What a municipal open data program actually is
A municipal open data program is three things stacked together: a legal instrument that obligates departments to publish, a catalog that holds the published datasets, and a small central team that referees between the two. The legal instrument is usually a city ordinance or a mayoral executive order. New York City's is Local Law 11 of 2012, which required every city agency to route public data through a single portal. San Francisco's sits in Chapter 22D of the Administrative Code, which created a Chief Data Officer and required each department to name a data coordinator. Chicago's began as Executive Order 2012-2. The wording differs; the shape is the same.
The catalog is a hosted platform. Four vendors carry most of the market: Socrata (now part of Tyler Technologies), CKAN in its open-source and commercially hosted forms, Esri's ArcGIS Hub, and OpenDataSoft. Each exposes a metadata catalog, a dataset browser, a download path, and an API. Each also publishes a machine-readable catalog file so that aggregators can harvest the inventory automatically.
The central team is smaller than outsiders expect. A city of a million people often runs its open data program with two to five full-time staff sitting inside the technology department or the mayor's office. They do not own the source systems. They cannot force a department to clean its data. Their only levers are the policy, an annual publishing plan, and a public inventory that shows which datasets are stale. That gap between obligation and capacity is where outside engineering work comes from.
Cities are not bound by the federal open data statute
The OPEN Government Data Act, enacted as Title II of the Foundations for Evidence-Based Policymaking Act of 2018 (P.L. 115-435), makes open and machine-readable the default for federal agencies and requires each to maintain a data inventory. It does not reach cities. Municipal obligations come from local law. But the federal schema conventions travel: most city catalogs publish a DCAT-US style data.json so their inventory can be harvested the same way federal inventories are.
What cities publish
The published set is remarkably consistent across jurisdictions, because it tracks the systems every city already runs. Service requests from the 311 system. Building and trade permits from the permitting system. Business licenses. Police incident reports and calls for service. Code enforcement violations. Property parcels and assessed values. Street centerlines, addresses, zoning, and the rest of the GIS basemap. Budget appropriations and the checkbook-level spending register. Restaurant and food-facility inspections. Traffic counts, crash records, and signal timing. Transit schedules. Tree inventories, hydrants, streetlights, and other asset registers. Election results and campaign finance filings.
What does not get published is equally consistent. Anything with personal identifiers that survives naive redaction. Anything derived from a criminal justice information system subject to the FBI CJIS Security Policy. Student records under FERPA where the city runs a school district. Public health case data under HIPAA. Utility customer billing. Anything a city attorney has flagged as security-sensitive, such as detailed water system schematics.
Buildable-work density by problem type
Editorial weighting from public open data plans, portal inventories, and posted solicitations — illustrative, not a measured statistic.
The standards that make the data usable
A handful of published specifications carry most of the interoperability, and knowing them by name is a fast credibility signal in a first conversation. GTFS and GTFS-Realtime define transit schedules and live vehicle positions. Open311 GeoReport v2 defines a read-and-write API for service requests, so a resident can file a pothole report from a third-party app. LIVES standardizes restaurant inspection results. BLDS standardizes building and land development permits. DCAT and its US profile standardize the catalog metadata itself. Socrata's SODA API and CKAN's Action API define how a client queries a dataset without downloading it whole.
Most city catalogs are only partly conformant. A transit feed validates; a permit extract has invented column names. Bringing a legacy extract into a published standard is a well-bounded, well-priced engagement, and it is the kind of scope a program manager can defend to a finance director because the specification is public and the finish line is objective.
Who decides
The Chief Data Officer or open data program manager. Owns the roadmap, the annual publishing plan, and the portal relationship. Usually the person who first sees a good idea and knows whether money exists.
The department that owns the source system. The real gatekeeper. Public Works, Police, Buildings, Finance. If that department's IT liaison will not schedule an extract, nothing ships.
The CIO or CTO. Owns the platform contract, the security review, and the integration approvals. Cares about who touches the network and what leaves it.
Procurement. Owns the path, not the decision. Their answer to "how do we buy this" determines your timeline more than any technical factor.
The city attorney. Owns indemnification, data ownership, insurance, and the privacy review that clears a dataset for release.
The council or board. Approves above a dollar threshold set in the municipal code, on a public agenda, with a staff report that names the vendor.
What actually needs building
The recurring failure across city programs is manual publishing. Someone runs a query against the permitting database on the first business day of the month, exports a CSV, opens the portal admin console, and uploads it. When that person changes jobs, the dataset goes stale, and the staleness shows up in the public inventory. Replacing that ritual with a scheduled extract, a schema contract, a validation step, and an API push is the single most common piece of work.
Behind it sit the systems of record: Accela and Tyler EnerGov for permitting, Tyler Munis for finance, CentralSquare and Motorola for public safety computer-aided dispatch and records, Cityworks for asset management, Esri for everything spatial. The engineering is unglamorous and specific. Change data capture off a database a department will not let you write to. Address normalization against a master address repository so that three spellings of one street collapse into one. Suppression rules that hold up when a reporter joins two published datasets and re-identifies a household. Freshness monitoring that pages a human when a feed stops.
