Beyond Trust Privileged Access Management

STATE OF NORTH CAROLINA INVITATION FOR BIDS NO. 45-RQ255223
DEPARTMENT OF REVENUE Description: BeyondTrust Privileged Access Management
Information Technology Division
Issue Date: 24 June 2026
Bid Opening Date: 8 July 2026 at 10:00 am ET
Refer ALL inquiries regarding this IFB to:
Commodity Number: 811118
Justin Stringfield, Contract Specialist
Justin.Stringfield@ncdor.gov Using Agency: Revenue
919-215-5229
Requisition No. RQ255223
OFFER AND ACCEPTANCE
The State seeks offers for the Software, Services and/or goods described in this solicitation. The State's
acceptance of any offer must be demonstrated by execution of the acceptance found below and any subsequent
Request for Best and Final Offer, if issued. Acceptance shall create a contract having an order of precedence
as follows in cases of conflict between documents comprising the contract: (1) Best and Final Offers, if any; (2)
special terms and conditions specific to this solicitation; (3) specifications; (4) NC Department of Information
Technology Terms and Conditions of this solicitation; and (5) the agreed portions of the awarded Vendor's offer.
No contract shall be binding on the State until an encumbrance of funds has been made for payment of
the sums due under the contract.
EXECUTION
In compliance with this solicitation and subject to all the conditions herein, the undersigned offers and agrees to
furnish any or all Services and/or goods upon which prices are offered, at the price(s) offered herein, within the
time specified herein. By executing this offer, I certify that this offer is submitted competitively and without
collusion.
Failure to execute/sign offer prior to submittal shall render offer invalid. Late offers are not acceptable.
OFFEROR
STREET ADDRESS PO BOX, ZIP
CITY, STATE, ZIP TELEPHONE NUMBER
NAME & TITLE OF PERSON SIGNING
AUTHORIZED SIGNATURE DATE E-MAIL
Offer valid for sixty (60) days from date of offer opening unless otherwise stated here: ____ days
ACCEPTANCE OF OFFER
If any or all parts of this solicitation are accepted, an authorized representative of the NC Department of
Revenue (NCDOR) shall affix a signature hereto. A copy of this acceptance will be forwarded to the Vendor.
FOR STATE USE ONLY: Offer accepted and Contract awarded as indicated on the attached certification by
__________________________________________________________________ ______________________
Authorized representative of NC Department of Revenue Date

TABLE OF CONTENTS
1.0 INTENT, USE, DURATION AND SCOPE ............................................................................................... 3
2.0 GENERAL INFORMATION ..................................................................................................................... 3
2.1 VENDOR QUESTIONS ...................................................................................................................... 3
2.2 ADDENDUM ...................................................................................................................................... 3
2.3 OFFER SUBMITTAL .......................................................................................................................... 3
2.4 BASIS FOR REJECTION ................................................................................................................... 4
2.5 LATE OFFERS .................................................................................................................................. 4
2.6 NON-RESPONSIVE OFFERS ........................................................................................................... 4
2.7 NOTICE TO VENDORS ..................................................................................................................... 4
2.8 NC ePROCUREMENT ....................................................................................................................... 5
2.9 DISTRIBUTORS AND RESELLERS .................................................................................................. 5
2.10 POSSESSION AND REVIEW ............................................................................................................ 5
2.11 BEST AND FINAL OFFER ................................................................................................................. 6
2.12 CONTRACT AWARD ......................................................................................................................... 6
2.13 POINTS OF CONTACT ...................................................................................................................... 6
3.0 SPECIFICATIONS .................................................................................................................................. 6
3.1 VENDOR STANDARD AGREEMENT(S) ........................................................................................... 6
