Managed IT Services

WCCAC RFP | Managed IT, Cybersecurity, and HIPAA Security Program Management
Solicitation Contents
Section Description
Part I General Requirements and Procurement Instructions
Part II Insurance Requirements
Part III Terms and Conditions
Part IV Scope of Work and Technical Requirements
Part V Discovery Phase: System, Network, and Security Audit
Part VI HIPAA Security Program Management
Part VII Personnel Screening, Training, and Access Requirements
Part VIII Service Levels and Reporting
Part IX Pricing, Evaluation, and Award
Attachment A Pricing Proposal Form
Attachment B Reference Form
Attachment C Subcontractor Information Form
Attachment D Environment and Technical Approach Questionnaire
Attachment E Service Level and Reporting Template
Attachment F HIPAA Compliance Questionnaire
Attachment G Network and Asset Inventory Worksheet
Attachment H Incident Response Questionnaire
Attachment I Staffing and Escalation Matrix
Attachment J BAA Acknowledgment and Vendor Certifications
Attachment K Business Associate Agreement Template
Note: Respondents may reproduce the forms provided the same sequence, headings, and requested information are
retained.
PART I - GENERAL REQUIREMENTS AND PROCUREMENT INSTRUCTIONS
1. Purpose
The Williamson County Children's Advocacy Center (WCCAC or "Center") requests proposals from qualified firms to provide
comprehensive managed information technology services, cybersecurity operations, and HIPAA Security Program
management. The selected respondent will serve as a strategic technology and security partner and will provide proactive
monitoring, support, protection, compliance oversight, documentation, reporting, and continuous improvement services.
2. Organizational Background and Community Impact
WCCAC is a Texas nonprofit organization located in Georgetown, Texas. Its mission is to provide hope, healing, and justice
for children and families impacted by abuse, violence, and exploitation. WCCAC coordinates a multidisciplinary response
with law enforcement, child protective services, prosecutors, medical providers, mental health professionals, and other
community partners. Because WCCAC handles highly sensitive information and supports time-critical services,
confidentiality, integrity, availability, resilience, and regulatory compliance are central to this procurement.
3. Project Objectives
* Maintain reliable and secure technology services for WCCAC staff and programs.
Williamson County Children's Advocacy Center | RFP Solicitation

WCCAC RFP | Managed IT, Cybersecurity, and HIPAA Security Program Management
* Provide 24x7 network monitoring and management and 24x7 Security Operations Center coverage.
* Improve endpoint, identity, email, network, and cloud security.
* Provide responsive remote and onsite support.
* Establish and maintain centralized, WCCAC-accessible documentation.
* Identify, prioritize, track, and remediate vulnerabilities and HIPAA security control gaps.
* Support executive oversight through monthly and quarterly reporting and strategic reviews.
4. Current Environment
Component Estimated Quantity / Description
Users 50-60
Workstations and laptops 75-85
Firewall 1
Network switches 3
Wireless access points 33
Network printers 7
Cloud productivity Microsoft 365
Primary location 1811 S.E. Inner Loop, Georgetown, Texas 78626
Quantities are estimates for proposal purposes and may change during the contract term. Respondents shall identify all
assumptions and dependencies used in their pricing.
5. Solicitation Schedule
Milestone Date
RFP released Friday, October 9, 2026
Deadline for written questions Friday, October 16, 2026, by 12:00 p.m. Central Time
WCCAC responses / addenda anticipated Monday, October 19, 2026
Electronic proposals due Friday, October 23, 2026, by 12:00 p.m. noon Central Time
Interviews or clarifications, if required October 23-26, 2026
Anticipated notice of award Thursday, October 29, 2026
Anticipated contract start Monday, November 2, 2026
WCCAC may revise this schedule by written addendum. Dates after the proposal deadline are estimates and do not bind
WCCAC.
6. Authorized Contact and Questions
All questions and communications concerning this RFP shall be directed to Darlene Lewis, Chief Operating Officer, at
dlewis@wilcocactx.org. Respondents shall not contact other WCCAC personnel, board members, evaluators, or partner
agencies regarding this solicitation unless authorized in writing.
