ATTACHMENT G- COMMONWEALTH RESPONSE TO VENDORS QUESTIONS RFP 758 2600000258.xlsx
XLSX spreadsheet 58 KB Posted
- Attached to
- DPA WEBSITE AND TRUMPET DESIGN AND CONFIGURATION
- Solicitation number
- RFP 758 2600000258 7
- Issued by
- Elliott County, Kentucky
About this file
This file is a comprehensive vendor question-and-answer document for RFP 758 2600000258, issued by the Commonwealth of Kentucky Department of Public Advocacy (DPA) for website and internal platform redesign and configuration services. The RFP seeks design, development, and implementation of two integrated platforms: a redesigned external website (currently 86 webpages with 1,803 media files totaling 3.3GB) and the Trumpet internal staff platform (currently 19,664 pages with approximately 20,000-30,000 files including PDFs, Word documents, PowerPoints, and Vimeo-linked training videos). The scope includes content migration, unified search functionality across both platforms, AI-powered chatbot capabilities, accessibility compliance to WCAG 2.2 AA standards, and multilingual support (Spanish for external site). The project requires development of component-based templates, comprehensive technical SEO audit, role-based access controls, disaster recovery planning with 24-hour RTO/RPO on business days, and training for approximately 10 DPA staff members. The current Trumpet platform is hosted as a subsite on the National Association for Public Defense's WordPress-based learning platform and will need to be transitioned to a new independent instance. Vendors must comply with Commonwealth of Kentucky information security policies, NIST 800-53 controls, and integration with Azure Entra ID for single sign-on authentication.
The RFP does not specify a budget range or funding cap, with the Commonwealth declining to share this information. Vendors must provide fixed-price cost proposals with milestone-based payments tied to implementation deliverables, and value-added services should be separately priced as optional items. No incumbent vendor exists for this engagement. The current environment includes approximately 7,000-8,000 unique monthly visitors and 20,000 monthly page views on the external website; the Trumpet currently has approximately 800 active users with 10 administrator accounts, though detailed analytics on concurrent usage are unavailable due to platform access restrictions. The solution must comply with Section 4.1 hosting requirements and be compatible with Commonwealth Office of Technology (COT) managed cloud environments (Azure, AWS, or GCP), FedRAMP/HITRUST certification if applicable, and Kentucky Information Technology Standards (KITS) approval or formal exception documentation. All Commonwealth data must remain within the continental United States, though offshore development resources are permitted if U.S. data access is restricted. All generative AI solutions must receive approval from the Commonwealth's AI governance committee and must comply with CIO-126 Artificial Intelligence Policy, with guaranteed protections against vendor use of Commonwealth data for training public foundation models.
View the file
Other files
Show all 19
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| RFP 758 2600000258 |
| DPA WEBSITE AND TRUMPET DESIGN AND CONFIGURATION |
| Question # | RFB Section / Requirement Number | Document | Document Page Number | Vendor Questions | Commonwealth Response |
| 1 | 2.2 Background | Attachment A RFP | 5 | Is the new platform/website intended to be the entire internal staff platform (motions + manuals + policies/procedures + trainings/webinars), or can learning be separated into a seperate Learning Management System (LMS) while other internal content remains in a different platform? | The Request for Proposal is not requesting a Learning Management System. Please rephrase your question and resubmit in the second set of Vendor questions. Refer to Section 1.1 Anticipated Schedule of Activities |
| 2 | 3.1.B.1.j (motion bank + learning materials database) | Attachment A RFP | 7 | For the “learning materials database,” is the Commonwealth expecting full LMS capabilities (learning paths, quizzes, completion tracking, certificates), or is it primarily a searchable library of recordings/materials? | The Request for Proposal is not requesting a Learning Management System. Please rephrase your question and resubmit in the second set of Vendor questions. Refer to Section 1.1 Anticipated Schedule of Activities |
| 3 | 3.1.B.1.a (Trumpet Design – subsite) | Attachment A RFP | 7 | When you say “subsite of the external DPA website,” must it be the same CMS/URL structure, or is a separate LMS tenant acceptable if it’s branded, linked, and SSO-enabled? | The Request for Proposal is not requesting a Learning Management System. Please rephrase your question and resubmit in the second set of Vendor questions. Refer to Section 1.1 Anticipated Schedule of Activities |
| 4 | 2.2 Background | Attachment A RFP | 5 | How many users accounts are provisioned on the TRUMPET platform today? Do you expect number to increase over 5 years? If so, how many? | Currently there are approximately eight hundred (800) users on the Trumpet platform. The user count is expected to remain stable in the next 5 years. |
| 5 | 2.2 Background | Attachment A RFP | 5 | Please confirm the in-scope Trumpet content types (trainings/webinars, motion banks, manuals, policies/procedures). Are there other repositories/content types we should assume are in scope? | Most are PDFs, others include Word docs, PowerPoints, Vimeo links, and older embedded videos are embedded. Everything on the site is considered in-scope. |
| 6 | 3.1.B.2.a–c (Trumpet Data Migration) | Attachment A RFP | 7 | What is the expected migration inventory (videos, webinar recordings, PDFs, Word docs, templates, metadata/tags, hierarchies), and are there any file formats or legacy items that can be excluded? Please provide the file types and counts for each type of file. | 19,664 pages on the Trumpet. About 20,000-30,000 files. Most are PDFs, others include Word docs, PowerPoints, Vimeo links, and older embedded videos are embedded. Exact number of files per type is impossible to determine; the Trumpet is a subsite of NAPD, and we cannot see those settings. Nothing is to be excluded during transfer. |
| 7 | 3.1.B.3.g (RBAC) | Attachment A RFP | 7 | What roles beyond “owners/admins” are required (e.g., instructors, content approvers, office-level admins), and what areas/content need role-based restrictions? | Refer to RFP Section 3.1 G.3. |
| 8 | 3.1.C.1.a (unified search external + Trumpet only) | Attachment A RFP | 7–8 | If Trumpet training is moved into an LMS, is the LMS expected to be a designated search source for the “unified search” (external + Trumpet only)? | The Request for Proposal is not requesting a Learning Management System. Please rephrase your question and resubmit in the second set of Vendor questions. Refer to Section 1.1 Anticipated Schedule of Activities |
| 9 | 3.1.C.1.e (permissions enforced in search) | Attachment A RFP | 8 | For unified search, do you require permission-trimmed results across all indexed sources (including LMS, if used), and what is the expected authorization model? | Vendors must comply with the RFP. See section 3.1.C.1.e |
The Request for Proposal is not requesting a Learning Management System. Please rephrase your question and resubmit in the second set of Vendor questions. Refer to Section 1.1 Anticipated Schedule of Activities.
