How to Write an RFP for Resilience Planning Software

FEMA’s Local Mitigation Planning Handbook makes the case for tracking plainly: keeping track of mitigation actions as they move forward is easier than checking five years of progress during the update (Handbook, section 7.2). The update has to report the status of every action in the previous plan, for each jurisdiction (Policy Guide, Element E2-b). In our resilience work, that record usually lives in pieces: actions in the plan, costs in the capital program, grants in a tracker and scores in someone’s spreadsheet.

Resilience planning software is the shared record a jurisdiction uses to hold its hazard mitigation and resilience actions, rank them on agreed criteria, match them to funding, track their status and report progress, often with a public map. You need it when several departments, partner towns and funders work from one action list. The RFP succeeds when it buys that record in a form you own, can export and can hand to the next plan update.

The buying rules moved in 2025 and 2026. Purchases under federal awards now follow a $15,000 micro-purchase threshold and a $350,000 simplified acquisition threshold (FEMA Information Bulletin 552), and web content a government provides through a vendor must meet WCAG 2.1 AA from April 26, 2027 for larger governments (28 CFR 35.200).

What this work should deliver

The outcome is a maintained action record that answers FEMA’s plan maintenance questions every year, produces the status table the next update needs, and shows anyone how a project earned its rank and its funding match.

Who this is for: counties and cities with a plan under 44 CFR 201.6, regional agencies running multi-jurisdictional plans, and resilience authorities that rank and fund projects across jurisdictions. It is the wrong purchase if you have no adopted action list; start with a hazard mitigation plan update. If the gap is money rather than a system, a resilience funding strategy comes first.

Expect more than one plan. The Resilience Authority of Annapolis and Anne Arundel County serves two jurisdictions whose FEMA plans run on different clocks: the City of Annapolis plan expires July 9, 2028 and the county’s multi-jurisdictional plan on September 7, 2030, according to FEMA’s plan status data. Software built for one plan and one cycle won’t fit. Our Anne Arundel County risk profile shows the hazards behind both.

Check what you already have before you buy. The table maps the main product categories to the job each does well.

Multi-jurisdictional plans multiply the record. Each participant needs at least one action for each hazard in the risk assessment (Element C4-b), and the update reports status for each jurisdiction, so require separate jurisdiction views, permissions and reports from the start. Our build-or-buy guide for resilience tools covers when a configurable product beats a custom build.

Rules and standards to cite

Cite the rules that decide what the record must hold, how you may buy it and what it must meet. Several changed in 2025 and 2026.

• Plan maintenance. 44 CFR 201.6(c)(4) requires a method and schedule for monitoring, evaluating and updating the plan within a five-year cycle, a process for carrying it into other planning mechanisms such as capital improvement plans, and continued public participation. The Policy Guide says monitoring may include a system for tracking the status of mitigation actions (D2-a), and that every action needs a responsible office, funding sources more specific than ‘federal’ or ‘state’, and a time frame (C5-b).
• Community Rating System. A community credited for a floodplain management plan must prepare an annual evaluation report that reviews each action item, submit it with its recertification and make it public; missing it zeroes the planning credit (2025 CRS Coordinator’s Manual, Activity 510, Step 10). Our flood risk management primer explains the program.
• Procurement. With federal money, 2 CFR 200.320 allows micro-purchases without quotes when the price is reasonable and documented, requires quotes from an adequate number of qualified sources up to the simplified acquisition threshold, and requires sealed bids or proposals above it. The FAR Council raised those thresholds from $10,000 and $250,000 effective October 1, 2025 (90 FR 41872), and FEMA notes the increase does not necessarily change state, tribal or local thresholds. Above the simplified acquisition threshold, 2 CFR 200.324 requires your own estimate before proposals arrive.
• Cooperative contracts. 2 CFR 200.318(e) encourages intergovernmental and inter-entity agreements and treats documented strategic sourcing as meeting the competition rules. FEMA still advises caution: the contract must describe what you actually need, and you must document how using it met federal, state and local rules. GSA’s Cooperative Purchasing program lets eligible state and local governments buy commercial IT through its Multiple Award Schedule; Fresno, California used a cooperative agreement for a three-year, $262,458.80 meeting software subscription in September 2025.
• Competition. 2 CFR 200.319 excludes contractors that draft specifications or requirements from competing on them, and lists naming a brand without allowing ‘an equal’ among practices that restrict competition. Describe the functions you need, not one product’s screens.
• Accessibility. 28 CFR 35.200 covers web content and mobile apps a government provides directly or through contractual, licensing or other arrangements: WCAG 2.1 AA from April 26, 2027 for governments of 50,000 or more, and April 26, 2028 for smaller ones and special districts, under a Justice Department interim final rule of April 20, 2026. Ask for an Accessibility Conformance Report on ITI’s VPAT template, now version 2.5Rev.
• Security and hosting. GovRAMP, formerly StateRAMP according to North Carolina’s procurement office, verifies cloud products against NIST SP 800-53 Revision 5 and posts each registered product’s status. It sets no hosting location for low- or moderate-impact data, so state any U.S. residency rule yourself. A SOC 2 report is a CPA’s examination of a service organization’s controls for security, availability, processing integrity, confidentiality or privacy.
• Records and ownership. 2 CFR 200.336 asks recipients to collect and store federal award information in open, machine-readable formats when practicable, and 200.334 keeps award records for three years after the final financial report. For software developed under an award, 200.315 lets the recipient copyright it while the awarding agency keeps a royalty-free right to use it for federal purposes.

