Continuity of Operations Plan (COOP) Software

Hillsborough County is seeking a qualified contractor to provide an automated Continuity of Operations Plan (COOP) software platform under solicitation RFP-26-00333, with a three-year contract term and an estimated value of $106,267.00. Proposals must be submitted electronically through the County’s bidding portal by August 5, 2026, and must include a comprehensive set of attachments such as a Training Plan, Implementation Plan, System Security Plan, and Vendor Security & Compliance Questionnaire, in addition to required questionnaires and disclosures. The evaluation process is based on a best-value trade-off approach, weighting the quality of the proposed system and its ability to meet county objectives at 35 points, followed by technical approach and understanding (30 points), organizational qualifications and experience (25 points), and cost (10 points), with non-cost factors dominating the scoring to prioritize technical merit over price. The contractor must deliver a fully configured, branded software solution with mobile offline access and departmental data collection tools within 45 days of purchase order issuance, ensuring full compliance with federal, state, and local regulations. All data must be stored and processed exclusively within the United States, encrypted using AES-256 at rest and TLS 1.2+ in transit, with strict prohibitions against using county data for AI/ML training, analytics, or product improvement without explicit written approval. Security requirements are stringent, mandating adherence to NIST SP 800-53 Rev. 5 (Moderate baseline), CIS Controls v8, and SOC 2 Type II certification, along with multi-factor authentication, SSO/SAML/OIDC integration, annual penetration testing, and vulnerability patching within 15 days. The vendor must appoint an Information Security Officer, undergo background checks for all personnel, disclose all subcontractors, and obtain prior approval before engaging any third parties. Upon contract termination, all county data must be deleted within 30 days with a Certificate of Destruction provided. The County retains full authority for inspection, acceptance, and audit rights, with payment processing via ACH within 30 days of invoice approval by the Project Manager. The contract prohibits engagement with entities based in Foreign Countries of Concern, requires legal workforce verification via I-9 or E-Verify, and allows preference to offerors with certified drug-free workplace programs—though no socioeconomic set-asides or UEI/CAGE code requirements are in place.