RFI Fire Investigation Reporting Management System FINAL.pdf

New York State Division of Homeland Security and Emergency Services

Office of Fire Prevention and Control

Request for Information (RFI)

Fire Investigation Reporting Management System

Issued: 10/22/2026

Responses Due: 11/19/2026

RFI Fire Investigation Reporting Management System

Purpose

The New York State (NYS) Division of Homeland Security and Emergency Services (DHSES), Office of Fire Prevention and Control (OFPC) is seeking information and collecting input from interested parties regarding a Fire Investigation Reporting Management System (FIRMS) in preparation of a Request for Proposals (RFP) or an Invitation for Bid (IFB).

DHSES’s goals in issuing this RFI are to:

• Identify available systems capable of supporting the creation, preparation, review, approval and completion of fire investigation reports, including standardized templates, integration of supporting documentation, report revision tracking, supervisory review, case status monitoring, and secure distribution and export of completed reports.

• Evaluate modern technologies and industry capabilities, including cloud-based, on-premises, and hybrid solutions, that can improve use, operational efficiency, mobile access, and administrative oversight. Understand current industry standards and best practices related to report accuracy and completeness, document integrity, version control, audit trails, access controls, records retention, cybersecurity, privacy, and data governance.

• Assess interoperability and integration capabilities with existing and future State and local systems, identity-management environments, mobile devices, investigative or case management systems, and other technologies used to capture incident information and incorporate supporting documentation into fire investigation reports. Identify capabilities for organizing and retrieving reports, associated reports with cases or incidents, tracking assignments and review status, monitoring completion timelines, and providing dashboards, performance measures, and authorized access to historical reports.

• Evaluate opportunities for responsible automation and artificial intelligence to assist with report drafting, transcription, completeness checks, consistency review, redaction, workflow routing, and performance analysis while maintaining investigator accountability, human review, document integrity, security, and audit trails.

• Understand scalability and long-term system requirements, including increasing report volumes, concurrent users, retention of reports and supporting documentation backup, disaster recovery, business continuity, and technology lifecycle considerations.

• Identify implementation requirements and potential challenges, including migration of existing reports, and case data integration, connectivity cybersecurity, user adoption, training, configuration, validation, internal staffing, maintenance, and vendor support.

• Obtain information regarding available pricing and licensing models and the primary factors affecting initial implementation and total cost of ownership.

• Identify limitations, risks, dependencies, vendor lock-in concerns, and exit-strategy considerations, including the ability to export reports, supporting documentation and workflow histories in usable formats.

• Identify potential challenges associated with system development or customization, including report templates, required data fields, review and approval workflows, integration, and ongoing maintenance related to system development or customization.

• Obtain recommendations for functional requirements, implementation milestones, and acceptance testing for fire investigation reporting capabilities.

• Understand how available systems support the scientific method, investigative findings, analysis, and conclusions consistent with National Fire Protection Association (NFPA) 921 and reporting activities associated with the professional qualifications addressed in NFPA 1033.

THIS IS A REQUEST FOR INFORMATION (RFI) ONLY. This RFI is issued solely for information and planning purposes - it does not constitute a Request for Proposal (RFP) or an Invitation for Bid (IFB) or a promise to issue an RFP or an IFB. This RFI does not commit DHSES, or the Office of Fire Prevention and Control to contract for any supply or service whatsoever. Vendors are advised that DHSES will not pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the interested party’s expense. Not responding to this RFI does not preclude participation in any future RFP or IFB, if any are issued.

Background

OFPC is seeking information regarding potential solutions for a Fire Investigation Reporting Management System environment to be utilized by OFPC’s Fire Investigations Branch. OFPC conducts, supports, and coordinates fire investigations throughout New York State. These investigations may involve complex incidents with multiple investigators, collaborating agencies, diagrams, interviews, laboratory findings, and other forms of extensive investigative documentation. The resulting investigative records must be accurate, secure, complete, and capable of supporting administrative, regulatory, civil, and criminal proceedings.

OFPC is evaluating opportunities regarding commercially available fire investigation report writing and case management systems capable of supporting the full investigative case lifecycle. The contemplated system would provide the capacity and capability to effectively collect, preserve, organize, retrieve, manage, and share (when authorized) digital investigative reports in a manner meeting OFPC’s current and future needs as collection platforms, applications, and processes continue to evolve.

