Title of the RFP: Incoming Mailroom Modernization RFP Number: RFP-185-2525-2026

REQUEST FOR PROPOSAL (RFP) COVER SHEET

DISCLAIMER: “If you experience difficulty accessing or reading this document and would like to request an accessible version compatible with screen readers, please contact Steven Dawson -steven.dawson@dom.iowa.gov – (515) 805-7902 to obtain one.”

Title of the RFP: IDR Incoming Mailroom Modernization

RFP Number: RFP-185-2525-2026

Agency: Department of Management – Division of Information Technology (DOM DoIT)

Iowa Department of Management on behalf of Iowa Department of Revenue (IDR)

The State of Iowa seeks to purchase:

A comprehensive, modernized mailroom Solution for the Iowa Department of Revenue (IDR), including hardware, software, and services.

Through this procurement, IDR aims to replace aging infrastructure and Manual processes with an Integrated, automated system that improves efficiency, accuracy, and security in Correspondence handling and Document processing. The Vendor will be responsible for delivering all necessary components, supporting full Integration with IDR’s existing systems, and providing ongoing maintenance, support, and training to ensure the Solution meets IDR’s operational, compliance, and future state objectives.

Issuing Officer

Name: Steven Dawson Email:

Steven.Dawson@dom.iowa.gov Phone: (515) 805-7902

Main Address:

Iowa Department of Management Attn: Steve Dawson 200 E. Grand Ave.

Des Moines, IA 50309

Notice Address:

Iowa Department of Management Attn: Office of General Counsel 1007 E. Grand Ave G13 Des Moines, IA 50319

Links:

IMPACS

eProcurement Website:

https://bids.sciquest.com/apps/Router/PublicEvent?CustomerOrg=DASIowa All documents for this Solicitation will be posted in IMPACS

Important Websites: Pre-proposal Conference meeting link-- meet.google.com/wsv-pttd-auh

Contract Terms and Conditions:

Refer to Section 7. Contract Terms & Conditions and Contract Administration, as well as Attachment #5: Sample Contract.

mailto:steven.dawson@dom.iowa.gov https://bids.sciquest.com/apps/Router/PublicEvent?CustomerOrg=DASIowa%20 https://bids.sciquest.com/apps/Router/PublicEvent?CustomerOrg=DASIowa%20 https://meet.google.com/wsv-pttd-auh?hs=224

Timetable There are no exceptions to any deadlines for Respondents.

However, the Agency reserves the right to change dates and times at its sole discretion.

Event or Action: Date / Time – Central Time

Targeted Small Business (TSB) website posting: April 6, 2026 State issues Solicitation: April 8, 2026

Pre-Submission Conference & Site Visit April 22, 2026, 10:00AM Central

Rm A104A, Hoover State Office Bldg 1305 E. Walnut St, Des Moines, IA

Round 1 Questions: Respondent’s written questions, requests for clarification, and suggested changes are due:

April 28, 2026 3:00PM Central

Round 1 Response: Written response to questions, requests for clarification, and suggested changes are due: May 7, 2026

Proposals Due:

June 8, 2026

3:00PM Central Anticipated Dates for Vendor Presentations July 20-24, 2026

Anticipated Date to issue Notice of Intent to Award: August 20, 2026

Anticipated Date to Execute Contract: January 29, 2027

Firm Proposal Terms. The minimum number of days post-submission deadline that the Respondent guarantees all Proposal terms, including price, will remain firm is:

180 days

Agreement Information

Potential initial term of the Contract: Five (5) years

Potential number of annual renewals: Ten (10)

Anticipated start date: February 1, 2027

Anticipated end date: January 31, 2032

Available to other entities authorized to purchase under the resulting Contract (s)?

YES, including local governmental entities, other states via piggybacking, and non-profit organizations, as long as permissible under the law.