Grant eligibility for software is narrow and shifting. FEMA’s HMA guide lists GIS software, hardware and data used for hazard mitigation among activities the HMGP 5 Percent Initiative may fund (page 174), but excludes GIS software aimed at carrying out a specific project from planning-related activities (page 231). The fiscal 2024-25 BRIC notice funds only capability-building tied to infrastructure projects and excludes plan development and updates (page 10).

Sample scope of work

Adapt the bracketed items. Tasks 1 to 3 tie the system to your plan; tasks 4 to 9 keep the record yours.

1. Fit to your plan. Configure the system around your plan’s fields, not the vendor’s demonstration data.

The Vendor shall configure the system to hold every mitigation action in the [County’s 2025] hazard mitigation plan by participating jurisdiction and hazard, with the responsible office, named potential funding sources, a cost range, a defined time frame, a priority score and a dated status history. Within [60] days of notice to proceed, the Vendor shall import the current action table and the status of each action in the previous plan, and the [County] shall verify the import against the adopted plan.

2. Rankings the [County] controls. Element C5-a requires prioritization that weighs benefits against costs. Your criteria should drive the score; our guide to prioritizing resilience projects covers how to set them.

The system shall score actions on criteria and weights adopted by the [County], show every input behind each score, and let authorized staff change the weights and rerun the ranking without vendor help. Scores or funding matches generated automatically, including by artificial intelligence, shall be labeled as drafts until a named staff member confirms them, and the system shall log each confirmation.

3. Annual reporting. Make the system produce what FEMA and the Community Rating System ask for, every year.

The system shall produce, without vendor assistance, an annual progress report that reviews each action item, states what was and was not implemented and records recommended changes, and a table of every action’s status by jurisdiction arranged for Element E of the Policy Guide. Both shall export to editable formats.

4. Data ownership and export. Federal rules already ask for open, machine-readable formats for award information when practicable; make it a contract term.

All data, documents and configuration entered in or generated by the system are the property of the [County]. At no added cost, the [County] may export all records at any time in CSV, all geographic features in GeoJSON or GeoPackage, and all attached files in their original formats, with a data dictionary, and may read its records through a documented API.

5. Accessibility.

All public-facing and staff-facing pages, generated documents and mobile interfaces shall conform to WCAG 2.1 Level AA. The Vendor shall provide a current Accessibility Conformance Report based on the VPAT 2.5 template, correct reported nonconformities within [30] days or on a schedule the [County] approves, and retest after major releases.

6. Security and hosting.

The Vendor shall maintain [GovRAMP Core status or higher, or a SOC 2 report dated within the past 12 months] for the proposed service, encrypt data in transit and at rest, support single sign-on through [the County’s identity provider], host [County] data in the United States, and notify the [County] of any security incident affecting its data within [72] hours.

7. GIS and other integrations. Tell bidders what you run. Wilmington, North Carolina told bidders in a December 2025 addendum that it runs ArcGIS Enterprise with REST endpoints and uses Microsoft Entra ID for sign-on. FEMA calls its plan status data raw and subject to entry error, so show its source and date.

The system shall read and write project locations through the [County’s ArcGIS Enterprise REST services or OGC-compliant services], import FEMA’s National Risk Index and the plan approval and expiration dates published by OpenFEMA with their source and refresh date, and exchange project costs and funding with [the finance system] through a documented API or scheduled file transfer.

8. Support, training and uptime. By our arithmetic, 99.9% monthly availability allows about 43 minutes of downtime in a 30-day month.

The Vendor shall guarantee [99.9]% monthly availability, excluding maintenance announced [five] business days ahead, with service credits for any shortfall; respond to critical issues within [four] business hours; and train [two] administrators and up to [20] staff, with recorded sessions and written guides the [County] may reuse.

9. Exit and transition.

On expiration or termination, the Vendor shall deliver the complete export described in Task 4 within [30] days, keep the [County’s] data available for retrieval for [90] days, provide up to [40] hours of transition help at contract rates, and then delete the data and certify the deletion in writing. Records supporting federal awards shall remain retrievable for at least three years after the final financial report.

