Portland City Vendor Secure Software Procurement Rules

Portland, Oregon requires vendors to meet defined security and procurement controls when supplying software to the city. This guide summarizes typical technical and contractual expectations, the offices that enforce them, how to submit vendor materials, and what to do if a procurement or security concern arises. It is written for vendors, procurement officers, and contract managers working with the City of Portland and points to official city contacts for questions and complaints.

Scope & Core Requirements

City procurements for software commonly require baseline security practices integrated into solicitations and contracts. Requirements vary by contract type, data sensitivity, and bureau needs; vendors should expect at minimum:

• Secure design and secure development lifecycle controls, including vulnerability management and patching.
• Evidence of security testing such as threat assessments, penetration testing reports, or third-party attestations.
• Contract clauses for data handling, breach notification, and audit rights.
• Pricing or fee disclosures for ongoing security services where applicable.
• Timelines for patching and response to security incidents.

Penalties & Enforcement

Portland enforces procurement and contract requirements through its procurement office and the executing bureau. Specific monetary fines tied to noncompliance in procurement contracts are not specified on the cited city procurement pages; remedies are generally administrative and contractual rather than civil fines unless other code sections apply. Complaints and contract compliance issues are handled by City Procurement Services; report issues to the official procurement contact Procurement Services^[1].

• Monetary fines: not specified on the cited page.
• Escalation: city remedies typically escalate from cure notices to contract termination; exact timelines and steps are contract-specific and not specified on the cited page.
• Non-monetary sanctions: corrective orders, contract suspension, withholding payments, contract termination, and referral to legal or enforcement units.
• Enforcer and complaint pathway: City Procurement Services and the contracting bureau handle compliance and investigations; see Procurement Services contact for submission details^[1].
• Appeals and review: appeal routes are determined by procurement rules and the contract; time limits for protests or appeals are contract- and solicitation-specific and are not specified on the cited procurement page.

Applications & Forms

Vendor onboarding and forms are managed through the City procurement portal or bureau-specific portals. Fees and exact submission methods are detailed on the official procurement pages; if a form or fee is required the procurement page or solicitation will list the form name and how to submit it. Where the procurement site does not publish a specific form number or fee amount, that information is not specified on the cited page.

FAQ

Who enforces vendor security requirements for city software contracts?

The City Procurement Services office and the contracting bureau enforce security requirements and contract compliance.

Are there standard security checklists vendors must complete?

Some solicitations include vendor security questionnaires or require third-party attestations; requirements are listed per solicitation and are not uniform across all contracts.

What happens if a vendor reports a breach affecting city data?

Vendors must follow contract breach-notification clauses and coordinate with the contracting bureau and Procurement Services for incident response and remediation steps.

How-To

1. Review the solicitation and contract security clauses before submitting your bid or proposal.
2. Assemble evidence of security controls (test reports, SOC/ISO attestations, patch policies) to include with your response.
3. Document incident response and breach-notification processes aligned to the contract requirements.
4. If required, register in the City vendor portal and complete any vendor security questionnaires or onboarding forms listed in the solicitation.
5. If a compliance concern arises, contact Procurement Services and the contracting bureau immediately to report and resolve issues.^[1]

Key Takeaways

• Security requirements are solicitation-specific; read RFPs closely.
• Provide documented evidence of controls and testing when possible.
• Use Procurement Services as the primary city contact for complaints and contract compliance.

Help and Support / Resources

• City of Portland Procurement Services
• City of Portland Bureau of Technology Services (BTS)
• Portland City Code and Charter information

1. [1] City of Portland Procurement Services - Procurement