TABLE OF CONTENTS

REQUEST FOR PROPOSAL (RFP) COVER SHEET

1. Introduction

1.1. Purpose

1.2. Background

1.3. Definitions

2. Scope of Work

2.1. Scope of Work Summary

2.2. Service and Deliverable Details

2.3. Mandatory Requirements (minimum, pass/fail)

2.4. Specifications

2.5. Maintenance and Operations (M&O) Services

2.6. Transition

2.7. Staffing and Organization

3. Administrative Information

3.1. Compliance with Solicitation

3.2. Respondent Business Registration

3.3. Restriction on Respondent Communication

3.4. Viewing the Solicitation via IMPACS eProcurement System

3.5. Procurement Timetable

3.6. Pre-Proposal Conference and Site Visit

3.7. Questions, Requests for Clarification, and Suggested Changes

3.8. Submission of Proposals

3.9. Release of Claims

3.10. Disposition of Proposals

3.11. Form 22 - Request for Confidentiality

3.12. Copyright Permission

3.13. Amendment and Withdrawal of Proposal

3.14. Late Proposals

3.15. Response Opening

3.16. Proposal Corrections and Disqualifications

3.17. Proposal Clarification

3.18. Respondent Presentations

3.19. Reference Checks

3.20. Criminal History and Background Investigation

3.21. Ancillary Information and Evaluators

3.22. Verification of Proposal Contents

3.23. Best and Final Offer

3.24. Award Notice and Acceptance Period

3.25. Exclusivity

3.26. No Minimum Guaranteed

3.27. No Commitment to Contract/No Rights Until Execution

3.28. Use of Subcontractors

3.29. Restrictions on Gifts and Activities

3.30. Respondent Continuing Disclosure Requirement

3.31. Appeals

3.32. Choice of Law and Forum

3.33. Order of Precedence

4. Form and Content of Proposal

5. Technical and Cost Proposal Contents

6. Evaluation and Selection

7. Contract Terms & Conditions and Contract Administration

7.1. RFP Specifications, Requirements, and Terms

7.2. Contract Terms and Conditions

7.3. Exception to Any Terms and Conditions

7.4. Objections Raised During the Solicitation Process

7.5. Contractual Terms and Conditions – No Material Changes/Non-Negotiable

7.6. Special Terms and Conditions

7.7. Respondent Discounts

7.8. Prompt Payment Discount

7.9. Invoices

7.10. Insurance

7.11. Performance Security

7.12. Quarterly Report

7.13. Administrative Fee

7.14. Order of Precedence

Attachment #1: Respondent Information

Attachment #2: Subcontractor Disclosure Form

Attachment #3: Proposal Points

Attachment #4: Cost Proposal

Attachment #5: Sample Contract

Attachment #6: Requirements Traceability Matrix (RTM)

Attachment #7: Resource Usage Template

Attachment #8: Exceptions to RFP/Contract Language

Attachment #9: References

Appendix A: IMM Current Iowa Stats

Appendix B: Example Form Intake Process Instructions

Appendix C: Current Incoming PO Box Addresses

Appendix D: Forecast 2026 Hourly Avg Throughput Rates

Appendix E: State of Iowa Generative Artificial Intelligence Policy

Appendix F: IDR Artificial Intelligence Policy

Appendix G: IDR Access Control Policy

Appendix H: Audit and Accountability Policy

Appendix I: IDR Confidentiality Policy

1. INTRODUCTION

1.1. Purpose

The Iowa Department of Management – Division of Information Technology (“Agency”), on behalf of the Iowa Department of Revenue (“IDR”), seeks Proposals from Respondents to provide the hardware, software, and services identified on the Request for Proposal (RFP) cover sheet and as further described below. This RFP is designed to provide Respondents with the information necessary for the preparation of competitive Proposals. The RFP process is for the Agency’s and IDR’s benefit and is intended to provide the Agency and IDR with competitive information to assist in the selection process. Each Respondent is responsible for determining all factors necessary for the submission of a comprehensive Proposal.

Through this RFP, IDR intends to select a single Vendor to modernize mailroom operations in alignment with its future state vision of operational excellence and enhanced taxpayer services. IDR prefers hardware to be provided as a lease rather than a one-time purchase. However, Respondents should propose the pricing structure, one-time purchase or lease, which offers IDR the most advantageous cost for the proposed Solution. No additional evaluation points will be given based on the pricing method. Cost Proposals will be assessed solely on the total cost over the potential fifteen

(15) year Contract term.

Key objectives of this initiative include:

• Improve mailroom efficiency

• Reduce operational risk

• Deliver high quality services to taxpayers and stakeholders

1.2. Background

IDR depends on efficient and secure mailroom operations to support its core tax administrative functions. For more than a decade, IDR has managed incoming Correspondences in-house, using specialized hardware and software to scan and process paper tax returns, payments, and other Documents. This approach has enabled IDR to maintain control over sensitive information and respond to changing business needs.

As technology and taxpayer behaviors evolve, IDR faces new operational challenges. In the past three years, IDR has experienced a shift in its workload: while electronic filing mandates have reduced the overall volume of paper Documents and increased the share of digital Correspondence, the complexity and data requirements of the remaining paper Documents have increased. This change has placed additional demands on the Mailroom and Data Capture teams, leading to increased reliance on temporary staffing and Manual intervention to maintain service levels.

To address these challenges, IDR completed a comprehensive business case and options analysis, which included interviews with peer agencies in seven states. The findings revealed that modernizing in-house operations with High-Speed scanners and AI-enabled data capture software represents the most cost-effective and resilient Solution for IDR’s future.

1.2.1. Current Environment and Conditions

1.2.1.1. Equipment & Software: The current scanning infrastructure consists of six OPEX

AS7200 scanners, and 12 Fujitsu desktop scanners (models fi-8170 and fi-7160), all of which are aging and nearing end-of-life. The system currently utilizes Fairfax scanning software. The desktop scanners were added during the COVID- 19 pandemic as a temporary stopgap; however, these remain a part of operations to meet service needs, despite limited scalability and efficiency.

1.2.1.2. Staffing: IDR manages incoming mail operations in-house through its Tax Operations Bureau, which includes the Mailroom and Data Capture teams. The existing environment is labor-intensive, requiring up to six full-time employees (FTEs) and 33 part-time temporary staff during Peak Tax Season.

1.2.1.2.1. Current User Volumes by Access Level

1.2.1.2.1.1. Data Entry: 31

1.2.1.2.1.2. Review: 26

1.2.1.2.1.3. Manager: 6

1.2.1.2.1.4. Admin: 7

1.2.1.3. Volumes & Quantities: Each year, IDR processes approximately 4,000,000 paper Documents, including tax returns, payments, and registration forms. Table 1 below captures a detailed breakdown of processing volumes by Document type.

Retention policy is based on Document type and can range from 6 months to perpetual.

