RFI 2026018 Mass Notification Solution.pdf

Request for Information

Mass Notification Solution

RFI No.: 2026018

RFI No. 2026018 1 of 14 (Revised 04.25.22)

REQUEST FOR INFORMATION

Mass Notification Solution DEP Posting Number: 2026018

The Florida Department of Environmental Protection (“Department or DEP”) is issuing this Request for Information (RFI), as defined in Section 287.012(22), Florida Statutes (F.S.), to Interested Entities concerning certain commodities and services relating to a hosted Software-as-a-Service (SaaS) Mass Notification Solution. Please note that under Section 287.012(22), F.S., responses to this request are not offers and will not be accepted by the Department to form a binding contract.

Interested Entities can view and download this RFI from the Vendor Information Portal (VIP) website at https://vendor.myfloridamarketplace.com/. Once at this site, the steps listed below should be followed to access the VIP.

• Click “Search Advertisements”

• Under the “Organization” search field, select the “Department of Environmental

Protection”

• Scroll down and click on “Search”

• Click on the applicable RFI number https://vendor.myfloridamarketplace.com/

DEP RFI No. 2026018 Page 2 of 14

TABLE OF CONTENTS

SCHEDULE OF EVENTS

Section 1.00 – INTRODUCTION

1.01. Purpose and Scope

1.02. Procurement Officer

1.03. Questions

1.04. Addenda

1.05. Submittal of Response

1.06. Public Records

1.07. RFI Process

1.08. Appendices

SECTION 2.00 – TECHNICAL REQUIREMENTS

2.01. Overview

2.02. Minimum System Requirements

2.03. Minimum Notification Requirements

2.04. Minimum Security Requirements……………………………………………………………………………………… 11

2.05. Minimum Support Requirements ………………………………………………………………………………………11

APPENDIX A – VENDOR INFORMATION

APPENDIX B – COST INFORMATION

DEP RFI No. 2026018 Page 3 of 14

SCHEDULE OF EVENTS

The following schedule will be strictly adhered to in all actions relative to this posting. The Department reserves the right to make adjustments to this schedule and will notify Interested Entities in the request by posting an addendum on the VIP. It is the responsibility of the Interested Entity to check VIP on a regular basis for such updates.

DATES EVENTS METHOD

05.12.26 RFI Advertised Vendor Information Portal

https://vendor.myfloridamarketplace.com/

05.26.26 by 5:00

PM ET

Questions Submitted in Writing

Submit via email:

Attn: Wanda Norton, Procurement Officer E-mail: Wanda.Norton@FloridaDEP.gov

RFI NUMBER MUST BE IN SUBJECT LINE OF EMAIL

On or about, 06.09.26

Answers to Questions Posted

Vendor Information Portal https://vendor.myfloridamarketplace.com/

06.23.26 by 3:00

PM ET

Response Due

Submit via email:

Attn: Wanda Norton, Procurement Officer E-mail: Wanda.Norton@FloridaDEP.gov

RFI NUMBER MUST BE IN SUBJECT LINE OF EMAIL

– Remainder of Page Intentionally Left Blank – mailto:XXXXXXXXX@FloridaDEP.gov mailto:XXXXXXXXX@FloridaDEP.gov

DEP RFI No. 2026018 Page 4 of 14

Section 1.00 – INTRODUCTION

1.01. Purpose and Scope. The Florida Department of Environmental Protection (“Department”), (“DEP”) is requesting information from Interested Entities with proven, verifiable, and documented expertise in providing a hosted SaaS Mass Notification Solution that could be used by DEP to notify employees and the public (opt-in) of emergency and non-emergency alerts and notifications throughout the State. This Request for Information (RFI) is being issued strictly for the purpose of gaining knowledge of the products and services available on the market.

THIS IS NOT A REQUEST OR INVITATION FOR COMPETITIVE BIDS, PROPOSALS OR REPLIES, AND NO

CONTRACT WILL BE AWARDED IN RESPONSE TO SUBMISSIONS.

If, as a result of the RFI, the Department decides to pursue contract(s) to provide any of the services mentioned and Interested Entities capable of providing such services are identified, a competitive procurement package may be developed and issued at a later date.

1.02. Procurement Officer.

Wanda Norton, Procurement Officer Procurement Section, Carr Building, Room 215 Florida Department of Environmental Protection 3800 Commonwealth Boulevard, MS#93 Tallahassee, Florida 32399-3000 Telephone Number: (850) 245-2447 Wanda.Norton@FloridaDEP.gov

1.03. Questions. Any questions from vendors concerning this RFI shall be submitted in writing, identifying the submitter and RFI number, to the Procurement Officer no later than the time and date specified in the Schedule of Events. All inquiries must be submitted by E-mail. All questions and answers will be posted on the VIP. It is the Vendor’s responsibility to periodically check the VIP. The Department bears no responsibility for any delays, or resulting impacts, associated with a Vendor’s failure to obtain the information made available through the VIP.

