6-Attachment 2 - Scope of Work.docx
DOCX document 20 KB Posted
- Solicitation number
- SLCI26080
- Issued by
- Salt Lake County, Salt Lake City, Utah
About this file
This is a Scope of Work document for Salt Lake City Corporation's Request for Proposals SLCI26080, soliciting qualified privacy consultants to support the City's Chief Privacy Officer in advancing the organization's privacy program maturity. The City seeks an awarded offeror to provide subject matter expertise, strategic guidance, and assistance in implementing privacy best practices with particular attention to Utah public sector legal and operational requirements. Key services include privacy program maturity enhancement using established frameworks such as the NIST Privacy Framework, conducting Privacy Impact Assessments (PIAs) and risk assessments for high-risk systems including the Real Time Crime Center, reviewing emerging technologies and vendor documentation for privacy compliance, developing or refining privacy training materials, and serving as an on-call advisor for complex privacy matters. The engagement is designed to enhance institutional capacity, promote responsible data governance, and ensure public safety technologies are deployed lawfully and ethically. Work shall be authorized through written task orders or purchase orders with no minimum amount of work guaranteed, and the awarded offeror shall report directly to the Chief Privacy Officer or designee.
Deliverables include annual privacy maturity assessment reports, updated or newly developed policies and procedures, completed PIA reports with risk assessment summaries and mitigation recommendations, training materials, written memoranda addressing specific privacy questions, and executive briefings as requested. All written deliverables must be clear, concise, and suitable for review by City leadership and public disclosure where applicable. The scope of work emphasizes alignment with applicable Utah state privacy requirements including the Utah Government Privacy Act and GRAMA, as well as federal regulations and recognized privacy best practices. The awarded offeror shall participate in periodic planning and status meetings, provide progress updates as requested, and coordinate with City departments, IT personnel, legal counsel, and public safety leadership as appropriate.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| 5-Attachment 3 - Cost Proposal.xlsx | XLSX spreadsheet | |
| 3-Attachment 4 - Score Sheet.xls | XLS spreadsheet | |
| 4-Attachment 1 - Sample Agreement.docx | DOCX document | |
| 1-Confidential+and+Proprietary+Info+Declaration+Form.pdf | ||
| 2-SLCI26080.docx | DOCX document |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Attachment 2 Scope of Work
A. Purpose
The City seeks to retain a qualified privacy consultant to support the Chief Privacy Officer (CPO) in advancing the City’s privacy program and increasing the overall privacy maturity of the organization as needed. The awarded Offeror will provide as needed subject matter expertise, strategic guidance, and assistance in implementing and operationalizing privacy best practices, with particular attention to the legal and operational requirements applicable to Utah public sector entities.
B. Background
The City seeks proposals from qualified consultants with demonstrated expertise in public sector privacy programs, particularly within Utah and comparable regulatory environments, to support the City’s Chief Privacy Officer (CPO) in advancing the overall privacy maturity of the organization. The awarded Offeror will provide strategic, operational, and technical assistance on an as needed basis to strengthen governance structures, policies, procedures, training, and accountability mechanisms in alignment with applicable Utah state privacy requirements (including the Utah Government Privacy Act, GRAMA and other relevant state laws), federal regulations where applicable, and recognized privacy best practices.
In addition, the awarded Offeror will assist the CPO in performing complex privacy-related initiatives on an as needed basis, including but not limited to conducting a comprehensive Privacy Impact Assessment (PIA) of the City’s Real Time Crime Center and associated technologies (e.g., video analytics, data integration platforms, and information-sharing systems), evaluating legal compliance, data minimization, purpose limitation, retention, security controls, transparency, and civil liberties considerations, and providing actionable recommendations to mitigate identified risks. The engagement is intended to enhance institutional capacity, promote responsible data governance, and ensure that evolving public safety technologies are deployed in a manner that is lawful, ethical, and aligned with community expectations.
