IT-Scope of Work-RFP.docx

Florida Department of Juvenile Justice Bureau of Information Technology Business Impact Analysis (BIA) and Disaster Recovery Plan (DRP) Development Scope of Work

May 9, 2025

HISTORY:

The State Department of Juvenile Justice (DJJ) plays a critical role in ensuring public safety and youth rehabilitation through secure detention, community-based services, education, and counseling. Given the sensitive nature of juvenile records, The Department of Juvenile Justice (DJJ) is essential for maintaining public safety and promoting youth rehabilitation, which is achieved through secure detention facilities, community-based services, education, and counseling. Due to the sensitive nature of juvenile records, DJJ must have continuous access to case management systems while adhering to legal data protection requirements. Therefore, DJJ requires a thorough Business Impact Analysis (BIA) and a Disaster Recovery Plan (DRP). Uninterrupted access to case management systems and the legal requirements for data protection, DJJ requires a comprehensive Business Impact Analysis (BIA) and Disaster Recovery Plan (DRP).

PROJECT OVERVIEW:

The Department of Juvenile Justice (“the Department”) is seeking proposals from qualified vendors to conduct a comprehensive Business Impact Analysis (BIA) and develop a robust Disaster Recovery Plan (DRP). This engagement aims to identify and prioritize mission-critical functions, assess the potential impacts of business interruptions, and establish an actionable recovery framework that ensures operational continuity following a disruption.

SCOPE:

This scope of work is for the vendor to perform the following: 1) Identify critical business operations and their dependencies. 2) Determine the impact of various disruption scenarios. 3) Establish Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs). 4) Develop a Disaster Recovery Plan (DRP) that aligns with regulatory requirements. 5) Ensure compliance with cybersecurity and business continuity policies. 6) Recommend and document recovery strategies and plans for IT systems. 7) Validate the feasibility of the DRP through simulation or testing. These efforts aim to enhance organizational resilience, identify critical functions, and prepare response strategies for potential disruptions while protecting the agency's and customers' interests. The BIA and DRP should align with the requirements specified in Chapters 60GG-2.001 through 60GG-2.006, F.A.C., known as the State of Florida Cybersecurity Standards (SFCS). (Current chapter 60GG-2001(1)(a), F.A.C). , NIST Cybersecurity Framework (CSF) 2.0 (February 2024)

TERM:

This scope of work will begin on 8/1/2025 or the date the purchase order is issued, whichever is later. It will end at midnight, Eastern Time on February 28, 2026. The State of Florida’s performance and obligation to pay under this purchase order and any subsequent renewal is contingent upon annual appropriation by the Legislature and satisfactory performance of the Contractor.

LOCATION OF WORK:

The worksite for this scope of work is the following location (s):

Department of Juvenile Justice, Office of Administration, Bureau of Technology 2737 Centerview Drive Tallahassee, Fl 32399

CONTRACTOR RESPONSIBILITIES/DELIVERABLES:

A. Business Impact Analysis (BIA)

B. Disaster Recovery Plan (DRP)

requiring improvement.

5. Testing and Validation – Facilitate at least one tabletop exercise or recovery simulation.

6. Final Plan Package – Deliver a complete DRP, including review protocols and update schedules.

C. Deliverable Table

scope, schedule, and communication protocols Week 1

stakeholder input Week 2–3

and systems Week 4-6

assessments, RTO/RPO, and prioritization Week 7-9

architecture Week 10-12

Roles and Responsibilities Client Responsibilities:

· Provide access to key personnel, documentation, and systems.

· Review and approve deliverables in a timely manner.

· Maintain compliance with all CJIS, HIPAA, and state laws.

Consultant Responsibilities:

· Conduct all activities outlined in the scope.

· Maintain confidentiality and data security.

· Deliver high-quality, actionable reports and plans.

· Maintain compliance with all CJIS, HIPAA, and state laws.

Assumptions and Constraints

· Stakeholders will be available for scheduled interviews.

· DR test scope limited to one simulation unless otherwise specified.

· All work will be performed within the continental United States (CONUS).

· The Vendor will have appropriate security clearances if required (e.g., Public Trust, Secret).

· Client will provide access to facilities, documentation, and personnel as needed.

· Any significant changes to scope, resources, or timeline will require a formal Change Order.

Acceptance Criteria

· Final BIA and DRP are approved by Chief Information Officer.

· Deliverables meet the requirements set in this SOW.

· Project completed within agreed-upon timeline and budget.

· DRP must include specific recovery instructions.

· Final approval from DJJ IT and Legal.

Records Retention and Disposal

At the conclusion of the project, the vendor will return or securely destroy all client data and project materials that are not required to be retained by law or contractual obligation. Data destruction will be conducted in accordance with NIST SP 800-88 standards (Media Sanitization Guidelines).

Confidentiality Agreement

All the vendor personnel assigned to the project will sign non-disclosure agreements (NDAs) and undergo agency-required training in information handling procedures prior to accessing sensitive agency data.

Data Handling Requirements

All data collected during the engagement will be encrypted during transit and at rest, utilizing FIPS 140-2 validated encryption modules. The data will be stored on secure systems that are authorized under the applicable Authority to Operate (ATO) standards.

Standards and Compliance

DATA SECURITY AND CONFIDENTIALITY TASK:

The Contractor, its employees, subcontractors, and agents must comply at all times with all Department data security procedures and policies in performing this scope of work, as specified in the Data Security and Confidentiality document attached to the purchase order.