Table 1. Annual Processing Volumes by Document Type

Document Type Est. Annual Processing Volumes Envelopes 700,000 – 1,250,000 Faxes 50,000 Pages 3,000,000 – 5,000,000 Registration Requests 100,000

1.2.1.4. Physical Space/Layout: The mailroom and scanning operations are conducted in a secure, access-controlled facility located at the Hoover Building. The primary mailroom area is approximately 5,500 square feet and includes dedicated workstations for Document preparation, scanning, and quality control. Any proposed Solution must be compatible with the existing physical space.

1.2.1.5. Network/IT Environment: All scanning and data capture hardware is connected to IDR’s secure internal network. IDR does not wish the current setup to constrain the design or capabilities of the proposed Solution.

1.2.1.6. Document Types & Workflows: Respondents shall be capable of securely and efficiently managing a wide range of Document types through mature, well-designed workflows that support consistent intake, processing, routing, and retention across all operational scenarios.

1.2.1.7. Business Hours/Schedule: Mailroom operations are conducted Monday through Friday, 8:00 AM to 4:30 PM CT, excluding state-observed holidays, with extended hours during Peak Tax Season.

1.2.1.8. Current State Challenges:

1.2.1.8.1. Aging Equipment: Due to age, the current OPEX scanners require more frequent repairs, resulting in maintenance costs that now outweigh their operational value.

1.2.1.8.2. Scan and OCR Quality: Current scanning and text recognition solutions periodically provide unusable results.

1.2.1.8.3. Manual Labor Dependency: Shortcomings in current processes and technology impacting accuracy and increases the need for Manual scanning, data entry, and additional staff.

1.2.1.8.4. Integration Challenges: Workflow modifications and additions require Vendor programming.

1.2.1.9. Strengths: IDR has experienced, skilled, and adaptable mailroom and data capture staff who maintain service levels and respond to workflow changes.

1.2.1.10. Figures, Diagrams, & References: The following appendices provide historical data and current-state workflows to support Respondents in developing comprehensive, informed Proposals. Respondents are encouraged to leverage these resources to validate assumptions, align Solution Architecture, and demonstrate compliance with operational, security, and performance requirements.

1.2.1.10.1. Appendix A: IMM Current Iowa Stats: Key operational metrics including staffing, paper volumes, hardware, and processing goals.

1.2.1.10.2. Appendix B: Example Form Intake Process Instructions:

Instructions for prepping and scanning IA 1120 returns, including barcode separator usage, and Batch rules.

1.2.1.10.3. Appendix C: Current Incoming PO Box Addresses: Detailed workflow based on PO Box addresses and Document routing.

1.2.1.10.4. Appendix D: Forecast 2026 Hourly Avg Throughput Rates:

Throughput expectations for opening, imaging, scanning, and keying tasks.

1.2.1.10.5. Appendix E: State of Iowa Generative Artificial Intelligence Policy:

Governs AI use in Solution design and operations at the statewide level.

1.2.1.10.6. Appendix F: IDR Artificial Intelligence Policy: Builds on the State of Iowa Generative Artificial Intelligence Policy by providing IDR-specific guidance, detailed procedures, and approval processes for AI use within IDR.

1.2.1.10.7. Appendix G: IDR Access Control Policy: Defines security and access requirements for systems and personnel.

1.2.1.10.8. Appendix H: Audit and Accountability Policy: Establishes compliance and audit standards for mailroom operations.

1.2.1.10.9. Appendix I: IDR Security Policy: Additional IDR specific security requirements the Vendor will have to agree to.

1.3. Definitions

In addition to any terms specifically defined elsewhere herein, for the purposes of this RFP and all supporting documents, including Attachment #6: Requirements Traceability Matrix (RTM), and any resulting Contract, the following terms will mean:

“Agency” means Iowa Department of Management; the agency identified on the RFP cover sheet that is issuing the RFP and, as used and to the extent used in the Contract, any other agency(s) or governmental entity(s) of the State that purchases from the Contract once executed.

“AI” or “Artificial Intelligence” means technologies that encompass a variety of techniques and approaches, such as ML, natural language processing, computer vision, and robotics, aimed at enabling machines to perform tasks that typically require human intelligence. For the sake of clarity, AI does not include traditional data science activities or robotic process automation.

“API” means Application Programming Interface; a set of protocols, routines, and tools that enable different software applications to communicate and exchange data with each other. APIs allow Integration between systems and facilitate automated workflows.

“Batch” or “Batching” means a group of Documents processed together as a single unit within the workflow. Batching enables efficient handling by grouping similar Documents for scanning, indexing, and classification. It supports workload balancing, prioritization, and tracking across lifecycle stages.

“BCM” means Business Capability Model; a framework that identifies and organizes the core functions and abilities an organization needs to achieve its objectives.

“Configuration” means a fulfillment method option; customizing system settings or features without coding to meet specific requirements.

“Contract” means the contract(s) entered into with the successful Respondent(s), as identified on the RFP Cover Sheet and more fully described in Section 7. Contract Terms & Conditions and Contract Administration.

“Correspondence” means Mail Items, emails, fax transmissions, and digital transactions received or processed by IDR or its designated systems.

“Data Transformation” means converting data from one format or structure to another so it can be accurately ingested, processed, or routed by the Solution and Integrated with IDR or Third-Party systems.

