Explanation
BACKGROUND: This legislation authorizes a temporary waiver of certain of the competitive bidding provisions of Chapter 329 of the Columbus City Codes which require, in part, (1) the City’s bidding documents include the city agency’s needs, requirements and all contractual terms and conditions applicable to the procurement; (2) the City to advertise such procurements for, at a minimum, twenty-one (21) calendar days prior to submission deadline; and (3) the City’s requirement to publicly open all bids specifically Sections 329.18(a)(1), 329.18(a)(2), 329.18(a)(5), 329.18(b)(1), 329.18(b)(2), 329.18(b)(5), 329.18(d)(2), 329.18(d)(4), 329.18(d)(5), 329.22(a), 329.23(A)(a), 329.23(A)(b), 329.23(A)(c), 329.23(B)(a), 329.23(B)(b), 329.23(B)(c), 329.27(b)(2), 329.27(c), 329.28(b)(2), and 329.28(c). The waiver is with respect to various solicitations expected to be processed by or on behalf of the Department of Technology and the Department of Finance and Management’s Construction Office between the time of passage of this Ordinance and December 31, 2026. The Department of Finance and Management, the Department of Technology, and the City Attorney’s Office are working together on amendments to Chapter 329 of the Columbus City Codes to present to Council later this year with the goal of permanently addressing the need to allow for a different solicitation process for certain products and services that are necessary to the operation of the Department of Technology in response to the recent cybersecurity requirements for public entities found in Ohio Revised Code (ORC) Section 9.64. If those Code amendments are not completed prior to the end of 2026, waiver of the above-described competitive bidding provisions of Chapter 329 will be sought again prior to the expiration of the waiver authorized by this Ordinance.
This waiver would apply only to technology/cybersecurity procurements and construction procurements relating to sensitive security and/or infrastructure related information for which the Department of Technology and the Department of Finance and Management is permitted, pursuant to ORC Section 9.64, as discussed below, to limit the provision of certain information to only a select group of self-indicated, interested vendors who agree to enter into Non-Disclosure Agreements. Such procurements shall be discussed and coordinated with the Department of Finance and Management and/or the City Attorney’s Office, depending on the type of procurement, to verify that each procurement qualifies for the limitations described in ORC Section 9.64 and the bid waiver authorized by this Ordinance.
The Department of Technology regularly conducts procurements for technology infrastructure, cybersecurity tools, software, cloud services, storage, remediation services, consulting, and related operational support necessary to maintain secure and reliable City operations. In certain procurements, the City may need to disclose technical information during the solicitation process, such as system architecture, infrastructure layouts, network configurations, security requirements, operational dependencies, implementation methods, or other details that could create unnecessary risk if broadly released.
Additionally, the City must consider the intent and requirement of ORC Section 9.64, which recognizes the need to protect certain cybersecurity and infrastructure-related information from inappropriate disclosure.
While the City remains committed to open and competitive procurement practices under Columbus City Codes Chapter 329, traditional public bid processes were not designed for modern procurements involving sensitive cybersecurity or infrastructure-related information. In some instances, unrestricted publication of all technical specifications or supporting materials may expose information that could be misused to target City systems, disrupt operations, or compromise public services.
Accordingly, the Department of Technology and the Department of Finance and Management request temporary authority, via bid waiver, to use a controlled-disclosure procurement process for qualifying technology-related procurements. Under this approach, the City would continue to publicly advertise and competitively solicit vendors, while certain sensitive, supporting information would only be shared with interested vendors that execute a City-approved Non-Disclosure Agreement (NDA) and satisfy applicable procurement requirements. All self-indicated, interested vendors who satisfy applicable procurement requirements would be invited to enter into the NDA related to the applicable solicitation in order to move to the next phase of the procurement process. Then, additional, sensitive information pertinent to the procurement would be provided by the Department of Technology or the Department of Finance and Management to those particular vendors, final proposals would be submitted via a sealed process, and an evaluation process that meets the requirements of Chapter 329 would follow.
This temporary bid waiver would serve as an interim solution while the longer-term amendments to Chapter 329 mentioned above are evaluated to better address cybersecurity-sensitive technology procurements.
The requested authority would help the City:
• Preserve fair and competitive vendor participation
• Protect sensitive infrastructure and cybersecurity information
• Avoid procurement delays for critical technology needs
• Maintain operational continuity and resiliency
• Align City procurement practices with evolving cybersecurity obligations and risk management needs.
Fiscal Impact: None.
Emergency action is requested in order to begin certain time-sensitive procurements as soon as possible, using a controlled-disclosure procurement process for qualifying technology-related procurements, while maintaining competitive procurement practices.