1.04. Addenda. If the Department finds it necessary to supplement, modify, or interpret any portion of the RFI documents, a written “Addendum” will be posted on the VIP. It is the responsibility of the Vendor to be aware of any Addenda that might have a bearing on their response.

DEP RFI No. 2026018 Page 5 of 14

1.05. Submittal of Response. Responses are due in accordance with VIP and Schedule of Events.

Vendors’ responses must be in writing and submitted electronically via email. Responses must be emailed to the Procurement Officer (Section 1.02). The naming convention for the subject line within your email is:

Subject Line: Your Company Name – DEP RFI No. 2026018

Once received, all RFI responses and attachments shall become the exclusive property of the Department and will not be returned. The Department is not liable for any of the costs incurred by the Vendor in preparing and submitting a response.

The response package must contain:

• A cover page including the below contact information:

o Vendor/Company Name;

o Contact Name and Title;

o Address; and o Phone Number and email address

• A completed Appendix A – Vendor Information

• A completed Appendix B – Cost Information

• A written narrative detailing the vendor’s proposed solution and how the solution meets or exceeds the requirements of Section 2.00, Technical Requirements.

• Any cooperative purchasing agreements with the vendor where the solution may be purchased.

To ensure a clear understanding of the products and service, the Department may use this RFI as the basis for requesting demonstrations. These demonstrations will be at the department’s discretion and at no cost to the Department.

1.06. Public Records. Any material submitted in response to this RFI will become a public record pursuant to Chapter 119, Florida Statutes (F.S.), once it is shared with the Department. Any claim of confidentiality is waived upon submission, unless addressed as set forth below.

Disclosure and Ownership of Response Contents: A Vendor’s response to this RFI shall be a public record and subject to production, disclosure, inspection and copying consistent with the requirements of Chapter 119, F.S. All information in a Vendor’s response (including, without limitation, technical and price information) will be a matter of public record, subject to the provisions of Florida’s Public Records Act, Chapter 119, F.S., regardless of copyright status. Submission of a response to this RFI shall constitute a waiver of any copyright protection which might otherwise apply to the Department’s production, disclosure, inspection and copying of such response and contract, or any part thereof, except those parts asserted to be exempt under Chapter 119, F.S. The response, upon submission shall be the property of the Department (except those parts asserted to be exempt in the manner set forth below), and the Department, in its sole discretion, shall have the right to use, reproduce, and disseminate the response. The Department reserves the right to use any and all information contained in a response received to this RFI.

Any content submitted to the Department which is asserted to be exempt under Chapter 119, F.S., shall be set forth on a page or pages separate from the rest of the response, and clearly marked “exempt,” “confidential,” or “trade secret” (as applicable), with the statutory basis for such claim of exemption, confidentiality, or trade secret specifically identified in writing on each and every such page. Failure to segregate and so identify any such content shall constitute a waiver of any claimed exemption, DEP RFI No. 2026018 Page 6 of 14 confidentiality, or trade secret as applied to the portion of the response or other document in which the content is set forth.

Per Section 287.012(22), F.S., “Responses to these requests are not offers and may not be accepted by the agency to form a binding contract.” Vendors submitting information to this RFI are not prohibited from responding to any related subsequent solicitation. The Department reserves the right to use or reject any information supplied in response to this RFI.

1.07. RFI Process. The Department will review and analyze information received in response to this RFI to determine the feasibility of issuing a competitive solicitation for these products/services. Any request for cost information received will be used solely to gain a perspective of the potential budgetary magnitude.

Responses to this RFI will be reviewed for informational purposes only and will not result in the award of a contract. Submitting a response to this RFI shall not disqualify a vendor for responding to any related subsequent solicitation.

1.08. Appendices.

• Appendix A – Vendor Contact Information

• Appendix B – Cost Information

DEP RFI No. 2026018 Page 7 of 14

SECTION 2.00 – TECHNICAL REQUIREMENTS

2.01. Overview. DEP is seeking information from vendors that can provide a hosted Software-as-a- Service (SaaS) Mass Notification Solution (Solution). DEP is interested in Solutions that include, but are not limited to, the following options/functions:

• Annual subscription price for access to all SaaS resources should include maintenance and upgrades.

• Ability to log-in to the SaaS system 24 hours a day, seven days a week and 365 days a year from any device.

