The RFP is not one document
A state RFP for a data platform arrives as a package: the base solicitation, an attachment holding the statement of work, a cost workbook in Excel, a sample contract almost nobody opens until it is too late, a forms packet, and then two or three addenda that quietly change all of it. The version posted on day one is rarely the version you bid. Reading it front to back is the wrong instinct. The first thirty pages are boilerplate identical across every solicitation that state issues, and the handful of pages that decide the outcome sit in three separate files.
The case assumed throughout: a state health, revenue, transportation, labor, or education agency buying ingest, a warehouse, reporting, and analytics on a three-to-five-year term worth $800K to $15M. The mechanics hold at $200K and at $50M.
One habit first: check the addenda tab on the state's portal before reading a single requirement. Bidders have withdrawn after writing forty pages against a scope replaced in week two.
Then open the package in reverse: evaluation criteria, minimum qualifications, the sample contract's insurance and indemnity and IP articles, the cost workbook, and only then the statement of work. The scope tells you whether you want the work. The other four tell you whether you can win it.
Where state data-platform bids get lost
Editorial weighting from reading public state solicitations, addenda, and award records. Illustrative, not a measured statistic.
Where the real scope lives
The base solicitation describes the procurement. The scope lives in the attachment, usually titled "Attachment A: Statement of Work," "Exhibit 1: Scope of Services," or "Appendix B: Technical Requirements." If the package includes a requirements matrix as a separate spreadsheet, each line coded mandatory, desirable, or optional, that spreadsheet is the scope and the prose is commentary. Every mandatory line is a pass/fail. Count them. A 900-line matrix on a $1.2M ceiling says more about who drafted it than about what the agency needs.
Scope hides in a second place: the deliverables and payment schedule in the sample contract. If the statement of work says the vendor "will support data migration" while the payment schedule ties 30% of contract value to "migration of all historical records with 100% source-to-target reconciliation," the schedule is the requirement and the prose is decoration.
The third place is silence. Government-furnished data and environment get one short paragraph, or none. If the package does not say the state provides the cloud tenancy, assume you are buying it and price five years of it. If it gives no record counts or data dictionary, you cannot price the migration, and you should say so in the question period.
How the points are actually awarded
Most state evaluations are point-scored and the weights are published. A common shape: technical 50 to 70 points, cost 20 to 40, and a participation component of 0 to 15 for minority-, women-, veteran-, disability-, or in-state-owned business involvement. Weights vary by state and agency. The cost formula usually does not vary at all: lowest responsive price divided by your price, times the available cost points.
Run that arithmetic before writing a sentence. If cost carries 30 points and you expect to land 25% above the low bidder, you start six points down. Then look at how points split inside the technical score. "Corporate experience 20, staffing 15, technical approach 15, project management 10" rewards a firm with a resume. "Technical approach 40, staffing 10, experience 10" rewards a firm with an answer. Reading those two the same way is how good engineering firms lose to staffing brokers.
Minimum qualifications: the page that ends most bids
Near the front sits one page titled "Minimum Qualifications," "Mandatory Requirements," or "Offeror Responsibility." Typical lines: three completed projects of similar size and scope in the last five years; a named project manager holding a PMP; three years of audited or reviewed financials; good standing in the state; occasionally ISO 27001 or a SOC 2 Type II report. These are not scored. They are checked, by one person, with a checklist, before technical volumes are distributed. Fail one and the proposal is never read.
A firm without state past performance has three real moves. Ask in the question period whether federal or commercial engagements of similar size and complexity satisfy the requirement; the answer binds once it lands in an addendum. Team with a prime that clears the bar and hold the technical scope as a subcontractor. Or no-bid. Bidding anyway and hoping an evaluator reads the rest has never worked.
Page limits, format rules, and responsiveness
The section is usually called "Proposal Format and Content" or "Submission Requirements." Expect a page limit on the technical volume with named exclusions (resumes, forms, the requirements matrix), a font floor of 11 or 12 point, one-inch margins, a required tab order, a file-naming convention, a portal file-size cap, and in a surprising number of states a wet-signed original plus copies on physical media.
Two words govern the outcome. Responsive means you followed the rules of the solicitation. Responsible means you can perform. Non-responsiveness is fatal and is decided administratively. Small firms lose to their own formatting far more often than to a better competitor. Build the compliance matrix on day one and have someone who did not write the proposal check it against the instructions.