| 10 | 3.1.C.4.i (link related documents/resources) | Attachment A RFP | 9 | Do you require explicit cross-linking between trainings and related motions/manuals (and should that linking be bi-directional and searchable)? | Training materials should be linked to the training video associated with the materials. Similar topics should be searchable for content based on topic area. |
| 11 | 4.1 Hosting (COT cloud tenant preference; FedRAMP/HITRUST; isolated tenant; monitoring; AI disclosure) | Attachment A RFP | 15 | If we propose a SaaS LMS, is that acceptable under COT hosting preferences (e.g., COT-managed tenant vs FedRAMP/HITRUST; isolated tenant; monitoring/peering), and what constraints should we assume? | The Request for Proposal is not requesting a Learning Management System. Please rephrase your question and resubmit in the second set of Vendor questions. Refer to Section 1.1 Anticipated Schedule of Activities |
| 12 | 3.3.1.a.(Main Website - Design & Visuals) | Attachment A RFP | 5 | What are the other website platform will you be interested in? | Any proposed platform must meet the requirements of the RFP. |
| 13 | 3.1.a.3.(Main Website - Content) | Attachment A RFP | 6 | To what extent are you expecting the provider to improve content beyond what is listed? | Vendors are expected to meet the requirements of the RFP. |
| 14 | 3.1.E.1.a | Attachment A RFP | 11 | Does DPA have an existing Identity Provider that thy integrate with (Okta, ForgeRock)? what is the integration protocol that is used (SAML, OIDC). | Okta based. SAML |
| 15 | 4.5 | Attachment A RFP | 21 | Does the commonwealth require the vendor to perform independent vulnerability assessment of the proposed system? | Section 4.5 states that "The Commonwealth reserves the right to conduct, in collaboration with the vendor, non-invasive vulnerability and security assessments.." |
| 16 | 4.2 | Attachment A RFP | 22 | Does the exting solution receive any data from IRS.? | No |
| 17 | 2.2 Background | Attachment A RFP | 5 | How many current unique visitors and page views does the site receive in an average month? | Seven to eight thousand (7,000-8,000) unique visitors per month and twenty-thousand (20,000) page views per month. |
| 18 | 3.1.A.1.a | Attachment A RFP | 5 | Is the agency committed to WordPress, or will proposals be scored equally if another content management system (CMS) is proposed? | Any proposed platform must meet the requirements of the RFP. The agency is not committed to WordPress. |
| 19 | 3.1.A.1.a | Attachment A RFP | 5 | If “other platform” is allowed: what constraints exist (state-approved hosting, SaaS allowed, on-prem restrictions, procurement/security requirements)? | The vendor must comply with Section 4.1 of the RFP and propose their best solution. |
| 20 | 3.1.A.1.a | Attachment A RFP | 5 | Is this a rebuild in a new instance or reconfiguration of the current site? | New instance of the website. |
| 21 | 3.1.A.1.b | Attachment A RFP | 5 | Should the vendor use an off-the-shelf theme, a starter theme, or a custom theme? | Vendors must comply with the RFP. There is no specified theme to be used. |
| 22 | 3.1.A.1.c | Attachment A RFP | 5 | Do you want content strategy/copywriting included or design only? | Design only. |
| 23 | 3.1.A.1.d | Attachment A RFP | 5 | Any accessibility constraints on brand colors (contrast requirements)? | Must adhere to the WCAG 2.2 AA guidelines for websites; DPA does have a style sheet for brand colors. |
| 24 | 3.1.A.1.e | Attachment A RFP | 5 | Are you expecting information architecture deliverables (sitemap, navigation model, page templates) and usability testing? | Yes |
| 25 | 3.1.A.1.f | Attachment A RFP | 5 | Should templates be component-based (reusable blocks) | Yes, templates should be component-based using reusable content blocks to ensure flexibility, scalability, and consistency across the site. |
| 26 | 3.1.A.1.g | Attachment A RFP | 5 | Which devices/browsers must be supported (iOS Safari, Android Chrome, older devices)? | All reasonable and current |
| 27 | 3.1.A.1.j | Attachment A RFP | 5 | Where do messages go (shared inbox, ticketing system, CRM, per-office distribution lists)? | Vendors are to propose their best solution. |
| 28 | 3.1.A.1.k | Attachment A RFP | 5 | What navigation model is preferred: audience-based, task-based, or organizational? | Vendors are to propose their best solution. |
| 29 | 3.1.A.1.l | Attachment A RFP | 5 | What does “integrate” mean: embedded feeds, share buttons, campaign banners? | Vendors are to propose their best solution. |
| 30 | 3.1.A.1.l | Attachment A RFP | 5 | Any restrictions on third-party embeds (privacy, performance, accessibility)? | See Sections 3.1(A)(2)(f), Section 3.1(D), Section 10.22 and Section 4 of the RFP. |
| 31 | 3.1.A.2.b | Attachment A RFP | 5 | Is the scope technical SEO only (metadata, indexing, redirects, schema) or also content SEO (keyword strategy, page rewrites)? | The scope includes a comprehensive technical SEO audit (metadata, indexing, redirects, schema, crawlability, and performance). Content SEO strategy and page rewrites are not required beyond high-level recommendations. |
| 32 | 3.1.A.2.c | Attachment A RFP | 5 | What is the maximum acceptable click depth for top tasks? | Top user tasks should ideally be accessible within 2–3 clicks from the homepage. Vendors should propose an information architecture that prioritizes intuitive navigation and task completion efficiency. |
| 33 | 3.1.A.2.e | Attachment A RFP | 5 | How will compliance be validated: automated scanning + manual keyboard/screen reader testing? | Compliance must be validated through a combination of automated accessibility scanning and manual testing, including keyboard navigation and screen reader validation. Vendors should document testing methodologies and remediation efforts to demonstrate conformance with WCAG 2.2 AA guidelines. |
| 34 | 3.1.A.2.e | Attachment A RFP | 5 | Who remediates legacy documents/media (vendor vs agency)? | Vendor |
| 35 | 3.1.A.2.f | Attachment A RFP | 5 | Is the requirement for true accessibility (WCAG-compliant layouts + browser zoom support), or specifically an on-page font-size switcher? | Site must fully comply with the WCAG 2.2 AA guidelines. |
| 36 | 3.1.A.2.g | Attachment A RFP | 6 | Which languages are required now vs “future-ready” (Spanish only? others)? | Spanish |