The accessibility deadline reshaping portal budgets
On April 24, 2024 the Department of Justice published a final rule under Title II of the Americans with Disabilities Act (89 FR 31320) setting a technical standard for state and local government web content and mobile applications: WCAG 2.1 Level AA. Public entities serving populations of 50,000 or more must comply by April 24, 2026. Smaller entities and special districts have until April 26, 2027.
A data portal is web content. So are the dashboards built on top of it, the PDFs linked from dataset pages, and the map viewers embedded in agency sites. Cities that have not audited their portals are discovering that color-only chart encodings, unlabeled map controls, and thousands of untagged legacy PDFs all fall inside scope. For a firm that can run an audit, remediate the templates, and put automated conformance checks into the publishing pipeline, this is funded, dated, defensible work.
How a vendor gets registered and found
Registration is mechanical and mostly free. Cities run their solicitations through a small set of eProcurement platforms: Bonfire, OpenGov Procurement, Bidnet Direct, DemandStar, Ionwave, Periscope, and vendor self-service modules inside Tyler Munis. Register in the platform the city names on its purchasing page, then register in the state's system if one exists, then pick commodity codes so alerts reach you. NIGP code 920 covers data processing, programming, and software services; 208 covers software; 918 covers consulting. Set the codes too narrowly and the alerts never arrive.
Then the paperwork. A W-9. A certificate of insurance naming the city as additional insured, with the specific limits the solicitation demands and a waiver of subrogation. A local business tax registration or business license, which several cities require before award and a few require before bid. Diverse-supplier certification if you hold one, noting that city programs certify locally and rarely accept a federal certification as a substitute. Foreign-entity registration with the Secretary of State and a registered agent if you are organized elsewhere.
Getting found is a different exercise from getting registered. Bid alerts surface only what has already been written as a solicitation, by which point the requirement was shaped months earlier. The higher-yield reading is the city's own publications: the annual open data report, the IT strategic plan, the adopted capital budget, the council agenda packets, and the portal's own inventory sorted by last-updated date. A dataset that has not refreshed in eighteen months, listed in a plan that promises quarterly updates, is a documented gap the program manager already has to explain.
Contract sizes and terms
Municipal technology work is smaller and faster than federal work, and the small size is an advantage. Most cities set three procurement bands in their municipal code: a direct-purchase band with no quotes required, an informal band requiring two or three written quotes, and a formal band requiring a sealed bid or a published RFP. The informal band is where a first engagement usually lands, because a program manager can move it without a council vote.
| Work shape | Commonly posted value | Term | Usual path |
|---|---|---|---|
| Pipeline automation, one source system | $35K–$120K | 4–9 months | Informal quote or task order |
| Privacy and de-identification review | $20K–$60K | 6–12 weeks | Informal quote |
| Portal accessibility remediation | $25K–$90K | 3–6 months | Task order under an on-call pool |
| Analytics and dashboard build | $50K–$200K | 1 year plus options | Published RFP |
| Portal platform subscription | $40K–$150K per year | 3–5 years | RFP or cooperative contract |
| On-call data engineering pool | Ceiling, not award | 1 year plus renewals | Prequalification |
The terms carry the friction. Expect a one-year base with several one-year renewals at the city's option, termination for convenience on thirty days' notice, net-30 or net-45 payment against monthly invoices, city ownership of all deliverables and often of the underlying code, and indemnification language that is broader than a commercial master services agreement. Expect local flow-downs too. San Francisco's Chapter 12B equal benefits requirement and its Chapter 12P minimum compensation ordinance are the well-known examples; many cities have equivalents covering living wage, first-source hiring, and non-discrimination. And expect that your entire proposal may become a public record under the state sunshine law, which in California now sits at Government Code section 7920 and following after the 2023 recodification.
When federal money is in the mix
Cities fund a large share of data work with federal pass-through dollars, and that changes the rules. Under the Uniform Guidance at 2 CFR part 200, a city spending federal award funds must follow the procurement standards at 2 CFR 200.317 through 200.327. The micro-purchase threshold is tied to the Federal Acquisition Regulation definition at FAR 2.101, currently $10,000, and 2 CFR 200.320(a)(1) permits a non-federal entity to self-certify a higher micro-purchase threshold up to $50,000. Above that and below the simplified acquisition threshold of $250,000, the city takes rate quotations from an adequate number of qualified sources.
Other clauses ride along. 2 CFR 200.216 bars federal award funds from being obligated for the covered telecommunications and video surveillance equipment named in Section 889 of the FY2019 National Defense Authorization Act. 2 CFR 200.322 carries a domestic preference for infrastructure work. 2 CFR 200.331 governs whether the city is treating you as a subrecipient or a contractor, which determines whether the single audit reaches you. Ask early which fund pays for the work. The answer sets your clause list.