“DAD” means Deliverable Acceptance Document, a written record, signed by IDR, which confirms a Deliverable provided by the Vendor has been received, reviewed, and meets the requirements and acceptance criteria specified in the Contract or statement of work.

“Defect(s)” means an error, flaw, or unintended behavior in a system, application, or process that causes it to operate incorrectly or fail to meet specified requirements.

“Deliverable(s)” means all of the services, goods, products, software, data (including data collected on behalf of IDR), work, work product, items, materials, and property to be created, developed, produced, delivered, performed, or provided by or on behalf of, or otherwise made available through the Vendor, directly or indirectly, in connection with any Contract resulting from this Solicitation.

“Document” means any physical or digital record that is processed by the Solution, such as tax forms, applications, payments, remittances, and registrations.

“DPI” means Dots Per Inch.

“ETL” means Extract, Transform, and Load.

“Flagged Mail Item(s)” means mail identified as requiring special attention or exception handling, including damaged, incomplete, misrouted, or invalid Mail Items flagged by AI or Manual review.

“Functional Requirement” means a specification describing what a system should do or the tasks it must perform.

“High-Speed” means the ability to process Mail Items and Documents rapidly with minimal Manual intervention, including envelope openers, scanners, and automated workflows to manage large volumes efficiently.

“Hypercare” means a time‑limited stabilization and support period following go‑live during which the Vendor provides enhanced operational oversight, expedited issue resolution, and additional assistance to ensure Solution performance, user adoption, and continuity of services. Hypercare includes focused monitoring, prioritized defect remediation, and coordinated communication to support a smooth transition to steady‑state operations and standard support procedures.

“IDR” means the Iowa Department of Revenue, the purchasing entity, the entity that will utilize the Contract and receive the resulting goods and services.

“IMPACS” means the Iowa Management of Procurement and Contracts System - an eProcurement software program.

Website: https://bids.sciquest.com/apps/Router/PublicEvent?CustomerOrg=DASIowa

“IMPACT” means the existing IDR system referenced for Integration, which serves as a core processing or case management system that stores taxpayer or compliance-related data.

“Incident(s)” means an unplanned event or disruption that affects the normal operation of a system or service. Incidents may include outages, performance degradation, or other issues that require investigation and resolution.

“Integrate” or “Integrated” or “Integrating” or “Integration” means the process of combining multiple systems, applications, or components into a unified Solution where they operate as a cohesive whole. Integration involves harmonizing workflows, data models, and processes so systems function seamlessly together, often requiring data transformation and synchronization.

https://bids.sciquest.com/apps/Router/PublicEvent?CustomerOrg=DASIowa

“Interface(s)” or “Interfacing” means a connection or communication pathway between systems so they can exchange data or interact without deep combination. Focuses on compatibility and communication using standardized protocols, APIs, or connectors, rather than merging functionalities.

“Level 1 Help Desk” means the first line of defense. It involves managing basic and common issues that can be resolved quickly. IDR Level 1 support staff will manage a wide range of basic issues and escalate more complex problems to the Vendor.

“Level 2 Help Desk” means a more in-depth technical assistance and troubleshooting. Vendor Level 2 support staff who possess specialized knowledge and manage more complex issues that cannot be resolved by Level 1 support, escalating further if necessary.

“Level 3 Help Desk” means the highest level of technical assistance, focusing on the most complex and advanced issues. Vendor Level 3 support staff are experts in their fields, often collaborating closely with developers, engineers, and other specialized teams to resolve these issues.

“Machine Learning (ML)” means the development and use of computer systems that adapt and learn from data with the goal of improving accuracy.

“Mail Item(s)” means physical objects received from carriers or internal sources, including envelopes, packages, and other deliverables that need opening, sorting, and scanning.

“Manual” means human-performed tasks within the workflow, including fallback processes, exception handling, and interventions when automation or AI cannot resolve issues.

“Non-Functional Requirement” means a specification describing how a system should operate, including performance, security, and usability.

“OCM” means Organizational Change Management; a strategic approach that helps companies navigate transitions and adapt successfully.

“OCR” means Optical Character Recognition; the electronic or mechanical conversion of scans of typed, handwritten, or printed text into machine-encoded text, whether from a scanned Document, a photo of a Document, a scene photo or from subtitle text superimposed on a scan.

“Out-of-the-Box” means a fulfillment method option; using standard features or capabilities of a product without customization.

“Peak Tax Season” means the annual period of highest operational volume and client activity which includes March 1 through June 30. During this timeframe, increased service levels, staffing, and performance responsiveness are required.

“PMP” means Project Management Professional; a globally recognized certification awarded by the Project Management Institute (PMI) to individuals who demonstrate expertise, experience, and competence in leading and directing Projects.

“Project” means the temporary, structured effort to deliver the Solution as defined within and resulting of this RFP, encompassing all activities from kickoff through completion of Hypercare support. The Project includes planning, design, Configuration, testing, deployment, and transition to steady-state operations.

“Proposal” means the Respondent’s proposal submitted in response to the RFP.

“Real-Time” means immediate processing and visibility of data as events occur, enabling live tracking of mail status, productivity metrics, and workflow progress without delays.

“Requirement Not Met” means the requirement identified is not met by the proposed Solution;

this is a fulfillment method option.

“Respondent” means a potential Vendor submitting a Proposal in response to this RFP.