Submit a full day early. State portals close on a clock, and a 400 MB upload at 2:55 p.m. against a 3:00 p.m. deadline gambles the effort on a network.
The forms packet
The forms are boring and they disqualify people. A typical package asks for:
- Signed offer form binding the price for 90 or 120 days, executed by someone with authority to bind the company.
- Addendum acknowledgments, one per addendum, including the one issued four days before the deadline.
- W-9 and vendor registration, which in some states must be complete before submission rather than before award.
- Non-collusion affidavit and a conflict-of-interest disclosure covering organizational as well as personal conflicts.
- Debarment certification under 2 CFR Part 180 wherever federal grant dollars flow through the contract.
- Statutory certifications: E-Verify, drug-free workplace, and the divestment and non-boycott certifications several states require.
- Good standing and tax clearance plus foreign-entity qualification if you are not organized in that state.
- Subcontractor and participation forms, with a good-faith-effort narrative if you cannot meet a participation goal.
Two carry real lead time. Qualifying as a foreign entity where you have no presence takes two to four weeks once a registered agent is engaged, and good standing or tax clearance is rarely issued same-day. Start both the morning you decide to bid.
Insurance and bonding
| Requirement | Typical state IT range | What to check |
|---|---|---|
| Commercial general liability | $1M per occurrence / $2M aggregate | State named as additional insured; "primary and non-contributory" wording; waiver of subrogation. |
| Professional liability (E&O) | $1M to $5M per claim | Written claims-made, and generally cannot name additional insureds even when the state's form demands it. |
| Cyber liability | $1M to $10M | Required separately once the platform holds personal, health, or tax data. Check whether notification cost erodes the limit. |
| Workers' compensation | Statutory limits | Required even with no employees resident in that state; a sole-owner exemption still needs documentation. |
| Bid bond | 1% to 5% of bid | Uncommon in IT, standard in construction. The surety relationship must exist before the due date. |
| Performance bond | 10% to 100% of contract value | The real gate for a young firm. Sureties underwrite working capital and CPA-prepared financials. |
Certificates are typically due within ten business days of a notice of award, with coverage in force before work begins. Get quotes during the bid. A broker needs the statement of work to price errors-and-omissions and cyber coverage for a platform holding state records, and the number can move a point or two of margin.
Non-allowable costs and how the money is scored
If federal money passes through to the state, the cost rules come from 2 CFR Part 200 Subpart E, which makes alcohol (200.423), lobbying (200.450), most advertising and public relations (200.421), entertainment (200.438), fundraising (200.442), and losses on other awards (200.451) unallowable. 2 CFR 200.216 bars covered telecommunications and video surveillance equipment under Section 889 of the FY2019 NDAA, reaching hardware and the sub-processor chain of a hosted service alike. Appendix II lists the provisions the state must flow down to you.
State rules stack on top: travel at the state's per diem, no markup on pass-through subcontractor cost, no fee on other direct costs, labor rates fixed for the base term. Deliverable-based payment with 10% retainage held to final acceptance, plus a 30-to-45-day prompt-payment clock, can mean carrying two or three months of payroll on a project running exactly on schedule.
Where the platform sits inside a federal match program, the architecture itself becomes a compliance question. Medicaid systems draw enhanced federal financial participation under 42 CFR Part 433 Subpart C, at 90% for design, development, and installation and 75% for operations, conditioned on the standards at 42 CFR 433.112 and an approved Advance Planning Document under 45 CFR Part 95 Subpart F. Child welfare systems run under CCWIS at 45 CFR 1355.50 through 1355.59. Both impose modularity and open-interface conditions. Failing them costs the state its match rate, the fastest way to lose a contract you already won.
The terms that cost more than the price
Intellectual property. Many state contracts declare every deliverable a work made for hire and the sole property of the state. If your bid depends on a pre-existing codebase, find the background-IP carve-out. If there is none, ask for one during the question period. If the answer is no, winning means donating your product.
Limitation of liability. Some states will not cap vendor liability at all, or cap it at contract value while carving data breach out of the cap entirely. Uncapped breach liability on a platform holding several million records is not insurable at small-firm scale.
Security frameworks. Find the acronyms early, because each carries months of lead time: the FBI CJIS Security Policy for criminal justice data; IRS Publication 1075 for federal tax information, which brings background investigations and a 45-day advance notification for contractor access; HIPAA at 45 CFR Parts 160 and 164; FERPA at 34 CFR Part 99; and a GovRAMP authorization (the state and local analogue to FedRAMP, rebranded from StateRAMP in 2025) for the hosting layer.
