Attachment A Digital Communication Platform RFP Requirements.xlsx

XLSX spreadsheet 343 KB Posted Aug 30, 2026

Attached to: DIGITAL COMMUNICATION PLATFORM
Solicitation number: 216316
Issued by: Natrona County, Wyoming

About this file

Written by GovTribe AI · Oct 1, 2026

This is a Digital Communication Platform RFP requirements attachment document for the State of Wyoming, specifically managed by the Department of Enterprise Technology Services (ETS) in the A & I Procurement Office for deployment across multiple state agencies including WYDOT, Game and Fish, Secretary of State, Water Development, Agriculture, Health, Legislative Services Office, Department of Education, Office of Health and Safety, Parks and Cultural Resources, Division of Water Supplies, State Lands and Investments, Stable Token, Soil Conservation District, Wyoming Geological Survey, Public Service Commission, and Department of Environmental Quality. The RFP seeks an enterprise-level digital communication platform capable of supporting multi-channel mass communications via email, SMS, RCS, MMS, and voice messaging to both internal state employees and external citizens. The platform must support high-volume messaging capabilities (60+ million bundled SMS/RCS messages annually, with WYDOT alone sending over 56.3 million road condition messages in 2025), handle concurrent usage across multiple agencies with subscriber bases ranging from 1,300 to 150,000+ depending on agency, and maintain a shared state-level service model with agency-level autonomy. Technical proposals with fully completed Attachment A IT Requirements must be submitted by October 29, 2026, at 2:00 PM Mountain Time through the Public Purchase online bidding system, with written questions due by October 13, 2026. The contract will include implementation, training, migration of existing data and subscriber lists from current platforms, and ongoing support.

The RFP specifies comprehensive security and compliance requirements including FedRAMP Moderate or High authorization, ISO 27001, SOC 2 Type II, NIST 800-53, and StateRAMP compliance, along with HIPAA, CJIS, and FERPA where applicable, with all data residing within the United States. The platform must provide role-based access control, multi-factor authentication, encryption in transit and at rest, Business Associate Agreement execution for health information access, and compliance with Wyoming IT security and data privacy policies. Required functionality includes advanced message tracking and analytics, customizable templates with white-label branding, segmentation capabilities, automated workflows, seamless integration with Microsoft 365 and Google Workspace, mobile applications (iOS and Android) with push notifications, and APIs supporting transactional and notification emails, SMS/RCS messaging, and SMTP relay. The vendor must provide dedicated customer success and technical account managers with enterprise-level support, comprehensive training for administrators and end users across multiple delivery methods, detailed migration plans with data integrity assurance, and transparent, scalable pricing appropriate for a shared state service model with unlimited growth potential. Specific agency requests include WYDOT's requirement to retain the existing WY 511 short code and support multiple road alert categories without interface changes, Game and Fish's capability to send to 500,000+ recipients simultaneously and send 250,000+ complex emails within one hour with no downtime on critical communication dates, and Secretary of State's requirement for full uptime during election cycles.

View the file

Other files

File	Type	Posted
Attachment B Business Associate Agreement.docx	DOCX document	Aug 30, 2026
RFP 0057-N.pdf	PDF	Aug 30, 2026

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

Text version

The file's text, extracted by GovTribe without its formatting.

Instructions tc={c0c4c3f2-044e-4cbd-8d54-e3a40eec9ec7}: [Threaded comment] Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924 Comment:

I just added this one. Not sure of the best way to phrase it.
Instructions
	The vendor must provide an answer for each numbered specification with 1 of the following 6 options. Additionally, on each tab, please provide the Company and Solution Name where indicated.
Company Name:
Product(s) Name:

Answer	Definition
Y	YES - Functionality is provided out of the box through the completion of a task associated with a routine configurable area that includes, but is not limited to, user-defined fields, delivered or configurable workflows, alerts or notifications, standard import/export, table driven setups and standard reports with no changes. These configuration areas will not be affected by a future upgrade. The proposed services include implementation and training on this functionality, unless specifically excluded in the Statement of Work, as part of the deployment of the solution.
R	REPORTING - Functionality is provided through reports generated using proposed Reporting Tools.
T	THIRD PARTY - Functionality is provided by proposed third party functionality (i.e., third party is defined as a separate software Vendor from the primary software Vendor). The pricing of all third-party products that provide this functionality MUST be included in the cost proposal.
M	MUST INCLUDE - Functionality is provided through customization to the application, including creation of a new workflow or development of a custom interface, that may have an impact on future upgradability. The pricing of all modifications identified in the functional requirements MUST be included in the cost proposal.
F	FUTURE AVAILABILITY - Functionality is provided through a future general availability (GA) release that is scheduled to occur within 1 year of the proposal response.
N	N/A - Functionality is not provided

I just added this one. Not sure of the best way to phrase it.