“RFP” or “Solicitation” means this Request for Proposal as amended, as well as any attachments, exhibits, schedules, or addenda hereto.

“RTM” means Requirements Traceability Matrix.

“Security Incident(s)” means an unplanned security event or disruption that affects the normal operation of a system or service. Security incidents may include unauthorized access, security breaches, or other issues identified in State Security Policies and the Vendor’s System Security Plan that require investigation and resolution.

“Service Request” means a formal, routine request submitted by a user or stakeholder for information, access, or a standard change to a system or service, and does not indicate a failure or Incident.

“SFTP” means Secure File Transfer Protocol; a network protocol that provides secure file access, transfer, and management functionalities over any reliable data stream.

“SLA” means Service Level Agreement; a Contract between a service provider and a customer that defines the level of service expected and the responsibilities of both parties. It outlines the metrics, performance targets, and support provisions for the services provided.

“SLR” means Service Level Requirement; a specific, measurable performance standard or target that a Vendor must meet as part of the Contract which define expected levels of service, such as response times, availability, and resolution timeframes.

“Solution” means the overall proposed capability set that meets IDR’s requirements, encompassing the system, processes, AI models, and Integrations that deliver end-to-end mail handling and Document processing.

“Solution Architecture” means the high-level structure and organization of a technology Solution, describing how different systems and components interact to meet business requirements.

“System Design” means the detailed specification of a system’s components, Interfaces, and data flows, outlining how the system will be built and function.

“SOP” means Standard Operating Procedure; a set of step-by-step instructions that outline how a particular task or process should be performed within an organization. It provides guidelines for employees to follow to ensure consistency, efficiency, and compliance with regulations or standards.

“State” means the State of Iowa, including the Agency identified on the Solicitation Cover Sheet and/or the Contract Declarations & Execution Page(s), and all State agencies, boards, and commissions, and any political subdivisions making purchases from the Contract as permitted by this Solicitation.

“Third-Party” means any external individual, organization, or entity, which is not the primary contracting party, but is engaged to provide goods and services in support of the primary party’s obligations or operations.

“UAT” means User Acceptance Testing; the last phase of the testing process, during which actual users test the Solution to make sure it can manage required tasks in real-world scenarios.

“Vendor” means the successful Respondent to this RFP that ultimately enters into a Contract as a result of this RFP.

2. SCOPE OF WORK

This Section lists the scope related to this RFP. By submitting a Proposal, the Respondent agrees to meet all the scope elements stated in this section and any other terms and conditions stated in this RFP.

2.1. Scope of Work Summary

The Vendor will provide a comprehensive Solution to modernize and digitize IDR’s mailroom operations. The Vendor will replace aging hardware and Manual processes with an Integrated, automated Solution, delivering all required hardware, software, and services to establish a fully operational Solution. Subcontracting of specific components is permitted; however, the Vendor retains full responsibility for managing all subcontractors and ensuring compliance with contractual requirements, performance standards, and timelines.

Key success measures include:

• Improve efficiency, accuracy, and security of Document handling

• Reduce reliance on seasonal staffing and Manual intervention

• Provide Real-Time visibility into mailroom operations

• Support compliance with State and federal regulations

• Integrate seamlessly with existing IDR systems, including IMPACT

By transforming Manual, paper-based processes into streamlined digital workflows, IDR aims to reduce processing time, enhance service delivery, and better manage seasonal volume spikes. The modernized Solution will enable Real-Time visibility, intelligent automation, and seamless Integration with existing systems.

2.1.1. Services

The Vendor shall provide all services necessary to fulfill the requirements of this RFP. Services have been organized into distinct domains. A high-level description of each domain is provided below, with further details provided in Section 2.2. Service and Deliverable Details. The State is seeking the best overall Solution and does not mandate a specific delivery approach.

Accordingly, Respondents are requested to describe how they will provide the services below, as well as any additional service offerings within each domain that support or enhance the proposed approach.

2.1.1.1. Project Management: The Vendor shall provide comprehensive Project management services, such as planning, governance, scheduling, risk and issue management, reporting, and stakeholder communications. A dedicated Vendor Project Manager shall be assigned to oversee all aspects of Project execution and ensure timely coordination with IDR.

2.1.1.2. Design & Development/Configuration: The Vendor shall deliver design, development/Configuration services to establish a Solution that meets all Functional and Non-Functional Requirements, such as process workflow design, requirements management, Solution Architecture, System Design, Configuration, and Integration with existing IDR systems and Third-Party applications.

2.1.1.3. Data Management: The Vendor shall perform all necessary data management activities, such as Data Transformation, validation, and archival. The Vendor is responsible for ensuring the secure, accurate, and complete exchange and ongoing integrity of all required data. No legacy data is intended to be leveraged in the new Solution and IDR will be responsible for management of legacy data.

2.1.1.4. Testing: The Vendor shall assist/collaborate with IDR to conduct all required testing activities, such as the development and execution of test plans, test cases, and scenarios for functional, Integration, performance, security, and disaster recovery testing. All testing shall be completed in accordance with Agency and IDR standards and acceptance criteria.

2.1.1.5. User Training: The Vendor shall assess training needs, develop training plans and materials, and deliver training programs for all user roles. The Vendor shall ensure IDR staff are fully prepared to operate the new Solution.

