RP022_26 INV.pdf

The files

May 20, 2026

REQUEST FOR PROPOSAL

RP022-26

The Gwinnett County Board of Commissioners is soliciting competitive sealed proposals from qualified service providers for the Provision and Implementation of a Laboratory Information Management System on a Multi-Year Contract for the Department of Water Resources.

Proposals must be returned in a sealed container marked on the outside with the Request for Proposal number and Company Name. Proposals will be received until 2:50 PM local time on June 15, 2026, at the Gwinnett County Financial Services - Purchasing Division – 2nd Floor, 75 Langley Drive, Lawrenceville, Georgia 30046. Any proposal received after this date and time will not be accepted. Proposals will be publicly opened, and only names of submitting service providers will be read at 3:00 PM. Please use the link found here to join, or by dialing 1-323-676- 6170. Access Code is: 736 648 12#. Apparent bid results will be available the following business day on our website.

Questions regarding proposals should be directed to Dana Garland, Purchasing Manager at Dana.Garland@GwinnettCounty.com or by calling 770-822-8723, no later than June 2, 2026. Proposals are legal and binding upon the vendor when submitted. One single sided unbound original, five (5) copies, and one (1) electronic copy on a flash drive should be submitted.

Successful service providers will be required to meet insurance requirements. The Insurance Company should be authorized to do business in Georgia by the Georgia Insurance Department and must have an A.M. Best rating of A-10 or higher.

Gwinnett County does not discriminate on the basis of disability in the admission or access to its programs or activities. Any requests for reasonable accommodations required by individuals to fully participate in any open meeting, program or activity of Gwinnett County Government should be directed to the ADA Coordinator at the Gwinnett County Justice and Administration Center, 770-822-8165.

The written proposal documents supersede any verbal or written prior communications between the parties.

Selection criteria are outlined in the request for proposal documents. Gwinnett County reserves the right to reject any or all proposals to waive technicalities, and to make an award deemed in its best interest.

Award notification will be posted after award on the County website, www.gwinnettcounty.com and companies submitting a proposal will be notified via email.

We look forward to your proposal and appreciate your interest in Gwinnett County.

Dana Garland, CPPB, FOII, NIGP-CPP Purchasing Manager https://teams.microsoft.com/meet/241233398734999?p=NFhMCguhcddXgbfDvt http://www.gwinnettcounty.com/

RP022-26 Page 2

Service Provider Name

1.0 Introduction

The Gwinnett County Board of Commissioners (County) is soliciting competitive sealed proposals from qualified service providers for the provision and implementation of a comprehensive Laboratory Information Management System (LIMS) on a Multi-Year Contract for the Gwinnett County Department of Water Resources (DWR). The solution will enhance the County’s Water Resources Laboratory (WRL) management capabilities and grow with its needs.

The WRL is interested in a Software as a Service (SaaS/Cloud) solution. Cloud-based systems must have a proven track record providing LIMS to a laboratory serving large water utilities or similarly complex and comprehensive testing facilities. The system must also provide key features, including regulatory compliance, workflow and sample management, instrument integration, mobile sample tracking, cloud-based accessibility, and quality assurance/quality control features compliant with 40 CFR 136, 141 and 143.

The County intends to award a contract for this proposal to one (1) service provider. There are no expressed or implied obligations for the County to reimburse responding service providers for any expenses incurred in preparing proposals in response to this solicitation. The full cost of proposal preparation and demonstration (if required) is to be borne by the proposing service provider.

Proposals must be signed by a company official who has the authority to commit company resources.

The request for proposal and the successful proposal will become part of a written contract between the County and the proposing service provider. The contract shall be on forms supplied by the County. A sample contract has been included for review by the proposer’s legal counsel.

Finally, all proposed solutions must comply with the Security Requirements (Part V) provided in the solicitation with any exceptions being itemized and explained in detail.

RP022-26 Page 3

2.0 Background and Current Environment

This Section of the request for proposal provides background on the Water Resources Laboratory, and relevant systems in operation in the current environment, as well as the planned future environment.

The DWR distribution system contains 4,110 miles of water pipe, 282,447 meters, and serves approximately one million residents. As the laboratory supporting DWR operations, the WRL is responsible for sampling, testing, and reporting on many aspects of the permits required for the operation of this utility. It is the goal of the WRL to utilize a secure proven information management system to holistically track, report, and maintain data for permit-related requirements.

The County operates and maintains the WRL for analyzing water, wastewater, and stormwater samples. Daily, the WRL conducts chemical analyses and microbial testing. Annually, the WRL performs over 44,000 analyses, totaling over half a million data entry points. This testing is being conducted to comply with the various regulatory laws, such as the Clean Water Act (specifically, National Pollutant Discharge Elimination System (NPDES)) and the Safe Drinking Water Act (SDWA). WRL is currently supported by up to 15 subcontracted specialty laboratories on an as-needed basis.