ETS does not have the bandwidth to help troubleshoot why a state user is unable to send a message, or other issues they may need help with. We cannot provide training to other users. If it is Azure SSO as BR 20, that is only applicable to state users. If there is a login for end users that is separate, we do not have the bandwidth to support that in any way, so that needs to be vendor supported.

If we are requiring vendor support on this, recommend deleting this line completely as help desk will just be end users.

@anna.jacknitsky1@wyo.gov I am good with the add ons- just formatting to match font

@micah.pfaffe@wyo.gov @joe.rubino1@wyo.gov Not quite sure how to word this one. if you want to jump in. Also feel free to change any of the ones I have added or add more if needed. You don't need to run the change by me since it is for you but I may have questions about a few.

No, good catch! I went ahead and deleted it

IT Requirements

Company/Product Name:
IT
Line #	MoSCoW	Description	Vendor Response: Y,R,T,M,F,N	Notes/Comments/Reference to Location in RFP Response
Platform Infrastructure and Housing
IT-1	Must Have	The platform shall operate on a robust enterprise infrastructure designed for high availability, performance, and reliability suitable for a multi-agency government environment.
IT-2	Must Have	The hosting environment shall support elastic scalability, automatically adjusting resources to accommodate spikes in usage and messaging volume.
IT-3	Must Have	The vendor shall disclose the location of all data centers hosting the platform.
IT-4	Must Have	The system shall ensure optimized email deliverability, ensuring communications reach intended recipients without unnecessary delay or filtering.
IT-5	Must Have	The system shall allow bulk messaging without daily send limits.
IT-6	Must Have	The platform shall support unlimited email distribution and provide a bundled SMS/RCS allocation (minimum 60,000,000 messages) with the ability to purchase additional capacity as needed.

tc={3552500a-411a-4903-aac9-c4d674b9c522}: [Threaded comment] Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924 Comment:

We send over 30 million messages per yer just for road condition information. This number seems low.

Reply:

In 2025 WYDOT sent over 56.3 million messages for road condition information.

IT-7	Must Have	The platform shall support multi-agency operations under a shared state-level service model.
Security, Privacy and Compliance

tc={c05d40cb-0b89-4936-b56e-09f7fbc48a03}: [Threaded comment] Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924 Comment:

I don't see anything about the vendor signing a Business Associate Agreement since they will have access to WDH's protected health information. Can you please verify that this required document will be attached to any contract resulting from this RFP? And will there be language in the RFP giving the vendor a heads up that they will be required to sign one? Thank you!

Reply:

Lindsay- It's in the main RFP boilerplate as a top 10 requirement. We are still working on the BAA. But I will get you access to the boilerplate to show where we input it.

IT-8	Must Have	The system shall comply with State and Federal security and privacy regulations, including data protection and governance requirements.
IT-9	Must Have	The platform shall implement secure data handling practices, including encryption of data in transit and at rest.
IT-10	Must Have	The system shall enforce role-based access control (RBAC) to manage user permissions by agency, role, and responsibility.
IT-11	Must Have	The system shall support secure user authentication, including configurable multi-factor authentication (MFA) (e.g., SMS, RCS, authenticator applications, or token-based methods) and enforcement of strong password policies.
IT-12	Must Have	The vendor shall conduct regular vulnerability scanning and penetration testing and provide a process for timely remediation of identified vulnerabilities.
IT-13	Must Have	The system shall maintain comprehensive audit logging of user activities and data modifications.
IT-14	Must Have	The platform shall provide dedicated IP infrastructure and integration with the State’s Single Sign-On (SSO) solution where required.
IT-15	Must Have	ADA compliance by the Federal April 2026
IT-16	Must Have	The platform shall provide administrative tools for auditing user activity, allowing administrators to review system access and data interactions.

tc={5b099d74-c42d-4ac6-9037-45897394bbe2}: [Threaded comment] Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924 Comment:

Language states "shall" but the requirement is "should have".

IT-17	Could Have	The platform may provide extended event log retention, including unlimited retention where feasible.
Data Management and Migration
IT-18	Must Have	All platform data, including subscriber lists and historical reporting data, shall be exportable in non-proprietary formats in the event of contract termination to prevent vendor lock-in.
IT-19	Must Have	The system shall support seamless migration of existing contact lists and subscriber data without loss of records or subscription preferences.
IT-20	Must Have	Vendors shall provide a clear migration strategy, including defined timelines and procedures for transferring subscriber lists and other relevant data from the current platform.

tc={48d3c7d4-9b41-42ba-af58-14da2a2db65b}: [Threaded comment] Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924 Comment:

Language states "shall" but the requirement is "could have". This requirement is extremely important as WYDOT has an extensive amount of data in the current system.

IT-21	Must Have	The system shall implement automated validation checks during data entry to prevent incomplete or incorrectly formatted information.
IT-22	Must Have	The system shall verify imported subscriber data (e.g., email format validation, phone number verification) before it is added to lists.
IT-23	Must Have	The platform shall allow CSV uploads to add or update users within existing groups.
IT-24	Must Have	The migration process shall prioritize data integrity and security throughout the transition.

tc={1feac165-a6ed-4d5f-95d2-8adecd8ac5d3}: [Threaded comment] Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924 Comment:

Language states "shall" but the requirement is "should have". I believe this should be "must have" as stated in the above security requirements.

IT-25	Could Have	The platform may include data reconciliation mechanisms to compare subscriber data with other internal systems and identify discrepancies.
Messaging. Campaigns, and Automation
IT-26	Must Have	The platform shall provide message scheduling capabilities.
IT-27	Must Have	The platform shall allow automated workflows, including scheduling, approval processes, and integrations with website feeds.
IT-28	Must Have	The system shall enable audience segmentation with granular access permissions and allow segments to operate independently under a parent account.
IT-29	Must Have	Segment managers shall have access to analytics and reporting specific to their segment.
IT-30	Must Have	The system shall provide advanced message tracking and engagement metrics.
IT-31	Must Have	The platform shall allow administrators to track and bill services by user segment where applicable.
IT-32	Should Have	The platform should enable management of ongoing messaging campaigns.

tc={2ca98165-05b2-4956-b18f-a0fa44efad1d}: [Threaded comment] Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924 Comment:

Language states "shall" but the requirement is "should have".

IT-33 Must Have The platform shall allow simultaneous delivery of messages through email and SMS/RCS.

tc={2abc8baf-46d0-469b-af13-f768712382d0}: [Threaded comment] Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924 Comment:

Language states "shall" but the requirement is "should have". WYDOT would like this requirement to be "must have".

IT-34 Should Have The platform should provide segmentation tools using filtering criteria.

tc={cc0c7505-0a7d-4ae7-92c0-abfd151967b1}: [Threaded comment] Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924 Comment:

Language states "shall" but the requirement is "should have".

Integration, API and Interopertability
IT-35	Must Have	The platform shall provide robust APIs for transactional and notification emails, SMS/RCS messaging, including SMTP relay and marketing automation capabilities.

tc={2decffb4-d969-48b7-af5f-ff6a3f8f3065}: [Threaded comment] Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924 Comment:

SMS messages should be included in this API requirement.

IT-36	Must Have	The platform shall provide developer documentation for API usage and integration.
IT-37	Must Have	The system shall provide SMTP account functionality for system-generated messages.
IT-38	Must Have	The platform shall include an SMS gateway for message delivery.
IT-39	Must Have	The platform shall integrate seamlessly with existing state systems and APIs to ensure interoperability across agencies.
IT-40	Should Have	The platform should support webhooks, enabling external systems to react in real time to platform events (e.g., new subscriber registration).

tc={26a40b8c-e8ea-4a52-9eca-568597238f1e}: [Threaded comment] Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924 Comment:

You are saying this items is a "Should Have" but the language of the requirement states "Shall"

IT-41 Should Have The vendor should provide a list of pre-built integrations with commonly used public-sector applications such as CRM systems and project management platforms.

tc={56ea18b0-550d-467d-880c-3f4d55745751}: [Threaded comment] Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924 Comment:

Language states "shall" but the requirement is "should have".

IT-42	Should Have	APIs may support interactive messaging features, such as polls, two-way communication, attachments, automated responses, and workflow triggers.
Templates, Branding and Web Integration
IT-43	Must Have	The system shall provide customizable templates for email, SMS, newsletters, social media messaging, and other communications.
IT-44	Must Have	Templates shall be fully editable by the State, allowing for customization and reuse.
IT-45	Must Have	The platform shall provide white-label branding capabilities for public-facing sections of the system.
IT-46	Must Have	The platform shall provide customizable widgets that can be embedded into websites to link to state content or allow users to subscribe to messaging lists.
Subscriber Management
IT-47	Must Have	The system shall support importing email addresses and phone numbers from previous platforms.
IT-48	Must Have	End users shall be able to independently manage their mailing list subscriptions without requiring IT assistance.
IT-49	Must Have	The system shall allow rule-based subscription controls, such as restricting certain topics to specific email domains (e.g., @wyo.gov).
IT-50	Should Have	The system should manage opt-in and opt-out processes, tracking related data for compliance and analytics. If a user opts-out they should be able to opt-back in without assistance.

tc={9f01ebfe-2b6d-4a21-a273-2672b99b6a99}: [Threaded comment] Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924 Comment:

You are saying this items is a "Should Have" but the language of the requirement states "Shall" Reply:

If a user previously opts-out they should be able to opt-in again without assistance.

Analytics and Reporting
IT-51	Must Have	The platform shall provide advanced message tracking and analytics, including message delivery metrics and engagement data.
IT-52	Should Have	The platform should generate standardized KPI reports, including:

Messages sent and received Subscriber opt-ins and opt-outs Open rates Device information Click-through rates Campaign performance analysis tc={f2a55975-5aea-4188-9ffa-ca2c90fe2816}: [Threaded comment] Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924 Comment:

You are saying this items is a "Should Have" but the language of the requirement states "Shall" tc={2ca98165-05b2-4956-b18f-a0fa44efad1d}: [Threaded comment] Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924 Comment:

Language states "shall" but the requirement is "should have".

Language states "shall" but the requirement is "should have". WYDOT would like this requirement to be "must have".

Language states "shall" but the requirement is "should have".

We send over 30 million messages per yer just for road condition information. This number seems low.

Reply:

In 2025 WYDOT sent over 56.3 million messages for road condition information.

Reply:

Lindsay- It's in the main RFP boilerplate as a top 10 requirement. We are still working on the BAA. But I will get you access to the boilerplate to show where we input it.

SMS messages should be included in this API requirement.

You are saying this items is a "Should Have" but the language of the requirement states "Shall"
Supporting, Training and Operations
IT-53	Must Have	The vendor shall provide training sessions and documentation for State users.
IT-54	Must Have	The vendor shall provide robust system monitoring, incident management, and documentation of actions taken during service interruptions.
IT-55	Must Have	The vendor shall notify the State when platform features are modified or updated.
IT-56	Must Have	The vendor shall provide a Dedicated Customer Success Manager.
IT-57	Must Have	The vendor shall provide a Technical Account Manager and technical support channels via email and phone during business hours, with escalation support for critical issues after hours.
IT-58	Must Have	The vendor shall provide comprehensive onboarding for new agencies.
IT-59	Must Have	The vendor shall maintain enterprise-level customer support suitable for a multi-agency environment.
IT-60	Must Have	The vendor shall demonstrate proven experience supporting government entities.
IT-61	Must Have	The vendor shall provide a transparent and scalable pricing structure appropriate for a shared state service model.
Usability and System Experience
IT-62	Must Have	The platform shall provide a user-friendly interface suitable for diverse users across multiple agencies.
IT-63	Must Have	The platform shall provide interoperability across agency communication functions.
IT-64	Must Have	The platform shall be designed for long-term scalability and adaptability to evolving communication needs.
IT-65	Must Have	The system shall provide a searchable and accessible archive of prior bulletins, newsletters, and communications, enabling users to easily locate and review historical content without requiring administrative assistance.
IT-66	Must Have	The system shall ensure data consistency across all platform components and access methods, including user interfaces, APIs, reports, and public-facing outputs, preventing discrepancies in data presentation or content delivery.
IT-67	Could Have	The platform may include additional capabilities that enhance both public and internal communications.
ETS IT Operation Policies
IT-68

tc={ff24e3b3-be19-4c98-9f42-373571a87720}: [Threaded comment] Your version of Excel allows you to read this threaded comment; however, any edits to it will get removed if the file is opened in a newer version of Excel. Learn more: https://go.microsoft.com/fwlink/?linkid=870924 Comment:

Do all of these standards really apply? As an example, are we really saying the vendor has to comply with the State's AI policy. It seems like it should apply to the users of the system but not to the vendor of the system.

Many if not all of the standards state: "This policy applies to all Executive Branch agencies, boards, and commissions staff (collectively referred to as "agencies"). This policy is also applicable to consultants, affiliates, third party vendors and temporary employees that use or store data."

Language states "shall" but the requirement is "should have".

Language states "shall" but the requirement is "could have". This requirement is extremely important as WYDOT has an extensive amount of data in the current system.