• Ability to “identify/brand” messages and corresponding webpage messages/templates.

• Ability to turn the texting function on/off by DEP.

• Must have a “discovery” capability for all text messaging. (Public Records Request)

• Must have ability to use a custom Short Message Service (SMS) message with high-character limitation.

• Must have ability to include a link to the end of SMS messages to enable recipients to view the entire message as a webpage message.

• Ability to escalate notifications to ensure that the next method (secondary) or person/group is notified if the primary method or first person/group does not timely acknowledge response.

• Ability to build events for one-click sending during incidents.

• Set up notification templates with predetermined contact lists and pre-defined messages for faster communications in a crisis. For example, multiple-choice polling questions with different responses: safe/not safe; yes/no; 1 / 2.

• Ability to broadcast messages to any communications device, including desktop alerts.

• Support multi-platform smart phones and tablets, including Apple® iOS and Android™ devices.

• Ability to resend notifications to recipients or send follow up messages to all or a sub-set of recipients for tracking within the same incident or event.

• Ability to put DEP management and operating structure into multiple notification environments.

• Ability to separate by geography, department/function, building or other criteria.

• Ability to automatically publish notifications to public websites, Intranets, internal systems and social media.

• Ability to manage settings, limits and defaults through an administrator interface.

• Ability to have multiple administrator roles.

• Ability to import, organize and categorize data. The vendor must sync the data on a regular schedule to ensure the contact list and information is accurate and current.

• Ability to set opt-in portals to either publicly available or private (invitation only) and allow contacts to opt-in, update and manage their accounts – including contact information, locations they care about, alert preferences and more- through branded, customizable web-based portals.

• Ability to automate bulk, partial and full updates utilizing a secure, industry standard method for data transfer.

• Define role-based access controls for managing separate user and contact data.

• Ability to notify contacts and/or manage contact data across multiple distributed data stores and groups from a single access point.

• Include multiple groups and custom fields from internal systems to help with message targeting.

DEP RFI No. 2026018 Page 8 of 14

• Communicate with multilingual text-to-speech support.

• Send notifications with customized caller ID’s (DEP branding) so that the number is local and familiar to the call recipient.

• Interactive Survey - phone and web-enabled surveys with multiple questions and responses interactive conference call.

• Interactive Conference Call - message recipients can join a live conference call after the voice message has finished playing.

• Meet the standards for regulatory requirements and handling of personally identifiable information.

• Support accessibility guidelines - public and private portals are Section 508 of the Rehabilitation

Act of 1973, as amended in 1998 compliant and include field-level view/read/write access controls.

• Analytic and reporting capabilities.

• Accurate incident analyses in real-time.

• Provide summary and detailed notification analysis (DNA) reports for after-the-event.

• Ability to run reports with off-line creation of pivot tables and cross-referencing.

• Ability to create reports and analyze data.

Geographic tools:

• Send messages to recipients in a specific geographic region (zip code, street address, radius from a specific point or other attribute) with GIS-based message targeting.

• Load, geo-code and manage contact data within a single interface and in real-time.

• Exclude specific contacts from targeted messaging, based on defined attributes, including location.

The system shall have the following levels of access by definition:

• System Administrator: Individuals at the state-level that perform account administration and oversight activities, to include creating new jurisdiction-level accounts and monitoring system usage across all lower accounts.

• Jurisdiction Administrator: Primary user for the jurisdiction, able to create and manage message originator accounts and recipient contact data sources within the jurisdiction’s segment of the system. Also performs the functions of a message originator.

• Message Originator: Individual authorized to initiate a notification message and monitor the status of other notifications originated within the jurisdiction.

• Recipient: End-users: Contact in the jurisdiction’s account; someone who receives a notification.

2.02. Minimum System Requirements. The System shall include the following, minimum requirements:

• Provide statewide coverage to an unlimited number of recipients.

• Be capable of sending mass notifications for multiple unique simultaneous events.

• The following levels of access: Administrator, Jurisdiction Administrator, Message Originator and

Recipient. The system must allow each administrator and message originator to have a unique username and credentials to access the site and launch calls, at no additional cost.

• Tiered administration to include multiple levels. Administrators shall be able to view system activity of all administrators below their level. There shall be no limit on the number of administrators.

DEP RFI No. 2026018 Page 9 of 14

• Allow administrators and jurisdiction administrators to create and edit an unlimited number of notification groups and sub-groups. Administrators and jurisdiction administrators shall be able to manage their own user groups. Jurisdiction administrators shall be able to create an unlimited number of message categories that recipients may subscribe to.

