How to Write an RFP for a Climate Vulnerability Assessment

Florida funded 46 assessment-only grants in its last two planning cycles at a median of $180,000, and its statute spells out what the money buys: every critical asset the grantee owns, four kinds of flooding, named sea level scenarios and two planning horizons (section 380.093). Most buyers write looser specs and get map books.

A climate vulnerability assessment identifies which assets, services and people are exposed to climate hazards, how sensitive they are, and how well they can cope, under stated scenarios and time horizons. You need one before an adaptation plan, a capital program or a general plan update. The RFP succeeds when it names the decisions the assessment must inform.

The science is shifting too. A federal notice of August 25, 2026 proposes limits on how agencies use the Fifth National Climate Assessment’s high-emissions results; an RFP that names its scenarios holds up either way.

What this work should deliver

The outcome is a ranked list of what is most likely to fail, how badly, and when, with enough evidence behind each ranking to defend a budget request. The U.S. Climate Resilience Toolkit’s vulnerability step frames it well: rate each asset-hazard pair on sensitivity and adaptive capacity, then plot probability against consequence. A stack of exposure maps is an input to that work, not the product; our climate risk assessment how-to walks through the steps.

Who this is for: cities and counties, utilities, ports, transit agencies and state agencies that own or regulate long-lived assets. It also suits hospitals and universities with a campus to protect. It is the wrong purchase for a company’s financial disclosure under IFRS S2, which asks different questions of the same physical data.

Set three boundaries in the RFP. First, the hazards: list them, and say which get modeled and which get a literature review. Second, the assets: attach your inventory and say who fills the gaps; the Ventura County Transportation Commission told 2026 bidders to expect to source some shapefiles themselves.

Third, name the next step. An assessment feeds a hazard mitigation plan update or an adaptation plan, so say which one and when; our climate resilience planning hub covers both.

People belong in the asset list. Tract-level social vulnerability from the Census Bureau’s Community Resilience Estimates, last released in April 2026, and FEMA’s National Risk Index give a baseline. In Maryland, our county risk profiles put FEMA’s social vulnerability and community resilience scores beside expected losses for each county.

Rules and standards to cite

The binding requirements come from state law and grant agreements, and they differ sharply by state. Cite what applies to you, then a method standard any qualified firm can meet. Our climate risk assessment hub collects the federal and state data sources.

• Florida. Section 380.093 requires a Resilient Florida assessment to cover the whole jurisdiction and all critical assets it owns or maintains, using the latest public elevation model. It must analyze, as applicable, flood depth from tides, storm surge at or above the current 100-year event, rainfall for 100-year and 500-year storms, and compound flooding. For work started after July 1, 2024, it must use at least NOAA’s 2022 intermediate-low and intermediate scenarios, or the state’s own projections, and two planning horizons, such as 2040 and 2070.
• Florida deliverables. The same section requires a findings report, mapping data with metadata, and an inventory of critical assets affected now or within 50 years. The state’s compliance checklist sets the tidal flooding threshold at 2 feet above mean higher high water and requires a page reference for every item.
• California. Government Code section 65302(g)(4) requires cities and counties, when they update the general plan’s safety element after revising their hazard mitigation plan, to include a vulnerability assessment drawing on Cal-Adapt and the California Adaptation Planning Guide. A hazard mitigation or adaptation plan can satisfy it if the city shows how each requirement is met.
• Method. ISO 14091:2021 gives guidelines on vulnerability, impacts and risk assessment. Citing it tells bidders you expect a documented method, and every serious firm can meet it.
• Sea level and rainfall. For sea-level rise, the interagency 2022 Sea Level Rise Technical Report projects 10 to 12 inches of rise, on average, along U.S. coastlines by 2050. For rain, NOAA’s precipitation frequency server delivers Atlas 14 estimates; say whether and how bidders should adjust them for future conditions.

Two federal changes deserve a sentence in your RFP. The notice from the White House science office proposes that NCA5 results depending on RCP8.5, SSP5-8.5 or similar pathways not be presented as expected or baseline federal planning futures, though they could remain stress tests; comments closed September 9, 2026. And FEMA’s 2025 mitigation planning policy no longer asks hazard mitigation plans to address climate change, so an assessment is now often the only place a community examines future conditions.

Sample scope of work

Adapt the bracketed items. The sequence runs from decisions to data to rankings, which keeps the analysis tied to use.

1. Decision framing and assessment plan. Make the consultant write down what the results will be used for before any modeling starts.

Within 45 days of notice to proceed, the Consultant shall deliver an assessment plan that names the decisions the assessment will inform, the hazards, assets, scenarios and planning horizons to be analyzed, the data sources for each, and the method for rating vulnerability and risk. The [Agency] shall approve the plan before analysis begins.

2. Data inventory. Say what you will supply. Bidders price the gaps.

The Consultant shall review the data listed in [Attachment A], identify gaps, and propose how to fill each one. The Consultant shall document the source, date and known limits of every dataset used and deliver all data in [the Agency’s GIS standard] with metadata.

3. Exposure. Specify scenarios, horizons and hazard metrics; our primer on climate modeling explains the terms.

The Consultant shall map exposure of [critical facilities, transportation, water and wastewater systems, natural resources and residents] to [tidal flooding, storm surge, rainfall-induced flooding, extreme heat and wildfire] under [a central scenario] and [a high-end stress test] for [2050 and 2080], reporting flood depth where applicable. Results that depend on the stress test shall be labeled as such in every map, table and summary.