2.1.1.6. Solution Hosting & Infrastructure: The Vendor shall provide hosting and infrastructure services within the Vendor’s environment to support the Solution, such as environment setup, security controls, access management, and compliance with all applicable State and federal requirements. IDR will provide network access to the Vendor environment.

2.1.1.7. Cutover, Deployment, & Hypercare: The Vendor shall plan and execute all cutover and deployment activities, such as transition from legacy systems, go-live support, and Hypercare services. The Vendor shall provide immediate post-deployment support to ensure operational stability and rapid issue resolution.

2.1.1.8. Third-Party Integration: The Vendor shall coordinate and collaborate with other vendors and service providers as required, such as managing Integration points and dependencies to ensure seamless interoperability and service delivery.

2.1.1.9. Organizational Change Management (OCM) Support: The Vendor shall provide assistance and serve as a liaison to support IDR’s OCM team in facilitating a successful transition and Solution adoption.

2.1.1.10. Knowledge Transfer: The Vendor shall provide comprehensive Knowledge Transfer necessary to run, support, and improve the Solution after implementation.

2.1.1.11. Technical Implementation: The Vendor shall provide comprehensive technical implementation services to configure, deploy, and optimize all Solution components, such as setup of system features such as barcode and envelope identification (ID) tracking, exception handling workflows, notification and automation rules, and Document routing capabilities to internal and external stakeholders. The Vendor shall ensure seamless Integration with middleware, APIs, and third-party platforms; monitor and manage routing operations for performance and error resolution; and maintain secure transmission, storage, and audit trails for all Documents and data. All technical implementation activities shall be performed to ensure system reliability, scalability, security, and compliance with IDR requirements.

2.1.2. Hardware and Software

The Vendor will supply and install High-Speed scanners and automated envelope openers capable of processing large volumes of mail with minimal Manual intervention. All hardware and software must produce data output that conforms to IDR’s IMPACT system file layout requirements and secure network drives.

2.1.3. Solution Functional and Non-Functional Requirements

The Vendor must fully comply with the Functional and Non-Functional Requirements detailed in Attachment #6: Requirements Traceability Matrix (RTM). The RTM serves as the authoritative source for Functional and Non-Functional Requirements outlined in 2.4 Specifications of the RFP. The Vendor is responsible for reviewing the RTM in its entirety and ensuring that every requirement is addressed within the proposed Solution. Each capability must be supported by clearly defined tools, processes, and methodologies. For any requirement that cannot be met, the Vendor must provide a documented explanation and rationale. This approach provides full traceability from RFP specifications to Solution delivery, offering transparency and accountability throughout the Contract term.

2.1.4. Security & Privacy

The Vendor and proposed Solution must maintain compliance with all applicable security and privacy laws, regulations, and policies, including (but not limited to):

2.1.4.1. Ensuring compliance with all IDR, State, and federal laws and policies, including those protecting privacy and confidentiality, throughout the Contract term.

2.1.4.2. Notifying IDR, Agency, and DOM DoIT's Security Operations Center (SOC, email:

SOC@iowa.gov) upon detecting any production or security Incident within a defined timeframe.

2.1.4.3. Paying the full cost of remediation and damages resulting from production or security Incidents arising from any Vendor work, including Solution changes.

2.1.4.4. Executing application code scans prior to all code promotion to production, delivering scan results to IDR with remediation plans for all critical and high vulnerabilities, and performing all remediations prior to code promotion.

2.1.4.5. Conducting vulnerability scans and penetration testing or compliance testing before promoting any code to production, in compliance with the Agency security standards and on a schedule approved by IDR. The Vendor shall provide scan results and remediation plans for all critical and high vulnerabilities, ensuring all issues are resolved prior to code promotion.

2.1.4.6. Proactively identifying and resolving security risks that threaten operations, data security, or connectivity with Interface partners, subject to IDR approval. The Vendor shall demonstrate security regulatory compliance as requested by IDR, including through audits.

2.1.4.7. Reporting on access control compliance for Solution users monthly, in a format specified by IDR.

2.1.4.8. Developing, maintaining, and providing a comprehensive System Security Plan (SSP) addressing architecture, controls, compliance, encryption, access control, vulnerability management, incident response, and audit logging. SSP is to be updated annually or upon significant changes.

2.1.4.9. Complying with all security requirements and standards set forth by IDR and DOM- DoIT, including but not limited to encryption standards.

2.1.4.10. Assuring Solution is compliant with IDR and DOM-DoIT requirements regarding Single Sign-On, including integration with Okta.

mailto:SOC@iowa.gov

2.1.5. Accessibility Requirements

2.1.5.1. Accessibility Conformance Report. For any Deliverable that includes electronic and information technology, Vendor shall provide an Accessibility Conformance Report (“ACR”) documenting conformance with the Accessibility Standards. An ACR is based on the Voluntary Product Accessibility Template (“VPAT”) developed to demonstrate conformance with Section 508 of the Rehabilitation Act. Vendor shall provide the ACR upon delivery of the applicable Deliverable and shall provide an updated ACR upon any material change to the Deliverable's user interface or accessibility-affecting functionality, at least annually during the term of the Contract and upon Contract renewal.