7. Electronic Submission Instructions
Submit one complete electronic proposal package to Darlene Lewis, Chief Operating Officer, at dlewis@wilcocactx.org no
later than Friday, October 23, 2026, at 12:00 p.m. noon Central Time. The email subject line should read: "RFP 26-IT-001 -
Managed IT, Cybersecurity, and HIPAA Services - [Respondent Name]."
Williamson County Children's Advocacy Center | RFP Solicitation

WCCAC RFP | Managed IT, Cybersecurity, and HIPAA Security Program Management
* Submit the response in searchable PDF format; editable Word or Excel schedules may also be included.
* Include all required forms, acknowledgments, pricing, requested exceptions, and supporting exhibits.
* WCCAC is not responsible for transmission failures, file-size limitations, quarantined messages, or late delivery.
* Late responses may be rejected at WCCAC's sole discretion.
* Respondents may withdraw or replace a response before the deadline by written notice.
8. Required Response Organization
1. Cover letter and authorized signature.
2. Executive summary and understanding of WCCAC's needs.
3. Company profile and core competencies.
4. Relevant healthcare, nonprofit, HIPAA, CJIS, managed IT, and cybersecurity experience.
5. Technical and service delivery approach corresponding to each scope section.
6. Transition and onboarding plan.
7. Staffing, support, escalation, and subcontractor model.
8. Project assumptions, exclusions, dependencies, and requested contract exceptions.
9. Completed Attachments A through J.
10. Certificate or evidence of required insurance (before work commences)
11. Sample executive, technical, vulnerability, and service reports, with confidential client data removed.
9. Addenda and Respondent Responsibility
Only written addenda issued by WCCAC may amend this RFP. Respondents are responsible for ensuring they have received
and acknowledged all addenda before submitting a proposal. Oral explanations or instructions are not binding.
PART II - INSURANCE REQUIREMENTS
Before beginning work and throughout the contract term, the successful respondent shall maintain the following coverage at
its own expense and provide certificates of insurance acceptable to WCCAC.
Coverage Minimum Limit
Commercial General Liability $1,000,000 each occurrence
Professional Liability / Errors and Omissions $1,000,000 each claim
Cyber / Privacy Liability $1,000,000 each claim
Workers' Compensation Statutory; Employer's Liability $1,000,000
Automobile Liability $1,000,000 combined single limit
* Williamson County Children's Advocacy Center shall be named as an Additional Insured on Commercial General Liability
and Automobile Liability policies and on other policies where commercially available and applicable.
* Coverage shall be primary and noncontributory to WCCAC insurance where commercially available.
* Certificates shall provide evidence of coverage before contract execution and upon renewal.
* Respondent shall give prompt written notice of cancellation, nonrenewal, or material reduction in coverage.
* All subcontractors shall maintain coverage appropriate to their work at limits no less than required of the respondent
unless WCCAC approves otherwise in writing.
* Failure to maintain required insurance may be grounds for withholding access, suspending work, or termination.
PART III - TERMS AND CONDITIONS
1. Contract Term
The anticipated initial term is three years beginning November 2, 2026, subject to execution of an agreement. WCCAC may
renew for up to two additional one-year periods by mutual written agreement and subject to funding and satisfactory
performance.
Williamson County Children's Advocacy Center | RFP Solicitation

WCCAC RFP | Managed IT, Cybersecurity, and HIPAA Security Program Management
2. Invoicing and Payment
The vendor shall invoice monthly in arrears and separately identify recurring services, approved projects, approved unit
additions, credits, taxes, and other authorized charges. Payment terms are Net 30 after receipt of a correct invoice and
acceptance of services. WCCAC is tax exempt and will provide documentation upon request.
3. Pricing
Prices shall include all labor, management, tools, licensing expressly included in the offering, travel, overhead, reporting,
training, insurance, and other costs necessary to perform the stated services. No charge may be added unless authorized in
writing by WCCAC.
4. Confidentiality and Nondisclosure
The successful respondent and personnel with access to WCCAC information shall execute confidentiality or nondisclosure
agreements required by WCCAC. Information shall be used only to perform contracted services and disclosed only to
authorized personnel with a legitimate need to know.
5. Information Security Compliance
The vendor shall comply with WCCAC information security policies, the executed Business Associate Agreement, applicable
HIPAA requirements, applicable CJIS privacy and security requirements, and other applicable confidentiality and data
protection obligations.
6. Incident Notification and Cooperation
The vendor shall immediately notify WCCAC of suspected or confirmed security incidents, unauthorized access, malware,
ransomware, data loss, or disclosure involving WCCAC systems or information. The vendor shall cooperate fully in
containment, investigation, forensics, remediation, notifications, audits, and regulatory inquiries. BAA reporting deadlines
remain controlling for incidents involving PHI.
7. Ownership and Access to Documentation
All WCCAC-specific configurations, diagrams, inventories, credentials, runbooks, reports, policies, POA&M records, and
other deliverables paid for by WCCAC shall be available to WCCAC throughout the term and upon termination. Vendor
proprietary tools and pre-existing intellectual property remain vendor property, but shall not prevent WCCAC from receiving
usable documentation and data exports.
8. Return or Destruction
Upon request or termination, the vendor shall return WCCAC information and securely destroy remaining copies, subject to
law and the BAA, and certify destruction upon request. Required protections continue for any information that cannot feasibly
be returned or destroyed.
9. Subcontractors
The vendor remains fully responsible for subcontractors and shall disclose them in Attachment C. Subcontractors with
access to WCCAC information must satisfy equivalent confidentiality, security, insurance, screening, training, and BAA
obligations. WCCAC may require prior approval or removal of a subcontractor.
10. Audit and Records
The vendor shall maintain records demonstrating performance, training, screening, security, and compliance and shall
reasonably cooperate with WCCAC audits and reviews. Security-sensitive details may be handled under appropriate
confidentiality controls.
11. Assignment and Change Control
The vendor may not assign the agreement or materially change the service delivery or subcontracting model without
WCCAC's prior written consent. Material changes to technology, hosting, monitoring, or staffing that affect risk shall be
disclosed in advance.
Williamson County Children's Advocacy Center | RFP Solicitation

WCCAC RFP | Managed IT, Cybersecurity, and HIPAA Security Program Management
12. Termination and Transition Assistance
The agreement may include termination for cause, uncured material breach, security or compliance risk, loss of required
insurance, nonappropriation, or convenience. The vendor shall provide orderly transition assistance, exports,
documentation, and credential transfer and shall not withhold WCCAC data because of a dispute.
13. Reservation of Rights
WCCAC may reject any or all responses, waive informalities, request clarifications, negotiate, conduct interviews, cancel or
amend the solicitation, make no award, or select the response that provides the best value. Issuance of this RFP does not
obligate WCCAC to reimburse response costs or award a contract.
PART IV - SCOPE OF WORK AND TECHNICAL REQUIREMENTS
1. Service Management and Governance
* Named service delivery manager and escalation contacts.
* Documented onboarding, transition, discovery, and stabilization plan.
* Ticketing system with WCCAC visibility and export capability.
* Service catalog, change management, problem management, and major incident processes.
* Quarterly Business Reviews covering performance, risk, roadmap, budget, lifecycle, compliance, and
recommendations.
2. 24x7 Network Monitoring and Management
* Install and maintain at least one appropriately secured monitoring/data-collection appliance or agent.
* Monitor Internet and network connectivity, latency, availability, capacity, and device health.
* Monitor and manage the firewall, switches, wireless access points, and other mutually supported devices.
* Create alerts and tickets and perform proactive investigation and remediation.
* Back up configurations, maintain firmware, and document changes.
* Maintain network availability, capacity, and recurring issue trends.
3. Firewall and Network Security Management
* Administer firewall rules, objects, VPNs, security profiles, logging, and built-in security services.
* Review firewall rules at least annually and after material changes.
* Apply least-privilege principles and document approvals for material changes.
* Monitor security events and coordinate escalation to the SOC.
* Maintain recoverable configuration backups and tested restoration procedures.
4. Workstation and Endpoint Management
* Remote monitoring and management for 75-85 workstations and laptops.
* Hardware and software inventory, warranty and lifecycle tracking.
* Operating system support, configuration standards, disk encryption status, health, capacity, and performance
monitoring.
* Software deployment, approved application support, remote troubleshooting, and user support.
* Endpoint Detection and Response and managed protection against viruses, malware, ransomware, and behavioral
threats.
* Isolation, containment, investigation, remediation, and post-incident documentation.
* Secure onboarding, role changes, offboarding, and access removal support.
5. Patch Management Plan
The respondent shall provide a documented patch management plan that addresses:
* Microsoft operating systems and supported Microsoft applications.
* Third-party business applications and common browsers, readers, runtimes, and utilities.
* Network device firmware and security updates.
* Risk-based prioritization and emergency/zero-day patching.
Williamson County Children's Advocacy Center | RFP Solicitation

WCCAC RFP | Managed IT, Cybersecurity, and HIPAA Security Program Management
* Testing, maintenance windows, failed-patch handling, rollback, exceptions, and business communication.
* Monthly compliance metrics, trend reporting, and remediation of devices outside policy.
6. Microsoft 365 Administration
* User, group, role, license, and shared resource administration.
* License optimization and monthly reconciliation.
* Multifactor authentication, Conditional Access, identity security, and privileged administration.
* Exchange Online, Teams, SharePoint, OneDrive, mail flow, anti-spam, and anti-phishing support as applicable.
* Security posture recommendations, configuration change documentation, and incident support.
* Coordination of retention, eDiscovery, backup, or compliance configuration when separately approved.
7. Remote Help Desk and Onsite Support
* Remote help desk during proposed business hours with after-hours support for priority events.
* Ticket intake by email, phone, and portal.
* Onsite support in Georgetown, Texas for issues requiring physical presence.
* Respondent shall identify included onsite hours, travel rules, minimum charges, and additional rates.
* User-facing communication, status updates, escalation, resolution notes, and satisfaction measurement.
8. 24x7 Security Operations Center
* Continuous security monitoring, alert triage, event correlation, investigation, and escalation.
* Threat detection, threat hunting, containment recommendations, and incident coordination.
* Defined coverage for endpoints, identity, Microsoft 365, firewall/network telemetry, and other proposed sources.
* Documented severity model, escalation contacts, after-hours notification, and evidence retention.
* Monthly security summary and immediate reporting of material events.
9. Vulnerability Management
* Recurring internal and external vulnerability scanning at least monthly or at a clearly stated frequency.
* Authenticated scanning where feasible, risk validation, false-positive review, and prioritized remediation.
* Tracking of owner, target date, status, exceptions, and residual risk.
* Executive and technical reporting with trend analysis and verification of remediation.
10. Penetration Testing
Provide at least annual independent or appropriately segregated penetration testing covering external and internal network
environments. Testing shall be authorized, scoped, controlled, and scheduled to minimize disruption.
* External perimeter and Internet-facing exposure testing.
* Internal network testing, privilege escalation, segmentation, and lateral movement assessment.
* Executive summary, detailed technical findings, evidence, risk ratings, and practical remediation recommendations.
* Retesting of material findings and closure documentation.
11. Documentation and Central Management
* Centralized documentation repository accessible to authorized WCCAC personnel.
* Three-layer network diagram showing Internet/WAN, core/network infrastructure, and endpoints/user services.
* Physical equipment inventory including manufacturer, model, serial number, location, warranty, support status, IP or
identifier, and lifecycle status.
* Software and licensing inventory including Microsoft 365 licenses and security tools.
* Configuration standards, runbooks, recovery procedures, escalation contacts, vendor contacts, and change history.
* Secure credential management with WCCAC continuity and break-glass access procedures.
