1-sUAS BID Specifications.pdf

BID SPECIFICATIONS

COUNTY OF BLAIR

PUBLIC SAFETY GRADE

SMALL UNMANNED AERIAL SYSTEMS (sUAS)

NATURE OF REQUEST: The County of Blair invites sealed bids for the procurement of two (2) Public Safety Grade Small Unmanned Aerial Systems (sUAS) and associated equipment meeting or exceeding the specifications contained herein.

The equipment shall be new, unused, and the manufacturer’s current production model.

Equivalent systems meeting performance specifications will be accepted. This is performance-based, non-proprietary procurement.

GENERAL REQUIREMENTS

1. Equipment shall be suitable for public safety operations

2. System shall be NDAA compliant or Blue UAS approved

3. Equipment shall be new and free from defects

4. All firmware/software must be fully licensed at delivery

5. Delivery timeline: within 90 days of awarded bid

6. Warranty: Minimum 1 year required

SYSTEM QUANTITY

1. Two (2) complete sUAS aircraft systems

2. Docking capable

3. Spare batteries and accessories as specified

COMPLIANCE REQUIREMENTS

Bidders must certify:

1. NDAA Section 848 compliance

2. Blue UAS approval status *if Blue UAS approved

3. No restricted or prohibited telecommunications components

4. System suitable for U.S. public safety use

Documentation shall be included with bid.

BID SUBMISSION CONTENTS

Bidders shall include:

1. Completed bid form

2. Technical compliance statement

3. Warranty information

4. Proof of NDAA / Blue UAS compliance

5. Delivery estimate

6. Pricing (itemized)

TECHNICAL SPECIFICATIONS: Public Safety Small Unmanned Aerial System (sUAS)

GENERAL SYSTEM REQUIREMENTS

The system shall be a professional-grade, autonomous-capable, small, unmanned aircraft suitable for public safety, emergency response, and other mapping/inspection operations.

Minimum requirements:

1. Flight time: Minimum 35 minutes

2. Weather resistance: IP55 or greater

3. Autonomous navigation and obstacle avoidance in complex environments

4. Docking capable system

5. Operable in daytime and nighttime conditions

6. Suitable for law enforcement, emergency response, and search and rescue

7. NDAA compliant or Blue UAS approved

AIRCRAFT PERFORMANCE

The aircraft shall:

1. Provide autonomous flight capability including obstacle avoidance in low or no visible light, can be assisted with onboard lighting.

2. Maintain stable flight in public safety operational environments

3. Support automated and manual flight modes

4. Support rapid deployment

5. Provide encrypted command and control link

6. Support secure data handling

7. Have the ability for attachments such as payload, parachute, lighting, and audio (provide pricing)

SENSOR REQUIREMENTS (MANDATORY)

The system must include an integrated multi-sensor payload. The sensor package can differ between the two requested aircraft to accommodate a wider range of capabilities:

1. Visual Sensor:

- High-resolution RGB camera, greater than 40 MP

- High-power zoom or wide-angle (greater than 50 degree field of view) capability suitable for public safety observation

2. Thermal Sensor:

- Radiometric thermal imaging capability suitable for search and rescue and detection in both hot and cold environments

3. Low-Light / Night Sensor:

- Low-light/night imaging capability suitable for nighttime operations without the aid of visible light

4. Autonomous Capability:

- Automated navigation and obstacle avoidance required while maintaining view of moving object of interest

OPTIONAL (NOT REQUIRED)

The County would like additional pricing on below options, if available:

1. Laser rangefinder / distance measurement capability

2. Multi-sensor simultaneous viewing

3. Mechanical shutter camera for mapping

4. RTK / precision GPS capability

MAPPING / PHOTOGRAMMETRY

The system shall be capable of supporting aerial mapping and photogrammetry missions through compatible software and/or onboard capabilities.