The barriers that actually block an out-of-state firm
Local preference and local business certification
Many cities apply a bid preference to certified local businesses, commonly between one and ten percent of evaluated price, and some reserve entire categories of solicitation for them. San Francisco's Local Business Enterprise program under Administrative Code Chapter 14B is the most documented version. Certification generally requires a physical office inside the jurisdiction, held for a minimum period. A preference is survivable on a technical evaluation; a set-aside is not. Read which one applies before you invest in the response.
Insurance that your carrier cannot actually issue
This blocks more small firms than local preference does. Solicitations commonly require general liability, automobile liability, workers' compensation at statutory limits, professional liability or errors and omissions, and increasingly cyber liability, each at named limits, from an insurer admitted in that state and rated by A.M. Best at a specified level. Add the city as additional insured with a waiver of subrogation. Get the certificate quoted during the question period, not after award.
Registration, licensing, and calendar traps
Portal registration often closes at the question deadline. Addenda must be acknowledged or the bid is non-responsive. Some pre-proposal conferences are mandatory attendance. A local business license or tax registration may be a condition of award, and a few cities want it at submission. None of these are hard; every one of them is fatal if discovered late.
Nexus, tax, and entity registration
Performing work in a state can require foreign-entity registration with the Secretary of State and a registered agent with an in-state address. Economic nexus rules following South Dakota v. Wayfair (2018) mean a subscription product may create a sales tax obligation in states that tax software as a service. Price this before you quote, not after the first invoice.
Two ways around the local wall
The first is cooperative purchasing. A city can often buy against a contract another public body competed, through NASPO ValuePoint, Sourcewell, OMNIA Partners, or TIPS. There is also a federal lane: under 40 U.S.C. 502(c), state and local governments may purchase information technology products and services from GSA Multiple Award Schedule contracts through the Cooperative Purchasing Program, and 40 U.S.C. 502(d) opens a wider set for disaster recovery. A firm on the right schedule becomes buyable by a city that never issued an RFP.
The second is teaming. A locally certified prime with the office, the license, and the insurance carries the compliance weight while your engineers carry the scope. On many city contracts the prime also has subcontracting participation goals to meet, which makes a qualified specialist subcontractor genuinely valuable rather than merely tolerated.
The practical first move
First 60 days into one city
Step four does the persuading. Every other vendor sends a capability deck. A working artifact built from the city's own published data proves the pipeline reads, the schema was understood, and the quality problems were seen firsthand. It also gives the program manager something to forward internally that is not a sales document.
Go / no-go checklist
- Is the requirement funded this fiscal year, or is it aspiration in a plan?
- Does a local preference apply, and is it a percentage or a set-aside?
- Can your carrier issue every required policy at the stated limits, admitted in that state?
- Does the dollar value sit in the informal band, or does it need a council vote and a public agenda?
- Which fund pays, and if federal, does 2 CFR part 200 pull in clauses you have not priced?
- Who owns the source system, and has that department agreed to give up an extract?
- Is there an existing cooperative or on-call vehicle that removes the RFP entirely?
- Can the deliverable be defended against a public records request and a re-identification test?
Bottom line
Municipal open data is a real market with a low entry price and an unusually legible demand signal. The policy is published. The inventory is public. The staleness is measurable from outside the building. The people who own the problem are named on a webpage and can move a small contract without a council vote. What blocks most firms is not technical difficulty but procedural detail: a registration deadline, an insurance limit, a local certification, a clause list nobody read. Handle the procedure, bring the artifact, and the engineering conversation gets easy.
Frequently asked questions
Four platforms carry most of the market: Socrata, now part of Tyler Technologies; CKAN, in open-source and hosted forms; Esri's ArcGIS Hub; and OpenDataSoft. All four expose a catalog API and a machine-readable inventory file, so a dataset can be read programmatically without portal credentials.
First engagements commonly land in the informal-quote band written into the city's municipal code, which is where a program manager can act without a council vote. Pipeline automation and privacy-review scopes posted publicly by cities frequently sit between $20,000 and $120,000, on terms of six weeks to nine months.
Only when federal award funds pay for it. Then 2 CFR 200.317 through 200.327 apply, along with the $10,000 micro-purchase threshold, the $250,000 simplified acquisition threshold, the Section 889 telecommunications restriction at 2 CFR 200.216, and the subrecipient-versus-contractor determination at 2 CFR 200.331.
Yes. The Department of Justice rule published at 89 FR 31320 on April 24, 2024 sets WCAG 2.1 Level AA for state and local government web content and mobile apps under ADA Title II, with compliance due April 24, 2026 for entities serving 50,000 or more people and April 26, 2027 for smaller entities and special districts.
Regularly. The reliable routes are a cooperative contract, a GSA Schedule purchase under the Cooperative Purchasing Program at 40 U.S.C. 502(c), a subcontract under a locally certified prime, or a direct award inside the city's informal purchase band where local preference weighting does not decide the outcome.