| 37 | 3.1.A.2.g | Attachment A RFP | 6 | Is the expectation machine translation, human translation, or hybrid—and who pays/operates it ongoing? | The site should support multilingual functionality. At this time, no additional languages are legally required; however, DPA would like the ability to provide Spanish translation. Vendors should propose a solution that supports automated translation for general informational content. The proposed solution must not interfere with WCAG 2.2 AA compliance. Vendors are to propose their best solution. |
| 38 | 3.1.A.2.h | Attachment A RFP | 6 | Are PDFs in scope for remediation (existing library) or only “going forward” standards? | Current PDFs are in scope and need to included. |
| 39 | 3.1.A.2.h | Attachment A RFP | 6 | Who will remediate Office documents before PDF generation? | Vendor |
| 40 | 3.1.A.2.i | Attachment A RFP | 6 | Are you okay with a third-party search service, or must it be hosted internally? | Either for the external site. Vendors are to propose their best solution. |
| 41 | 3.1.A.3.a | Attachment A RFP | 6 | Is copywriting/editing in scope or guidance only? | Copywriting/editing are not in scope for this RFP. |
| 42 | 3.1.A.3.b | Attachment A RFP | 6 | Who owns selection, rights/consent, and accessibility (alt text standards)? | DPA owns all photos. There is no alt text for photos at this time. Site must fully comply with the WCAG 2.2 AA guidelines requirements. |
| 43 | 3.1.A.3.c | Attachment A RFP | 6 | Where will submissions be stored (email only vs database/CRM/ticketing)? | Vendors are to propose their best solution. |
| 44 | 3.1.A.3.d | Attachment A RFP | 6 | Would CMS be sufficient or will you need a separate database. | Vendors are to propose their best solution. |
| 45 | 3.1.A.4.a | Attachment A RFP | 6 | Will staff training sessions be required? | Training for the admins of the sites is required but not for the full agency staff. |
| 46 | 3.1.A.4.a | Attachment A RFP | 6 | Do you need role-based guides (authors vs admins)? | Yes. |
| 47 | 3.1.B.2 | Attachment A RFP | 7 | Will the content be migrated “as-is” vs consolidate/retire stale content on the external site? | DPA prefers a curated migration approach rather than a straight lift-and-shift. While all currently available content will be evaluated for migration, vendors are expected to support content audit, consolidation, archiving of outdated or duplicative material, and information architecture refinement as part of the implementation. Content that is no longer accessible from prior platform transitions is not expected to be recovered unless separately identified. |
| 48 | 3.1.C.4.f | Attachment A RFP | 9 | How will heading order, link text quality, and alt text completeness be enforced—editor checks or audits? | Accessibility compliance will be enforced through a combination of CMS-level controls and ongoing audits. The vendor's proposed CMS should include built-in editor guardrails where feasible, such as required alt text fields, heading structure guidance, and link text validation. Compliance will also be validated through periodic automated scanning and manual testing, including keyboard navigation and screen reader validation. Vendors should describe how their proposed solution supports both point-of-entry enforcement and ongoing accessibility auditing. |
| 49 | 3.1.C.5.a | Attachment A RFP | 9 | Must external and internal share a single design system/component library | A single unified platform is desired, however vendors are to propose their best solution. |
| 50 | 3.1.C.5.i | Attachment A RFP | 9 | Pages load within 2 seconds”: define measurement method (p75 on mobile, specific pages, specific network), and which pages are exempt (heavy documents, maps). | Performance will be measured mobile-first at p75 for primary page templates. Vendors should propose methodology. Heavy assets may be exempt but optimized where feasible. |
| 51 | Section 2.2 | RFP (Attachment A RFP 758 2600000258 DPA Website and Trumpet Design and Configuration.pdf) | 4 | The Trumpt mentioned in the RFP as the Intranet website, is this the name of a CMS or just the branded name of the site? If not the CMS, what is the current CMS used to manage the content for the website? | Trumpet is a branded name. The Trumpet is hosted as a subsite on the National Association for Public Defense’s (NAPD) learning platform, which utilizes WordPress |
| 52 | Sections 1.01 and 2.01 | RFP | 4, 8 | Who are the decision makers, evaluation criteria, and timeline for selecting the CMS “at the beginning of the project”? Is the State open to SaaS, PaaS, and are there State-preferred platforms? | The decision makers are the Evaluation Team Members for the RFP. Evaluation Criteria is listed in Section 7.2 . Considering the complexity of this procurement and unknown number of responses the Commonwealth may receive for this RFP, the timeline cannot be anticipated at this time. As for platforms, the vendor must comply with Section 4.1 of the RFP and propose their best solution. |
| 53 | Section 2.2 | RFP | 4 | What CMS is currently being used to manage the content for the internet website for DPA? | WordPress |
| 54 | Section 3.1. A.1.a | RFP | 5 | Is there a preferred CMS platform (e.g., WordPress), or is the vendor free to propose alternatives that meet all requirements? | Any proposed platform must meet the requirements of the RFP. |
| 55 | Section 3.1.A.1.i | RFP | 5 | Are there any integrations with existing Commonwealth systems (e.g., GIS for office map, HR systems for staff directory) that must be supported? Please provide a list of all integrations and use cases. | None. |
| 56 | Section 3.1.A.1.i | RFP | 5 | Is DPA open to alternative solutions to display offices content if an interactive map cannot be made fully accessibility complaint with WCAG 2.2 AA standards? | The external site must fully comply with the WCAG 2.2 AA guidelines. |
| 57 | Section 3.1.A.2.h | RFP | 5 | Is DPA looking for services to remediate existing PDFs and other downloadable files are accessible or will DPA staff rememdiate those files? | Vendor must comply with the requirements of the RFP. See Section 3.1 B.2. |
| 58 | Section 3.1.A.2.k | RFP | 6 | What are the required Recovery Time Objective (RTO) and Recovery Point Objective (RPO) targets for disaster recovery? | Twenty-four (24) hours on business days RTO and RPO |
| 59 | Section 3.1.A.4.b | RFP | 6 | Is Google Analytics (GA4) the required analytics platform, or is DPA looking to implement alternative analytics solutions? | Google Analytics is desired but not required, alternatives that meet the requirements of the RFP are acceptable. Vendors are to propose their best solution. |