RP022-26 Page 4

3.0 Scope of Services

3.1 Project Overview

The WRL staff include state-licensed scientists, analysts, interns, quality assurance/quality control staff, and management, totaling nineteen (19) employees. The WRL has two primary testing functions, operating as a state-accredited water microbiological lab and a state-compliant wastewater lab. The County currently utilizes an on-premises version of a LIMS, Accelerated Technology Laboratories Sample Master, Version 10 (v10.5.0.2). This application is critical for the management of daily operations such as work scheduling, inventory, calculations, QA/QC, data entry, archival data, trend analysis, sample preparation logs, sample preparation labels, unique data identifications, audit trail, and instrument management.

The proposed LIMS must be fully capable of immediate (out-of-box) implementation with full functionality except for configuration items. The system should not require service provider customization.

The selected solution will consist of at least the following:

1. All software for a complete and operable system

2. Installation, on-site testing, and startup

3. Warranties, maintenance contracts, and support services

4. Training, including printed materials and an in-person trainer

5. Project management

6. Data migration

7. Instrument parsing setup and support

8. Integration with external solutions that currently support the WRL - electronic integration with Hach WIMS and ARCGIS

9. Mobile capability to document and upload distribution system sampling location data o Geofencing features are considered optional. If offered, the service provider must detail the integration/interactions of this option with WRL operations and the County’s GIS system

It is the expectation of the County that the service provider will implement a fully functional LIMS, including upgrades, integrations with other County and WRL systems, and successful testing within one year of the project start date.

The successful solution will include, and will be evaluated on, not only the software, but also the service provider’s explanation of technical services, ongoing platform hosting and maintenance, implementation plan, and post-implementation support as described in this request for proposal.

The functions listed throughout this proposal should all work together to provide a comprehensive, well-integrated, and scalable solution for the WRL.

3.2 Component Systems

The County expects the service provider to provide all the components necessary for a fully functioning solution - considering each solution component individually, and the collective components working together. The County anticipates that in a proposed solution with components from different sources, the service provider will act as the system integrator and be responsible for

RP022-26 Page 5 overall implementation, any internal interfaces required, testing, training, and maintenance support of the complete solution.

The service provider shall be responsible for ensuring continuity and functionality for all components of the provided solution regardless of the source throughout the contract duration.

RP022-26 Page 6

4.0 Proposal Requirements

The service provider is to submit a written proposal that presents an understanding of the work to be performed. The proposal is to demonstrate and provide evidence that the service provider has the capabilities, professional expertise, and experience to provide the necessary services as described in this solicitation. The service provider is to ensure that all information required herein is submitted with the proposal. An authorized representative of the service provider shall sign the proposal. The proposal must stand alone and include verifiable documentation to support the service provider’s claims. Since a demonstration of the proposed product is not guaranteed, the service provider should not rely on that option to relay relevant information about the proposed solution and should ensure that the solution is adequately described in the proposal.

All service providers should adhere to a standardized technical proposal format outlined in this proposal. Responses must be received in both electronic and written formats. Submit all electronic files on a virus-free USB drive.

Responses are to be adequately detailed for the County to properly evaluate the service provider’s capabilities to provide the required services. However, service providers are encouraged to submit clear and concise responses, and excessive length or extraneous information is discouraged.

Please address the specific issues requested in this solicitation. Submission of excessive “boilerplate” information, including sales brochures, is discouraged. Elaborate brochures or presentations beyond what is needed for a complete and effective proposal will not be considered and are discouraged.

Proposers should not submit website links in lieu of written responses. Website links and any information contained within may not be reviewed or considered by the County. Service providers are to respond clearly and concisely to all questions without referring to preprinted materials (unless the request for proposal specifically requests the service provider to do so) as a response.

RP022-26 Page 7

5.0 Proposal Evaluation Process

The County’s evaluation process will use the criteria outlined in this section to identify the solution that best meets the County’s business and operational needs, is offered at the best value, and is submitted by a service provider with expertise and a proven implementation track record for delivering successful systems. The County reserves the right to reject any or all proposals, in whole or in part, to negotiate changes in the scope of services and to waive any technicalities as deemed in its best interest.

For any sections that have required questions to answer, please label the question with the corresponding number, re-state the question, and then answer it.

Required Proposal Formatting

Part I Responsiveness

This section of the proposal response should be identified as “SECTION 1 – RESPONSIVENESS” and include the items listed below in the order indicated below.

Responsiveness: The service provider’s ability to follow the proposal preparation instructions outlined in this solicitation including the presence of all required pages, required signatures, applicable references, requested documents, etc.

