Cybersecurity Governance, Risk, and Compliance Solution

The Orlando Utilities Commission (OUC) is requesting proposals for implementation of a comprehensive Governance, Risk, and Compliance (GRC) solution to strengthen enterprise risk management across electric and water utility operations, with proposals due August 27, 2026.

The solution must enable OUC to manage risk in a structured, repeatable, and auditable manner. Scope includes system implementation, configuration, data migration, user training, and ongoing support. The solution must be cloud-hosted and comply with mandatory IT security requirements: separation of OUC data from other clients' data; encryption of privileged or private data in transit, in process, and at rest; storage and transmission of OUC data only within North America; regular data backups per OUC specifications; third-party attestation demonstrating compliance with PCI, SSAE 16, or ISO 27001; three-tier user access control at network and application layers; allowance for OUC to conduct penetration testing; and ongoing security and health monitoring. The proposer must notify OUC of any potential or confirmed security breach within four hours of discovery and comply with Florida Information Protection Act breach-notification requirements. All OUC data hosted on the solution is subject to Florida public records law, with no deletion rights for the proposer and continued access and copying rights required for OUC during defined periods following termination or suspension.

The pricing proposal must detail all costs for software licensing, implementation, professional services, training, and post-implementation support. The contract will include a one-year warranty period, mandatory maintenance services for a minimum of five years post-acceptance, and maintenance fee increases capped at no increase during the first three years, with subsequent increases limited to Producer Price Index adjustments and requiring 90-day advance notice. The vendor must maintain workers' compensation insurance at statutory limits, commercial general liability insurance of $2 million per occurrence, and automobile liability insurance of $1 million per occurrence, with OUC listed as an additional insured. OUC retains the right to obtain source code through direct purchase or escrow arrangement triggered by the vendor's insolvency, bankruptcy, business cessation, or unwillingness to maintain the software. The contract is governed by Florida law with exclusive venue in Orange County.

Evaluation criteria focus on technical capability, implementation approach, vendor experience with utility-specific GRC and regulatory compliance requirements, cost-effectiveness, vendor financial stability, references from similar utility implementations, and proposed deployment timeline.