The quiet clauses. Source-code escrow, audit rights, records retention for seven years past final payment, termination for convenience on thirty days' notice, key-personnel substitution requiring written approval. All price into the bid.
The question period is the only lever you get
Typical state solicitation calendar
Only the written addendum binds. Anything a program manager says at a pre-bid conference or on a phone call is worth nothing if it does not appear in an addendum. Ask in writing, every time.
Two rules about what to ask. Questions and answers go to every bidder, so a question explaining your approach hands your thinking to the competition. Ask about requirements, never about your solution. And spend the questions where a pass/fail might move: whether commercial engagements satisfy a state-experience requirement, whether an equivalent credential substitutes for a named certification, whether the page limit excludes the requirements matrix. One softened requirement turns a no-bid into a bid.
How to spot an incumbent
Five signals, roughly in order of how much they should worry you. The requirements matrix names a product, a schema, a version number, or an internal module, meaning someone with system access helped write it. Transition language runs one direction: pages on what a new vendor must do to take over, nothing on what the state will hand you. The response window is 21 days for a five-year platform. Mandatory experience is oddly specific, down to a beneficiary count or a named subsystem. And there is no data dictionary, no record counts, no sample extract, so the only firm that can price the migration is the one already inside.
Check the public record before deciding. Most states publish awarded contracts, values, and expiration dates through a transparency portal or a contract search on the procurement office's site. Pull the current contract, read the scope you are being asked to replace, note the expiration date. A solicitation issued nine months before expiry is a routine recompete; one issued three weeks before expiry is a state in trouble, which cuts both ways. Published bid tabulations tell you the field and the winning price.
An incumbent is not automatically fatal. Incumbents lose on price, on a project the agency has grown unhappy with, and on scope that outran the original architecture. Bidding blind against one is what is fatal.
A twenty-minute go/no-go
- Minimum qualifications: can we document a pass today, alone or with a named subcontractor?
- Cost formula: at a realistic price, how many cost points do we start behind?
- Technical weighting: does the score reward approach, or a resume we do not have?
- Insurance: will a broker write these limits at a premium the contract carries?
- Bonding: is a performance bond required, and does a surety line exist for us?
- Terms: is there a background-IP carve-out, and is the liability cap survivable?
- Forms: can registration, good standing, and tax clearance land before the deadline?
- Data: do we know enough about volume and quality to price migration without guessing?
- Incumbent: who holds the contract, what is it worth, and why is it being rebid?
- Calendar: is the question period still open, and what do the next 100 hours cost us?
Nine yeses and one soft no is a bid with a mitigation plan attached. Two hard noes in the first six lines is a no-bid, and a no-bid is worth making well: send the contracting officer a two-page capability summary and register for bid notifications under the right commodity codes. The firms already in the record when the next solicitation posts are the ones the program office recognizes.
Common questions on state procurement mechanics
Does the FAR apply to a state RFP?
No. State procurement runs on state statute and administrative rule, and many state codes descend from the ABA Model Procurement Code for State and Local Governments. Federal requirements arrive indirectly, riding along with grant money: 2 CFR Part 200 and its Appendix II provisions flow down through the state to the vendor.
Is the lowest price always the winner?
It depends on the method, and the cover page names it. An invitation for bids awards to the lowest responsive and responsible bidder, with no technical scoring at all. A request for proposals awards on points. A request for qualifications, used by some states for professional services, ranks on qualifications first and negotiates price afterward.
What happens after the notice of intent to award?
A protest window opens, commonly seven to ten calendar days from the notice or from a debrief, and the deadlines are strictly enforced. Most states also provide a debrief on request whether or not you protest. Take it. Scoring sheets and evaluator comments from a loss are the cheapest research available on how that agency reads a proposal.
Frequently asked questions
Most use a proportional formula: the lowest responsive price divided by your price, times the available cost points. With 30 cost points on the table, a price 25% above the low bidder starts you six points behind before anyone reads your technical volume. Run the formula before writing.
Sometimes. Ask in the question period whether federal or commercial engagements of similar size satisfy the experience requirement; a yes in an addendum binds the evaluation. Otherwise the workable paths are subcontracting to a prime that clears the bar, or building the relationship before the next solicitation.
Product names or version numbers in the requirements, one-sided transition language, a short response window, hyper-specific experience minimums, and no data dictionary or sample extract. Confirm against the state's published contract records, which usually show the current holder, value, and expiration date.