Section 1 of Proposal

a. Include a Cover Sheet as the first page of the proposal response. Include the following at a minimum:

i. Request for proposal number and name.

ii. The company submitting the proposal response (service provider).

iii. Date of submission.

iv. Point of contact (service provider).

b. Table of Contents that includes all major response headings and page numbers. Note:

all pages in the proposal response should be uniquely numbered.

c. Cover Letter should:

i. Be supplied on company letterhead.

ii. Signed by a person with the corporate authority to enter into any contract which results from the proposal.

d. Executive Summary should include:

i. Overview of service provider company and all partners that make up the proposed solution.

ii. List of products/modules that make up the complete proposed solution.

iii. Acknowledgement that service provider has reviewed and understands this RFP and the scope of services to be provided.

iv. Acknowledgement that the service provider has reviewed and understands and can fully comply with all Gwinnett County IT security requirements set out herein.

RP022-26 Page 8

Part II Experience & Qualifications

This section of the proposal response should be identified as “SECTION 2 – EXPERIENCE & QUALIFICATIONS ” and include the items listed below in the order indicated below.

Experience: (Past performance) The service provider is to document their experience providing, installing, maintaining, and hosting a LIMS system of similar or larger size and complexity as requested under this request for proposal. The experience documented should include such factors as quality of work, control of cost, ability to meet time requirements, and ability to meet the objectives of the project. If the proposal reflects a team rather than a single service provider, then experience working as a team should be provided in the proposal. The service provider should use the outline provided below to provide this information.

Qualifications: (Ability to provide the solution) Provide background on the service provider, such as the number of years in business and specialized skills of the staff proposed to support this effort.

The service provider is to provide specific information on the qualifications of the available resources for delivery of the services required under this request for proposal. The service provider should specifically delineate for each major component of the proposal requirements (implementation, data conversion, testing, training, cutover, etc.) whether such resources are locally or remotely located. Independent certifications of the system’s security measures should be provided if available. The service provider should use the outline provided below to provide this information.

Service Provider Identification Information

Identify the prime service provider information and explain if there are any subcontractors, partners, or parties that are part of the proposed solution. This should include the information listed below at a minimum. The prime service provider is solely responsible for the successful implementation and the performance of the service offered under this proposal for the full duration of the contract, regardless of the use of subcontractors or partners.

1. Service provider’s full company name.

2. Service provider’s organizational structure (individual, partnership, or corporation;

private or public; profit or non-profit).

3. If the service provider is a subsidiary of a larger corporate structure, specifically identify primary firm and any affiliates or subsidiaries (if any) that may be involved in providing services under this request for proposal.

4. Service provider’s headquarters location address and telephone number.

5. Service provider’s location address that will be directly responsible for the delivery of the proposed solution to the County.

6. Provide a summary of the service provider’s company history. This should include the information listed below at a minimum.

a. Dates of inception to present

b. Timelines associated with all acquisitions and changes.

Experience and Qualifications

The service provider and all partners that make up the proposed solution will use the response to this section to share information related to experience and qualifications that will be used to

RP022-26 Page 9 evaluate the service provider’s ability and willingness to provide the proposed solution in the manner required by the County. If in-house staff and resources must be supported by subcontractors to accomplish a fully functional solution and hosting services, the service provider must disclose this in their proposal.

1. Provide the following information regarding the service provider’s size.

a. The total number of locations.

i. Include a breakdown of US versus non-US.

b. The total number of full-time technical employees.

i. Include a breakdown of how many at the location serving this project and how many elsewhere.

c. List professional qualifications and specialized experience of the proposed team related to implementing solutions of similar scope and magnitude (most specifically with respect to large organizations and government agencies).

2. If the service provider had a contract terminated for default or unilaterally ended service for a client during the past three (3) years, please disclose it along with the service provider’s position on the matter(s). If the service provider has experienced no such terminations for default in the past, indicate as such.

3. Are there any current or past lawsuits against the service provider’s company by current or former clients specifically related to the performance of the software or security issues?

The LIMS must be an established system, which has been in use for a minimum of three years but is not near the end of its functional life due to outdated software or an emerging company product line. The proposed system must have been installed and operated in at least three laboratories comparable to the WRL for at least 3 years. However, these three installations do not need to be offered as the references required under Part VIII.

Service Provider’s Customers

The service provider must include a list of the service provider’s current customers within the United States who are using the proposed solution. Include the customer’s name, size of the implementation, and years in service.

1. List laboratories serving Governments/Agencies/Utilities that are using the proposed solution.

a. Identify any laboratories supporting a utility serving 500,000 or more residents.

2. List any in the state of Georgia.

3. Identify other installations which are either on-going or proposed to overlap with the timeframe associated to this proposed installation effort that might compete for the respondent’s resources or the resources of any of their proposed support team.

a. Detail how these competing responsibilities will be managed to the betterment of the County’s installation.

RP022-26 Page 10

Part III Water Resources Laboratory System Requirements

Service providers shall indicate how the service provider can satisfy the County’s business needs, specify system requirements, and identify the capabilities available in the proposed solution as defined in this section. This section of the proposal response should be identified as “SECTION 3

– WATER RESOURCES LABORATORY SYSTEM REQUIREMENTS” and include the items listed below in the order indicated below.

In this section, provide specific information including how the features and functions work, the architecture, supportability, and overall robustness of the solution, as well as an overview of the complexity and flexibility of the solution and how scalable it is.

The service provider must clearly demonstrate an understanding of the County’s objectives and vision in the proposed solution and the ability to meet the County’s requirements.

The WRL system requirements of the LIMS are the basic functions that the software application should be capable of performing. Functionality is outlined in Part III, sections 3.1-3.10.

For each of the sections listed below, the service provider should indicate to what level the proposed solution provides the functionality, feature, and use indicated. Service providers should indicate one of the options listed below for each requirement. Failure to do so will result in that requirement being scored as “No – Does not meet”. The service provider’s responses must coordinate with the requirement numbering. Service providers are encouraged to provide as much detail as possible if alternative functionality/capabilities are available that partially or alternatively meet the identified functional requirement.

• YES – Fully meets – the service provider’s proposed solution will provide the described functionality in the system.

• YES – Partially meets – The solution proposed will provide significant portions of the functionality as described - but cannot fully provide the functionality as described -- (provide detail relating how the functionality is and is not met).

• NO – Does not meet – the service provider’s proposed system is not capable of performing the function as listed in the requirement.

3.1 Laboratory Operations – The requirements associated with laboratory operations include, at a minimum:

• Scheduling internal and external sample requests based on turnaround time and holding time

• Sample collection schedule

• Sample receipt

• Unique sample identification

• Chemical solution inventory and monitoring

• Sample tracking with a read-only audit trail

• Sample analysis

• Equipment maintenance, calibrations, scheduling, and documenting

3.2 Offsite/Field Operations – The requirements specific to distribution system sampling (ZONE, Water Quality Parameter, etc.) include, at a minimum:

RP022-26 Page 11

• Secure methods for off-site sample data entry

i. WRL currently has 5 field Samplers

• Integration with mapping applications (ARCGIS, CentralSquare EAM, etc.) (Part IV, Section 4.3)

• Configurable bench sheet creation

3.3 Quality Control – The requirements specific to confirm QA/QC parameters specified by 40

CFR 136, 141 and 143 and Standard Methods version 24 or greater, to address the following areas:

• Legally defensible data - requiring, maintaining, and securing records

• Control chart creation

• Data qualifiers

• Method detection limit monitoring

• Corrective action creation and documentation

• Standard operating procedures

• Branded bench sheet creation

3.4 Laboratory Management – The requirements are specifically related to the following:

• Pre-login of scheduled samples

• Labels for samples and solutions

• Chain of custody - creation and storage

• Assessing productivity

• Instrument data entry

• Electronic bench sheet (upload and print)

• Batch data upload

• Completeness of results

• Supply inventory

• Personnel training/certification

3.5 Monitoring and Control – The requirements specific to monitoring and control require a LIMS to address the following areas:

• Sample tracking and status

• Data validation and approval

• Analytical batch requirements

• Result parameters defined by site and test

• Data archival

3.6 Reporting and Communication – Information is used for regulatory compliance, trending, scientific support, and comparative analysis. The reporting requirements include access to reliable data and communicating information in written, graphical, and electronic formats.

• The County will require reporting that incorporates a table of contents, case narrative, general reporting notes, results, summary of results, detailed results, QC data, blanks, controls, sample custody, and chain of custody.

• The service provider should provide report configuration and report training for the WRL via Crystal Reports/Power BI or a similar application.

• Hach WIMS and CentralSquare EAM will need to access data remotely on demand and at scheduled times.

RP022-26 Page 12

3.7 Data Capture – The LIMS must be capable of the methods of data capture listed below and be capable of being interfaced with the WRL's current instrumentation as listed below. The WRL’s summary of current methods is listed in Table 2 below. The service provider must describe how future instrument acquisitions, by the WRL, during the course of this contract will be connected to and interface with the LIMS. Costs, services provided by the respondent, and limitations related to future connection of new or additional devices should be detailed in the proposal.

• Manual data entry

• Batch upload entry

• Automated instrument entry

• Electronic data imported from external systems

• Excel spreadsheets

• Barcode scanners and barcodes

• Optical scanner

• QR code scanner

Equipment Type Manufacturer and Model

Analytical Balance Mettler PC2000 balance

Total Organic Carbon (TOC) Shimadzu L CSH

Ion Chromatography Metrohm 930 Compact IC Flex

Benchtop Nephelometer Hach TU5200

Spectrophotometer Hach 6000 and Hach 3900 Fluorometer Turner Designs Trilogy Discrete Analyzer Thermo Fisher Scientific Gallery Biochemical Oxygen Demand Skalar BOD Model#21088905-01

Total Phosphorus Spectrophotometer Shimadzu UV-2600i UV-Vis

Microscope Nikon Eclipse Ci Incubator Walk in unit

Table 1: Existing Water Resources Laboratory Instruments

RP022-26 Page 13

Methods currently performed by WRL include but are not limited to the following:

Parameter Method Ammonia, as N SM 4500 NH3-G Nitrate-Nitrate, as N SM 4500 NO3-H Total Kjeldahl Nitrogen (TKN) EPA 351.2 Nitrogen, Organic (TKN-NH3) Calculated: Norg=TKN-NH3 Nitrogen, Total (TKN + NO3/NO2) Calculated: N total=TKN+ NO3/NO2 Total Phosphorus, as P SM 4500-P B.5, SM 4500-P E Oxygen, Dissolved SM 4500-O C/SM 4500-O G Biochemical Oxygen Demand (BOD)/ Carbonaceous Biochemical Oxygen Demand (cBOD)

SM 5210 B

Chemical Oxygen Demand (COD) low range SM 5220 D Chemical Oxygen Demand (COD) high range SM 5220 D Total Organic Carbon (TOC) SM 5310 B Alkalinity SM 2320 B Total Residue (TS) SM2540 B Nonfilterable Residue (TSS) SM 2540 D Volatile Residue (VSS) SM 2540 E Total, Fixed and Volatile Solids (VS) SM 2540 E, SM 2540 G Hydrogen ion (pH) SM 4500-H+ B Specific Conductance SM 2510 B Threshold Odor SM 2150 B Temperature SM 2550 B Turbidity, NTU EPA 180.1

UV-254 SM 5910 B

Fecal Coliform SM 9222 D Fecal Coliform IDEXX Colilert-18 E. coli IDEXX Colilert-18 Micro-exam Manual on the Causes and Control of Activated Sludge Bulking, Foaming, and Other Solids Separation Solids Problems, 3rd Edition.

Chlorophyll A EPA 445 Table 2: Summary of Methods Currently Used by WRL

3.8 Data Export – To facilitate data modeling, manipulation, and reporting, the system shall include the following features:

• A means for exporting data into an SQL database

• Provide the ability to export data in standard file formats (i.e. PDF, CSV, MS Excel, etc.)

3.9 Calculations – The LIMS should include provisions for the definition of mathematically derived fields as test results, and within reports. Additionally, the LIMS must:

• Provide a library of mathematical functions, including advanced functions

• Provide an advanced statistical tool

RP022-26 Page 14

• Allow user-defined functions/calculations

• Allow the manipulation of computations through event triggers

• Generate visual data prompts for data below the detection level

3.10 Data Validation – The LIMS should be capable of multiple levels of data validation.

Specifically, the WRL desires electronic verification of data by the analyst or sample collector for each sample batch. In addition, LIMS should provide an electronic validation step by supervisory staff for each batch of test results. This validation would include:

• Multiple verification statuses (e.g., Pass/Fail, Valid/Invalid, Approved/Not Approved, Questionable, and Arabic numeral). Statuses may be combined for differing scenarios and may be automatically assigned upon data entry

• Multiple limits checking up to ten classifications or ranges

• Changeable limits with maintenance of historical values

• Compliance with laboratory procedures

• Manual annotation and flagging of questioned data and subsequent resolution by analyst or laboratory management

• Automated sample rescheduling

• Communication of verification status to external systems (e.g., automated exception reports)

• Provide the ability to review data before it downloads

3.11 Data Migration – The service provider should assist in data migration by analyzing the WRL’s historical data, identifying existing LIMS data formats, and providing direction in reformatting or additional data population.

RP022-26 Page 15

Part IV Technical System Requirements

This section of the proposal response should be identified as “SECTION 4 –TECHNICAL SYSTEM REQUIREMENTS” and include the items listed below in the order indicated below.

Technical System Requirements: The service provider is to specify how the features and functions work, the architecture, supportability, and overall robustness of the solution, as well as an overview of the complexity and flexibility of the solution and how scalable it is.

The service provider is to clearly demonstrate an understanding of the County’s objectives and vision in the proposed solution and the ability to meet the County’s technical requirements.

The service provider should have a minimum of three years’ experience in providing cloud hosting and implementation services and provide appropriate supporting documentation.

For each of the sections listed below, the service provider should indicate to what level the proposed solution provides the functionality, feature, and use indicated. Service providers should indicate one of the options listed below for each requirement. Failure to do so will result in that requirement being scored as “No – Does not meet”. The service provider’s responses must coordinate with the requirement numbering. Service providers are encouraged to provide as much detail as possible if alternative functionality/capabilities are available that partially or alternatively meet the identified functional requirement.

• YES – Fully meets – the service provider’s proposed solution will provide the described functionality in the system.

• YES – Partially meets – The solution proposed will provide significant portions of the functionality as described - but cannot fully provide the functionality as described -- (provide detail relating how the functionality is and is not met).

• NO – Does not meet – the service provider’s proposed system is not capable of performing the function as listed in the requirement.