You are saying this items is a "Should Have" but the language of the requirement states "Shall" Reply:

If a user previously opts-out they should be able to opt-in again without assistance.

Language states "shall" but the requirement is "should have". I believe this should be "must have" as stated in the above security requirements.
Must Have	WyIT - 1001 Agency Controlled Information Technology (IT) Change Management and Maintenance 07/2024
IT-69	Must Have	WyIT - 1002 Electronic Communication Management 07/2024
IT-70	Must Have	WyIT - 1003 Contingency Planning 07/2024
IT-71	Must Have	WyIT - 1004 Web Standards & Compliance 07/2024
ETS Data Privacy Policies
IT-72	Must Have	WyIT - 2001 Information Classification 9/2025
IT-73	Must Have	WyIT - 2001 - GL- Information Classification Guidelines 9/2025
IT-74	Must Have	WyIT - 2001 - S - Information Classification Standard 9/2025
IT-75	Must Have	WyIT - 2002 - Data Protection for Electronic Government Services 9/2025
IT-76	Must Have	WyIT - 2002 - GL - Data Loss Prevention Guideline 9/2025
IT-77	Must Have	WyIT - 2003 - Data Backup, Storage and Restoration 9/2025
IT-78	Must Have	WyIT - 2004 - Information Breach 9/2025
IT-79	Must Have	WyIT - 2004 - GL Information Breach Response Guidelines 9/2025
IT-80	Must Have	WyIT - 2005 - Information Residency and Transportation 9/2025
IT-81	Must Have	WyIT - 2006 - Agency Official for Privacy (AOP) 9/2025
IT-82	Must Have	WyIT - 2007 - Data and Privacy Exception Request 9/2025
IT-83	Must Have	WyIT - 2008 - Website Online Maps and Data Disclaimer Policy 9/2025
IT-84	Must Have	WyIT - 2009 - Clean Desk Confidential Information and Sensitive Materials Policy 9/2025
IT-85	Must Have	WyIT - 2010 - Agency Data Sharing Review Frequency Policy 9/2025
IT-86	Must Have	WyIT - 2013 - S - Standard for Electronic Data Destruction and Sanitization Standard 09/2025
ETS Security and Privacy Policies
IT-87	Must Have	WyIT - 3023 - Generative Artificial Intelligence Acceptable Use 06/2024
IT-88	Must Have	WyIT - 3001 - General Security Acceptable Use 06/2024
IT-89	Must Have	WyIT - 3001 - S - Sending Encrypted Email Standard 06/2024
IT-90	Must Have	WyIT - 3002 - Security Exception Request 06/2024
IT-91	Must Have	WyIT - 3003 - Information Security 06/2024
IT-92	Must Have	WyIT - 3004 - Security Awareness Training and Education 8/2024
IT-93	Must Have	WyIT - 3005 - Access Controls 8/2024
IT-94	Must Have	WyIT - 3006 - Identification and Authentication 06/2024
IT-95	Must Have	WyIT - 3007 - System and Communication Protection 06/2024
IT-96	Must Have	WyIT - 3008 - Risk Assessment 8/2024
IT-97	Must Have	WyIT - 3009 - Computer Security Threat Response 06/2024
IT-98	Must Have	WyIT - 3010 - Incident Response 06/2024
IT-99	Must Have	WyIT - 3011 - Systems and Services Acquisition 06/2024
IT-100	Must Have	WyIT - 3012 - System and Information Integrity 8/2024
IT-101	Must Have	WyIT - 3013 - Physical and Environmental Protection 8/2024
IT-102	Must Have	WyIT - 3014 - Personnel Security 8/2024
IT-103	Must Have	WyIT - 3015 - Physical Media 06/2024
IT-104	Must Have	WyIT - 3016 - Mobile Device Security 06/2024
IT-105	Must Have	WyIT - 3017 - Remote Access 06/2024
IT-106	Must Have	WyIT - 3018 - Software Use 06/2024
IT-107	Must Have	WyIT - 3019 - Local Administrative Rights 06/2024
IT-108	Must Have	WyIT - 3020 Vulnerability Scanning 062024
IT-109	Must Have	WyIT - 3021 - Patch Management 06/2024
IT-110	Must Have	WyIT - 3022 - Mainframe Security 8/2024
IT-111	Must Have	WyIT - 3025 - Source Code Control Policy 06/2024
IT-112	Must Have	09400-P221 Policy for Electronic Data Destruction and Sanitization 11/5/18
IT-113	Must Have	09400-S221 Standard for Electronic Data Destruction and Sanitization 11/5/18