Ultimately, the goal is to utilize a system that improves operational and administrative efficiency and effectiveness, is easy to use, secure, provides mobile access, allows access to historical information, provides scalable tools for managing, auditing, and generating investigating reporting and aligns with industry best practices while meeting current and future fire investigative reporting and case management requirements.

The State recognizes that available solutions may include cloud-hosted, on-premises, hybrid, or other architectures. Respondents should not assume that a single existing technology, storage architecture, workflow, or reporting source will define the future environment.

The following capabilities are intended to support market research and should not be interpreted as final mandatory specifications. Respondents should identify whether each capability is native, configurable, available through integration or an optional module, under development, or not currently supported.

Fire Investigation Reporting Management System (FIRMS) must provide an integrated platform capable of the following:

• Fire Investigation and Case Management

The system must provide a centralized platform for authorized users to create, assign, manage, track, and retain fire investigation reports of varying size and complexity throughout the complete lifecycle. This must include initial case creation, investigator assignment, scene activity, report preparation, supervisory review, approval, closure, reopening, and final retention.

The system must support concurrent investigations, multiple investigators, multiple organizational units, and investigations involving more than one jurisdiction. Each investigation must have a unique case number and configurable fields for recording incident information, responsible jurisdiction, assisting agencies, assigned personnel, investigation type, priority, current status, significant dates, fatalities or injuries, estimated property loss, and applicable incident identifiers.

The system must provide real time visibility into case assignments, investigative progress, outstanding requirements, report status, supervisory review, approval, and closure.

Authorized users must be able to associate related incidents, supplemental investigations, persons, properties, vehicles, responsible parties, fire service agencies, law enforcement agencies, and other relevant records with a case.

• Investigative Report Development and Documentation

The system must support the creation of standardized, professional fire investigation reports consistent with OFPC approved policies and the scientific framework principles for fire and explosion investigations contained in the current edition of NFPA 921 and other applicable standards. The system should support that methodology without independently determining the origin or cause.

The system must provide configurable report templates, structured data fields and narrative sections, checklists, supplemental reports, and agency approved terminology. At a minimum, report functionality should accommodate:

• Incident and property information.

• Scene description and examination.

• Building and occupancy information.

• Fire protection and detection systems.

• Weather and environmental conditions.

• Witness and involved party information.

• Interviews and statements.

• Fire patterns and fire behavior observations.

• Area and point of origin.

• Potential ignition sources.

• Hypotheses considered, tested, supported or eliminated.

• Origin and cause classification and supporting analysis.

• Fatalities, injuries, and property loss.

• Investigative findings, conclusions, and recommendations.

• Investigator certification of investigative conclusions and supervisory review and approval.

The system must support spell checking, configurable required fields, control, terminology, standardized selections, narrative formatting, auto-population, recurring information, version control, and identification of incomplete or inconsistent information before submission.

The system must allow authorized users to attach appropriate supporting documents or securely link the report to evidence maintained in the separate digital evidence management system. The system should not require unnecessary duplication of original reporting files.

• Investigation Records Search, Organization, and Retrieval

The system must provide efficient search and retrieval across active, closed, and authorized historical investigation records. Search functionality should include case number, date range, incident address, municipality, county, investigator(s) assigned, agency or agencies involved, property owner, involved persons, fire classification, origin, and cause factors and determination, ignition source, casualty status, case status, and other configurable fields.

The system should support full-text narrative searches, saved searches, filters, sorting, tagging, indexing, and authorized cross-case analysis. Search results must respect the user's assigned role, organizational unit, jurisdiction and record-access permissions.

The system must support standardized naming, classification, case association, duplicate record identification, and bulk metadata operations where authorized. Records must remain retrievable throughout their required retention, including after software upgrades, data integrations, or changes in the organization structure.

• Workflow, Task Assignment, Review Approval, and Case Closure

The system must provide configurable workflows reflecting OFPC’s investigation, supervisory, administrative and report approval processes. Authorized supervisors must be able to assign or reassign cases and tasks, establish priorities and due dates, identify primary and assisting investigators, and monitor workload and completion status. The system must support automated notifications and reminders for new assignments, approaching deadlines, overdue reports, incomplete required fields, returned reports, requested corrections, pending approvals, and other contributable workflow events.

