Enterprise GRC for TSTC Follow Solicitation

Texas State Technical College (“TSTC”) is seeking proposals from qualified suppliers to provide an Enterprise Governance, Risk, and Compliance (“GRC”) Platform to support institutional governance, audit, risk management, compliance tracking, policy and document management, workflow automation, reporting, and corrective action monitoring across applicable departments.

The purpose of this solicitation is to identify a solution that centralizes GRC-related processes, improves visibility into institutional risks and compliance obligations, supports standardized workflows, strengthens audit and remediation tracking, and provides secure, role-based access for authorized users. The proposed solution should be scalable, configurable, user-friendly, and capable of supporting multiple functional areas, including Internal Audit, Legal, Policy Management, Information Technology, Risk Management, and other departments as determined by TSTC.

The Enterprise GRC Platform should support multiple functional areas within TSTC. Suppliers must identify which capabilities are included in the base solution, which require configuration, and which require additional modules, third-party tools, or custom development. The proposed solution should support, at minimum, the following functional areas:

• Internal Audit: Audit planning, risk assessment, work programs, evidence collection, testing documentation, findings, management action plans, remediation tracking, reporting, and continuous monitoring.
• Legal: Matter tracking, document management, task tracking, reporting, workflow routing, status tracking, and secure record retention.
• Policy Management: Policy and procedure lifecycle management, Statewide Operating Standards management, document review, approval workflows, publication support, version control, and reporting.
• Information Technology / Security and Compliance: IT risk tracking, security compliance, control monitoring, issue tracking, remediation workflows, audit logs, access controls, and reporting.
• Enterprise Risk Management / Risk Management: Risk registers, risk scoring, risk ownership, mitigation plans, dashboards, reporting, and risk monitoring.
• Environmental Health and Safety, if applicable: Incident tracking, corrective action tracking, compliance monitoring, inspections, reporting, and documentation management.

The platform must support configurable workflows, dashboards, permissions, reporting, notifications, and document or record types by department or functional area.

**Implementation and Support.** The supplier must:

• Develop and execute an implementation plan in collaboration with TSTC
• Provide training to relevant TSTC Staff (End User), Application Administrators, and Train the Trainer.
• Offer ongoing maintenance and technical support
• Ensure prompt troubleshooting and issue resolution within defined SLA

Proposals must be submitted through the portal; **email submissions cannot be accepted**. Please post all inquiries to the event’s Q&A Board within the portal so we can provide formal responses. If new to the portal, please register early to avoid delays.

The evaluation of the proposals shall be based on the requirements described in this RFP. All properly submitted proposals will be reviewed, evaluated, and ranked by TSTC in accordance with the evaluation criteria set forth below:

| Criteria to be Evaluated | Points |
| --- | --- |
| Criteria One: Support and Service Capability | 35 |
| Criteria Two: Security and Compliance with Integration and Functional Requirements | 30 |
| Criteria Three: Cost Effectiveness | 20 |
| Criteria Four: Experience in Sector | 15 |