The County requires that service provider’s response to this proposal includes a turnkey system configuration necessary to meet the functional and operational requirements of this proposal consisting of items as outlined below:

• Completed solution component diagram and how it will connect the user and County to the cloud-based solution.

• Databases and database management.

• Operating system software required (device, browser, internet speeds, etc.)

• Authentication credentials or sensitive data are not allowed to be stored in the service provider's code.

4.1 Technical Architecture:

• Describe the technical architecture of the solution and how it would be accessible to County users (through a County computer and mobile devices) and by external users or non-users who are interacting with the solution. This must include any, and all bandwidth assumptions and requirements.

RP022-26 Page 16

• The solution is expected to be browser agnostic and backward compatible to all actively supported browser versions. The service provider must ensure that the solution is upgraded and maintained to this specification during its lifetime.

• Provide a complete solution component diagram that shows solution components.

• Solution provider must disclose whether the solution contains an Artificial

Intelligence (AI) or Machine Learning (ML) component o Provide a brief description of how AI or ML is used in the solution and specifically in what features/functions.

o Is the AI/ML usage deterministic (meaning it is rules-based) or probabilistic

(meaning it requires prediction, classification, or pattern detection)?

o What data is required for the AI/ML component to function and will such need be ongoing after implementation?

o AI/ML component must not use any County data containing personal, sensitive, or regulated information.

o The service provider will provide transparency into how the model works and how often it will require retraining.

4.2 Database: The service provider is expected to adhere to all backup and recovery procedures.

Twelve years and 3 months of data must be available to the end user as live data. Older data must be archived. The archived data should be stored as read-only and available to permissioned users within 1 business hour of a formal written request. All active and archived data is to be stored until successfully transferred to the County at the termination of the contract. Service provider is to detail the methods and procedures for achieving these requirements as part of the proposal. Refer to Part V, Section 5.12 and 5.14.

System Interfaces and Integrations

4.3 Third Party Interfaces: The proposed software should support the creation of custom integration flows to automate business processes and synchronize data between different systems. The system should offer multiple mechanisms for integration, including file based data transfer (CSV, XML), Datastream connectivity, APIs, web services, and direct database-to-database connections. Integration options should be scalable and flexible, allowing WRL to expand resources as needed and adapt to evolving business requirements.

• Custom Integration Flows: Ability to create custom integration flows to automate business processes and data synchronization between different systems

• Scalability and Flexibility: Support for scalable and flexible integrations to meet evolving business needs.

• Integrations with:

o WIMS

An automated LIMS report is generated for integration with the Hach WIMS system for data analytics and to prepare summaries and reports to DWR Management and others.

o ArcGIS The County's GIS system stores the infrastructure inventory, including water sampling stations, hydrants, and water mains. The GIS data is used for locating sample sites and stations, and for the routing of sample collection personnel in the field.

LIMS will read geographic information about sampling sites from GIS.

The programs will not modify information contained in the other directly.

RP022-26 Page 17 o CentralSquare EAM (Lucity) The CentralSquare EAM oversees the inventory of water sample stations and coordinates all maintenance activities related to these assets. It acts as a centralized database for requests, work orders, and inspection records associated with the stations. By integrating this inventory with the County’s webmap, the system significantly improves the efficiency of sample collection throughout the County.

o Instruments (see Table 1 – Existing Water Resources Laboratory Instruments) The LIMS should possess the capability to parse from the instrument listed.

Service Provider is to detail the methods and workflow for managing such data transfers for the proposed solution.

o Zebra barcode scanners

The LIMS should possess the capability to interface with the scanner systems to read and create barcodes and labels.

Service Provider is to detail the methods and workflow for managing such data transfers for the proposed solution

4.4 Application Programming Interfaces (APIs): Ensure robust API capabilities to facilitate seamless integration with third-party applications, providing comprehensive documentation, REST and SOAP support, secure authentication and authorization, real-time data exchange, error handling and logging, API rate limiting, and versioning. Any cost associated with an API must be listed in the cost proposal.

• Describe what APIs are available for integration with third-party tools or internal systems

• Describe how plug-ins or modular add-ons are supported for extending functionality

4.5 Standard Integration Flows: List all existing standard interfaces and integrations that are included with the proposed solutions and other productivity tools such as Microsoft Outlook, content management solutions, ERPs, electronic signature solutions etc.

4.6 Mobile Accessibility: Service provider to define functionality, limitations, and security measures of the proposed solution for users interacting with the solution via mobile devices.

Include any known device or software limitations for mobile access. Currently five simultaneous users are projected to require mobile access.

4.7 Documentation: The service provider must provide documentation to support the software, as well as the WRL business processes pertaining to the software. Any solution tools or utilities that are required to tune, test, maintain, or support the systems must be specified in the documentation. Any configuring performed as part of the implementation must be documented and delivered to the County. At a minimum, as applicable, the service provider shall provide the County with the following:

• User documentation

• Configuration documentation

• Interface documentation.

