement System of Texas (TRS) is seeking qualified vendors to provide comprehensive Cyber Incident Response (IR) services under solicitation TRS000615, which was posted on May 4, 2026, with proposals due by June 5, 2026. This solicitation, issued through the PAVES procurement system, requires a response in the form of a competitive proposal under Texas Government Code Section 825.103 and is classified under NAICS code 541512. The scope of work centers on preparing for and responding to major unplanned cyber events such as malware, ransomware, data breaches, account compromises, and Denial of Service attacks across M365, Azure, AWS, and other SaaS platforms. Services include annual tabletop exercises—technical, executive, or hybrid—along with active incident response when engaged, with a clear exclusion of ransomware negotiation support. All response activities must adhere to Texas state data sovereignty rules, ensuring TRS data remains within the continental U.S., and must be delivered without requiring TRS to adopt a specific technical solution. Contractors must maintain a 24/7/365 availability posture and be prepared for onsite engagement when requested. The contract is structured as a one-year base term with three optional one-year renewals, and pricing must be submitted as fully loaded, firm-fixed rates that include all labor, equipment, materials, and overhead costs, with no price escalation permitted during renewal periods. Key deliverables include incident reports, executive readouts, digital forensic analysis of up to 20 hosts, and standard and after-hours incident response labor hours. Proposals are evaluated using a best-value approach, with weightings of 35% for past performance and client references, 30% for proposed performance details, 25% for key personnel qualifications, and 10% for pricing. Key personnel must hold current certifications such as CISSP, GCIH, or ECIH, and all responders must be U.S.-based with no offshore-only service delivery permitted. Compliance with Texas regulatory frameworks including TAC 202 and the DIR Security Controls Catalog is mandatory. Responses must be submitted via PAVES, include a completed pricing form and a redlined draft contract using TrackChanges for any proposed modifications, and must acknowledge and accept TRS’s general terms and conditions. Contractors must establish a PAVES account with two-factor authentication via cell phone and maintain separate credentials