Title
To waive the provisions of Sections 329.18(a)(1), 329.18(a)(2), 329.18(a)(5), 329.18(b)(1), 329.18(b)(2), 329.18(b)(5), 329.18(d)(2), 329.18(d)(4), 329.18(d)(5), 329.22(a), 329.23(A)(a), 329.23(A)(b), 329.23(A)(c), 329.23(B)(a), 329.23(B)(b), 329.23(B)(c), 329.27(b)(2), 329.27(c), 329.28(b)(2), and 329.28(c) of the Columbus City Codes that are in conflict with ORC Section 9.64 to allow for a controlled-disclosure procurement process for qualifying technology-related procurements; and to declare an emergency. ($0.00)
Body
WHEREAS, traditional public bid processes were not designed for modern procurements involving sensitive cybersecurity or infrastructure-related information, as contemplated by ORC Section 9.64; and
WHEREAS, the Department of Technology, in consultation with the Department of Finance and Management and the City Attorney’s Office, desires to use a controlled-disclosure procurement process for technology-related procurements that involve sensitive cybersecurity or infrastructure-related information, while maintaining as open and competitive a bidding process as possible; and
WHEREAS, the Department of Technology and the Department of Finance and Management plan to use a phased approach to such procurements where, in response to a publicly-issued invitation to bid describing the products and/or services needed, all self-indicated, interested vendors who satisfy applicable procurement requirements would be invited to enter into the NDA related to the applicable solicitation in order to move to the next phase of the procurement process; then, additional, sensitive information pertinent to the procurement would be provided by the Department of Technology or the Department of Finance and Management to those particular vendors, final proposals would be submitted via a sealed process, and an evaluation process that meets the requirements of Chapter 329 would follow; and
WHEREAS, it is necessary that City Council waive the provisions of Sections 329.18(a)(1), 329.18(a)(2), 329.18(a)(5) 329.18(b)(1), 329.18(b)(2), 329.18(b)(5), 329.18(d)(2), 329.18(d)(4), 329.18(d)(5), 329.22(a), 329.23(A)(a), 329.23(A)(b), 329.23(A)(c), 329.23(B)(a), 329.23(B)(b), 329.23(B)(c), 329.27(b)(2), 329.27(c), 329.28(b)(2), and 329.28(c) of Columbus City Codes until December 31, 2026 to allow for the above-described controlled-disclosure procurement process for certain qualifying technology-related procurements; and
WHEREAS, all such procurements shall be discussed with the Department of Finance and Management and/or the City Attorney’s Office, depending on the type of procurement, to verify that each procurement qualifies for the limitations described in ORC Section 9.64 and the bid waiver authorized by this Ordinance; and
WHEREAS, an emergency exists in the usual daily operation of the Department of Technology in that it is immediately necessary to authorize the waiver of the provisions of Sections 329.18(a)(1), 329.18(a)(2), 329.18(a)(5), 329.18(b)(1), 329.18(b)(2), 329.18(b)(5), 329.18(d)(2), 329.18(d)(4), 329.18(d)(5), 329.22(a), 329.23(A)(a), 329.23(A)(b), 329.23(A)(c), 329.23(B)(a), 329.23(B)(b), 329.23(B)(c), 329.27(b)(2), 329.27(c), 329.28(b)(2), and 329.28(c) of Columbus City Codes in order to begin certain time-sensitive procurements as soon as possible using a controlled-disclosure procurement process for qualifying technology-related procurements, while maintaining competitive procurement practices, all for the immediate preservation of the public health, peace, property, safety and welfare; NOW, THEREFORE,
BE IT ORDAINED BY THE COUNCIL OF THE CITY OF COLUMBUS:
SECTION 1. That the based upon the explanations described in the background and the recitals (which are fully incorporated herein), Council finds it is in the best interests of the City to waive the provisions of Sections 329.18(a)(1), 329.18(a)(2), 329.18(a)(5), 329.18(b)(1), 329.18(b)(2), 329.18(b)(5), 329.18(d)(2), 329.18(d)(4), 329.18(d)(5), 329.22(a), 329.23(A)(a), 329.23(A)(b), 329.23(A)(c), 329.23(B)(a), 329.23(B)(b), 329.23(B)(c), 329.27(b)(2), 329.27(c), 329.28(b)(2), and 329.28(c) of Columbus City Codes that are in conflict with ORC Section 9.64 and to allow for the above-described controlled-disclosure procurement process to be used for certain qualifying technology-related procurements.
SECTION 2. That such waiver shall expire on December 31, 2026 or may expire sooner should the Department of Finance and Management report to Council that Chapter 329 of the Columbus City Codes has been amended to reflect the above-described controlled-disclosure procurement process for certain qualifying technology-related procurements.
SECTION 3. That for reasons stated in the preamble hereto, which is hereby made a part hereof, this ordinance is hereby declared an emergency measure and shall take effect and be enforced from and after its passage and approval by the Mayor, or ten (10) days after passage if the Mayor neither approves nor vetoes the same.