2.2. Service and Deliverable Details

The Vendor will deliver services that support a fully modernized mailroom that operates with speed, accuracy, and resilience. Incoming Mail Items will be processed using High-Speed envelope openers and scanners designed to manage diverse Document types with minimal Manual intervention. These devices will reliably process high volumes during Peak Tax Season, automatically open envelopes using thickness detection, and recover from jams without disrupting operations. The Vendor will ensure consistent Document scan quality at 300 DPI or higher, supported by Real-Time validation.

Integrated productivity tracking will provide visibility into performance, and the Solution will securely connect with IDR’s IMPACT system and approved network file shares.

OCR technology will extract text from both handwritten and printed content to support downstream processing. Digitized document classification will categorize and organize Documents based on content, structure, and available metadata, enabling consistent tagging, indexing, and workflow routing. Classification and metadata capture will be driven by configurable business rules, reducing Manual keying and minimizing error rates. The Solution shall also support 1D and 2D barcode standards to aid intake, tracking, and classification.

Workflow automation will further streamline operations through configurable tools that enable IDR to manage intake, sorting, triage, and routing. The Solution will Interface with USPS Informed Visibility, FedEx, UPS, and DHL pre-delivery data feeds, as well as IDR’s existing systems. Real- Time dashboards will provide role-based visibility into every stage of the Correspondence lifecycle, from intake through archival. Analytics capabilities will support forecasting of Correspondence volume and optimize staffing planning.

By leveraging automation and advanced scanning technology, the modernized mailroom will support IDR’s strategic goals of operational efficiency and responsible revenue generation, delivering a resilient and future-ready operation.

The following sections provide instructions for the Respondents to describe how the Respondent will deliver the services, staffing, processes, and milestones throughout the Contract term. These items relate specifically to the Vendor’s service delivery approach, including project management, implementation activities, operational support, and other services, not the system’s Functional or Non‑Functional Requirements. While the services referenced may not all be included in the final Contract, Respondents are requested to address each service domain within their Proposal so that potential scope may be fully evaluated and negotiated during Contract discussions.

2.2.1. Project Management Services

Describe your approach to providing the following Project Management Services.

Project Management & Governance

2.2.1.1. Providing a Project Manager to oversee day-to-day Project management in alignment with the Project Management Plan and facilitate all coordination with IDR.

2.2.1.2. Providing a Project management methodology tailored to the Contract scope, and train and guide IDR in the methodology’s use.

2.2.1.3. Monitoring Project activity progress and maintain planning documents.

2.2.1.4. Maintaining an up-to-date Project schedule and work breakdown structure that include dependencies, ownership, critical path, and alignment to the approved baseline.

2.2.1.5. Providing weekly status reports that include details such as work completed, work planned, Project health, risk log, issue log, action item log, and decision log.

2.2.1.6. Providing meeting agendas prior to scheduled meetings.

2.2.1.7. Providing meeting minutes within twenty-four (24) hours following each meeting.

2.2.1.8. Identifying and escalating risks and issues to Project governance for awareness and decision-making and implementing risk mitigation and contingency plans.

2.2.1.9. Facilitating consistent communication of Project updates to all relevant stakeholders as identified in the Project Management Plan.

2.2.1.10. Participating in all meetings as requested by IDR.

2.2.1.11. Conducting oversight of Contract requirements and SLAs.

Change Management

2.1.1.12. Preparing and documenting Solution change requests and impact analyses.

2.1.1.13. Escalating items to Project governance for awareness and decision-making.

2.1.1.14. Facilitating review and prioritization of approved Solution changes and follow through implementation.

2.1.1.15. Communicating all Solution changes to stakeholders.

Deliverable Management

2.2.1.12. Using a Deliverable Acceptance Document (DAD) for all contractually required

Deliverables. Each DAD must be formally approved prior to the associated Deliverable being considered eligible for submission. IDR will provide a DAD template during Contract negotiations that will be included in the SOW.

2.2.1.13. Conducting internal quality assurance reviews of all Deliverables prior to submission, ensuring that only complete, accurate, and DAD-compliant Deliverables, which have been properly scoped, reviewed, approved, and version-controlled, are submitted for IDR review.

2.2.1.14. Coordinating IDR Deliverable reviews and approvals in accordance with the timelines and procedures defined in the approved DAD.

2.2.1.15. Maintaining accessibility to the most current version of each DAD and Deliverable for IDR and retaining historical versions for audit and traceability purposes.

2.2.1.16. Ensuring all Deliverables have been formally accepted by IDR through a DAD prior to invoicing.

Staff Management

2.2.1.17. Maintaining staffing and oversight to IDR’s satisfaction throughout the life of the

Contract. If circumstances require the replacement of Vendor Key Personnel, Vendor will inform IDR as soon as reasonably possible and substitute appropriate associates with comparable skills. IDR shall have the right to approve/disapprove/remove any replacement staff member, identified as Key Personnel.

2.2.1.18. Notifying IDR and providing transition plans within 14 calendar days of any change to Key Personnel.

2.2.1.19. Do not remove or reassign any approved Key Personnel without prior written approval from IDR, except in circumstances beyond the Vendor’s control, such as leave of absence, illness, resignation, or termination.

2.2.2. Design & Development/Configuration Services

Describe your approach to providing the following Design & Development/Configuration Services.

2.2.2.1. Implementing a formal requirements management process that includes continuous prioritization based on impact and feasibility and providing complete traceability and transparency.

2.2.2.2. Conducting joint validation sessions with IDR and appropriate stakeholders to validate understanding of identified requirements and user needs.