| 60 | Section 3.1.B.1.j | RFP | 6 | As this would be custom work, please provide more details about the motion bank and and learning materials database, including the scope of work, number of records, type of information, etc. | 19,664 pages on the Trumpet. About 20,000-30,000 files. Most are PDFs, others include Word docs, PowerPoints, Vimeo links, and older videos are embedded. Exact number of files per type and size is impossible to determine; the Trumpet is a subsite of NAPD, and we cannot see those settings. Nothing is to be excluded during transfer. |
| 61 | Section 3.1.B.2 | RFP | 7 | Will DPA provide all legacy Trumpet content in a format suitable for automated migration, or is manual remediation anticipated? | Will be provided in the format that is exported by WordPress. |
| 62 | Section 3.1.B.2 | RFP | 7 | Are there specific content types or file formats (e.g., video, PDF, legacy web archives) that require special handling during migration? | No content types are currently identified as requiring special handling. Vendors should describe how their proposed solution addresses migration of standard web pages, documents, and media files, and identify any formats that may require specialized treatment. |
| 63 | Section 3.1.B.2.h | RFP | 7 | Please describe the expectation DPA has for the vendor to "ensure current links to existing content will continue to work" means as there is a chance that links to content could change if the information architecture and site navigation changes during the buildout of the new sites. | DPA’s expectation that “current links continue to work” refers primarily to preservation of external media links (e.g., Vimeo-hosted trainings) and associated downloadable assets (PowerPoints, handouts). These assets should remain properly connected to their respective training records following migration. |
We understand that internal page URLs and navigation structures may change as part of the new information architecture and do not require identical URL preservation. However, vendors should implement appropriate redirect strategies or link validation processes to prevent broken internal references during migration.
In prior platform transitions, externally hosted Vimeo links became disconnected or broken despite being static URLs. The vendor should ensure proper migration and link validation controls to prevent recurrence of these issues.
| 64 | Section 3.1.B.2.a | RFP | 7 | Is the content to be migrated from Trumpet static or interactive? | The content is static. |
| 65 | Section 3.1.B.3 | RFP | 7 | What is the expected process for onboarding and offboarding users, especially for internal staff and external partners? | For the initial onboarding, we would expect the vendor to add all staff and external partners as users for the site. For ongoing maintenance of the membership list, DPA would be responsible for adding/removing/modifying members. We would not expect training for all DPA staff, but about 10 staff members would need to be trained on the new roster management process. |
| 66 | Section 3.1.B.3.d/e | RFP | 7 | Is Azure Active Directory (AD) the only acceptable SSO provider, or are other SAML/OAuth providers permitted? | See Section 3.1 E.1.b. |
| 67 | Section 3.C.1.i/j | RFP | 7 | What is the preferred cadence for search index refreshes (hourly, nightly, or other), and are there hard SLAs for search freshness? | Search indexing should occur automatically upon content publication or update. At minimum, a nightly refresh is acceptable. No hard SLA for search freshness is currently defined; vendors may propose standard best practices. |
| 68 | Sections 2.01 and 3.03.1 and 2 | RFP | 8, 11 | Do you have an existing content inventory (pages, PDFs, database‑driven content, media)? If not, can we get rough counts by type to size the audit and migration effort? | 19,664 pages on the Trumpet. About 20,000-30,000 files. Most are PDFs, others include Word docs, PowerPoints, Vimeo links, and older videos are embedded. Exact number of files per type and size is impossible to determine; the Trumpet is a subsite of NAPD, and we cannot see those settings. Nothing is to be excluded during transfer. |
The external website has 86 webpages with 1,803 media files totaling 3.3GB.
| 69 | Sec. 2.01–3.01 | RFP | 8-9 | Are there required metadata schemas, taxonomy standards, or an enterprise search solution we must integrate with (e.g., Statewide search) or is the agency looking for the vendor to provide a solution? | Vendors are to propose their best solution. External site must comply with WCAG 2.2 AA guidelines. | |
| 70 | Sec. 2.01–3.01 | RFP | 8-9 | Are there dynamic applications or data integrations on the current site (e.g., licensing, harvest reports, regulations lookups) that must be re‑platformed or wrapped? Please list known CF apps, their owners, and expected disposition. | No | |
| 71 | Section 3.C.2 | RFP | 8 | Is the agency open to leveraging third-party AI/LLM services (e.g., Azure OpenAI, AWS Bedrock), or must all AI components be hosted within the Commonwealth’s infrastructure? | The vendor must comply with Section 4.1 of the RFP as well as the other requirements and submit its best solution. | |
| 72 | Section 3.C.2.a/h | RFP | 8 | Should the AI chatbot be available to both public and internal users, or only to authenticated staff? | The Trumpet content referenced is restricted to DPA users only, therefore internal users only. | |
| 73 | Section 3.C.3 | RFP | 8 | What are the key performance indicators (KPIs) DPA wishes to track for both public and internal sites? | Post-launch success may be measured through indicators such as task completion, page load performance, accessibility error trends, content publishing efficiency, and security findings. Offerors should describe how they support measurement and reporting of these metrics. | |
| 74 | Sec. 3.01.4-6 | RFP | 9 | Any required integrations (e.g., identity/SSO, forms/workflow tools, GIS, DAM, analytics, alerts/subscriptions/email/SMS)? Please be specific with each integration detailing hte use case and nature of the integration. | See Section 3.1 A.1.j., Section 3.1 A.1.l., Section 3.1 B.3.d., Section 3.1 D. 5.b., Section 3.1 E.1.b. , and Section 3.1 G.1.b. | |
| 75 | Section 3.01.4 | RFP | 9 | Please confirm required roles (author/editor/approver/publisher) and whether agency divisions will need segregated permissions, content lifecycles, and approval SLAs. | See RFP Section G.3. Agency divisions will not need separate roles. | |
