Nintex Automation K2 Enterprise Upgrade Services

Opportunity for the fixed-price upgrade and migration of Nintex Automation K2 Enterprise, including training and support, for a three-year period in California.

Submit bid online via Vendor Self Service (VSS) portal by the closing date and time
Attach all required documentation and Appendix A forms
Complete and sign all forms labeled in Appendix A
Comply with all applicable Federal, State, and local laws, rules, regulations, ordinances, and directives
Indemnify and hold harmless the County from liability, damages, costs, and expenses related to violations of laws or regulations
Maintain payroll records in accordance with Labor Code Section 1776
Maintain all books, documents, papers, and records related to performance for at least three years
Notify employees of eligibility for Federal Earned Income Credit
Use recycled-content paper (minimum 30% post-consumer waste)
Secure and maintain cyber liability insurance with limits of at least $10,000,000 per occurrence and in aggregate
Add County as an additional insured to cyber liability insurance policy
Ensure subcontractors meet insurance requirements
Not knowingly sell or supply products produced in violation of child labor standards
Certify data and information destruction consistent with NIST SP 800-88
Provide written certification of data destruction within ten business days of removal of electronic storage equipment
Submit a direct deposit authorization request
Comply with the County's Contractor Employee Jury Service Ordinance
Comply with the County Policy of Equity (CPOE)
Comply with fair chance employment hiring practices (California Government Code Section 12952)
Notify County of any pending acquisitions or mergers
Obtain prior written consent from County for assignment or delegation of duties
Maintain a company-wide Information Security Program
Maintain a company-wide Privacy Program
Use County Information only as necessary for contract obligations
Do not share County Information with third parties for monetary or other valuable consideration
Perform background and security investigations on all employees and subcontractors
Require employees, agents, and volunteers to sign confidentiality/non-disclosure agreements
Provide annual Information Security training to employees
Establish procedures for employees to report security breaches
Render all County Information unusable, unreadable, or indecipherable to unauthorized individuals
Encrypt all workstations, portable devices, and removable media storing County Information (FIPS 140-2 or County approved)
Encrypt County Information transmitted on networks outside Contractor's control with TLS 1.2 or higher or IPSec
Do not store County Information in the cloud or online storage without written County authorization
Manage all mobile devices storing County Information with a Mobile Device Management system
Maintain latest operating system security patches and virus definitions on all workstations/PCs
Obtain County approval for the hosting environment for County Information
Promptly notify DHS CISO and DHS CPO of any security or privacy incidents within 24 hours of detection
Cooperate with County to investigate and remediate incidents
Initiate Business Continuity and/or Disaster Recovery plans during IT operations interference
Assist forensic investigators, County, and law enforcement agencies as directed by County
Allow County or third-party designee to interview relevant employees and review documentation during incident investigation
Conduct periodic self-audits, assessments, and testing of security and privacy controls
Provide audit results and corrective action documentation to County upon request
Allow County or independent third-party auditor to audit infrastructure, security, and privacy practices annually
Implement Business Continuity Plan within two hours if SaaS infrastructure is affected
Create daily backups of all County Information related to SaaS in a segmented or off-site hardened environment
Provide software/firmware enhancements, upgrades, and replacements at no cost
Notify County of available updates/enhancements/newer versions of SaaS within 30 days
Do not delete or disable SaaS features without 60 days advance notice and County written consent
Store and process County Information only in the continental United States
Conduct annual SOC 2 type II audit or equivalent for internal controls
Notify County of proposed subcontractors for SaaS at least 30 days prior and obtain written consent
Provide a complete, portable, and secure copy of all County Information upon contract termination
Provide reasonable termination assistance services at no additional cost to County
Actively manage all hardware devices covered under the contract, including inventory and tracking
Manage access to all systems or hardware, including administrative privileges and unique passwords
Ensure systems and hardware are kept up to date with the latest operating systems, applications, and patches within 90 days
Continuously identify and remediate vulnerabilities within systems and hardware
Encrypt all workstations, portable devices, and removable media associated with systems and hardware (FIPS 140-2 or County approved)
Provide and maintain industry-standard endpoint antivirus and antimalware protection on all systems and hardware
Version control, store, and deliver all County Source Code on a County-provided private Git repository
Demonstrate that GenAI system usage does not conflict with County's GenAI Policy and Principles
Ensure GenAI system is suitable for intended use and complies with applicable laws and regulations
Thoroughly investigate and report GenAI incidents to County upon request
Discontinue GenAI system use immediately upon County's request if involved in an incident
Update GenAI Factsheet annually and within 30 days of substantive changes
Provide means to monitor GenAI system performance and accuracy to County
Provide evidence that GenAI system bias is effectively managed
Provide means for human evaluation and override of GenAI system outputs
Provide explanation of GenAI system output generation
Provide written notice of GenAI system usage to data subjects/end-users if required by County
Comply with local, state, and federal law for data access and decision appeals related to GenAI system use
Regularly monitor GenAI system performance to detect and rectify behavior violations
Ensure appropriate training is available to County staff operating the GenAI system
Allow County to observe or audit work processes, services, or documents to confirm GenAI Addendum compliance
Instruct employees not to pursue or gain access to Protected Health Information (PHI)
Maintain confidentiality of any inadvertently accessed PHI and notify hospital supervisory personnel immediately
Provide appropriate training to employees regarding PHI obligations
Keep a monthly record of single-use product purchases and provide data to County upon request

$500,000 – $2,000,000

RFP issued on March 11th, 2026.

Questions due by March 15th, 2026.

Bids due by March 20th, 2026 at 12:00:00 PM.

Bids subject to acceptance by April 19th, 2026.

Internal Services Department

Organization overview and procurement intelligence available on paid plans.

The client is seeking a vendor to provide Nintex Automation K2 Enterprise upgrade services. This includes the provision and installation of Nintex-brand upgrades, K2 migration hours (from SPOP to K2), and a one-time allocation of service credits on an hourly basis. Additionally, the scope requires a rapid value package for training (RVPT), delivered as a one-time service. The contract is expected to be executed on a fixed price, standard install or upgrade basis for a three-year term.

Only Nintex-brand solutions and services will be accepted for this RFP. The awarded vendor will be responsible for ensuring a seamless upgrade and migration to K2, comprehensive training under the RVPT program, and ongoing support within the defined scope and contract period.

Nintex Automation K2 Enterprise Upgrade Services

Overview

Fit Score

SUMMARY

KEY REQUIREMENTS

BUDGET

CONTRACT DURATION

TIMELINE

QUESTION DEADLINE

Issuing Agency

DESCRIPTION

Similar RFPs