ENVIRONMENTAL REQUIREMENTS

1. Weather resistance rating: IP55 minimum

2. Operable in public safety field conditions including wind, light rain, and variable temperatures

DOCKING / ACCESSORIES

Each system shall be/include:

1. Compatible with an autonomous dock

2. Minimum two (2) spare batteries per aircraft

3. Spare set of propellers per aircraft

4. All required chargers and support equipment

DRONE SOFTWARE SAFETY & CYBERSECURITY REQUIREMENTS:

SCOPE OF “SOFTWARE PACKAGE”

Bidder shall disclose and include in scope all software components used to operate, manage, or update the UAS, including:

1. Aircraft firmware / autopilot stack

2. Payload firmware (camera, LiDAR, etc.)

3. Ground Control Station (GCS) application (mobile/desktop)

4. Backend/cloud services (telemetry relay, fleet management, mapping, storage)

5. APIs, SDKs, and any third-party libraries/services

6. Update mechanisms (firmware/app/cloud)

Bid response must include: a bill of materials for the necessary and required software components and a diagram of what software is required for operation.

Minimum bill of materials (BOM) requirements to include:

1. Component/Software name and version

2. Supplier/origin

3. Dependency relationships

4. Hashes/checksums where applicable

5. License information including any expiration dates

CRYPTOGRAPHIC PROTECTIONS

Bid response must include: a cryptography statement describing which data is encrypted

(in transit/at rest) and where keys are stored/managed.

The software package(s) shall enforce:

1. Encryption in transit for command-and-control, telemetry, and backend communications (industry-standard TLS or equivalent)

2. Encryption at rest for sensitive stored data (mission data, credentials, logs, stored media, etc.) on device and in cloud where applicable

3. No hard-coded credentials or default passwords

STRONG AUTHENTICATION & ACCESS CONTROL

Bid response must include: roles supported + MFA methods (TOTP, FIDO2, etc.).

The software package shall support:

1. Role-based access control (RBAC) for administrative/fleet functions

2. Unique user identities (no shared admin accounts) for enterprise/fleet systems

3. Multi-factor authentication (MFA) for any cloud console or fleet management portal

4. Device/app session management (timeouts, revocation)

DATA GOVERNANCE, TELEMETRY & “WHERE DATA GOES”

Bidder shall disclose, in plain language:

1. What data is collected (telemetry, location, video, diagnostics)

2. Where it is stored/processed (on-device, customer environment, vendor cloud)

3. Whether data is shared with third parties, and for what purpose

4. Retention periods and deletion capabilities

5. Customer ability to export data and delete data upon request/termination

6. Minimum control: ability to operate in a mode that prevents vendor cloud relay/storage unless explicitly required (e.g., “offline/local-only operation”) or a clear justification if not possible

VULNERABILITY DISCLOSURE & PATCH SLAs

Bidder shall notify the County of critical vulnerabilities affecting delivered components within 5 business days of confirmation, including mitigations.

Bid response must include: a copy/link to vulnerability disclosure policy and escalation path.

Bidder shall have a documented vulnerability disclosure program and commit to the following minimum remediation timelines (or better), measured from verified report:

1. Critical: mitigation within 7 days; patch within 30 days

2. High: patch within 60 days

3. Medium: patch within 120 days

4. Low: next regular release cycle

LOGGING, AUDITABILITY & INCIDENT SUPPORT

Bid response must include: log types available + export methods.

Software package(s) shall provide:

1. Security-relevant logs (authentication events, admin actions, configuration changes, update events)

2. Time synchronization support (NTP or equivalent)

3. Export capability in a standard format (e.g., syslog/CSV) for enterprise use

4. Incident response support commitments (support hours, contact methods, response targets)

NETWORK AND OPERATIONAL HARDENING

Software package should support:

1. IP allowlisting / firewall-friendly network requirements

2. Proxy support for enterprise networks

3. Ability to disable unused services/ports and restrict local interfaces

4. Separate operator vs admin privileges (least privilege)

WARRANTY

1. Minimum 1-year manufacturer warranty (Required)

2. 3-year extended warranty option (Optional, provide pricing)

TRAINING

Training is not required under this procurement. However, the County would like pricing for platform specific training as an option, if available.

