NIGP 92044: Risk Management for Software Development

NIGP 92044 Risk Management For Software Development, an Item code, covers specialized advisory and analytical services that state and local agencies buy to assess, mitigate, and manage technology and operational risks embedded in software systems, modernization initiatives, and digital infrastructure investments. Recent solicitations show government demand spanning formal verification and error-reduction analysis for eligibility systems, cloud-hosted risk management information systems for claims and incident tracking, predictive analytics platforms for healthcare utilization, and comprehensive assessment of software modernization architectures—with buyers ranging from state human services and health departments to county risk managers and municipal utilities seeking to de-risk complex system replacements and new deployments.

State departments, counties, cities, and special-purpose districts are the primary issuing bodies, with standout recent activity in Georgia (Fulton County RMIS procurement, Georgia DHS SNAP error-reduction RFI, DeKalb County School District software), Florida (Hillsborough County Schools assessment platform, Orlando utilities procurement automation RFI, Central Health emergency department predictive analytics), and Texas (TSBPA legacy system modernization, San Mateo County ADA services). The Texas State Board of Public Accountancy's June 2026 RFO for legacy IBM iSeries modernization across six modules with ten-year hosting through August 2036 and Hillsborough County Public Schools' RFP for a 200,000-student assessment platform migration with go-live by July 2027 represent substantial technology-risk engagements. Georgia's DHS RFI closing July 7, 2026, seeks documented SNAP payment error-reduction methodologies—formal verification, rules engines, automated case review—implemented in production with quantified outcome proof, indicating growing state appetite for risk-validated, outcome-backed modernization approaches. Collier County, Florida's Opioid Data Collaborative (RFP due October 6, 2025; budget $407,436) and Fulton County, Georgia's 90-day RMIS deployment (pre-advertisement posted January 26, 2026, due March 6) show county demand for rapid-cycle, cloud-hosted risk and compliance platforms. Municipal buyers include the City of Newnan, Georgia (ERP RFQ for 343-staff municipality), City of Orlando (firefighter workers' compensation third-party administration), and Orlando Utilities Commission (procurement automation RFI for market research, due May 11, 2026). The vendor pipeline across these opportunities emphasizes compliance certification (SOC 2 Type II, ISO 27001, FedRAMP, TexRamp), integration depth with legacy systems, and proof of implementation scale and performance outcomes—signals that risk-management service providers win by demonstrating measurable risk reduction and seamless architectural fit rather than feature breadth alone.