| 76 | Secions 3.01 and 3.03 | RFP | 9, 11 | Please share applicable State of Alaska Information Security Policies (ISPs) and hosting requirements (e.g., FedRAMP, data residency, WAF standards) to ensure CMS candidates comply. | The RFP 758 2600000258 is for the Commonwealth of Kentucky. Please rephrase your question and resubmit in the second set of Vendor questions. Refer to Section 1.1 Anticipated Schedule of Activities. | |
| 77 | Secions 3.01 and 3.03 | RFP | 9-11 | Beyond WCAG 2.1 AA, are there agency-specific accessibility requirements (e.g., plain language standards, captioning policy for legacy video, PDF remediation thresholds)? How will accessibility conformance be verified and accepted at each phase? | No, site must comply with WCAG requirements. Compliance must be validated through a combination of automated accessibility scanning and manual testing, including keyboard navigation and screen reader validation. Vendors should document testing methodologies and remediation efforts to demonstrate conformance with WCAG requirements. | |
| 78 | Secs. 3.01–3.03 | RFP | 9-12 | For PDFs/Office files that remain public, what level of accessibility remediation is required (full tag tree, form fields, reading order)? Are there exceptions for scanned historical documents? | The vendor is responsible for remediation of existing documents as part of migration scope. Scanned documents must be processed through OCR to produce machine-readable text prior to publication. Vendors should describe their approach to PDF remediation and OCR processing in their technical proposal. | |
| 79 | Secton 3.01.1 | RFP | 9 | Please provide or point to the current State of Alaska UX/brand system and any required component libraries so we can scope design alignment and variance requests. | The RFP 758 2600000258 is for the Commonwealth of Kentucky. Please rephrase your question and resubmit in the second set of Vendor questions. Refer to Section 1.1 Anticipated Schedule of Activities | |
| 80 | Secton 3.01.6 | RFP | 9 | Which near‑term features should the platform anticipate (e.g., forms, personalization, multilingual content, notification subscriptions, maps/data apps)? Any systems expected to be onboarded in Year 1 vs later? | Nothing planned for the future | |
| 81 | Section 3.D.5.b | RFP | 10 | Is there a preferred translation technology (e.g., Google Translate API, DeepL), or should the solution support integration with multiple providers? | DPA does not have a preferred translation tool; vendors are to propose their best solution. | |
| 82 | Section 3.D.5.a/c | RFP | 10 | Are there specific languages required for translation at launch, or should the system be designed for future expansion? | See RFP Section 3.1 2.g. and 3.1 D.5.c. Language translation options should be available on the external website. | |
| 83 | Section 3.01 | RFP | 10 | What are the success metrics ADF&G will use post‑launch (e.g., task completion, page load thresholds, accessibility error rate, content throughput, security findings)? | We are not ADFG. Post-launch success may be measured through indicators such as task completion, page load performance, accessibility error trends, content publishing efficiency, and security findings. Offerors should describe how they support measurement and reporting of these metrics. | |
| 84 | Seciton 3.02 | RFP | 10 | Is the April 26, 2026 deadline a hard dead for all work to be completed or is the agnecy looking to have a detail plan for addressing accessibility compliance in place with regard to the website by that date? | No deadline for either site was provided in the RFP. | |
| 85 | Section 3.02.1-4 | RFP | 10 | Who makes archive vs migrate decisions and what legal retention requirements apply? Please confirm whether archived content will be excluded from the April 26, 2026 WCAG deadline per the four‑part test. | Customer will decide on archive vs. migration. No legal retention requirements (i.e. no case files), the vendor should comply with the Kentucky Department of Library and Archives (KDLA) retention periods for the agency as well as any DPA retention schedules. | |
| 86 | Section 3.1, E. Security & Compliance | RFP | 11 | What is the standard lead time and change window with OIT for DNS and WAF migration at launch? Are there required pre‑go‑live security scans or change advisory board gates? | Please identify the acronyms and resubmit in the second set of vendor questions | |
| 87 | Section 3.03.A42:D476 | RFP | 11 | Please confirm required format and controls for the Security Plan (e.g., aligned to NIST 800‑53, CIS, or State ISPs), and whether a formal risk assessment and POA&M are required pre‑launch. | The RFP 758 2600000258 is for the Commonwealth of Kentucky. Please rephrase your question and resubmit in the second set of Vendor questions. Refer to Section 1.1 Anticipated Schedule of Activities | |
| 88 | Section 3.03.5 | RFP | 11 | How many staff need training, in what roles, and preferred delivery (onsite, remote, train‑the‑trainer)? Are accessible training materials (e.g., WCAG‑compliant manuals, captioned videos) required as deliverables? | About 10 staff would need training, preferred onsite. Training materials should be accessible. | |
| 89 | Section 3.031, 4 and Section 4.04.4 | RFP | 11,19 | Who is the State’s accessibility authority for decisions/waivers? What tools does ADF&G prefer (axe, Siteimprove, WAVE, PAWS, screen reader matrix), and what acceptance thresholds apply (zero critical/blockers, % pass rate)? | We are not ADF&G. We must comply with all WCAG accessibility requirements. | |
| 90 | Section 3.10 | RFP | 13 | Sec. 3.10 requires annual SOC 1/2/3 Type 2 reports from third‑party service providers. If the selected CMS is SaaS, will the State accept the vendor’s SOC 2 Type 2 and a downstream responsibility matrix from the implementer? | There is no section 3.10 in this RFP. The RFP 758 2600000258 is for the Commonwealth of Kentucky. Please rephrase your question and resubmit in the second set of Vendor questions. Refer to Section 1.1 Anticipated Schedule of Activities | |
| 91 | Sections 3.10-3.12 | RFP | 13 | Sec. 3.11 disallows subcontractors. May we utilize specialized accessibility testers or cloud platform partners as third‑party service providers under our responsibility (without subcontracting labor to them), or is all labor required to be our staff? | There is no section 3.11 in this RFP. The RFP 758 2600000258 is for the Commonwealth of Kentucky. Please rephrase your question and resubmit in the second set of Vendor questions. Refer to Section 1.1 Anticipated Schedule of Activities | |