C. Objectives
The objectives of this engagement are to:
1. Increase the overall privacy maturity of the City through structured program development and implementation.
2. Strengthen privacy governance, accountability, and compliance mechanisms.
3. Provide expert assistance in conducting complex privacy assessments and risk analyses.
4. Support the CPO in evaluating emerging technologies and high-impact data uses.
5. Deliver practical, actionable recommendations tailored to the operational realities of a municipal government.
D. Scope of Services
The awarded Offeror shall provide services that may include, but are not limited to, the following:
1. Privacy Program Maturity Enhancement
The awarded Offeror shall assist the CPO in evaluating and strengthening the City’s privacy program, including:
a. Conducting a privacy maturity assessment using an established framework (e.g., NIST Privacy Framework or comparable model).
b. Reviewing and recommending updates to privacy policies, procedures, and standards.
c. Assisting in the development of governance structures, roles, and accountability mechanisms.
d. Supporting the creation or refinement of data inventory and data mapping processes.
e. Advising on data minimization, purpose limitation, retention, and records management practices.
f. Assisting with development of privacy metrics, reporting mechanisms, and continuous improvement plans.
2. Privacy Impact Assessments (PIAs) and Risk Assessments
The awarded Offeror shall provide expertise in planning, conducting, and documenting PIAs and related risk assessments for high-risk or sensitive systems, including but not limited to a Real Time Crime Center.
Services may include:
a. Designing or refining PIA templates tailored to the City’s needs.
b. Facilitating stakeholder interviews and workshops.
c. Evaluating system architecture, data flows, data sharing arrangements, and vendor involvement.
d. Assessing compliance with applicable Utah state laws and relevant federal laws.
e. Identifying privacy, civil liberties, and ethical risks.
f. Evaluating transparency, notice, consent (where applicable), and public accountability considerations.
g. Providing written reports that include risk ratings and prioritized mitigation recommendations.
h. Assisting in drafting public-facing summaries, where appropriate.
i. The PIA for the Real Time Crime Center may include review of technologies such as video surveillance systems, automated license plate readers, analytics tools, data aggregation platforms, and information-sharing systems.
3. Technology and Vendor Review Support
At the request of the CPO, the awarded Offeror may:
a. Review proposed technologies or systems for privacy risks.
b. Evaluate vendor privacy and security documentation.
c. Recommend contract language or privacy controls for inclusion in procurement documents.
d. Assess data sharing agreements and intergovernmental arrangements for privacy compliance.
4. Training and Awareness
The awarded Offeror may assist in:
a. Developing or refining privacy training materials for City employees.
b. Providing subject matter expertise for targeted training sessions (e.g., public safety personnel, IT staff, leadership).
c. Advising on strategies to build a culture of privacy within the organization.
5. Advisory Services
The awarded Offeror shall serve as an on-call advisor to the CPO for complex or sensitive privacy matters, including:
a. Interpretation of applicable legal and regulatory requirements.
b. Incident response consultation from a privacy perspective.
c. Advising on public communications related to privacy issues.
d. Supporting responses to inquiries or oversight related to privacy practices.
6. Deliverables
Deliverables may include, but are not limited to:
a. Annual privacy maturity assessment reports.
b. Updated or newly developed privacy policies and procedures.
c. Completed Privacy Impact Assessment reports.
d. Risk assessment summaries with mitigation recommendations.
e. Training materials or presentation content.
f. Written memoranda addressing specific privacy questions or issues.
g. Executive briefings or presentations to City leadership, as requested.
All written deliverables provided by the awarded Offeror shall be clear, concise, and suitable for review by City leadership and, where applicable, public disclosure.
7. Coordination and Reporting
The awarded Offeror shall report directly to the Chief Privacy Officer or designee. Work shall be authorized through written task orders, purchase orders, or similar written direction. No minimum amount of work is guaranteed.
The awarded Offeror shall:
a. Participate in periodic planning and status meetings.
b. Provide progress updates as requested.
c. Coordinate with City departments, IT personnel, legal counsel, and public safety leadership, as appropriate.
File details come from the government source that posted it. Updated .