The system must document submission, review, return, revision, approval, closure, and reopening actions. Supervisors should be able to provide comments or correction requests without altering the investigator’s original narrative. Final reports must be protected against unauthorized modification, while authorized supplemental reports or formally documented amendments may be added after approval.

• User Roles, Security, Access Controls, and Audit History

The system must provide role-based access controls, configurable user roles and permissions, least-privilege administration, privilege-user controls, and appropriate separation of duties. The system must support multiple agencies, organizational agreements, readings, and geographically distributed users. Access should be configurable based on job responsibility, assigned investigation, organization unit, jurisdiction, supervisory authority, and record sensitivity.

The system must support multi-factor authentication, single sign-on, identity-management integration, account provisioning and deprovisioning, password and session controls, and periodic user-access review where required. Audit records must identify the user, date and time, action performed, affected record, and, where technically feasible, the previous and revised values. Audit records must be protected from unauthorized alteration or deletion.

• Interagency Collaboration and information Sharing

The system must support secure collaboration among authorized State personnel, regional offices, local fire departments, law-enforcement agencies, prosecutors, laboratories, regulatory agencies, and other approved investigative partners and allow the lead agency to grant case-specific, time-limited, and role-appropriate access without providing access to unrelated investigations. Collaboration capabilities may include task assignment, secure comments, document review, report contribution, requests for information, and tracking of participating agencies.

The system must support controlled disclosure or export of authorized investigation records. Sharing functions should include configurable expiration dates, authentication, download restrictions, watermarks where appropriate, and audit logging, and should provide capabilities for review, annotation, redaction, and production of disclosure copies without changing the authoritative investigation record. Redacted or derivative copies must be clearly identified and maintained separately from the original approved report.

• Mobile and Filed Based Investigations Capabilities

The system must provide a secure, functional, and user-friendly mobile interface for authorized personnel conducting investigations in the field. The interface should support case creation, assignment review, structured data entry, narrative notes, interviews, checklists, location information, diagrams, and other approved field activities and support the capture or authorized attachment of photographs and documents when permitted by agency policy.

If original evidentiary media will be maintained in the separate Digital Evidence Management System (DEMS), the system should support secure transfer or linking to that system and retain the related DEMS identifier within the investigation record.

The mobile system should support limited-connectivity or offline environments, local draft saving, resumable synchronization, and controls to prevent duplicate or conflicting records. Locally stored information must be encrypted, protected, synchronized, and removed from the device following successful transfer and include appropriate device, application, authentication, timeout, and session-security controls, including the ability to revoke access from lost, stolen, or deauthorized devices.

• Data Analytics, Dashboard, and Administrative Reporting

The system must provide configurable dashboards, reports, analytics, and supervisory tools that present current and historical information according to the user’s authorization level. Authorized administrators must be able to configure dashboards, fields, filters, date ranges, calculations, and scheduled reports without requiring extensive vendor programming and support export of authorized reports and data in commonly used nonproprietary formats. Personally identifiable, law enforcement sensitive, or otherwise restricted information must be excluded, masked, or aggregated when appropriate.

• Records Retention, Archiving, and Legal Holds

The system must support configurable retention schedules, archival requirements, legal or administrative holds, disposition review, approval controls, and documented destruction or deletion consistent with applicable New York State Archives schedules and agency-specific records disposition authorizations. New York State Archives defines a retention schedule as establishing the minimum period for which a record must be maintained and what occurs after that period.

The system must generate reports and alerts concerning retention status, pending disposition, legal holds, archived records, exceptions, and completed dispositions. No record should be automatically destroyed solely because a retention period has elapsed;

disposition must follow the State’s authorized review and approval process.

• System Integration and Data Exchange

The system must provide documented Application Programming Interfaces (APIs) or other secure integration methods for exchanging authorized information with existing and future federal, State, local, and agency systems and should support import and export using standard, nonproprietary formats and preserve applicable field definitions, identifiers, relationships, dates, audit information, and record status. Integration with the DEMS should permit an authorized user to link an investigation record to evidence stored in the

DEMS, display appropriate identifying information, and retrieve the evidence through authorized access without unnecessarily duplicating the original file.