• Be web-based and hosted on the vendor’s infrastructure, accessible from any internet connection. The vendor will not require additional client- or server-based hardware to be housed on-site by administrators. The web-based system must be compatible with supported versions of industry standard browsers, at a minimum, Microsoft Edge, Google Chrome, Apple Safari and Mozilla Firefox.

• Fully interface with the Integrated Public Alert and Warning System (IPAWS) for alerting via Wireless Emergency Alerts (WEA), Emergency Alert System (EAS), and HazCollect National Oceanic and Atmospheric Administration (NOAA) Weather Radio All Hazards. The vendor must be a Federal Emergency Management Agency (FEMA) IPAWS Alert Origination Software Provider.

• The ability to accept and utilize E911 phone data at no additional cost and be able to scrub duplicate information.

• Provide a training/exercise mode which provides full functionality but separate from contact data in the “real-world” instances of the system.

• Contains a reporting tool, with the ability for jurisdictions to define reports without vendor assistance and any jurisdiction-defined report format to be generated again in the future. The number of report formats shall be unlimited. The system shall allow for the export of any data in standard delimited format and pdf.

• Allow for the creation and storage of pre-scripted scenarios and messages. The system shall be able to store broadcast templates/scenarios with content and recipients for later deployment.

The system shall allow jurisdiction administrators and message originators to edit pre-scripted messages and scenarios as needed.

• Capable of text-to-speech. Voice recordings and text-to-speech must be reviewable as part of message origination workflow before message transmission.

• Allow web-based access for recipients to a jurisdiction-specific subscription portal where they can “opt in” to the system and manage contact information.

• Allow the public to opt-in to the system by registering phone numbers, SMS/Multimedia Messaging Service (MMS) numbers and email addresses. The system will only require the public to enter one selection for the record to be effective. This information shall be updated in real time. Lost password and username recovery shall be accomplished automatically and without administrator action.

• Allow jurisdiction administrators to customize, without vendor intervention, the opt-in page content and banner for custom branding.

• Ability for recipients to identify a preferred language.

• Allow citizens to register a minimum of two (2) location points in their recipient profile

(example: work, home, etc.). The system shall provide all of the following methods for recipients to register with it:

o Automatically compare addresses against the United States Postal Service data to suggest a correct address, and then automatically geocode the address into the recipient’s profile.

o Provide the ability for recipients to manually input latitude/longitude or decimal degree.

o Provide the ability for recipients to access a graphical user interface where they can view their location on a map and select point.

DEP RFI No. 2026018 Page 10 of 14

• Able to support a minimum of two (2) telephone numbers, two (2) SMS numbers, and two (2) email addresses per recipient.

• Adhere to the Common Alerting Protocol (CAP) standard specified by FEMA via the Organization for the Advancement of Structured Information Standards (OASIS). As new CAP versions and sources are implemented, the system must be updated to include CAP format changes as part of ongoing system updates.

• Support automatically adding and removing recipients at the jurisdiction-level from static and dynamic groups without vendor assistance.

• The inherent capability to immediately import and export recipient group and subgroup data.

Capable of accepting recurring, automated imports and updates, via a secured service.

Information could include items such as employee phone numbers, email addresses, physical addresses and other relevant contact information at no additional cost.

2.03. Minimum Notification Requirements. The System shall include the following, minimum notification requirements:

• Use of the system shall not be governed by number of minutes, messages, increments or credits.

• Accomplish mass notification of the public via phone (landline, VoIP and wireless), NativeSMS via SMPP and MMS messaging, email, and Really Simple Syndication (RSS). The system shall be able to send messages through each of these mediums simultaneously. For notification methods where the sent message exceeds the allowed number of characters the system shall intelligently detect and provide an alternate mechanism for the recipient to view the complete message, such as a webpage message.

• All text/SMS messaging shall be Short Message Peer-to-Peer (SMPP) messaging via cellular network gateway providers. To reduce the possibility of notification messages being handled as spam, the vendor must have an established SMPP short code that whitelisted with the major US commercial cellular carriers (at minimum Verizon, T-Mobile and AT&T). Simple Mail Transfer Protocol (SMTP) text messaging, or any portion of the user profile that requires a user to specify their mobile carrier, does not meet this requirement.

• Be accessed by message originator for the purpose of launch and utilization via a computer with internet connection, smart phone, mobile app and phone to record and schedule calls. Mobile apps shall be designed specifically for their respective device and platform and must support visual Geographic Information System (GIS) map-based notifications.

• Enable message originators to specify whether recipients must acknowledge human receipt of a message. If confirmed receipts are requested, the system must continue trying to reach the recipient until positive confirmation has been received with human acknowledgement. Once acknowledgement has been received, the system will cease all further attempts to reach that recipient.