3.2 VENDOR UTILIZATION OF WORKERS OUTSIDE U.S. ................................................................... 7
3.3 E-VERIFY .......................................................................................................................................... 7
3.4 BRAND SPECIFIC PRODUCT ........................................................................................................... 8
3.5 SOLUTIONS NOT HOSTED ON STATE INFRASTRUCTURE .......................................................... 8
3.6 ENTERPRISE ARCHITECTURE SPECIFICATIONS ......................................................................... 8
3.7 DELIVERY ......................................................................................................................................... 9
3.8 CONTRACT TE/RM ........................................................................................................................... 9
3.9 REQUIREMENTS ............................................................................................................................ 10
4.0 FURNISH AND DELIVER ..................................................................................................................... 11
5.0 HISTORICALLY UNDERUTILIZED BUSINESSES ............................................................................... 12
6.0 NC DEPARTMENT OF INFORMATION TECHNOLOGY INSTRUCTIONS TO VENDORS .................. 12
7.0 NC DEPARTMENT OF INFORMATION TECHNOLOGY TERMS AND CONDITIONS ......................... 13
Attachment A: Statement of Work for Implementation Services ....................................................................... 38
Attachment B: Onboarding Requirements for Contractors ............................................................................... 40
Beyond Trust Privileged Access Management - NCDOR IFB 45-RQ255223
Page 2 of 41

1.0 INTENT, USE, DURATION AND SCOPE
The purpose of this solicitation is to obtain pricing for and procure a turnkey BeyondTrust Privileged
Access Management ("PAM") solution, implementation services, and training for the North Carolina
Department of Revenue ("NCDOR").
Goods and Services will be provided in accordance with the terms and conditions of this RFQ.
2.0 GENERAL INFORMATION
2.1 VENDOR QUESTIONS
All inquiries regarding this IFB must be emailed to Justin.Stringfield@ncdor.gov.
Written questions will be received until 2 July, 2026 at _5 pm Eastern Time.
Please put "Questions - IFB 45-RQ255223" in the subject line of the email. Questions should be
submitted in the following format:
REFERENCE VENDOR QUESTION
IFB Section, Page Number
Vendor communications with anyone other than the person named above may be grounds for
rejection of said Vendor's offer.
2.2 ADDENDUM
The Agency will issue an Addendum to provide a response to all questions received in accordance
with Section 2.1 above.
The Agency may issue additional Addenda as needed to modify the specifications, requirements,
terms and conditions, etc.
All Addenda will be posted on the electronic Vendor Portal (eVP) website at https://evp.nc.gov and
will become Addenda to this IFB.
Critical information may be included in these Addenda. It is important for Vendors to periodically
check the website for any and all Addenda that may be issued prior to the bid opening date.
2.3 OFFER SUBMITTAL
Due Date: 8 July, 2026
Time: 10:00 am Eastern Time
Sealed offers, subject to the conditions made a part hereof, will be received until the time and date
specified above and then opened for furnishing and delivering the commodity as described herein.
It is the Vendor's sole responsibility to submit its offer by the specified time and date of opening.
The Vendor shall bear the risk for late electronic submission due to unintended or unanticipated
delay including, but not limited to, internet issues, network issues, local power outages, or
application issues.
Beyond Trust Privileged Access Management - NCDOR IFB 45-RQ255223
Page 3 of 41

a) Submit one (1) signed, original electronic offer via the Ariba Sourcing Module.
The Vendor must include all pages of the solicitation in its offer. The execution page must be
signed and dated by an official authorized to bind the Vendor's firm. Failure to return a signed
offer shall result in disqualification.
b) File names should identify the Vendor, solicitation, and document in that order (Vendor Name -
IFB Number - Proposal, etc.).
c) Files must not be password protected. They must be in .PDF, .JPEG, .DOC or .XLS format and
capable of being copied to other sources. The Vendor's offer may be deemed non-responsive if
the Agency is unable to open the file(s).
d) If the offer contains any confidential information (as defined in the NCDIT Terms and Conditions,
Section 1, Paragraph 18), the Vendor must provide one (1) redacted electronic copy in addition
to the original copy.
2.4 BASIS FOR REJECTION
Pursuant to 9 NCAC 06B.0401, the State reserves the right to reject any and all offers in whole or
in part by deeming the offer unsatisfactory as to quality or quantity, delivery, price or service offered;
non-compliance with the specifications or intent of this solicitation; lack of competitiveness; error(s)
in specifications or indications that revision would be advantageous to the State; cancellation or
other changes in the intended project, or other determination that the proposed requirement is no
longer needed; limitation or lack of available funds; circumstances that prevent determination of the
best offer; or any other determination that rejection would be in the best interest of the State. Vendor
contact regarding this RFQ with anyone other than the person listed on page 1 may be grounds for
rejection of said Vendor's offer.
2.5 LATE OFFERS
Regardless of cause, late offers will not be accepted and will automatically be disqualified from
further consideration. It shall be the Vendor's sole risk to ensure delivery at the designated office
by the designated time. Late offers will not be opened and may be returned to the Vendor at the
expense of the Vendor or destroyed if requested.
2.6 NON-RESPONSIVE OFFERS
Vendor offers will be deemed non-responsive by the State and will be rejected without further
consideration or evaluation if statements such as the following are included:
"This offer does not constitute a binding offer"
"This offer will be valid only if this offer is selected as a finalist or in the competitive range"
"Vendor does not commit or bind itself to any terms and conditions by this submission"
"This document and all associated documents are non-binding and shall be used for discussion
purposes only"
"This offer will not be binding on either party until incorporated in a definitive agreement signed
by authorized representatives of both parties" or
A statement of similar intent.
2.7 NOTICE TO VENDORS
The State objects to and will not be required to evaluate or consider any additional terms and
conditions not previously agreed to by the State and submitted with a Vendor's response. This
applies to any language appearing in or attached to the document as part of the Vendor's response.
By execution and delivery of this solicitation and response(s), the Vendor agrees that any additional
terms and conditions, whether submitted purposely or inadvertently, shall have no force or effect.
Beyond Trust Privileged Access Management - NCDOR IFB 45-RQ255223
Page 4 of 41

2.8 NC ePROCUREMENT
The State utilizes the NC eProcurement (NCEP) system to process requisitions and issue purchase
orders. See http://eprocurement.nc.gov/ and the NCDIT Terms and Conditions (Section 1,
paragraph 47) for more information.
a) It is the Vendor's responsibility to read these provisions carefully and to consider them in
preparing the Offer. By signature, the Vendor acknowledges acceptance of all provisions related
to NCEP.
b) The transaction fee addressed in Section 7.0, Paragraphs 47 a) and b) applies to the purchase
of goods (including the initial purchase of software). It does not apply to SaaS, software
maintenance/support services, or any other type of services.
c) If not already registered in NCEP, the Vendor selected for contract award must register within
two (2) days after notification of contract award.
d) The Vendor must be current on all NCEP fees prior to submitting an offer. Otherwise, the State
may disqualify the Vendor from participating in this solicitation.
2.9 DISTRIBUTORS AND RESELLERS
"Resellers" as used herein, refers to businesses that routinely sell or distribute Vendor's Products,
and may include "Distributors", "Value Added Resellers" (VARs), "Original Equipment
Manufacturers" (OEMs), Channel Partners, or such other designations. These businesses must be
approved by the State prior to placement of any orders. Any contract established will be subject to
this solicitation and any resulting Agreement(s), and to the terms and conditions of the State's
competitive bidding process.
The Agency acknowledges that the Reseller has merely purchased the Third-Party Items for resale
or license to the Agency, and that the proprietary and intellectual property rights to the Third-Party
Items are owned by parties other than the Reseller ("Third Parties"). The Agency further
acknowledges that except for the payment to the Reseller for the Third-Party Items, all of its rights
and obligations with respect thereto flow from and to the Third Parties. The Reseller shall provide
the Agency with copies of all documentation and warranties for the Third-Party Items which are
provided to the Reseller. The Reseller shall assign all applicable third-party warranties for
Deliverables to the Agency.
2.10 POSSESSION AND REVIEW
During the evaluation period and prior to award, possession of the bids and accompanying
information is limited to personnel of the issuing agency, and to the committee responsible for
participating in the evaluation. Vendors who attempt to gain this privileged information or to
influence the evaluation process (i.e., assist in evaluation) will be in violation of purchasing rules
and their offer will not be further evaluated or considered.
After award of contract, the complete bid file will be available to any interested persons with the
exception of trade secrets, test information, or similar proprietary information as provided by statute
and rule. Any proprietary or confidential information which conforms to exclusions from public
records as provided by N.C.G.S. 132-1.2 must be clearly marked as such in the offer when
submitted.
Beyond Trust Privileged Access Management - NCDOR IFB 45-RQ255223
Page 5 of 41

2.11 BEST AND FINAL OFFER
The State may establish a competitive range based upon evaluations of offers, and request Best
and Final Offers (BAFOs) from the Vendor(s) within this range (i.e., Finalist Vendors). If negotiations
or subsequent offers are solicited, the Vendor(s) shall provide BAFO(s) in response. Failure to
deliver a BAFO when requested shall disqualify the non-responsive Vendor from further
consideration. The State will evaluate BAFO(s), oral presentations, and product demonstrations as
part of the Vendors' respective offers to determine the final rankings.
2.12 CONTRACT AWARD
It is the general intent to award this contract to one (1) Vendor. As provided by statute, award will
be based on Best Value Analysis, Lowest Price Technically Acceptable Source Selection Method
in accordance with 09 NCAC 06B. 0302 Information Technology Procurement.
2.13 POINTS OF CONTACT
Contact with the persons shown below for contractual and technical matters related to this
solicitation is only permitted if expressly agreed to by the Agency or upon award of contract:
Vendor Contractual Point of Contact Vendor Technical Point of Contact
Contract Manager: Technical Lead:
Address: Address:
Phone Number: Phone Number:
Email Address: Email Address:
3.0 SPECIFICATIONS
3.1 VENDOR STANDARD AGREEMENT(S)
The terms and conditions of the Vendor's standard services, license, maintenance or other
agreement(s) applicable to Services, Goods, Software and other Products acquired under this
Agreement ("License Agreement") may apply to the extent such terms and conditions do not
materially change the terms and conditions of this Agreement. In the event of any conflict between
the terms and conditions of this Agreement and the Vendor's standard agreement(s), the terms and
conditions of this Agreement relating to audit and records, jurisdiction, choice of law, the State's
electronic procurement application of law or administrative rules, the remedy for intellectual property
infringement and the exclusive remedies and limitation of liability in the NCDIT Terms and
Conditions herein shall apply in all cases and supersede any provisions contained in the Vendor's
relevant standard agreement or any other agreement. The State shall not be obligated under any
standard license and/or maintenance or other Vendor agreement(s) to indemnify or hold harmless
the Vendor, its licensors, successors or assigns; nor arbitrate any dispute, nor pay late fees, legal
fees or other similar costs.
A license agreement for BeyondTrust software and support will be finalized by and between
BeyondTrust Corporation and NCDOR and will be applicable to this IFB. A fully executed copy of
the updated license agreement shall be incorporated by reference to the final version of this IFB via
a Best and Final Offer.
Beyond Trust Privileged Access Management - NCDOR IFB 45-RQ255223
Page 6 of 41

3.2 VENDOR UTILIZATION OF WORKERS OUTSIDE U.S.
In accordance with the Statewide Information Security Manual (SISM), the State restricts the
location of information systems that receive, process, store, or transmit State and Federal data to
the United States which includes the US States, US Territories, US Embassies, and US Military
installations (stateside or overseas). This restriction applies to the Vendor and to any subcontractors
engaged to provide Services under this Agreement or with access to State Data. The Vendor must
ensure that its subcontractor agreements contain the same restrictions and will be responsible for
monitoring and enforcing subcontractor compliance at all times.
Pursuant to N.C.G.S. 143B-1361(b), the Vendor must provide the following information with its
Offer (attach additional pages if needed). The State will evaluate this information for additional risks,
costs, and other factors associated with its service prior to making an award.
a) Will any work under this under this Agreement be performed outside the United States?
YES NO
If yes, specify the location(s) where such work will be performed:
b) Describe the corporate structure and location of corporate employees and activities of the
Vendor, its affiliates, or any other subcontractors.
c) The Vendor agrees to notify the State if any work under the Agreement will be relocated outside
of the United States.