• System administration manuals

• Application software tutorial

• Database setup and maintenance

• System documentation

RP022-26 Page 18

• Documentation for web service/interface definitions

• First level triaging/trouble shooting for agency helpdesk

• Helpdesk supports call escalation process

• Disaster recovery documentation

• Planned system maintenance and upgrade schedules

4.8 Dashboards: Describe the dashboarding capabilities for a basic user. This should include at a minimum:

• Any customization options available to the user - at what permission level.

• What is presented on a default dashboard for different hierarchies of users.

• How does the dashboard integrate and function with existing work tools such as

Microsoft Office 365 and Outlook, etc.

• How does the dashboard utilize user created workflows.

4.9 Reports: The proposed solution must provide reports to support the WRL business processes pertaining to the software. Reports must be consistently formatted per County provided guidelines.

• Describe what standard and configurable reports are available within the proposed solution.

o All information available within the standard reports o How the user would export the report, including formats and file types.

• The County will require reporting that incorporates a table of contents, case narrative, general reporting notes, results, summary of results, detailed results, QC data, blanks, controls, sample custody, and chain of custody.

• Describe how reports can be shared with non-users of the proposed solution.

• Describe how users would request a custom report to be built with the options to run the report i.e. on-demand, scheduled, etc.

4.10 Analytics: Describe the data analysis capabilities, if any, provided by the solution.

• Explain how users can create visualizations such as timelines, link charts, trend graphs and maps from ingested data.

• Does the solution support automated generation of visualization from structured data?

• Describe the support for automated link analysis and explain how linkages update dynamically as new data is added.

o The LIMS must effectively interpret data collected from various laboratory instruments and systematically map this information to the appropriate fields within the application according to a predetermined schedule. This process should include automated updates for new data.

RP022-26 Page 19

Part V Security and Compliance Requirements

This section of the proposal response should be identified as “SECTION 5 – SECURITY AND COMPLIANCE REQUIREMENTS” and include the items listed below in the order indicated below.

Security and Compliance Requirements: The ability of the service provider to clearly demonstrate an understanding of the County’s objectives and vision in the proposed solution and the ability to meet the County’s security and compliance requirements. The service provider shall provide a documented and robust disaster recovery strategy.

The service provider must adhere to the requirements and policies outlined below. The proposed solution(s) must be able to comply and work with the end-point protection and other security requirements of Gwinnett County. The solution provided must be compatible with Microsoft Windows Defender.

For each of the sections listed below, the service provider should indicate to what level the proposed solution provides the functionality, feature, and use indicated. Service providers should indicate one of the options listed below for each requirement. Failure to do so will result in that requirement being scored as “No – Does not meet”. The service provider’s responses must coordinate with the requirement numbering. Service providers are encouraged to provide as much detail as possible if alternative functionality/capabilities are available that partially or alternatively meet the identified functional requirement.

• YES – Fully meets – the service provider’s proposed solution will provide the described functionality in the system.

• YES – Partially meets – The solution proposed will provide significant portions of the functionality as described - but cannot fully provide the functionality as described -- (provide detail relating how the functionality is and is not met).

• NO – Does not meet – the service provider’s proposed system is not capable of performing the function as listed in the requirement.

The system shall incorporate multiple levels of security to allow a supervisory user and several other users with personal profiles. Each user will have privileges based on their level of access. At minimum, it is expected that LIMS will provide separable insert, update, delete, and read-only privileges and will restrict access to individual screens, menu items, tables, reports, data validation/approval, and quality control functions as a function of these profiles. The system must support the collection of “last user/last updated, date/time stamp” information with every database record. The WRL systems administrator should be able to set and modify security permission profiles using simple methods.

5.1 Single Sign-On (SSO)

• SSO Integration: Enable single sign-on integration with existing DWR and County authentication systems using SAML 2.0, OAuth, or other standard protocols to provide seamless and secure access for users.

• Multifactor Authentication (MFA): Compatible with Microsoft Intra (Azure AD).

5.2 Data Security

• Data Security: Implement robust security measures to protect sensitive data.

RP022-26 Page 20 o All data, including archived data, is to be stored in an environment established for government clients. Any vendors proposing a private cloud environment will be required to provide a SOC2 Type2 report attesting that a third-party acceptable to the County has evaluated their application/cloud environment and determined that they are following industry best practices for security and provide an equal level of security.

• Data Storage: Data must be stored in the United States.

• Compliance: Ensure the solution complies with relevant regulations and standards.

• Water Resources Laboratory and Infrastructure Sensitive Data. The service provider must be responsible for securing and protecting all data managed by the solution which may include the following data:

o Compliance monitoring and research data: Any and all results of monitoring for water quality parameters regulated under the Safe Drinking Water Act (SDWA), the Clean Water Act (CWA), or state-specific regulations, and any and all results of monitoring for research purposes.

o Critical infrastructure information: Data pertaining to the specific physical locations of water sampling points, treatment facilities, distribution system components (e.g., intakes, pump stations, storage tanks).

o Safety-related analytical results: Data from investigative analyses conducted to monitor for contamination events, waterborne disease outbreaks, or other public health threats.

o Proprietary methods and procedures: Any analytical methods, processes, or data handling protocols developed by or for the Department of Water Resources.

