Guide · California special district IT RFP
How to write a managed IT services RFP for California special districts.
A section-by-section guide, a free fillable template and a scoring matrix your board can stand behind
Maybe your IT contract is up and you're not sure where to start. Maybe the board is asking questions, or you inherited a technology setup you're still figuring out. Whatever brought you here, you're in the right place.
Generic business IT procurement doesn't translate to how special districts actually operate, so we wrote the guide we wish our clients had. Take what's useful, share it with a colleague, and reach out if you want to talk it through.
CSDA Business Affiliate
2025 & 2026 CSDA Conference Exhibitor
Trusted partner
California-based team
$ rfp --build
> agency background ✓
> environment inventory ✓
> scoring matrix ✓
$ proposals --compare
> apples to apples
$ board --approve
> documented. defensible.
✓ a better partner, chosen well
Nine sections. One clear decision.
Start here
Special districts aren't businesses.
At some point almost every district ends up here: the current vendor isn't cutting it, the board has questions and someone has to run a competitive procurement. Search for a template and you'll find one built for a startup or a Fortune 500 company.
You operate under the Brown Act, answer to a board, carry public records obligations, and run a mix of aging servers, field operations, permitting software, GIS and a VoIP system nobody fully understands. This guide walks through every section of a well-structured RFP, explains what to include and why, and points you to a free template. Use it and you'll get better proposals, clearer pricing and a selection your board can defend.
Who this guide is for
General managers, assistant GMs, operations managers and board clerks at water districts, recreation and park districts, community services districts, healthcare districts, LAFCOs and other special districts preparing to solicit managed IT proposals.
No technical background needed. If you can describe what your agency does, you can fill out this template.
Why most district IT RFPs miss the mark
Better questions, better proposals.
Most special district IT RFPs share the same gaps. Fix them and the whole process gets easier.
> 01
Thin agency context
A sentence or two about the agency, then a list of services wanted. Vendors can't tailor what they can't see.
> 02
No environment documentation
Without an inventory every vendor guesses at scope, so pricing varies wildly and proposals are hard to compare.
> 03
Borrowed scoring
Evaluation criteria copied from a county procurement that was never designed for a small public agency.
> 04
Missing key questions
Who holds the domain admin credentials? Who owns the backup appliance? Any security incidents in the past two years?
A well-written RFP tells vendors exactly what they're walking into, asks for responses in a consistent format, and gives your agency a scoring framework that produces a documented, defensible decision.
Sections 1–3
Tell vendors who you are, why you're here and what you have.
Section 1
Agency background
Two to four paragraphs on when the agency formed, what it's responsible for, the area and population served, headcount and relevant context. Fifty thousand water customers? Seven park sites? A recent board transition or system migration? Say so. Vendors who understand your agency write better proposals and flag complications early.
Section 2
Purpose and intent
Be honest about why you're going to market: an expiring contract, a board directive, or goals like faster response times, a stronger security posture or a clearer technology roadmap. No need to disparage the incumbent. Describe the partner you want: an extension of your team who understands public agency obligations and can grow with you over a multi-year engagement.
Section 3
Scope of services
The most important section, and where most agencies leave the biggest gaps. Describe the services you need (help desk, on-site support, server and network management, patching, endpoint security, backup and DR, email security, Microsoft 365, VoIP, 24/7 security monitoring and incident response, vendor management, procurement help and technology planning), and name specific systems like a Tyler Technologies ERP, Esri ArcGIS or a billing platform.
Current environment inventory
Document what you have, honestly.
This is what separates a useful RFP from one that generates incomparable proposals. If you don't know something, write "unknown." An honest gap is useful information for a vendor.
> hardware
Hardware
Desktops with approximate age and OS. Laptops with the same detail, noting district-owned vs. hardware-as-a-service and whether they transfer. Servers by quantity, physical or virtual, and role (domain controller, file, application, backup). Mobile devices by make, model and OS, and whether MDM is in place.
> locations
Locations
Every site by name and address, with firewall make, model and ownership, managed switches, wireless access points, any local servers or storage, ISP with circuit type and speed, any failover connection, and the number of users at that site.
> m365
Microsoft 365
Tenant name, license tier (Business Basic, Standard, Premium, E3, E5 or other), licenses purchased vs. assigned, how they're procured (direct, CSP or incumbent), MFA status, SharePoint, OneDrive and Teams usage, and renewal date. If you don't control your own tenant, note it. It's more common than it should be.
> software
Other software
Primary line-of-business applications by name, such as Tyler Technologies, Esri ArcGIS, permitting, billing or asset management, plus any dedicated server or infrastructure dependencies and other daily-use subscriptions.
> voice
Voice & communications
Phone platform and provider, VoIP, landline or hybrid, handsets and extensions, ownership, contract status and expiration, and after-hours or emergency call routing needs. Document routing thoroughly, because it matters a lot to public agencies.
> security
Security & compliance
Endpoint protection platform, where MFA is deployed, any SOC or monitoring service, the date of the last security assessment or penetration test, known incidents in the past 24 months, and compliance requirements like HIPAA or grant-funded obligations.
> access
Access & control
Who holds domain admin credentials, who controls DNS and domain registration, whether the agency has direct access or the incumbent holds them exclusively, the incumbent contract expiration, who owns the backup appliance, and whether you have independent access to the backup console.
Free download
Get the free RFP template.