4. Sensitivity and adaptive capacity. This is where most assessments cut corners, especially on people; see our note on equitable climate adaptation.

For each exposed asset, the Consultant shall assess sensitivity using asset condition, criticality, design thresholds and dependencies on power, water and access, and assess adaptive capacity using redundancy and existing protections. For people, the Consultant shall use tract-level social vulnerability data and local knowledge gathered under Task 6.

5. Risk ranking and consequences.

The Consultant shall rate each asset-hazard pair for likelihood and consequence, including service disruption, population affected and planning-level economic loss, and shall deliver a ranked risk register that identifies which scenario and horizon drive each rating.

6. Engagement and validation. Residents know where water sits after a storm. Models often don’t; our stakeholder engagement plan guide covers the design.

The Consultant shall collect resident and staff reports of past impacts through [workshops, a mapping survey and interviews with asset managers], reconcile them with model results, and document every material difference and how it was resolved.

7. Reporting and compliance.

The Consultant shall deliver a technical report, a plain-language summary for elected officials, and a completed crosswalk showing where the assessment meets [section 380.093, Government Code section 65302(g)(4) or the hazard mitigation plan’s risk assessment elements], with page references.

Deliverables to require

• Approved assessment plan naming decisions, hazards, assets, scenarios, horizons and methods.
• Data inventory with sources, dates and limits for every dataset.
• Exposure maps and GIS layers for each hazard, scenario and horizon, with metadata.
• Asset inventory with sensitivity, adaptive capacity and criticality ratings.
• Ranked risk register as an editable spreadsheet, one row per asset-hazard pair, noting which scenario drives each rating.
• Social vulnerability analysis at tract level, with the local knowledge that confirmed or corrected it.
• Engagement record, including resident-reported sites and how each was treated.
• Methods appendix covering uncertainty and what the assessment cannot tell you.
• Compliance crosswalk with page references, where a statute or funder requires one.
• Plain-language summary and a briefing deck for elected officials.
• All model inputs and outputs, with written rights to reuse them without license fees.

How to evaluate proposals

Florida agencies can buy assessments as engineering services under the Consultants’ Competitive Negotiation Act, which ranks at least three firms on qualifications and then negotiates a fair price with the top one. Boynton Beach used it for its 2026 update. With federal money, 2 CFR 200.320 limits selection without price to architectural and engineering services, and every evaluation factor and its relative importance must appear in the RFP.

Set minimum qualifications with care. Ventura County’s transportation RFP asked for three comparable plans in the last seven years, which is reasonable; demanding ten, or a specific software license, is the kind of unnecessary or unreasonable qualification requirement that 2 CFR 200.319 lists as restricting competition.

Ask each finalist to walk through one asset-hazard rating from raw data to rank. You will learn more in ten minutes than from the whole proposal.

Timeline

Check your funder’s calendar before you promise a start date. Florida’s program did not accept planning applications in its 2026 cycle; only implementation projects could apply, from July 1 to September 1, 2026.

Budget and cost drivers

Florida’s award lists are the best public benchmark we found. Across the fiscal 2024-25 and 2025-26 cycles, 46 assessment-only awards had a median of $180,000, a middle half from $127,625 to $250,000, and a range from $50,000 to $570,400. The eight 2025-26 awards that paired an assessment with an adaptation plan had a median near $349,000.

Small cities sit at the bottom: West Miami accepted a $55,500 grant in 2023 with no city share. Asset owners sit at the top; SeaPort Manatee’s assessment drew $500,000 in fiscal 2024-25. Ventura County’s multimodal transportation assessment and action plan carries a $299,995 Caltrans grant, with $259,995 for consultant services and the rest for a community foundation’s outreach.

What moves the price:

• Geography and asset count. Florida requires the whole jurisdiction and every critical asset the grantee owns or maintains unless the state approves a narrower scope.
• Hazard modeling. Hydrologic and hydraulic modeling of rainfall costs far more than overlaying published flood layers. Decide which hazards earn models.
• Scenarios and horizons. Each added scenario-horizon pair multiplies maps, tables and review time.
• Data condition. An asset inventory with condition ratings saves weeks; a missing one becomes a task of its own.
• Engagement. Workshops, translation and interviews with asset managers add hours, and they are where errors get caught.
• Tools. A custom dashboard adds build and hosting costs. Make sure the data survives if the subscription ends.

If you are still assembling the money, our resilience funding hub tracks current programs.

Red flags in proposals

• A single scenario, or scenarios chosen without a stated rationale.
• Maps without a ranking, or rankings without the evidence behind them.
• Vulnerability scored from national indices alone, with no asset condition or local knowledge.
• A proprietary platform that holds your data and charges for access after the contract ends.
• No discussion of uncertainty, or uncertainty confined to a boilerplate appendix.
• Resident input scheduled after the analysis is finished, when it can’t change anything.
• Most hours in report production rather than analysis and validation.

How we’d approach it

We would start from the decisions and work back to the data, and we would put residents in the room before the model runs. In our work on the Annapolis Maritime Resilience Initiative, residents identified 38 sites of concern that became the foundation for the technical work, scored on climate vulnerability, ecological function, equity, community interest and feasibility. For the Huron River Watershed Council, we showed that a 1% drop in regional economic activity would cost 3,814 jobs and $19 million a year in local tax revenue, the kind of consequence figure a council can act on.