YES NO
d) The Vendor agrees that any Vendor or subcontractor providing call or contact center Services
to the State shall disclose to inbound callers the location from which the call or contact center
Services are being provided.
YES NO
The use of resources or workers located outside the United States is a critical security exception
that must be escalated to the State Chief Information Officer for review pursuant to N.C.G.S.
143B-1376(c) and 143B-1320(c). These critical security exceptions are approved only in rare and
extenuating circumstances. The Vendor should account for this when preparing its offer.
3.3 E-VERIFY
Pursuant to N.C.G.S. 143B-1350(k), the State shall not enter into a contract unless the awarded
Vendor and each of its subcontractors comply with the E-Verify requirements of N.C.G.S. Chapter
64, Article 2. Vendors are directed to review the foregoing laws. Any awarded Vendor must submit
a certification of compliance with E-Verify to the awarding agency, and on a periodic basis thereafter
as may be required by the State.
Beyond Trust Privileged Access Management - NCDOR IFB 45-RQ255223
Page 7 of 41

3.4 BRAND SPECIFIC PRODUCT
Manufacturer(s) name and product descriptions used in this solicitation are product specific. The
items offered in response to this solicitation must be the manufacturer and type specified. Failure
to comply with this requirement will result in rejection of offer.
3.5 SOLUTIONS NOT HOSTED ON STATE INFRASTRUCTURE
The BeyondTrust PAM solution will be required to receive and securely manage data that is
classified as Confidential.
To comply with the State's Security Standards and Policies, State agencies are required to perform
annual security/risk assessments on their information systems using NIST 800-53 controls. This
requirement additionally applies to all Vendor-provided, agency-managed Infrastructure as a
Service ("IaaS"), Platform as a Service ("PaaS"), and Software as a Service ("SaaS") solutions
which will handle data classified as Confidential data.
(a) Reserved.
(b) Upon request, Vendors shall provide a current independent third-party assessment report in
accordance with the following subparagraphs (i)-(iii) prior to contract award. However, Vendors
are encouraged to provide a current independent third-party assessment report in accordance
with subparagraphs (i)-(iii) at the time of offer submission.
(i) Federal Risk and Authorization Management Program (FedRAMP) certification, SOC 2
Type 2, ISO 27001, or HITRUST are the preferred assessment reports for any Vendor
solutions which will handle data classified as Medium Risk (Restricted) or High Risk
(Highly Restricted).
(ii) A Vendor that cannot provide a preferred independent third-party assessment report as
described above may submit an alternative assessment, such as a SOC 2 Type 1
assessment report. The Vendor shall provide an explanation for submitting the alternative
assessment report. If awarded this contract, a Vendor who submits an alternative
assessment report shall submit one of the preferred assessment reports no later than 365
days of the Effective Date of the contract. Timely submission of this preferred assessment
report shall be a material requirement of the contract.
(iii) An IaaS vendor cannot provide a certification or assessment report for a SaaS provider
UNLESS permitted by the terms of a written agreement between the two vendors and the
scope of the IaaS certification or assessment report clearly includes the SaaS solution.
(c) Additional Security Documentation. Prior to contract award, the State may in its discretion
require the Vendor to provide additional security documentation, including but not limited to
vulnerability assessment reports and penetration test reports. The awarded Vendor shall
provide such additional security documentation upon request by the State during the term of the
contract.
3.6 ENTERPRISE ARCHITECTURE SPECIFICATIONS
Vendors should refer to the Vendor Resources Page (https://it.nc.gov/resources/statewide-it-
procurement/vendor-engagement-resources) for information on the State's standards for
architecture, security, strategy, data quality, digital services, and identity and access management.