| 92 | Section 4.2–4.8 | RFP | 14-17 | Are there additional Commonwealth or agency-specific policies (beyond KITS, NIST 800-53, GDPR, IRS Pub 1075) that must be complied with and addressed in the proposal? | Vendor must comply with all of the RFP requirements. | |
| 93 | Section 4.1 | RFP | 14 | Are there any other requirements for Cloud-hosted solutions other than FedRAMP/NITRUST-certification? | The vendor must comply with Section 4.1 of the RFP and propose their best solution. | |
| 94 | Section 3.2 | RFP | 14 | Are there specific value-added services (e.g., training, change management, content strategy) that DPA would prioritize if offered? | DPA prioritizes fulfilling all RFP requirements. Value-added services would be considered but not prioritized over RFP requirements. | |
| 95 | Section 4.3.A; 4.17 | RFP | 15 | Our CMS products are not currently KITS approved. Will that preclude us from competing? Or will we need to seek being granted a written exception to KITS? | No. If the technology is not on KITS, it must be accepted by the Commonwealth to be added to KITS or granted as an exception to KITS per CIO-051. Please follow the process in Section 6.7(A)(i) for submitting deviations to the RFP requirements. | |
| 96 | Section 4.3.B | RFP | 15 | What is the frequency that technology roadmaps need to be supplied? | Section 4.3(B) states the vendor "may" be required to submit a technology roadmap. It also states that additional roadmaps will be submitted "upon request". There is no frequency and may or may not be requested. | |
| 97 | Section 4.04.4 | RFP | 19 | How many UAT cycles, who participates, and what constitutes acceptance for each milestone? | The RFP 758 2600000258 is for the Commonwealth of Kentucky. Please rephrase your question and resubmit in the second set of Vendor questions. Refer to Section 1.1 Anticipated Schedule of Activities. | |
| 98 | Section 4.14 | RFP | 19 | Can you clarify your definition of co-mingling of data? Is it okay to have a webserver with multiple clients but where no clients can access another client's data? In other words, is it okay to provide a non-dedicated server? | Servers may be shared resources as long as client controls, configurations and data are completely isolated - no access or impact KY functions. | |
| 99 | Section 4.16 | RFP | 20 | Are there specific requirements for integration with COT’s monitoring and alerting systems, or is a vendor-provided dashboard sufficient? | Please provide your best solution and per the RFP Section 4.16 "Vendor shall work with the agency and COT to establish a monitoring solution" | |
| 100 | Section 4.18 | RFP | 20 | Will DPA require a detailed project management plan aligned to COT-DGS standards as part of the proposal, or only upon award? | See Section 6.8 D. for requested Project Plan details to be submitted with the vendor proposal. The plan must comply with Section 4.18. | |
| 101 | Section 4.19 | RFP | 26 | Are ISO 27001 controls suffient to satisfy your NIST 800-53 requirements? | This is an equivalency requirement and ISO-27001 should be sufficient | |
| 102 | Sections 6.9 and 10.4 | RFP | 34, 39 | To ensure accuracy in preparing the required firm fixed price Cost Proposal, can the Commonwealth clarify whether there is an established funding ceiling, target cost range, or expected level‑of‑effort guidance associated with this project? If no specific budget parameters can be shared, can the Commonwealth provide direction on the scale or complexity assumptions vendors should use when developing pricing? | This information will not be shared. Substantial clean-up required. | |
| 103 | Section 7.4 | RFP | 36 | If selected for oral presentations, are there specific scenarios or use cases DPA would like demonstrated (e.g., AI chatbot, content migration, analytics dashboards)? | Vendors are expected to propose their best solution to complete all requirements listed in the RFP. A demonstration agenda will be shared if selected for oral presentations. | |
| 104 | EAS Code 2060 - Cloud Services (XaaS) | KITS Library | 5 | From KITS: "Any Cloud Services that are vendor driven that would | ||
| live outside of COT managed cloud environments would be processed as an Exception." Would we have to process an exception prior to competing for this work? | No. If the technology is not on KITS, it must be accepted by the Commonwealth to be added to KITS or granted as an exception to KITS per CIO-051. Please follow the process in Section 6.7(A)(i) for submitting deviations to the RFP requirements. | |||||
| 105 | 3.1 Scope of Work/Technical Requirement | 5 | On which platform the existing website is developed? | WordPress | ||
| 106 | Can the work be performed remotely or outside USA? | No. All state data must remain within the continental US. Offshore development is at the discretion of the agency as long as state data and access is restricted to the continental US. See Section 4.7 of the RFP. | ||||
| 107 | 3.1 Scope of Work/Technical Requirement | 3.1 | 9 | Does the experience need to support designs for other subdomains or portals? Or will all have the same user experience? | All will have the same experience. | |
| 108 | Do you have an estimated amount of expected website traffic? | There are 7,000-8,000 unique visitors per month, and 20,000 page views per month. | ||||
| 109 | 3.1 Scope of Work/Technical Requirement | 11&12 | What is your anticipated role in the content migration? Is there a substantial amount of clean-up, content redevelopment, or optimization needed? | Vendor will be responsible for content migration and organization of content on the new site. Vendors should anticipate content organization, metadata normalization, and link validation as part of the migration scope. The RFP does not require content development or redevelopment. |
There are 19,664 pages on the Trumpet. About 20,000-30,000 files. Most are PDFs, others include Word docs, PowerPoints, Vimeo links, and older videos are embedded. Exact number of files per type and size is impossible to determine; the Trumpet is a subsite of NAPD, and we cannot see those settings. Nothing is to be excluded during transfer. The external website has 86 webpages with 1,803 media files totaling 3.3GB.