2.2.2.3. Maintaining an up-to-date RTM, mapping original requirements as included in this RFP to any revisions, reflecting any changes or updates and documentation of supporting rationale and references throughout the term of the Contract.

2.2.2.4. Conducting design interviews and/or working sessions to document and obtain consensus on Solution design that allows for implementation of the business and technical functionalities identified by IDR.

2.2.2.5. Establishing and maintaining a Solution design that supports seamless Integration with existing IDR systems and Third-Party applications.

2.2.2.6. Developing, maintaining, and implementing Role Based Access Control (RBAC) throughout the Solution, such as clearly defined roles within the system and the specific permissions associated with each role, and role to position mapping to elaborate on how roles are mapped to specific positions within IDR.

2.2.2.7. Documenting and maintaining Interface Control Documents (ICDs) for all inbound and outbound Interfaces and Batch jobs, ensuring Integration with other Project management processes.

2.2.2.8. Conducting code and Configuration reviews to ensure compliance with State standards and reduce Defects.

2.2.2.9. Completing the Solution build as defined by the final design specifications and in accordance with the approved delivery schedule.

2.2.2.10 All vendor systems and integrations must authenticate through the State of Iowa’s Identity Provider (IdP) and must enforce multifactor authentication (MFA) for all users accessing State data or services. The solution shall not permit alternative or standalone authentication methods that bypass the State’s IdP.

2.2.3. Data Management Services

Describe your approach to providing the following Data Management Services.

2.2.3.1. Performing all necessary data management services related to development, implementation, and data validation.

2.2.3.2. Coordinating with IDR to identify all data sources, data fields, and business rules required for Integrations.

2.2.3.3. Conducting data mapping and transformation activities, such as resolving data discrepancies and converting data formats.

2.2.3.4. Executing all data Integration tasks according to the agreed schedule, ensuring minimal disruption to business operations.

2.2.3.5. Validating data against records using sampling and reconciliation techniques and addressing any mismatches or residual data quality issues identified during validation.

2.2.3.6. Documenting all data Integration activities, such as mapping logic, transformation rules, validation results, and reconciliation outcomes, and providing regular status updates to IDR.

2.2.4. Testing Services

Describe your approach to providing the following Testing Services.

2.2.4.1. Providing all necessary resources, such as staff, environments, tools, and test data, to support robust and efficient testing sessions throughout the Contract term.

2.2.4.2. Developing, maintaining, and executing comprehensive test plans in collaboration with IDR for all required testing types, such as functional, performance, Integration, security, user acceptance, disaster recovery, and regression testing.

2.2.4.3. Developing, maintaining, and executing in collaboration with IDR test scripts, test cases, and test scenarios aligned to Functional and Non-Functional Requirements.

2.2.4.4. Preparing and configuring test environments and data in accordance with approved test plans and schedules.

2.2.4.5. Completing all Solution testing, such as support and facilitation of UAT.

2.2.4.6. Facilitating and supporting UAT by developing scenario-based use cases, establishing test environments aligned with acceptance criteria, preparing test data, providing training for testers, managing Interfaces required for testing, troubleshooting issues, and supporting users as they progress through testing scenarios.

2.2.4.7. Documenting, tracking, and managing all test results, such as detailed findings, outcomes, Defects, issues, and risks, and providing these results and any recommended actions to IDR for collaborative review and resolution.

2.2.4.8. Validating that all test objectives, entry and exit criteria, and acceptance criteria are met prior to completion of each test event.

2.2.4.9. Providing regular status updates to IDR on testing progress, issues encountered, and resolution activities.

2.2.4.10. Providing post-testing support to address any issues or Defects identified after deployment, such as retesting and validation as required by IDR.

2.2.5. User Training Services

Describe your approach to providing the following User Training Services.

2.2.5.1. Conducting a thorough training needs assessment to identify specific training requirements for all user roles within IDR, ensuring the training program is tailored to the unique needs of each group.

2.2.5.2. Developing, maintaining, and implementing a comprehensive User Training Plan that defines objectives, identifies target audiences, specifies delivery methods, outlines content, provides a training schedule, lists training materials, and assigns roles and responsibilities.

2.2.5.3. Developing and maintaining tailored training curriculum and materials that incorporate IDR-specific business processes, to support both initial and ongoing training needs.

2.2.5.4. Developing, maintaining, and implementing a hybrid User Training Program that includes both in-person and remote/virtual learning to ensure all users who interact with the Solution are adequately trained for their roles.

2.2.5.5. Establishing a quality assurance process for the training program.

2.2.5.6. Providing ongoing support to users during and after the training program, such as a dedicated help desk or support team to address questions, issues, or technical difficulties, especially during Hypercare.

2.2.5.7. Communicating training information and updates effectively to all users as outlined in the approved Communication Plan.

2.2.5.8. Evaluating the effectiveness of the established training program through assessments, feedback, and follow-up activities, and implementing improvements as needed.

2.2.5.9. Addressing ongoing training needs, such as regular refresher training, and updating materials, as necessary.

2.2.6. Solution Hosting and Infrastructure Services

Describe your approach to providing the following Solution Hosting and Infrastructure Services.

2.2.6.1. Hosting and management services are necessary to implement and maintain the Solution as described in this RFP, beginning with the initial implementation of any Solution instance, and continuing throughout the implementation and post-implementation.