DELIVERY CONTENTS

Each system shall include:

1. Aircraft

2. Controller / Ground control system

3. Integrated sensor payload

4. Batteries and charger

5. Spare propellers

6. Docking compatibility

7. All required software licenses

8. Documentation and manuals

ACCEPTANCE

Equipment shall be considered accepted upon verification that:

1. All required components are delivered

2. System powers on and operates

3. Sensors function as specified

4. Documentation and licensing provided

Appendix A Requirements for non-Blair County Hosted Applications/Services

The purpose of this appendix is to define requirements for technology solutions procured by the County of Blair that are not hosted within Blair County infrastructure. If bid includes applications or services hosted outside of Blair County Infrastructure review and indicate if bid solution is compliant/non-compliant for each listed item. If non-compliant please provide explanation. If bid does not include hosting outside of Blair County Infrastructure, please indicate that the requirements are nonapplicable.

A. Hosting Requirements

1. The selected Bidder shall supply all hosting equipment (hardware and software) required for performance of the Contract.

2. The selected Bidder shall provide secure access to all levels of users via the internet.

3. The selected Bidder shall use commercially reasonable resources and efforts to maintain adequate internet connection bandwidth and server capacity.

4. The selected Bidder shall maintain all hosting equipment (hardware and software) and replace as necessary to maintain compliance with the Service Level Agreements

5. The selected Bidder shall monitor, prevent and deter unauthorized system access.

Any and all known attempts must be reported to the County of Blair within the timeframe set. In the event of any impermissible disclosure, loss or destruction of Confidential Information, the receiving Party must immediately notify the disclosing Party and take all reasonable steps to mitigate any potential harm or further disclosure, loss or destruction of such Confidential Information. In addition, pertaining to the unauthorized access, use, release, or disclosure of data, the selected Bidder shall comply with state and federal data breach notifications regulations and is to report security incidents to the County of Blair within one (1) hour of when the selected Bidder knew of such unauthorized access, use, release, or disclosure of data.

6. The selected Bidder shall allow the County of Blair or its delegate, at times chosen by the County of Blair, to review the hosted system’s location and security architecture.

7. The selected Bidder staff, directly responsible for day-to-day monitoring and maintenance, shall have industry standard certifications applicable to the environment and system architecture used.

8. The selected Bidder shall locate servers in a climate-controlled environment. Bidder shall house all servers and equipment in an operational environment that meets industry standards including climate control, fire and security hazard detection, electrical needs, and physical security.

9. The selected Bidder shall examine system and error logs daily to minimize and predict system problems and initiate appropriate action.

10. The selected Bidder shall completely test and apply patches for all third-party software products before release.

11. Bidders shall provide a successfully passed SSAE-18 SOC2 audit report, conducted by an independent certified public accounting firm, subject to the approval of the Department, as part of its proposal, and the selected Bidder shall provide a SSAE-18 audit report annually.

B. Security Requirements

1. The selected Bidder shall conduct a third-party independent security/vulnerability assessment at its own expense on an annual basis and submit the results of such assessment to County of Blair within three (3) business days.

2. The selected Bidder shall comply with the County of Blair’s directions/resolutions to remediate the results of the security/vulnerability assessment to align with the standards of the County of Blair.

3. The selected Bidder shall use industry best practices to protect access to the system with a firewall and firewall rules to prevent access by non-authorized users and block all improper and unauthorized access attempts.

4. The selected Bidder shall use industry best practices to provide system intrusion detection and prevention in order to detect intrusions in a timely manner.

5. The selected Bidder shall use industry best practices to provide virus protection on all servers and network components.

