How to Write an RFP for a Climate and Sustainability Data Dashboard

Yolo County, California capped its climate plan dashboard contract at $99,085 in March 2025, and the line for building the dashboard came to 210 of 498 hours. Drafting and finalizing the metrics behind it took 151 more (contract). An RFP that describes the screens in detail and the data in a sentence buys the easier half of the job.

A climate and sustainability data dashboard brings emissions, climate risk, resilience or program data into one view for staff, a board or the public, with a data pipeline that keeps the figures current. You need one when the same numbers are rebuilt by hand for every report and meeting. The RFP succeeds when it fixes each metric’s definition, source, owner and refresh schedule before anyone designs a chart.

Three things moved under these purchases. The Justice Department pushed its web accessibility deadlines for state and local governments back a year (interim final rule), and the FAR thresholds that federal grant rules borrow rose to $15,000 and $350,000 on October 1, 2025 (FAR 2.101). Federal data moved too: FEMA retired its National Risk Index web application and froze OpenFEMA’s mitigation projects dataset on August 31, 2026.

What this work should deliver

The outcome is a dashboard that answers named questions from named sources, a pipeline your staff can run without the builder, and the right to take your data and leave.

Who this is for: local governments tracking a climate action plan; ports and universities reporting emissions and resilience progress; foundations and nonprofits tracking program and grant outcomes; and companies that want one reconciled view of their carbon accounting. It is the wrong purchase if the numbers don’t exist yet, so buy the community greenhouse gas inventory or corporate inventory first. It doesn’t replace a sustainability report, which is a reviewed statement at a point in time. Our sustainability data and technology hub covers the adjacent tools.

Settle these before you write tasks:

• Questions and audiences. Name the decisions the dashboard serves and who sees what. Internal views can carry draft figures; Yolo County’s scope required role-based access so only authorized staff could edit while key information stayed public. Every field on a public view is a published claim, and for a public entity that view is web content under the ADA rule.
• Metrics and owners. Give each metric a definition, unit, owner and source system, and say which source wins when two disagree. Without that rule, the dashboard makes the disagreement look official. Our ESG data management primer covers ownership.
• Sources. Typical inputs are a greenhouse gas inventory workbook, utility data, FEMA’s National Risk Index and program or grant records from the finance system. The Index covers 18 natural hazards by county and census tract, and its current release, version 1.20 from December 2025, is published on OpenFEMA as table, shapefile and geodatabase downloads. An Index score is a screen; a climate vulnerability assessment is the deeper study.
• Refresh cadence. Match each metric to its slowest source. An inventory covers a year at a time; New York City’s housing agencies asked for monthly automated utility data in their 2025 benchmarking vendor RFQ; and Rhode Island’s state climate dashboard was updated about quarterly at roughly 40 staff-hours a year (state memo).
• Methods. The same Rhode Island memo asked that the state’s next dashboard link readers to data sources, explanations and notes. Write that into the scope for every metric.

In Maryland, our county risk profiles show the minimum: each page names the National Risk Index release behind its scores.

Rules and standards to cite

Software purchases carry rules that consulting RFPs rarely touch. Cite each by section and date.

• Procurement route. When federal money pays, 2 CFR 200.320 sets the method by size, using the FAR thresholds in force since October 1, 2025: micro-purchases up to $15,000 need no quotes, purchases up to $350,000 need quotes from an adequate number of qualified sources, and larger ones need a formal, publicly advertised solicitation (FAR 2.101). A recipient may self-certify a micro-purchase threshold up to $50,000 or set a lower simplified acquisition threshold, and its procedures must follow state and local law (2 CFR 200.318), which can be stricter.
• Cooperative contracts. Section 200.318(e) encourages intergovernmental and inter-entity purchasing agreements and says documented arrangements of this kind meet its competition requirements. In 2019 Takoma Park, Maryland used the Metropolitan Washington Council of Governments’ climate contract, sent one task order to both approved firms and added a $10,020 online dashboard to a $41,004 plan update (council item). Confirm that the cooperative contract covers software and that your own rules allow the purchase.
• Accessibility. The Justice Department’s Title II rule requires WCAG 2.1 Level AA for web content a public entity provides directly or through contractual, licensing or other arrangements, so a vendor-hosted dashboard counts (28 CFR 35.200). An April 2026 interim final rule moved compliance to April 26, 2027 for entities of 50,000 people or more, and to April 26, 2028 for smaller ones and special district governments. The rule reaches special purpose districts and other instrumentalities of state and local government (28 CFR 35.104), which takes in public universities and port authorities that are public bodies.
• Federal data rights. Under 2 CFR 200.315, the awarding agency keeps a royalty-free license to copyrighted work developed under its award and the right to obtain and use data produced under it. Your contract has to give you rights broad enough to honor that, which a standard subscription agreement may not.
• Security. GovRAMP, the nonprofit that helps state and local governments verify the security of cloud products (stateramp.org now redirects to it), builds its program on NIST SP 800-53 Revision 5 and verifies products at Core, Ready, Provisional and Authorized levels. A SOC 2 report covers a service organization’s controls for security, availability, processing integrity, confidentiality or privacy (AICPA). CPC Climate Capital, a community lender working under EPA’s Greenhouse Gas Reduction Fund, asked for SOC 2 Type 2, ISO 27001 and NIST compliance in its 2024 data platform RFP (addendum).
• Sources you don’t control. EPA has proposed removing reporting obligations for 46 source categories in its Greenhouse Gas Reporting Program, a September 2025 proposal that isn’t final, and has moved the 2025 reporting deadline to March 10, 2027; our program explainer has the background. FEMA now serves the National Risk Index through downloads and its Resilience Analysis and Planning Tool, and said its frozen mitigation projects dataset would stop being available on October 15, 2026.

That last item is the one templates miss. A dashboard that calls a federal service live inherits every change to it, including the day it disappears. Require a stored, dated copy of every external source and a log of which version fed each figure, so a federal change becomes a documented update instead of a blank chart.

Accessibility is the other gap. Jackson, Wyoming’s January 2026 dashboard RFP asked bidders to price support through June 30, 2031, yet its answers to bidders said the town had no specific accessibility standard (RFP; questions and answers). A town of just over 10,000 people falls under the April 26, 2028 date, three years before that support term ends.

Sample scope of work

Adapt the bracketed items. Tasks 1 and 2 carry most of the value; the rest protect it.

1. Questions and metric register. Yolo County gave drafting and finalizing the metrics two tasks and 151 hours, ahead of development in its task list. Settle definitions before design, not during it.

The Contractor shall confirm the decisions the dashboard must support for [staff, the governing board and the public] and deliver a metric register stating, for each metric, its definition, unit, owner, source system, refresh frequency and the rule for resolving conflicts between sources. Design shall not begin until the [City] approves the register.

2. Data pipeline and source log. Automate the slow handoffs and record every version. New York City’s RFQ also asked vendors to load utility data into EPA’s ENERGY STAR Portfolio Manager and to keep up to 30 years of building data.

The Contractor shall build scheduled imports from [the greenhouse gas inventory workbook, the utility data feed, FEMA’s National Risk Index and the finance system], store a dated copy of each external source version used, and alert the named data owner to a missing period, a changed definition or a failed import before the figure is published.

3. Views and audiences. San Diego’s contract makes the dashboard’s data and charts directly downloadable by anyone (agreement).

The Contractor shall deliver an internal view with role-based editing and a public view that shows only the fields the [City] approves for publication, embedded in the [City’s] website, with the data behind every chart downloadable in CSV.

4. Methods notes. A figure without a method invites the wrong argument.

For every metric, the dashboard shall link to a methods note naming the source and its version, the date retrieved, the calculation, known limits and the date of the next update. When a definition changes, the note shall record the change and any restated years.

5. Accessibility. WCAG 2.1 asks for a text alternative for non-text content, no information carried by color alone, 3:1 contrast for the parts of a graphic needed to understand it, and full keyboard operation (W3C). A completed VPAT is called an Accessibility Conformance Report, and the current template is version 2.5Rev (ITI).

All content shall conform to WCAG 2.1 Level AA. Each chart shall have a text alternative and an accessible data table. Before acceptance and after each major release, the Contractor shall deliver an Accessibility Conformance Report on the WCAG edition of the VPAT and the results of testing with [a screen reader and keyboard only].

6. Hosting, security and support. CPC Climate Capital required 99.5% uptime with disaster recovery, and Yolo County’s license included hosting, security updates and daily backups through December 2026.

The Contractor shall host the dashboard and its data in [the United States], maintain [99.5]% monthly availability excluding maintenance announced [five] business days ahead, back up data daily, provide a current SOC 2 Type 2 report or GovRAMP status each year, and respond to critical defects within [four] hours. The fee proposal shall price hosting and support for each year through [2031].

7. Training and handover. Jackson said it would favor proposals that train staff to update the dashboard without outside help, and Yolo County required a staff guide to using, updating and maintaining it after the contract.

The Contractor shall deliver a staff guide and train [two] staff members, who shall add a new period of data and publish an update without the Contractor’s help before final acceptance.

8. Ownership, exit and transition. Yolo County’s contract shows the standard to aim for: on request or at termination, the platform’s source code under an open-source license, a full export of county data in a machine-readable format such as CSV, JSON or a SQL dump, and documentation of the data schema, all at no added cost.

The [City] owns all data, metric definitions, configuration and content it provides or pays for. Within [30] days of termination or expiration, the Contractor shall deliver a full export in open, machine-readable formats with a data dictionary, the dashboard configuration and schema documentation at no added cost, then delete [City] data and certify the deletion in writing. The Contractor shall demonstrate the export once before final payment.

Deliverables to require

• Metric register with definitions, units, owners, sources, refresh frequency and conflict rules.
• Source log naming each external source, version and retrieval date.
• Automated pipeline with failure alerts and a run history.
• Internal and public views, with the data behind each chart downloadable.
• A methods note for every metric, with its change history.
• Accessibility Conformance Report and test results.
• Security evidence: a current SOC 2 Type 2 report or GovRAMP status, and the incident response plan.
• Staff guide and training records, including one update published by staff alone.
• A tested full export of data and configuration in open formats.
• Support plan with response times and annual prices for the full term.

How to evaluate proposals

Published weights put cost near a quarter. Jackson gave its fee proposal 10 of 42 weighting points and asked evaluators whether ongoing maintenance fees were low, while approach, experience and project management took 24 (Jackson RFP). Weight the whole term, not the launch price.

With federal money, 2 CFR 200.320 requires the RFP to identify every evaluation factor and its relative importance, and to award on price and other factors. Above the simplified acquisition threshold, prepare an independent estimate before proposals arrive, as 2 CFR 200.324 requires. 2 CFR 200.319 excludes firms that drafted your specifications from competing, which matters if a vendor’s demo team helped write them.

Score the demo on your data. Send finalists two of your real spreadsheets, one with a missing month and one with a figure that conflicts with another source, and watch what each platform does with them.

Timeline

Work backward from your reporting calendar. If the board sees annual figures in [month], the metric register and data-sharing agreements have to close well before, because no vendor can automate a source nobody has agreed to share. Jackson hoped to finish all work in calendar 2026, about eight months after its planned selection (questions and answers).

Budget and cost drivers

Two recent public contracts bracket a mid-sized build. San Diego capped its Climate Action Plan dashboard at $101,000 over five years: $61,000 to configure and launch a subscription platform, then $10,000 a year for four years of maintenance. The city bought it without formal bidding after informally comparing similar products from five companies (agreement). Yolo County’s $99,085 contract, paid with American Rescue Plan funds, put $39,750, about 40%, into dashboard development and about 30% into the metrics (contract).

Subscriptions shift cost into later years. A vendor quoted Brentwood, Missouri $5,000 to set up a standard community dashboard and $9,500 a year for a license covering hosting, up to five staff users, training and quarterly quality checks (commission packet). By our arithmetic, five years of that quote total $52,500, and setup is under a tenth of it. Our comparison of building and buying sustainability software covers when each model wins.

Platform licenses are a smaller line. Microsoft lists Power BI Pro at $14 per user per month, paid yearly (Microsoft), and Esri’s published price list for its Texas cooperative contract shows list prices of $700 a year for an ArcGIS Online Creator user and $10,300 a year for ArcGIS Hub Premium (Esri). For a custom build, one studio’s published range is $18,000 to $45,000 over four to eight weeks (CF Labs estimator). Staff upkeep comes on top; our budget brief for custom sustainability software lists the lines buyers forget.

What moves the price:

• Sources and connections. Each feed needs an import, checks and an owner who answers when it fails. Jackson told bidders most of its data sat in Excel files.
• Data cleanup. Metrics that don’t reconcile add hours before any chart; Yolo County spent about 30% of its contract defining them.
• Public views. Accessibility testing, plain-language notes and translation; Yolo County’s RFP required English and Spanish (RFP).
• Maps and scenario tools. GIS layers, licenses and models. Yolo County added a scenario tool for emissions pathways and a resident pledge tracker.
• Security evidence. Requiring SOC 2 Type 2 or GovRAMP status narrows the field to vendors that hold it.
• Support term. Five years of license, hosting and support can cost more than the build, as Brentwood’s quote shows.

Red flags in proposals

• A demo built on the vendor’s sample data, with no plan to load and reconcile yours.
• A build price with licenses, hosting or support left to be determined.
• Exports limited to PDFs or images, or a full data export only at hourly rates.
• Default terms that license your inputs to others. Yolo County’s contract licensed material entered into the system under Creative Commons by default unless the county agreed otherwise; read the defaults before you sign.
• ‘ADA compliant’ with no WCAG version, conformance level or conformance report.
• Live calls to federal services with no stored copy or source log.
• Staff who can’t publish an update without opening a support ticket.

How we’d approach it

We would write the metric register before the RFP and test the export before the final payment. Our Maryland county risk profiles and climate risk assessment tool are small dashboards of our own, built from FEMA’s National Risk Index and its mitigation planning and grant data. By the time we pulled FEMA’s grant data on September 30, 2026, one of the two datasets we read had been frozen and scheduled to go offline, and dated sources made that a documented change instead of a broken page. CF Labs builds climate data dashboards on the same pattern, and for the Maryland Port Administration and Maryland Environmental Service we turned scattered data points into reports covering five jurisdictions.