Beyond Trust Privileged Access Management - NCDOR IFB 45-RQ255223
Page 8 of 41

3.6.1 ARCHITECTURE DIAGRAMS - Reserved.
3.6.2 SOLUTION ROADMAP - Reserved.
3.6.3 IDENTITY AND ACCESS MANAGEMENT - Reserved.
3.6.4 INTEGRATION APPROACH - Reserved.
3.6.5 DISASTER RECOVERY AND BUSINESS CONTINUITY - Reserved.
3.6.6 DATA MIGRATION - Reserved.
3.6.7 APPLICATION MANAGEMENT - Reserved.
3.6.8 ACCESSIBILITY
Describe how the proposed solution complies with industry accessibility standards:
1. W3C Web Accessibility Initiative - Web Content Accessibility Guidelines (WCAG) 2.1:
https://www.w3.org/TR/WCAG21/
2. Section 508 - Rehabilitation Act of 1973: https://www.section508.gov/
3. Voluntary Product Accessibility Template (VPAT(R)):
https://www.itic.org/policy/accessibility/vpat
Explain whether the Solution is digitally accessible. If not fully accessible, describe the
roadmap with a timeline for remediation.
3.7 DELIVERY
Successful Vendor will complete the work within ninety (90) consecutive calendar days after receipt
of purchase order in accordance with Attachment A - Statement of Work for Implementation
Services.
Artifact deliverables must be sent electronically to Michael.Circello@ncdor.gov.
If circumstances beyond the control of the contractor result in late delivery or implementation, it is
the responsibility and obligation of the contractor to notify the Purchasing Agent listed on the
purchase order, in writing, immediately upon determining delay. The written notification should
indicate the anticipated delivery date.
3.8 CONTRACT TERM
A contract awarded pursuant to this IFB shall have an effective date as provided in the Notice of
Award. The Initial Term shall be three (3) years, invoiced annually, and will expire upon the
anniversary date of the effective date unless otherwise stated in the Notice of Award, or unless
terminated earlier.
The State retains the option to extend this contract for two (2) additional one (1) year periods
("Renewal Term(s)") at its sole discretion.
Beyond Trust Privileged Access Management - NCDOR IFB 45-RQ255223
Page 9 of 41

3.9 REQUIREMENTS
3.9.1 Core Modules -The turnkey PAM solution must provide:
a. Privileged Remote Access: Secure jump/bastion capabilities with session joining and
real-time termination.
b. Privileged Remote Access Training for Administrators for FedRAMP, annual access for
three (3) administrators
c. Cloud, On-premises, or Hybrid Deployment: Support for appliance, virtual machines,
software-as-a-service, or hybrid modules with high-availability clustering
3.9.2 Technical Specifications -The turnkey PAM solution must demonstrate compliance with
the following:
a. Sizing and Performance: Support for 100 licensed seats and 100 concurrent sessions,
with the ability to scale to 500 sessions. Console response times must be less than two
(2) seconds.
b. Integration: Native connectors for NCID, Microsoft Entra (or equivalent), Active Directory
("AD")/Lightweight Directory Access Protocol ("LDAP") Security Assertion Markup
Language ("SAML") 2.0, and Security Incident Event Management ("SIEM") tools (e.g.
Palo Alto, QRadar, or equivalent), while supporting Syslog, Common ("CEF"), or
JavaScript Object Notation ("JSON") formats
c. Encryption: AES256 for data at rest and TLS 1.2+ for data in transit, utilizing FIPS 140-
2/3 validated modules.
d. Audit and Compliance: Tamper-evident session recording (video and keystroke) with
immutable logs stored for a minimum of twelve (12) months. Compliant with IRS
Publication 1075 Safeguarding Requirements.
e. Vulnerability Management: Remediation of Critical CVSS vulnerability within seven (7)
calendar days
3.9.3 Implementation Services
The Vendor shall provide professional services to deploy the PAM solution in accordance
with Attachment A - Statement of Work.
3.9.4 Administrator and End User Training
The Vendor must provide a minimum of one (1) eight (8)-hour remote Administrator
course and two (2) four (4)-hour end user remote training sessions to include:
i Shadow and coach Administrators on routine administrator tasks
ii Walkthrough of configuration changes and troubleshooting steps
iii Share best practice recommendations
Beyond Trust Privileged Access Management - NCDOR IFB 45-RQ255223
Page 10 of 41