UOCAVA Ballot Delivery and Tracking System - UPDATED

The State of Tennessee, Department of State, Division of Elections, is issuing a Request for Proposals (RFP) to procure a secure online ballot delivery and tracking system for Uniformed and Overseas Citizens Absentee Voting Act (UOCAVA) voters and print disability voters, to be developed using Federal Voting Assistance Program (FVAP) EASE Grant 4 funding. The system must function as a centralized, internet-based platform for voter registration materials, military-overseas ballots, and voter information delivery with no capability to receive voted ballots. Key deliverables and requirements include accessibility compliance with the Americans with Disabilities Act and Section 508 of the Rehabilitation Act, signature verification capability, integration with Tennessee's Automated Election System (AES) and county voter registration systems, acceptance of multiple data formats (Excel, CSV, Text, DBF), and adherence to extensive security requirements including FIPS 140-2/140-3 encryption, annual SOC 2 Type 2 examinations, penetration testing, data hosting in the continental United States, and disaster recovery with a one-hour recovery point objective and 24-hour recovery time objective (or 8 hours during election cycles). Evaluation criteria consist of general qualifications and experience (maximum 35 points), technical qualifications and approach (maximum 35 points), and cost proposal (maximum 30 points). Critical deadlines include a pre-response conference on February 13, 2026, written questions due by February 20, 2026, proposal response deadline of March 4, 2026, at 2:00 p.m. central time, anticipated contract award by March 11, 2026, and contractor signature deadline of March 20, 2026. Contractors must demonstrate prior experience with UOCAVA systems or similar internet-facing platforms handling personally identifiable information and maintain cyber liability insurance of $10 million per occurrence and aggregate.

The RFP does not specify set-aside designations or restrictions limiting organizational types that may respond. Compensation is structured in three components: a creation and installation fee, monthly maintenance and support charges, and an hourly rate for additional work orders, though specific budget ranges or award values are not disclosed in the available documentation. The contractor will be responsible for all data protection obligations, including immediate notification of security breaches within 24 hours, prohibition on use of state data to train artificial intelligence models without written consent, and responsibility for all notification and remediation costs associated with unauthorized data access. Upon contract termination, the contractor must return or destroy all state data in accordance with NIST Special Publication 800-88 standards, with all state data ownership remaining with Tennessee. No incumbent vendors or current contractors are identified in the RFP materials, and the contract term will be established upon award with specific dates to be completed during the procurement process.