RFI 311-26-180526AK The Trust Company Investment Data Platform Solution

The Texas Treasury Safekeeping Trust Company, acting under the Comptroller of Public Accounts, is seeking information from qualified vendors to support the development of a centralized, governed Investment Data Platform that will integrate and harmonize investment, accounting, operations, performance, and risk data from sources such as SimCorp, Bloomberg, and Clearwater. This Request for Information, issued with solicitation number RFI311-26-180526AK and a response deadline of June 29, 2026, is targeted at vendors with proven experience in capital markets, institutional investing, and fiduciary-grade data environments. The platform must deliver a governed golden copy of data with comprehensive metadata management, end-to-end lineage tracking, automated data quality controls, and seamless integration with existing systems without replacing them. The solution must comply with stringent security and data handling standards including IRS Publication 1075 for Federal Tax Information, NIST SP 800-88 for media sanitization, NIST Digital Identity Guidelines (IAL2/AAL2), CIS benchmarks, FIPS 140-2 encryption, and TX-RAMP authorization, with FedRAMP or StateRAMP being preferred. All personnel with access to Federal Tax Information must undergo background checks consistent with IRS requirements and are personally liable under federal law for any unauthorized access or disclosure, with penalties including fines up to $5,000 and imprisonment up to five years. Subcontracting involving Federal Tax Information is prohibited without prior IRS written approval, and all subcontractors must adhere to the same strict safeguards as the prime vendor. Vendor responses must be submitted via email to researchcpa@cpa.texas.gov no later than 2:00 p.m. Central Time on June 29, 2026, and must be organized as a single submission with no more than one page per required item, using standard document formats such as PDF or DOCX; encrypted or proprietary markings are not permitted. The platform must be operated and accessed from within the continental United States, and all physical and electronic media containing Federal Tax Information must be permanently purged within sixty days of contract expiration using NIST SP 800-88 standards, with destruction certified in writing. Security controls must include multifactor authentication, audit logging, CVSS-based vulnerability scanning, and hardened configurations, with compliance validated through SSAE-18 SOC 2 Type II reports or equivalent. Supply chain risks must be disclosed, particularly concerning technology from foreign countries