How to win IT, web and software contracts in BC

Public buyers in BC spend a lot on technology, and much of it goes to small and mid-sized firms. A town needs a new website. A school district needs a help desk partner. A regional district wants a GIS viewer, a Crown corporation needs a security review, and a college wants an app. Tech work is posted on the same portals as construction, so many studios never see it. CrewBid's tech page lists the tech categories we track.

Who buys tech work in BC?

• Municipalities and regional districts: websites, permitting and service request systems, GIS, IT support and network work, meeting video and digital marketing.
• School districts: IT support, devices, networks, student information integrations and websites.
• Health authorities: large systems and integration work, often with high privacy and security needs. See health authority contracts.
• Crown corporations, colleges and universities: software, data, security and web work.
• The BC government: ministries often buy through pre-qualified lists and BC Bid. See standing offers and pre-qualified lists.
• Federal buyers: IT services through CanadaBuys, often through supply arrangements.

How is tech work bought?

Most tech work is bought by request for proposals, scored on understanding, approach, team, experience and price. Under BC's procurement processes, RFPs are evaluated on the criteria set out in the document, so read the scoring grid first. See how to write an RFP proposal and how public bids are scored.

Smaller jobs, such as a small website refresh, may be bought by invitation or quote, often below the open posting thresholds. See public tender thresholds. Getting known to the IT manager or communications team matters for those.

What privacy rules apply?

BC public bodies are covered by the Freedom of Information and Protection of Privacy Act (FOIPPA). Since the 2021 amendments, the old rule that personal information must be stored and accessed only in Canada was removed. Public bodies now generally need to assess privacy risks, and storage outside Canada is likely to call for a privacy impact assessment. The amendments also added privacy offences with fines of up to $50,000.

For a vendor, this means:

• Say where data is stored and processed, including backups and support access, by country and provider.
• Name your subprocessors (hosting, email, analytics, support tools).
• Describe security controls: access control, encryption, logging, backups and incident response.
• Expect privacy clauses in the contract, including breach notice and audit rights.
• Help with the privacy impact assessment. Buyers appreciate a vendor who fills in the data flow section for them.

Canadian hosting is not always required now, but it often scores better and makes the buyer's assessment easier.

What else do tech RFPs ask for?

• Accessibility: websites are usually expected to meet WCAG 2.1 AA or higher.
• Ownership and licensing: who owns the code, and whether you can reuse components. Read this carefully.
• Hosting and support: service levels, uptime and response times, and monthly costs after launch.
• Exit plan: how the buyer gets its data and content back.
• Insurance, often including professional liability and cyber liability. See insurance requirements.

How do small studios win?

• Answer the buyer's actual problem. Restate it in their words and show a plan, not a sales deck.
• Show similar public work, or close private-sector equivalents with real outcomes.
• Name the team who will do the work, with short bios.
• Price clearly: fixed fees by phase, with hourly rates for changes, and running costs for years two to five.
• Use open, maintainable tools that the buyer's staff can manage after launch.
• Keep the proposal readable. A clear one-page summary goes a long way. See the one-page executive summary.

Tech contracts often renew or grow into support contracts. Read keeping a contract at renewal.