| 110 | Hosting & Infrastructure | Is hosting also required for this Project, Does the City (or your specific team) have a preference on AWS vs Google Cloud for the infrastructure? | The vendor must comply with Section 4.1 of the RFP and propose their best solution. | ||
| 111 | 3.1 Scope of Work/Technical Requirement | 5 | Are there specific SEO goals or targeted keywords? | Our primary goal for the Trumpet is to increase useability and functionality so that more defenders utilize the resource. For the website, to increase traffic and assistance to clients. | |
| 112 | What is the estimated budget for this project? | This information will not be shared. | |||
| 113 | translation tools | Section 3.D.5 | Section 3.D.5 mentions translation tools. Is the Commonwealth looking for real-time machine translation (e.g., Google Translate API integration) or a system that supports manually curated multilingual content blocks? | There will be no content written in any language other than English. Refer to section 3.1 D.5. | |
| 114 | Active Directory Integration: | Does the DPA use Azure AD (Entra ID) exclusively for SSO, or is there an on-premises Active Directory component that requires a specific connector for authentication?" | Azure Entra ID is used for SSO | ||
| 115 | Hosting & Infrastructure | If the vendor proposes a cloud-hosted solution on a COT-managed tenant, what specific cloud providers (e.g., Azure, AWS, Google) are currently supported and managed by COT? | Azure, AWS, GCP | ||
| 116 | Data Migration Complexity | What is the approximate volume of data (in GB) and the number of individual files/documents currently residing on the NAPD subsite that need to be migrated to the new Trumpet platform?" | 19,664 pages on the Trumpet. About 20,000-30,000 files. Most are PDFs, others include Word docs, PowerPoints, Vimeo links, and older videos are embedded. Exact number of files per type and size is impossible to determine; the Trumpet is a subsite of NAPD, and we cannot see those settings. Nothing is to be excluded during transfer. | ||
| 117 | 3.1 Scope of Work/Technical Requirement | 6 | What is your anticipated role in the content migration? Is there a substantial amount of clean-up, content redevelopment, or optimization needed? | Substantial clean-up required, DPA will be involved in conversations around what to keep and what to archive | |
| 118 | 3.1 Scope of Work/Technical Requirement | 10 | Identify the key use cases where the system must accurately interpret and translate non-standard dialect or slang terms to maintain content accessibility | Primary use cases involve internal staff searching using acronyms, shorthand, legal terms, or informal phrasing rather than exact document titles. The system should recognize and map these variations to the appropriate internal content. | |
| 119 | How many pages will you be migrating from the current site to the new site? | The selected vendor will be required to migrate the following number of pages Website: approximately Eighty-Six (86) Trumpet: approximately Nineteen-Thousand Six Hundred and Sixty-Four (19,664) | |||
| 120 | Do you have any incumbent for this Opportunity? | No | |||
| 121 | 3.1 Scope of Work/Technical Requirement | 4 | which type of employees data you will add on this site. do we need to create LMS type backend to add employees data because I saw you put some training related data also? | Employee data added will be their email for login purposes. The Request for Proposal is not requesting a Learning Management System. Please rephrase your question and resubmit in the second set of Vendor questions. Refer to Section 1.1 Anticipated Schedule of Activities. | |
| 122 | 3.1 Scope of Work/Technical Requirement | 4 | Need to know about the trainings that will be added on site. That will be based videos, videos plus description or any other custom fields data? Either need to create LMS or need to just put videos on site. | The Request for Proposal is not requesting a Learning Management System. Please rephrase your question and resubmit in the second set of Vendor questions. Refer to Section 1.1 Anticipated Schedule of Activities |
Current learning includes video links, handouts, presentation, title, description, and speaker information.
123 2. Technical and Performance 6 one of the requirement is [Shall provide a disaster recovery (DR) and failover plan, including geographic redundancy and defined Recovery Time Objective (RTO) and Recovery Point Objective (RPO) parameters]].
| could not understand this | Vendor should propose how to ensure data is maintained should a catastrophic event occur (i.e., server destroyed at the primary location). | ||||
| 124 | 3.1 Scope of Work/Technical Requirement | 13 | Which type of data would you like to bulk import. trainings related videos, any other custom fields data or its just to create number of user accounts by importing the necessary information? | For the Trumpet, there are 19,664 pages on the Trumpet. About 20,000-30,000 files. Most are PDFs, others include Word docs, PowerPoints, Vimeo links, and older videos are embedded. Exact number of files per type and size is impossible to determine; the Trumpet is a subsite of NAPD, and we cannot see those settings. Nothing is to be excluded during transfer. |
For the external website, there are 86 webpages with 1,803 media files totaling 3.3GB.
User accounts for the Trumpet would also need to be created. See RFP Section 3.1 B.2.
| 125 | 3.1 Scope of Work/Technical Requirement | Will you use wordpress CMS for this development and will you use mobile first css framework. | See RFP section 3.1 A.1.a. and 3.1 A.1.g. The site should be fully responsive, accessible (WCAG 2.2 AA compliant), and optimized for performance across devices. Vendors are to propose their best solution. | ||
| 126 | 3.1 Scope of Work/Technical Requirement | Can you provide a list of all the Kentucky county offices that need to be displayed on Google Maps? | Yes, we will provide a list. Additionally, you can see all offices on our current website: https://dpa.ky.gov/kentucky-department-of-public-advocacy/findhelp/find-a-dpa-office/ | ||
| 127 | 3.1 Scope of Work/Technical Requirement | What specific information do you want displayed when users click on a pin (e.g., office name, address, contact details)? | Office name, directing attorney, office address, office phone, office email, description of office, photo of the office, and link to the office page on the website. These items could later be modified. | ||
| 128 | 3.1 Scope of Work/Technical Requirement | 3.1 | Are there any specific design or functionality preferences for the map integration? | No. | |
| 129 | 3.1 Scope of Work/Technical Requirement | 3.1.F.5 | 12&13 | We need details of permissions each role should have regarding content access? | Refer to RFP Section G.3. |
While the current Trumpet site provides broad content visibility across users, DPA requires the new platform to support role-based access controls (RBAC) for both content management and content visibility where appropriate.
The system should allow assignment of permissions based on defined user roles and/or their associated job role (e.g., administrator, content editor, attorney, investigator, administrative staff), with the ability to restrict specific content, sections, or resources to designated roles or user groups.
Detailed role definitions and permission mappings will be refined during implementation; however, the platform must support flexible and scalable role-based content access controls.
