30-270072-DPH Smartsheet Business Plan Plus Premium Support - IT Sourcing Event

The North Carolina Department of Health and Human Services, Division of Public Health is requesting bids for Smartsheet Business Plan Plus Premium Support with Control Center and Dynamic View applications under IFB 30-270072-DPH, with sealed offers due October 2, 2026 at 2:00 PM Eastern Time. This is a brand-specific procurement — only authorized Smartsheet resellers may bid, and authorization letters from the OEM must be provided within seven days of request or the bid faces rejection. Questions are due September 28, 2026 at 2:00 PM Eastern Time.

The scope includes 50 paid Business Plan users with Premium Support billed annually, up to 500 Dynamic View configurations billed annually, Control Center support for up to 5,000 active projects billed annually, and one-time data migration services from commercial Smartsheet to the government version. The Division is transitioning from its current commercial implementation with no implementation or configuration services anticipated beyond migration.

The contract term is one year, October 23, 2026 through October 22, 2027. Subscription fees in years following the initial year may not increase more than 5% annually unless otherwise agreed. Award will be made to one vendor based on best value analysis using the lowest price technically acceptable source selection method. Payment terms are Net 30 days after receipt of a correct invoice, with a 10% retainage pending final acceptance. Vendors must ensure software access delivery within five consecutive calendar days of receiving the purchase order.

The State classifies this procurement as receiving Restricted data and requires vendors to achieve GovRAMP Authorized status or agree to achieve it within 21 months of contract award. Vendors without current GovRAMP authorization must submit a Security Snapshot Score and enroll in the GovRAMP Progressing Snapshot program. Vendors must comply with North Carolina security standards, NIST 800-53 controls, and encryption requirements for data in transit and at rest. All non-public State data must remain stored and processed within the United States. Vendors must submit disclosure statements regarding work location, corporate structure, E-Verify compliance, and whether any work will be performed outside the United States, plus architectural diagrams detailing network architecture and technology stack.