• Hosting, Availability, Backup, and Disaster Recovery

OFPC will consider any available hosting architectures, including State-hosted, vendor-hosted, cloud-hosted, and hybrid options, as applicable. OFPC seeks to identify data locations, hosting providers, subcontractors, logical data segregation, administrative-access arrangements, and the division of security responsibilities among the State, vendor, hosting provider, and subcontractors and support the anticipated number of investigations, concurrent users, attached records, integrations, and future growth without material loss of performance. Backups must be protected from unauthorized alteration or deletion and must not circumvent applicable retention, security, or legal-hold controls.

• Automation and Artificial Intelligence (AI)

The system may support AI-assisted capabilities, including transcription, document classification, search, summarization, narrative assistance, data-quality review, workload prioritization, redaction assistance, or analytics. AI will not independently determine fire origin, fire cause, criminal responsibility, investigative conclusions, case closure, or final report approval. All substantive investigative findings must remain the responsibility of qualified personnel.

• Implementation, Configuration, Training and Technical Support

The system will require administrator, supervisor, investigator, report reviewer, and end-user training. Training should include initial instruction, written and electronic materials, user guides, system administrator documentation, new-user onboarding, refresher training, and training following significant system updates. The system will also require ongoing maintenance and support services, methods for submitting issues, severity levels, response and resolution targets, escalation processes, system monitoring, planned maintenance, software updates, security patches, release communications, and assigned support resources.

• Product Viability, Data Ownership, Exit Strategy, and Portability

All State investigation data, reports, attachments, configuration information, and associated metadata must remain the property of the State.

The system must allow the State to retrieve its complete data set upon request and upon contract expiration, termination, system replacement, or vendor transition. Exported information should include investigation records, report versions, attachments, relationships, user-defined fields, workflow status, comments, approvals, audit histories, retention designations, and legal-hold information.

Measures are needed to reduce vendor lock-in. State access to its records must continue during an orderly transition.

Guidance to Respondents

OFPC may use information obtained from responses to this RFI to make programmatic decisions and/or to develop a competitive procurement such as an RFP or IFB.

Any content that is proprietary and/or confidential must be clearly marked as such in the response. Failure to mark content as proprietary and/or confidential may result in its disclosure in the event a response is the subject of a Freedom of Information request under Public Officers Law Section 87. In any event, DHSES will determine, in its sole discretion, appropriate FOIL disclosure in accordance with Public Officers Law Section

87. All materials submitted by a respondent shall become the property of DHSES and may or may not be returned to the respondent, at the sole discretion of DHSES.

DHSES may issue announcements amending this RFI in response to questions. Any revisions to the RFI will be posted to the New York State Contract Reporter website (http:///www.nyscr.ny.gov).

DHSES may communicate with any and all third parties, about this RFI or otherwise, during the pendency of this RFI and/or following the receipt and consideration of RFI responses. This may be through email exchanges, phone discussions, meetings, demonstrations, and/or correspondence, and may be with an individual respondent, a subset of respondents, or all respondents. As RFI responses are reviewed, DHSES reserves the right to send follow-up clarification questions to respondents of further interest.

Requested Information

Please provide the following information electronically. You may provide the requested information as a completed attachment or in the body of an email.

1. Contact Information:

a. Name of individual responding

b. Name of agency/organization

c. Mailing address

d. Email address

e. Phone number

2. Provide a brief history of your organization and describe your experience developing, implementing, or supporting fire investigation report writing, case management, inspection, incident reporting, or comparable public safety information management systems.

3. Identify software platforms or systems your organization has developed, implemented, or provided that are comparable to the capabilities contemplated by this RFI. Include, where applicable; current development or implementation status, length of time in production, types and sizes of organizations served, number of users, relevant state, federal, municipal, fire service, law enforcement, or public safety experience, and experience supporting statewide or multi-jurisdictional operations; and customer references for comparable implementations.

4. Describe the proposed platform, including its overall architecture, hosting options, principal modules, system requirements, and core operational capabilities. Explain how the platform provides a centralized environment for managing multiple concurrent fire investigations while maintaining detailed, independently identifiable case records across organizational and jurisdictional boundaries. Address the system’s ability to provide authorized personnel with visibility into case status, investigative activity, assignments, deadlines, workload, approvals, and other operational impacts.