| 130 | SECTION 2 - INTRODUCTION | 4 | How frequently do you plan to upload new training videos, and who will be responsible for this? | Training videos are uploaded alongside every training we have, as we record nearly every training. About two weeks of every month is filled with trainings. There is a DPA staff member responsible for video production and uploading those videos to the internal site, and they should retain this ability with the new site. | |
| 131 | SECTION 2 - INTRODUCTION | 4 | Should all staff have access to all training videos, or will there be restrictions based on user roles? | All staff should have full access to all training videos, but the ability to restrict should exist. See RFP section 3.1 F.5.b. and 3.1 G.3. | |
| 132 | 3.1 Scope of Work/Technical Requirement | 6 | How often would you like the site to be backed up (daily, weekly, monthly)? | DPA expects automated daily backups at minimum. Vendors should define retention policies and restoration procedures as part of their disaster recovery plan. | |
| 133 | 3.1 Scope of Work/Technical Requirement | 6 | Where would you like the backup data to be stored (e.g., cloud storage, local server)? | The vendor must comply with Section 4.1 of the RFP as well as the other requirements and submit its best solution. | |
| 134 | 3.1 Scope of Work/Technical Requirement | 3.1.E.4.c | 11 | What specific information do you want to be logged for access attempts (e.g., user ID, timestamp)? | UserID and date/time stamps must be logged. Refer to RFP section 3.1 F.5.d. |
| 135 | 3.1 Scope of Work/Technical Requirement | 3.1.E.4.c | Would you like to receive alerts for specific types of access attempts? | See RFP section 3.1 E.4.c. | |
| 136 | 3.1 Scope of Work/Technical Requirement | 3.1 B.3 | 7 | What specific information do you require for each user account (e.g., name, email, role) in order to bulk import? | First name, last name, email, and job role |
| 137 | 3.1 Scope of Work/Technical Requirement | Are there any existing systems or platforms that this new site needs to integrate with? | No | ||
| 138 | 3.1 Scope of Work/Technical Requirement | 3.1.A.2.I | What are your expectations for ongoing support and maintenance after the site is launched? | See section 3.1 A.2.l. Vendors are to propose their best solution. | |
| 139 | Section 2.1 – Purpose | RFP | 4 | Can the Commonwealth confirm whether the vendor’s responsibility includes ongoing content creation and updates post-launch, or if support ends after initial deployment and knowledge transfer? | Content creation is not in the scope of the RFP. See section 3.1 A.2.l. Vendors must comply with the RFP. |
| 140 | Section 2.2 – Background | RFP | 4 | Are there any known functional or data limitations in the current Trumpet platform that vendors should be aware of prior to migration? | Content organization has evolved over multiple prior platform transitions without a formal content governance or archival strategy, resulting in some redundancy and discoverability challenges. |
Metadata and tagging practices are inconsistent across content, and prior transitions have resulted in broken external media links (e.g., Vimeo-hosted videos).
Vendors should anticipate the need for content audit, metadata normalization, link validation, and information architecture refinement as part of migration planning.
| 141 | Section 3 – Scope of Work | RFP | 5 | Should the external website and Trumpet internal platform be treated as two independent projects with separate timelines and approvals? | Vendors are to propose their best solution. |
| 142 | Section 3.1.A.1.a | RFP | 5 | Is WordPress the preferred CMS, or may vendors propose alternative CMS solutions that meet all technical, security, and accessibility requirements? | Any proposed platform must meet the requirements of the RFP. DPA is not committed to WordPress. |
| 143 | Section 3.1.A.1.c | RFP | 5 | Approximately how many unique page templates are anticipated for the external website? | There are currently 86 pages, with 10 different styles of page. Flexibility is needed. Vendors are to propose their best solution for this project. |
| 144 | Section 3.1.A.1.i | RFP | 5 | Will the Commonwealth provide GIS data for the interactive Kentucky county map, or should the vendor source and configure this data? | Vendor should source and configure. |
| 145 | Section 3.1.A.1.j | RFP | 5 | Should the office-level contact forms route messages to a centralized inbox or to individual office administrators? | See section 3.1 A.1.j. Vendors are to propose their best solutions. |
| 146 | Section 3.1.A.2.b | RFP | 6 | Should the SEO audit and optimization be limited to on-site SEO, or should it also include content strategy recommendations? | The scope includes a comprehensive technical SEO audit (metadata, indexing, redirects, schema, crawlability, and performance). Content SEO strategy and page rewrites are not required beyond high-level recommendations. |
| 147 | Section 3.1.A.2.e | RFP | 6 | Can the Commonwealth confirm whether WCAG 2.2 AA compliance certification or third-party accessibility testing is required? | Compliance must be validated through a combination of automated accessibility scanning and manual testing, including keyboard navigation and screen reader validation. Vendors should document testing methodologies and remediation efforts to demonstrate conformance with WCAG 2.2 AA guidelines. |
| 148 | Section 3.1.A.2.g | RFP | 6 | Is multilingual support expected to be automated, human-reviewed, or a hybrid approach? | Hybrid |
| 149 | Section 3.1.B.1.j | RFP | 6 | Can the Commonwealth clarify expectations for the structure and scale of the motion bank and learning materials database? | 19,664 pages on the Trumpet. About 20,000-30,000 files. Most are PDFs, others include Word docs, PowerPoints, Vimeo links, and older embedded videos are embedded. |
Vendor is to propose their best solution.
| 150 | Section 3.1.B.2.a | RFP | 7 | Can the Commonwealth provide an estimated count of documents, videos, and total storage size for Trumpet content migration? | 19,664 pages on the Trumpet. About 20,000-30,000 files. Most are PDFs, others include Word docs, PowerPoints, Vimeo links, and older embedded videos are embedded. Exact storage size is impossible to determine; the Trumpet is a subsite of NAPD, and we cannot see those settings. |
| 151 | Section 3.1.B.2.c | RFP | 7 | Are there existing external links referencing Trumpet content that must remain functional after migration? | No |
| 152 | Section 3.1.B.3.d | RFP | 7 | Which identity provider is currently used for authentication (e.g., Azure AD), and will test credentials be provided? | Currently NAPD manages users for the Trumpet. It is a subsite on WordPress and uses a username and password, not Azure AD. We do not know specifics beyond that. Test credentials for the Trumpet can be provided. |
| 153 | Section 3.1.B.3.f | RFP | 7 | Are MFA policies enforced at the identity-provider level or expected to be implemented within the application? | MFA not currently in use for the Trumpet. See RFP section 3.1 B.3.f. |
| 154 | Section 3.C.1 | RFP | 7–8 | Does the Commonwealth have a preferred enterprise search platform, or should vendors propose an end-to-end search solution? | There is no preferred enterprise search platform. Vendors should propose their best solution. |
| 155 | Section 3.C.1.i | RFP | 7 | Is near-real-time indexing required for search, or is daily indexing sufficient? | Search indexing should occur automatically upon content publication or update. At minimum, a nightly refresh is acceptable. No hard SLA for search freshness is currently defined; vendors may propose standard best practices. |
This is the start of the file's text. The full file is on GovTribe.
File details come from the government source that posted it. Updated .