12. Onboarding Deliverables
* Kickoff and stakeholder plan.
* Discovery and baseline assessment.
* Validated asset and software inventories.
Williamson County Children's Advocacy Center | RFP Solicitation

WCCAC RFP | Managed IT, Cybersecurity, and HIPAA Security Program Management
* Three-layer network diagram.
* Monitoring, RMM, EDR, and SOC deployment plan.
* Administrative account and access review.
* Prioritized remediation and transition backlog.
* Documentation repository and operating procedures.
PART V - DISCOVERY PHASE: SYSTEM, NETWORK, AND SECURITY AUDIT
1. Purpose and Timing
The selected respondent shall conduct a structured discovery phase and comprehensive system, network, and security audit
at the beginning of the engagement. The discovery phase shall validate the current environment, establish an authoritative
baseline, identify urgent risks, confirm service assumptions, and produce a prioritized transition and remediation plan.
Discovery should be substantially completed within the first 30 to 60 days unless WCCAC approves another schedule.
2. Required Audit Scope
* Inventory and validate network devices, endpoints, printers, Microsoft 365 assets, software, licenses, warranties,
support status, and ownership.
* Review network architecture, Internet connectivity, VLANs, wireless configuration, firewall rules, VPNs, remote access,
routing, segmentation, and trust boundaries.
* Assess privileged access, MFA, Conditional Access, encryption, endpoint protection, patching, backups, logging,
monitoring, alerting, and configuration standards.
* Assess Microsoft 365 identity, email security, external sharing, risky sign-ins, privileged roles, tenant configuration,
retention, and license utilization.
* Identify unsupported or end-of-life technology, single points of failure, coverage gaps, and undocumented
dependencies.
* Assess vulnerability exposure, restoration readiness, disaster recovery, business continuity, and incident-response
readiness.
* Map material findings to operational risk, HIPAA Security Rule requirements, and WCCAC obligations.
3. Required Discovery Deliverables
* Discovery kickoff plan, evidence request, schedule, access needs, dependencies, and communication plan.
* System, network, and security audit report with scope, methodology, architecture, validated assets, findings, evidence,
and limitations.
* Executive risk summary identifying critical and high risks, business impact, urgent decisions, and priorities.
* Validated equipment, software, licensing, account, service, warranty, and lifecycle inventories.
* Updated three-layer network diagram with trust boundaries, legend, date, and owner.
* Findings and remediation register with risk, evidence, owner, recommendation, target date, status, validation, and
residual risk.
* Prioritized 30/60/90-day transition and remediation plan.
* Executive and technical discovery briefing.
4. Audit Safeguards and Authorization
* Coordinate scan windows, credentialed reviews, packet capture, active testing, and configuration changes with
WCCAC.
* Use least-privilege access and protect audit information as confidential.
* Do not perform destructive, denial-of-service, phishing, social-engineering, or exploitation testing without separate
written authorization.
* Report critical findings presenting imminent risk immediately.
* Document assumptions, limitations, exclusions, unavailable evidence, and testing constraints.
* Provide editable deliverables and usable exports.
Williamson County Children's Advocacy Center | RFP Solicitation

WCCAC RFP | Managed IT, Cybersecurity, and HIPAA Security Program Management
5. Acceptance and Follow-Through
WCCAC will review discovery deliverables for completeness, accuracy, usability, and alignment with scope. The vendor shall
correct material omissions and incorporate approved findings into inventories, documentation, the POA&M, service
roadmap, and ongoing reporting.
PART VI - HIPAA SECURITY PROGRAM MANAGEMENT
1. Program Objectives
The vendor shall support a sustainable HIPAA Security Program that identifies, prioritizes, tracks, and remediates compliance
and security control gaps and provides governance visibility to WCCAC leadership.
2. Governance and Oversight
* Program charter, roles, responsibilities, meeting cadence, and decision tracking.
* Monthly status meetings and executive risk summaries.
* Coordination with WCCAC leadership, privacy, operations, and service providers.
* Support for board or committee reporting when requested.