• Allow message originators to enable a timeout option for notifications, at which time notification attempts will cease, even if a user has not been successfully contacted. For weather notifications, this timeout window should default to the expiration of the product issued by the National Weather Service.

• Allow jurisdiction administrators to use a system default or create a jurisdiction level caller ID and send-from email address to outgoing notification recipients.

• Allow outgoing notification messages to contain photo, video, audio attachments and links.

• Americans with Disabilities Act (ADA) compliant to include Test-Driven Development (TDD)/Teletypewriter (TTY) capability.

DEP RFI No. 2026018 Page 11 of 14

• Provide online real-time reports detailing success, failure and reason for failure. These reports shall be customizable per jurisdiction administrator.

• Able to recognize human voice versus an answering machine and wait until the outgoing message from an answering machine or voicemail system has ended prior to leaving the message.

• Allow for voice message throttling, which allows the sender to determine and define desired delivery rate for specific area codes and prefixes so as to not overwhelm a telephone exchange for a given area.

2.04. Minimum Security Requirements. The System shall include the following minimum security requirements:

• System shall require a secure login for any administrator or message originator to access the system. The secure login shall be a case-sensitive complex password with the following attributes:

o Minimum 8 characters o Maximum 15 characters o Allow for upper and lower-case letters.

o Allow for numeric and common symbols (i.e.!@#$%^&*)

• Not allow trivial passwords for login (i.e. username, person’s name, people, places, keyboard patterns like “qwerty”, dates, or dictionary words).

• Encrypt data at rest and in transit.

• Create an auditable event log for all account actions to be accessible by the system administrator.

• System data centers shall reside in the United States.

• Allow for Single Sign On integration with the Department’s identity provider using industry standard protocols, OAuth 2.0 or OpenID Connect.

• Allow for user management through role or group assignment within DEP’s identity provider.

2.05. Minimum Support Requirements. The System shall include the following, minimum support requirements:

• The vendor shall provide 24-hour Helpdesk assistance to support the application’s users at all levels, reachable by telephone or email, and with sufficient resources to respond to assistance requests within 30 minutes. Helpdesk assistance must be available in multiple languages and via

TTY.

• The vendor shall be able to initiate alert notifications on behalf of administrators and jurisdiction administrators if connectivity with the system is lost.

• The vendor shall provide maintenance of the system to ensure there is no downtime. The system will provide a backup site as redundancy with an automatic flip in case of site failure.

• The system will provide online user help and assistance. Online help will consist of text-based, contextual help, as well as video and audio assisted help. Help for system use should also be interlaced within the site (i.e. screen-within-a-screen). Training for system use must be web-based.

• The system must have 24-7 technical support available to customers via phone and Internet support.

• The annual maintenance agreement will include vendor maintenance, and support shall include all applicable patches released including for any 3rd party system components.

DEP RFI No. 2026018 Page 12 of 14

• There must be a one (1)-month period to test system functionality to allow for the event that users determine additional requirements or fixes to fulfill the intended use and need of the system. The vendor will meet these needs if they are determined within the testing period.

• The system’s recipient data, including opt-in or jurisdiction supplied, remains the property of the jurisdiction and/or State of Florida. The data must be exportable from the system at any time and provided to the State of Florida for distribution to jurisdictions upon termination of the contract. Data shall only be used by the vendor for the sole purpose of initiating notifications through the system and may not be used for marketing purposes. The data may not be sold or rented to any third party.

DEP RFI No. 2026018 Page 13 of 14

APPENDIX A – VENDOR INFORMATION

Providers are asked to provide the following information:

CONTACTS

Primary contact regarding this submission? Name:

Email Address:

Phone:

Title or Role in Organization?

Primary contact to schedule Presentation:

(If other than contact above)

Name:

Email Address:

Phone:

Title or Role in Organization?

Company Name

Company Website URL:

Type of Organization (Corporation, Partnership, etc.):

How long has your company been in this type of business?

Years:

Months:

Location of Project Manager that would serve the Department:

City:

State:

Location of Regional Sales Manager that would serve the Department:

City:

State:

DEP RFI No. 2026018 Page 14 of 14

APPENDIX B – COST INFORMATION

Providers are asked to provide the following cost information:

DESCRIPTION

TIMELINE

(If Applicable)

PER/UNIT OF

MEASURE QUANTITY

ESTIMATED

DOLLAR

AMOUNT

Estimated Support Rates:

Estimated Licensing Cost:

Estimated Upgrades and other Maintenance Costs per Year:

Estimated Third Party Licenses Requirement Costs:

Estimated Cost of Implementation Including Migration Service Fees:

Length of typical implementation: