H. B. 250 Retirement Plan Exchange Platform Administrator

The State of Utah Division of Purchasing, conducting procurement on behalf of the Office of State Treasurer, is requesting proposals for a Retirement Plan Exchange Platform Administrator under H.B. 250 to establish, administer, and maintain a secure, publicly accessible retirement plan marketplace, with proposals due June 17, 2026. The state anticipates a single contract award to the highest-scoring responsive and responsible vendor. Pricing must be guaranteed for the entire five-year contract term.

The contractor must deliver a fully operational Exchange platform serving as a technology-enabled marketplace enabling eligible employers to establish qualified retirement plans or auto-IRA programs with private-sector providers. Core deliverables include an employer database and CRM system, provider onboarding system, plan comparison tools, reporting dashboards, and a business continuity plan. The platform must operate as a self-sustaining model without ongoing state funding; the contractor defines all revenue sources and fee structures. The contractor may receive compensation from participating providers but must maintain strict neutrality among providers, fully disclose compensation, avoid preferential treatment, and refrain from creating incentives favoring higher-cost plans or influencing provider visibility in ways that disadvantage participants. The contractor shall not act as a retirement plan provider or assume fiduciary responsibility. GovRAMP security certification is mandatory: GovRAMP Core status within 12 months of contract execution and GovRAMP Moderate Authorized status within 24 months. All contractor personnel with access to secure facilities or state data must pass federal criminal background checks and drug testing. Contractor must comply with NIST 800-53 (Revision 5), maintain three separate development, test, and production environments, implement encryption for all data in transit and at rest with storage limited to United States-based data centers, and maintain cybersecurity insurance of $2,000,000 to $10,000,000 depending on data risk categorization. Commercial general liability insurance of at least $1,000,000 per occurrence and $3,000,000 aggregate is required.

Evaluation is weighted across eight criteria: Executive Summary (5%), Organizational Experience and Expertise (15%), Technical Approach & Platform Design (20%), Provider Marketplace Management & Oversight (15%), Data Security, Reporting & Compliance (15%), Implementation Timeline & Project Management (10%), Fee Schedule and Revenue Sources (10%), and Adoption Strategy & Marketplace Viability (10%). Vendors must score a minimum of 350 points (70% of 500 total technical points) to be eligible for award. Cost will be scored separately, with the lowest-cost proposal receiving 100% of cost points. All custom deliverables and work product become the property of the State of Utah. The state reserves the right to terminate the contract without cause upon thirty days' written notice.