3. Assessments and Risk Analysis
* HIPAA Security Rule risk analysis and periodic updates.
* Administrative, physical, and technical safeguard assessment.
* Threat, vulnerability, likelihood, impact, and residual risk evaluation.
* Documented methodology, evidence, recommendations, and management review.
4. Policy and Procedure Development
* Develop, update, and maintain applicable security policies and procedures.
* At minimum address access control, acceptable use, security incident response, risk management, workforce security,
contingency planning, backup and recovery, vendor management, mobile devices, encryption, and change
management.
* Track approvals, review dates, ownership, version history, and training implications.
5. POA&M and Remediation Management
* Maintain a Plan of Action and Milestones (POA&M) for identified gaps.
* Record finding, source, risk, owner, corrective action, milestones, due date, status, evidence, and residual risk.
* Prioritize work based on risk and operational feasibility.
* Track overdue items, exceptions, and management acceptance.
6. Training and Exercises
* HIPAA privacy and security awareness support.
* Role-based technical security training for personnel with elevated responsibilities.
* At least one annual tabletop exercise addressing a realistic security or continuity scenario.
* Exercise plan, participant materials, after-action report, lessons learned, and corrective action tracking.
7. HIPAA Deliverables
Deliverable Minimum Frequency
Program status report and remediation dashboard Monthly
POA&M / remediation tracker Monthly and upon material change
Risk summary and executive briefing Quarterly
Policy set and review log At onboarding and at least annually
Williamson County Children's Advocacy Center | RFP Solicitation

WCCAC RFP | Managed IT, Cybersecurity, and HIPAA Security Program Management
Deliverable Minimum Frequency
At onboarding and annually or as
HIPAA risk analysis / assessment
required
Tabletop exercise and after-action report Annually
At onboarding/assignment and
Role-based technical security training
annually or as required
8. Business Associate Agreement
The successful respondent shall execute WCCAC's Business Associate Agreement, included as Attachment K, before
accessing PHI or beginning services that involve PHI. Requested exceptions must be clearly identified with the proposal.
Silence will be treated as acceptance of the BAA as presented.
PART VII - PERSONNEL SCREENING, TRAINING, AND ACCESS REQUIREMENTS
1. Applicability
These requirements apply to all respondent and subcontractor personnel who require physical or logical access to WCCAC
facilities, systems, networks, applications, Microsoft 365 resources, documentation, ePHI, criminal justice information, or
other sensitive information.
2. Required Screening and Training
* Criminal background check completed before access.
* Sex offender registry check completed before access.
* SafeSport training completed before access and maintained as required.
* CJIS Privacy and Security Training completed before applicable access and maintained as required.
* HIPAA privacy and security training completed before access to PHI and maintained as required.
* WCCAC-specific confidentiality, security, or facility training when requested.
3. Background Guidelines and Eligibility
WCCAC shall not accept or assign volunteers or vendors, inclusive of board members, where an individual has been
convicted, has prior charges, or has charges pending for a felony or misdemeanor involving a sex offense, violent act, child
abuse, or child neglect, except that WCCAC may evaluate circumstances on a case-by-case basis consistent with its
policies, legal obligations, and risk assessment. WCCAC retains sole discretion to approve, deny, restrict, or revoke an
individual's access.
4. Vendor Responsibilities
* Verify and document screening and training before requesting access.
* Provide certification or supporting evidence upon request, subject to applicable privacy laws.
* Immediately notify WCCAC of information that may affect eligibility or access.
* Promptly remove or replace personnel when directed by WCCAC.
* Ensure subcontractor personnel meet the same requirements.
* Revoke credentials and recover WCCAC property immediately upon separation or reassignment.
5. Access Control
WCCAC may limit access by role, system, location, time, and method and may require multifactor authentication, named
accounts, privileged access controls, session logging, supervised access, or other safeguards. Access may be suspended or
revoked immediately when WCCAC determines that security, compliance, safety, or operational risk exists.
Williamson County Children's Advocacy Center | RFP Solicitation