Deliverables to require

• Configuration workbook and data dictionary, approved before data entry begins.
• The migrated action table, with each record traced to a page of the adopted plan.
• Adopted prioritization criteria and weights, and the scored list with every input visible.
• An annual progress report and an Element E status table, both produced from live data.
• A current Accessibility Conformance Report and a dated remediation schedule.
• GovRAMP status documentation or a recent SOC 2 report, plus the incident response procedure.
• API documentation and a working connection to your GIS.
• A service level agreement with availability, response times and service credits.
• Training sessions, recordings and administrator guides.
• A tested full export in the first [90] days, and a written exit plan.
• A five-year price schedule with capped renewals.

How to evaluate proposals

Score the demonstration, not the prose. Send each finalist the same anonymized action table and ask it to load the table, rank it on your criteria and print your annual report in a timed session. A vendor that needs weeks of setup to do that in a demonstration will need them after award too.

When federal money pays, 2 CFR 200.320 requires the RFP to identify every evaluation factor and its relative importance, and to award to the proposal most advantageous with price and other factors considered. Selection without price is limited to architectural and engineering services, so software proposals must be priced and scored.

Mind who writes the requirements. If a vendor helps draft your specifications and federal money pays, 2 CFR 200.319(b) requires excluding it from the competition. We build software in this category, which is why this template describes functions any qualified product can meet.

Timeline

Work backward from your plan’s expiration date. Anne Arundel County’s plan runs to September 7, 2030 in FEMA’s data, so on the Handbook’s schedule its update scope and funding should be moving by 2028. Software bought now can have annual reviews on record before that scope is written; our guide to implementing a hazard mitigation plan between updates shows what those reviews should capture.

Budget and cost drivers

FEMA’s grant records give the clearest public benchmarks for building tools in this category. In OpenFEMA’s subapplication data, FEMA’s fiscal 2022 Flood Mitigation Assistance round obligated money for Maryland’s GIS watershed prioritization tool, covering all 23 counties and Baltimore City ($1,040,000 total, $744,000 federal, 36 months), and for regional floodplain management and Community Rating System software in Monmouth County, New Jersey ($449,990 total, $300,000 federal, 36 months).

Smaller requests and refusals sit in the same data. Montgomery County, Maryland asked for $55,000 in fiscal 2023 BRIC funds to scope a hazard mitigation survey and planning digital application, still listed as submitted to FEMA, and Delaware’s $570,878 BRIC scoping subaward for a water and wastewater database to support mitigation actions was accepted. A Massachusetts town’s $161,578 GIS software upgrade, submitted for fiscal 2023, is listed as ineligible.

Subscriptions are harder to benchmark, because few vendors in this category publish prices; ICLEI offers Temperate through an annual license fee without posting the amount. Ask every bidder for five years of prices, and budget the years after a grant ends: a license bought with grant money becomes a general fund line when the award closes. Our resilience funding hub tracks other sources, and our guide to building resilience into the capital improvement plan covers the budget side.

What moves the price:

• Jurisdictions and users. Each participating jurisdiction adds records, permissions and reports.
• Migration. Actions scattered across old plans, spreadsheets and capital budgets take hours to clean and match.
• Integrations. Each live connection to GIS, finance or grants systems adds configuration and upkeep.
• Public portfolio. A public map or portfolio brings accessibility testing and content review.
• Security level. GovRAMP’s Core verification assesses 60 NIST controls; Authorized status assesses more than 300.
• Custom features. Wilmington made bidders mark every requirement as standard, future release, custom, third-party or unavailable, and price the custom ones; copy that.
• Term. Multi-year terms trade price for flexibility, so cap renewal increases.

Red flags in proposals

• A proprietary risk or priority score whose inputs you cannot see or reweight.
• Exports limited to PDF reports, or export and API access priced as extras.
• Accessibility claims with no Accessibility Conformance Report behind them.
• Security described in adjectives, with no GovRAMP status or SOC 2 report.
• Hazard layers with no source, version or date, or public federal data resold as proprietary.
• Prices for year one only, or renewals with no cap.
• A demonstration on sample data, with no plan to migrate your action table.
• An offer to help write your requirements from a firm that intends to bid.

How we’d approach it

We would write the action record before the feature list, because the record is what FEMA, the Community Rating System and your council ask about. On the Annapolis Maritime Resilience Initiative, residents named 38 sites of concern over 18 months, and partners weighed them on climate vulnerability, ecological function, equity, community interest and feasibility before ten advanced to concept design; software has to carry criteria like those, not replace them. Buyers weighing a product against a build can see how CF Labs approaches resilience planning software, and our climate resilience planning hub collects related guides. Whoever you hire, test the full export before you pay for the second year.