IT-Scope of Work-RFP.pdf

Florida Department of Juvenile Justice Bureau of Information Technology

Business Impact Analysis (BIA) and Disaster Recovery Plan (DRP) Development Scope of Work

May 9, 2025

HISTORY:

The State Department of Juvenile Justice (DJJ) plays a critical role in ensuring public safety and youth rehabilitation through secure detention, community-based services, education, and counseling. Given the sensitive nature of juvenile records, The Department of Juvenile Justice (DJJ) is essential for maintaining public safety and promoting youth rehabilitation, which is achieved through secure detention facilities, community-based services, education, and counseling. Due to the sensitive nature of juvenile records, DJJ must have continuous access to case management systems while adhering to legal data protection requirements. Therefore, DJJ requires a thorough Business Impact Analysis (BIA) and a Disaster Recovery Plan (DRP). Uninterrupted access to case management systems and the legal requirements for data protection, DJJ requires a comprehensive Business Impact Analysis (BIA) and Disaster Recovery Plan (DRP).

PROJECT OVERVIEW:

The Department of Juvenile Justice (“the Department”) is seeking proposals from qualified vendors to conduct a comprehensive Business Impact Analysis (BIA) and develop a robust Disaster Recovery Plan (DRP). This engagement aims to identify and prioritize mission-critical functions, assess the potential impacts of business interruptions, and establish an actionable recovery framework that ensures operational continuity following a disruption.

SCOPE:

This scope of work is for the vendor to perform the following: 1) Identify critical business operations and their dependencies. 2) Determine the impact of various disruption scenarios. 3) Establish Recovery Time Objectives

(RTOs) and Recovery Point Objectives (RPOs). 4) Develop a Disaster Recovery Plan (DRP) that aligns with regulatory requirements. 5) Ensure compliance with cybersecurity and business continuity policies. 6)

Recommend and document recovery strategies and plans for IT systems. 7) Validate the feasibility of the DRP through simulation or testing. These efforts aim to enhance organizational resilience, identify critical functions, and prepare response strategies for potential disruptions while protecting the agency's and customers' interests.

The BIA and DRP should align with the requirements specified in Chapters 60GG-2.001 through 60GG-2.006, F.A.C., known as the State of Florida Cybersecurity Standards (SFCS). (Current chapter 60GG-2001(1)(a), F.A.C). , NIST Cybersecurity Framework (CSF) 2.0 (February 2024)

TERM:

This scope of work will begin on 8/1/2025 or the date the purchase order is issued, whichever is later. It will end at midnight, Eastern Time on February 28, 2026. The State of Florida’s performance and obligation to pay under this purchase order and any subsequent renewal is contingent upon annual appropriation by the

Legislature and satisfactory performance of the Contractor.

LOCATION OF WORK:

The worksite for this scope of work is the following location (s):

Department of Juvenile Justice, Office of Administration, Bureau of Technology

2737 Centerview Drive

Tallahassee, Fl 32399

CONTRACTOR RESPONSIBILITIES/DELIVERABLES:

A. Business Impact Analysis (BIA)

1. Stakeholder Engagement – Conduct interviews, surveys, and workshops with key personnel across all departments.

2. Critical Function Identification – Identify mission-critical business processes, applications, systems, and personnel.

3. Dependency Mapping – Assess and document internal and external interdependencies.

4. Impact Analysis – Evaluate potential impacts across multiple dimensions (e.g., operational, financial, legal, regulatory, reputational).

5. Recovery Objectives – Establish and document RTOs and RPOs for all critical functions.

6. Prioritization – Develop a prioritization matrix for systems and functions based on criticality.

B. Disaster Recovery Plan (DRP)

1. DR Strategy Development – Define technical and operational strategies for recovery of IT systems, applications, data, and infrastructure.