5.3 Software Updates and Patches

• Transparent communication between the service provider and the county regarding patches, fixes, or upgrades applied to the application before and after installation is complete.

• Service providers must specify their process/method for providing upgrades.

• Provider to coordinate with DWR prior to releasing/pushing updates and patches.

• Service provider shall detail how they will verify upgrades or patches will be verified to protect against impacts to any DWR customizations prior to implementing patches or upgrades.

5.4 Third-Party Subcontractors

• If third-party subcontractors are used for any reason:

o They must adhere to the same security and compliance standards as the primary service provider.

o Their roles and responsibilities must be transparently disclosed.

• All contractual requirements apply equally to service providers and subcontractors.

Cloud Solution Requirements Standards: As part of the proposal response, the service provider shall state the minimum and maximum bandwidth requirements, as well as other permitted ranges of environmental variations necessary for the satisfactory operation of the proposed solution. The service provider should describe any environmental requirements for all recommended and/or proposed components of the proposed solution. This would include the following (if required):

• The latency between Gwinnett County and the service provider’s cloud solution

RP022-26 Page 21

• Transactional response time ranges (numeric) that may be tied to service level agreements (SLAs) or invocation of support-related tickets.

• Documented connection speeds up and down, from the service provider’s cloud solution

5.5 Implementation & Migration

• Service providers must clearly disclose whether subcontracted services are required for solution implementation or data migration.

o If third party support for implementation is required, it must be disclosed in the proposal.

• WRL LIMS database currently occupies 16 GB of storage.

• Any associated costs, timelines, and resource requirements must be documented in the proposal.

5.6 Security & Compliance Certifications

• Service providers must provide a SOC 2 Type II report covering the entire technology stack—excluding inherited reports from infrastructure providers like AWS, Azure, or GCP.

5.7 Personnel & Security Vetting

• Employee Background Checks

• Service providers must perform background checks on employees accessing sensitive

County data.

• Must provide evidence of checks upon request.

• Sensitive data includes:

o Personally Identifiable Information (PII) as defined by Georgia law o Data regulated by PCI, HIPAA, CJIS, or other legal frameworks

5.8 Data Sovereignty & Storage

• Service providers must disclose the geographic location of data storage in the United States.

• Clear policies must be in place for data sovereignty, ensuring compliance with local and federal regulations.

5.9 Authentication & Access Control

• Solutions must support:

o Multi-Factor Authentication (MFA) o Single Sign-On (SSO) via SAML, OAuth, or similar protocols

5.10 Data Segmentation

• County or agency data must be logically or physically segmented from other customers to prevent unauthorized access or data leakage.

5.11 Encryption Standards

• All data must be encrypted.

o At rest using industry-standard encryption (e.g., AES-256) o In transit using secure protocols (e.g., TLS 1.2 or higher)

5.12 Disaster Recovery: Service providers must provide a comprehensive disaster recovery plan, including Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO). The County’s minimum expectations are listed below for these issues.

RP022-26 Page 22

• Recover Time Objective (RTO) of 12 hours after declaration of a disaster.

• Recover Point Objective (RPO) of 4 hours maximum customer data loss.

5.13 Incident Response & Monitoring

• Service providers must maintain a documented incident response protocol, including breach notification timelines and mitigation procedures.

• Service providers and subcontractors must notify Gwinnett County within 24 hours in writing if a security breach involves:

o County-owned data, accounts, or systems o Systems compromised while connected to the County network (including VPN) o Any event reasonably expected to impact WRL Operations, the County’s security posture, or reputation, contact both the Gwinnett County I.T. Department and the Water Resources Lab:

For Gwinnett County ITS: GC-ITSSecurityOPS@gwinnettcounty.com Security Operations Center Hotline: 770-822-8317 (Available 24x7x365) Water Resources Lab: DWRMicrobiology@gwinnettcounty.com Laboratory Main Office: 678-376-4270

• Solutions must include:

o Security event detection o Audit logging with retention policies

5.14 Data Ownership, Retention & Deletion

• The County shall retain sole ownership of all data generated and stored in the proposed solution and any derivative products produced from the data.

• The County will not pay any royalties or fees for use of the data.

• Service providers must define:

o Retention policies for inactive or terminated accounts

• Upon contract termination regardless of reason, the service provider must transfer all data including active and archived data to the County in a form and format specified by the County.

• The Service provider must cooperate with the County to verify transferred data integrity and accuracy prior to deletion.

• Deletion must occur 30 calendar days following written notice from County approving data verification.

Service providers may not share County-owned data (including network diagrams or system information) with third parties…