5. Describe the platform’s fire investigation report writing capabilities, including, configurable report templates and required fields, narrative development and formatting, supplemental reports, addenda, amendments, and supporting documents, spell-checking, standardized terminology, and data-validation controls, electronic signatures, certification, and report locking; and production of professional final reports suitable for administrative, legal, and court-related purposes.

6. Describe how the platform supports the complete fire investigation case lifecycle, including, case creation and numbering, intake and referral, assignment and reassignment, lead and assisting investigator designations, task and deadline management, investigative notes and activity logs, interviews and witness management, leads, requests, follow-up actions, and referrals, supervisor and peer review, returned reports and required corrections, approval and finalization, case status classifications, reopening and amending closed cases, report distribution, and administrative closure and records retention.

7. Explain how workflows, statuses, approval levels, required fields, and business rules can be configured to reflect the State’s investigative and supervisory processes.

8. Describe how the platform allows users to upload, organize, associate, retrieve, and manage photographs, videos, audio files, diagrams, laboratory reports, correspondence, permits, inspection records, external agency reports, and other supporting case materials. Address supported file types and sizes, metadata capture, indexing, version control, annotations, duplicate detection, links between related records, and the ability to associate a single record with multiple authorized cases without unnecessary duplication.

9. Describe the platform’s architecture and controls for protecting the integrity and authenticity of investigative records. Address encryption, authentication, version histories, audit trails, tamper-evident or immutable activity logging, tracking of record creation, access, modification, review, approval, export, and deletion, protection of original and finalized reports, prevention of unauthorized alteration, disclosure, or deletion, and documentation of amendments made after report approval or case closure.

10. Describe how the platform supports internal and external communications, notifications, alerts, and collaboration. Address case assignments and reassignment notices, task and deadline reminders, overdue report alerts, supervisor and peer review notifications, requests for information or corrective action, communication across agencies and jurisdictions, communication histories and activity logs, and support for email, SMS, and in-application notifications.

11. Explain how workflows, statuses, approval levels, required fields, and business rules can be configured to reflect the State’s investigative and supervisory processes.

12. Describe the platform’s role-based access controls, configurable user roles and permissions, user provisioning and deprovisioning, privileged-user controls, and supervisory and administrative access. Address multi-agency user management, jurisdiction-based restrictions, temporary access, separation of investigative and administrative functions, audit logs of user activity, and the ability to limit access to sensitive, confidential, criminal, personnel-related, or otherwise restricted investigations. Explain how authorized administrators can access and manage current and historical case information without compromising record integrity.

13. Describe the platform’s mobile and field capabilities, including functionality available through smartphones, tablets, laptops, or other authorized devices.

Address case creation and field data entry, investigative notes, photographs, video, audio, and document uploads, voice-to-text or dictation, scene sketches, diagrams, and mapping, interviews and contact information, electronic forms and signatures, assignment and task updates, offline or limited-connectivity operation, synchronization when connectivity is restored, device and session security, accessibility and configurable interfaces, and features intended to reduce user burden and the learning curve.

14. Describe how the platform supports APIs, system-to-system data exchange, and imports and exports using standard formats. Identify capabilities for integration with existing and future federal, state, local, and enterprise systems, including:

identity and access-management environments, computer-aided dispatch and records management systems, National Fire Incident Reporting System/National Emergency Response Information System data environments, where applicable, GIS and mapping platforms, inspection and code-enforcement systems, laboratory or forensic systems, digital evidence management systems, document and records management platforms, data-visualization and business-intelligence tools, email and notification systems, and mobile, camera, or scene-documentation technologies.

15. Describe the platform’s search, reporting, dashboard, and analytics capabilities.

Address full-text and structured-data searches, saved and advanced searches, configurable reports and dashboards, real-time or near real-time information, case volume and status, open and closed investigations, aging and overdue cases, investigator assignments and workload, time from assignment to completion, supervisor and peer-review timelines, fire causes, classifications, contributing factors, and trends, fatalities, injuries, property losses, and geographic patterns, historical and comparative reporting, administrative and supervisory views, scheduled report distribution, and export of data for authorized analysis. Explain whether authorized users can independently configure dashboards, reports, filters, and performance measures without vendor programming.