2. Role Definition and Escalation – Outline roles, responsibilities, escalation procedures, and communication plans.

3. DRP Documentation – Develop a detailed, modular DRP aligned with industry standards

(e.g., NIST SP 800-34, ISO/IEC 22301)

4. Gap Analysis – Evaluate existing DR practices and capabilities; identify areas requiring improvement.

5. Testing and Validation – Facilitate at least one tabletop exercise or recovery simulation.

6. Final Plan Package – Deliver a complete DRP, including review protocols and update schedules.

C. Deliverable Table

Deliverable Description Due Date (Tentative)

Project Kickoff Meeting Initial meeting to establish scope, schedule, and communication protocols

Week 1

Stakeholder Interview Summary Documentation of all initial stakeholder input

Week 2–3

Critical Function Inventory List of all critical processes and systems

Week 4-6

Business Impact Analysis Report Detailed report with impact assessments, RTO/RPO, and prioritization

Week 7-9

Disaster Recovery Strategy Draft Proposed DR strategies and architecture

Week 10-12

Disaster Recovery Plan (Draft) Full draft of DRP with documented roles, procedures, and dependencies

Week 13-15

Tabletop Exercise Facilitated simulation with lessons learned summary

Week 16-18

Training and Awareness Materials PowerPoints, handouts, and job aids for staff

Week 19-21

Final Disaster Recovery Plan Final version of DRP with incorporated feedback

Week 22- 24

DRP Maintenance Plan Guidelines for review/update cycles and ownership

Week 25 - 26

Roles and Responsibilities

Client Responsibilities:

• Provide access to key personnel, documentation, and systems.

• Review and approve deliverables in a timely manner.

• Maintain compliance with all CJIS, HIPAA, and state laws.

Consultant Responsibilities:

• Conduct all activities outlined in the scope.

• Maintain confidentiality and data security.

• Deliver high-quality, actionable reports and plans.

• Maintain compliance with all CJIS, HIPAA, and state laws.

Assumptions and Constraints

• Stakeholders will be available for scheduled interviews.

• DR test scope limited to one simulation unless otherwise specified.

• All work will be performed within the continental United States (CONUS).

• The Vendor will have appropriate security clearances if required (e.g., Public Trust, Secret).

• Client will provide access to facilities, documentation, and personnel as needed.

• Any significant changes to scope, resources, or timeline will require a formal Change Order.

Acceptance Criteria

• Final BIA and DRP are approved by Chief Information Officer.

• Deliverables meet the requirements set in this SOW.

• Project completed within agreed-upon timeline and budget.

• DRP must include specific recovery instructions.

• Final approval from DJJ IT and Legal.

Records Retention and Disposal

At the conclusion of the project, the vendor will return or securely destroy all client data and project materials that are not required to be retained by law or contractual obligation. Data destruction will be conducted in accordance with NIST SP 800-88 standards (Media Sanitization Guidelines).

Confidentiality Agreement

All the vendor personnel assigned to the project will sign non-disclosure agreements (NDAs) and undergo agency-required training in information handling procedures prior to accessing sensitive agency data.

Data Handling Requirements

All data collected during the engagement will be encrypted during transit and at rest, utilizing FIPS 140-2 validated encryption modules. The data will be stored on secure systems that are authorized under the applicable

Authority to Operate (ATO) standards.

Standards and Compliance

Fla. Stat. ch. 252 Fla. Stat. ch. 186 CJIS Security Policy ISO/TEC 22301

Fla. Stat. ch. 282 Fla. Stat. ch. 119 NIST SP 800-34 Rev. 1 ISO/IEC 27001

Fla. Stat. ch. 501 State COOP Requirements NIST SP 800-53 HIPAA Rules

ITIL GDPR Florida Digital Standards 60GG-2

DATA SECURITY AND CONFIDENTIALITY TASK:

The Contractor, its employees, subcontractors, and agents must comply at all times with all Department data security procedures and policies in performing this scope of work, as specified in the Data Security and Confidentiality document attached to the purchase order.