A fillable template that follows this guide section by section, with placeholder text, instructions throughout and a pre-built scoring matrix your board can use. Share your name, email, agency and phone number and we'll send it to your inbox.
✓ placeholder text & instructions
✓ pre-built scoring matrix
✓ location-by-location network inventory
✓ services checklist
✓ timeline table
✓ vendor qualifications section
✓ submission checklist
Board-ready, without starting from scratch.
Section 4
Vendor qualifications that actually matter.
This section separates MSPs who truly serve the public sector from those who are just expanding their sales territory.
Special district & public agency experience
Ask for current or recent California special district or public agency clients with agency name and type, scope, approximate users and a reference contact (name, title, phone). Special districts have Brown Act, procurement and transparency obligations, small staffs and public-facing continuity needs. A provider new to public agencies has a learning curve your agency pays for.
CSDA Business Affiliate status
Ask whether vendors hold current CSDA Business Affiliate status through the California Special Districts Association. Affiliates have made a formal commitment to the special district community: they understand district governance, attend CSDA and regional conferences and track legislative changes. It's reflected in the scoring matrix.
Technical credentials
Ask for certifications held by staff assigned to your account, such as CompTIA A+, Network+ and Security+, Microsoft 365, AWS or Azure, and ITIL Foundation or higher. A summary list with certification names and approximate staff counts is enough. Individual resumes aren't necessary.
Cybersecurity posture
Ask whether 24/7 SOC monitoring is included, which EDR platform is used, how MFA is deployed and enforced, what incident response looks like (response times and escalation), and whether the vendor carries cyber liability insurance. Security should be built into the service, not offered as optional line items.
Section 5
A default scoring matrix for 100 points.
Adjust weights to fit local priorities. These categories are a balanced starting point for California special district IT procurement.
35 pts
Technical capability & scope response
How completely and specifically the vendor addresses each scope element, the depth of the service model and clarity of support structure. Generic responses that don't reference your environment score lower.
25 pts
Special district & public agency experience
Number and relevance of verified California public agency references, with extra weight for similar size and type. No California public agency experience caps this category at 10 points.
15 pts
Cybersecurity posture
Whether 24/7 SOC monitoring is included, the maturity of endpoint protection and MFA, and incident response quality. No active SOC partnership or equivalent caps this category at 5 points.
10 pts
CSDA Business Affiliate & sector commitment
A flat 10 points for current CSDA Business Affiliate status, recognizing formal commitment to the California special district community.
10 pts
References
Recency, relevance and verifiability. California public agency references get full consideration; private-sector-only references are weighted at 50 percent.
5 pts
Pricing
Total monthly cost relative to scope. Lowest price doesn't automatically win. Flat-rate, all-inclusive pricing should be viewed favorably because it supports the predictable budgeting public agencies need.
Sections 6–9
Timeline, submissions, insurance and legal.
Section 6
Project timeline
List the issue date, written questions deadline, public addendum date, submission deadline with exact time and method, oral presentations if any, anticipated award and contract start. Allow at least three weeks from issuance to submission for a managed IT engagement of this scope.
Section 7
Submission instructions
Specify electronic, physical or both. For physical copies, give quantity, address and sealing and labeling rules. For electronic, give file format, naming convention and the email or portal. Name the contact who confirms receipt. Vendors shouldn't contact board members or staff; all questions go in writing and are answered by public addendum.
Section 8
Insurance requirements
General liability of $1,000,000 per occurrence and $2,000,000 aggregate, workers' compensation at statutory limits, professional liability (E&O) of $1,000,000 and cyber liability of $1,000,000, with the district named as additional insured on general and cyber liability. Cyber liability is often left out of public agency RFPs. Include it.
Section 9
Legal & compliance
Reserve the right to reject any or all proposals and waive irregularities. Proposals become district property and may be disclosed under the California Public Records Act after award. Confidentiality claims must cite the specific CPRA provision and factual basis; blanket designations aren't valid. Require a non-collusion affidavit and conflict of interest disclosure.
The five most common mistakes
What we see in district RFPs, and the fix.
After reviewing managed IT services RFPs from districts across California, these five gaps cause the most trouble.
01
Not documenting the environment
Without an inventory, proposals differ by thousands of dollars a month because every vendor assumed something different. Document what you have.
02
Not asking who owns what
Do you own the backup appliance? Do you have admin credentials to your own systems? Ask in the RFP so you know what transition looks like before you sign.
03
Treating security as an add-on
Antivirus on a scope list isn't a security plan. Ask vendors to describe 24/7 monitoring, incident response and ransomware recovery. Clear answers tell you a lot.
04
Weighting price too heavily
A flat-rate provider can look pricier per month than time-and-materials, but over a three-year contract the math usually inverts. Weight capability, public agency experience and security appropriately.
05
Skipping the transition plan
Every contract ends. Ask how the vendor will hand off, what documentation they'll provide and how they'll cooperate with a successor. The answer says a lot about character.
$ skip --rfp --find-partner
Ready for a better IT partner?
Sometimes you don't need an RFP, you just need the right vendor. Golden Hills IT is a CSDA Business Affiliate serving California special districts with flat-rate managed IT, 24/7 security monitoring and direct access to your support team, no call centers or ticket queues. No obligation on the first call and no pressure on the second.
Golden Hills IT · CSDA Business Affiliate · Managed IT for California special districts in all 58 counties