16. Describe any currently available or planned artificial intelligence, machine-learning, rules-based automation, or decision-support capabilities. Examples may include; transcription and voice-to-text, narrative assistance, automated field population, data quality and completeness checks, identification of contradictory or inconsistent entries, classification and indexing, advanced search and summarization, redaction assistance, duplicate record detection, workflow automation and prioritization, workload monitoring; and identification of patterns or trends across investigations. Describe human-review requirements, audit functions, privacy and security controls, explainability, accuracy validation, and the ability to enable, disable, or restrict individual AI functions. Address whether State information would be retained by an AI provider or used to train vendor or third-party models.

17. Describe how the proposed platform would be implemented to meet the objectives of this RFI. Address implementation methodology and project phases, project governance and staffing requirements, requirements validation and workflow configuration, system configuration and customization, testing, acceptance, and validation, migration of existing investigation records, reports, attachments, and metadata, data cleansing, mapping, reconciliation, and integrity verification, cutover and change management, anticipated implementation timeframe, deployment approach; and methods for minimizing disruption to active investigations and ongoing operations.

18. Describe administrator, investigator, supervisor, and end-user training, including training materials, user guides, system documentation, new-user training, and refresher training. Also describe ongoing maintenance, updates, technical support, system monitoring, issue resolution, service levels, escalation procedures, upgrades, and post-implementation assistance.

19. Describe the platform’s ability to accommodate growth in users, agencies, jurisdictions, investigations, reports, attachments, data volume, file sizes, storage requirements, and concurrent system activity. Address system performance and availability, redundant infrastructure, backup methods and frequency, recovery time objectives, recovery point objectives, disaster recovery testing, service-restoration procedures, data replication and geographic redundancy, scheduled maintenance and notification, continuity during outages or disruptions, and methods for maintaining authorized access to critical investigative information.

20. Provide a summary of available cost structures, packages, licensing models, and associated capabilities. Identify costs related to implementation, configuration, users, storage capacity, data volume, retention periods, migration, API or system integrations, training, technical support, maintenance, archival storage, data egress, professional services, optional modules, AI capabilities, and other one-time or recurring expenses. Explain how costs may change based on changes of the number of users, storage requirements, functionality, or level of service selected.

21. Explain how costs may change based on the number of users, agencies investigations, storage requirements, system functionality, or selected service level. Identify foreseeable technical, operational, cybersecurity, migration, integration, bandwidth, staffing, implementation, legal, records management, and cost challenges or dependencies. Disclose known product limitations and potential vendor lock-in considerations.

22. Describe how State-owned reports, investigative data, attachments, metadata, audit histories, version histories, workflow records, and configuration information can be exported or returned upon contract expiration, termination, or transition to another system. Include available formats, anticipated timeframes, transition assistance, and associated costs. Identify any limits on State access, retrieval, use, copying, or export of its information.

23. Identify emerging technologies, industry developments, capabilities, risks, or other considerations relevant to a statewide fire investigation reporting and case management system that have not otherwise been addressed in this RFI.

24. Provide a summary of available cost structures, packages, licensing models, and associated capabilities. Identify costs related to implementation, configuration, users, storage capacity, data volume, retention periods, migration, API or system integrations, training, technical support, maintenance, archival storage, data egress, professional services, optional modules, AI capabilities, and other one-time or recurring expenses. Explain how costs may change based on changes of the number of users, storage requirements, functionality, or level of service selected.

Questions

Questions regarding this RFI should be submitted via email to procurement@dhses.ny.gov prior to the due date and time noted above. Please submit your question(s) with adequate time for response. DHSES recommends allowing at least five business days. Be sure to put “RFI FIRMS” in the subject line. Late questions may not be addressed. Questions should not contain proprietary or classified information.

Deadline for Responses

All respondents should respond to this RFI with the information requested in the section entitled “Requested Information” no later than the deadline indicated on the first page of this announcement. Responses to this RFI must be made via email.

Method: Send to: Subject Line:

Email procurement@dhses.ny.gov RFI FIRMS mailto:procurement@dhses.ny.gov mailto:procurement@dhses.ny.gov