6. The selected Bidder shall limit access to the system and servers and provide access only to those staff that must have access to provide services proposed.

7. The Selected Bidder will provide all Services, using security technologies and techniques in accordance with industry best practices and the County of Blair’s security policies, procedures, and requirements, including those relating to the prevention and detection of fraud and any other inappropriate use or access of systems and networks.

C. Data Storage

1. The selected Bidder shall use industry best practices to update all systems and third-party software security patches to reduce security risk. The Selected Bidder shall protect their systems with anti-virus, host intrusion protection, incident response monitoring and reporting, network firewalls, application firewalls, and employ system and application patch management to protect its network and customer data from unauthorized disclosure.

2. The selected Bidder shall be solely responsible for all data storage required.

3. The selected Bidder shall take all necessary measures to protect the data including, but not limited to, the backup of the servers on a daily basis in accordance with industry best practices and encryption techniques.

4. The Selected Bidder agrees to have appropriate controls in place to protect critical or sensitive data and shall employ stringent policies, procedures, and best practices to protect that data particularly in instances where sensitive data may be stored on a Selected Bidder controlled or owned electronic device.

5. The selected Bidder shall utilize a secured backup solution to prevent loss of data, back up all data every day and store backup media. Storage of backup media offsite is required. Stored media must be kept in an all-hazards protective storage safe at the worksite and when taken offsite. All back up data and media shall be encrypted.

D. Data Breach

1. Bidder shall comply with all state and federal data breach notification laws, including but not limited to the Commonwealth of PA Breach of Personal Information Notification Act (73 P.S. § §2301 et seq.).

2. Bidder shall report any Breach of the Security of the System to the Agency Contact Person and the County of Blair's Information Security Officer within one (1) hour of confirmation of, or within one (1) calendar day after reasonably suspecting, any such Breach of the Security of the System has occurred, including the nature of the breach, the data compromised, the involved parties, mitigation efforts, and corrective actions to be taken by the Bidder. Bidder shall provide timely notification to all individuals that may be impacted by a Breach of the Security of the System as required by the Breach of Personal Information Notification Act.

3. At the County of Blair's request, Bidder shall, at its sole expense, provide credit monitoring services to all individuals that may be impacted by a Breach of the Security of the System.

4. Bidder shall be solely responsible for any costs, losses, fines, or damages incurred by the County of Blair due to PII being accessed, used, released, disclosed and/or acquired in an unauthorized manner while in the possession and control of the Bidder or its employees, agents, and/or subcontractors.

E. Adherence to Policy

1. The selected Bidder support and problem resolution solution shall provide a means to classify problems as to criticality and impact and with appropriate resolution procedures and escalation process for each classification of problem.

2. The selected Bidder shall abide by all the County of Blair’s policies (Information Technology Bulletins (ITBs)).

3. The Selected Bidder shall comply with all pertinent federal and state privacy regulations.

F. Closeout

1. When the contract term expires or terminates, and at any other time at the written request of the County of Blair; the selected Bidder must promptly return to the

County of Blair all its data (and all copies of this information), in a format agreed to by the County of Blair, that is in the selected Bidder’s possession or control.

BID FORM

COUNTY OF BLAIR

PUBLIC SAFETY GRADE

SMALL UNMANNED AERIAL SYSTEMS (sUAS)

Bid DUE DATE: March 30, 2026, 2:00 PM Include prices for all items that satisfy the bid specifications.

Company:

Contact Name:

Address:

Telephone: Fax:

Cell Phone: Email:

The bidder proposes and agrees, if awarded this bid, to furnish the products, software and or services at the costs provided in this bid submission for the quantity and items selected from the provided bid materials by the County of Blair that satisfy in whole, or in part, the specifications outlined in the Bid Specifications for the period of six (6) months from the date of being awarded the bid.

Date: ________________

Print Name & Title: _________________________

Signature: _______________________