Career Information System

Overview

Education, Training & Libraries

Wilmington, Delaware, United States; Dover, Delaware, United StatesPosted 2 months agoDeadline: April 16th, 2026

Fit Score

Settle Intelligence

Settle helps teams find, evaluate, and respond to public RFPs. We continuously surface new opportunities, score them against your company strengths, and draft proposal responses so you can focus on the work that wins business.

SUMMARY

Delaware seeks a vendor-hosted web platform for career exploration, postsecondary planning, and work-based learning, supporting students, families, and educators.

KEY REQUIREMENTS

Provide a lead contact for services.
Participate in virtual meetings, conference calls, and correspondence.
Provide advice, expertise, and documentation related to the CIS.
Demonstrate experience providing academic and career planning CIS to at least 70,000 users for a minimum of four years.
Deploy and implement CIS for all students in grades 6-12 across all 42 LEAs in Delaware by fall 2027, including large-scale migration.
Provide dedicated staff for onboarding, technical support, and training for Delaware educators.
Provide minimum required data reports to schools, LEAs, and DDOE.
Provide DDOE with ongoing performance analytics and service delivery reports.
CIS must offer comprehensive, current, and accurate information on all postsecondary education and training pathways.
CIS must use research-validated assessments and adult-led activities to identify student career interests, skills, and work values.
CIS must provide Delaware-specific labor market information, highlighting in-demand careers, and profiles for career clusters, occupations, postsecondary institutions, and programs/majors.
CIS must enable educators to connect with local employers for work-based learning opportunities, with a toggle for student visibility.
CIS must include a student dashboard and personal portfolio for saving education, career, and SSP goals, with information transferability between schools/LEAs and retention for at least one year post-graduation.
Students must be able to create, update, review, download, and share SSP goals.
Students must be able to view and select course schedules within the CIS.
CIS must be engaging, easy, and intuitive for students to use, with appropriate graphics, content, and layout.
CIS must differentiate content and features for middle and high school students to ensure age-appropriateness.
CIS must provide and update features for educators to manage and maintain the system.
All CIS features must be accessible to students with intellectual, learning, physical, or sensory disabilities, and English learners.
Provide a high-level conceptual network diagram.
Provide the solution's data dictionary.
List the five most sensitive customer-relevant data fields stored in the solution.
Describe the release and maintenance approach.
Explain the managed hosting environment.
SAAS solutions must maintain an independent tenant for the state's use.
Provide evidence of IPS signatures and event logs.
Describe managed hosting services including software/hardware installation, updates, patching, monitoring, backup, failover, and disaster recovery.
Assure all supported operating systems and third-party applications are assessed and patched as required.
Describe active services and hardening standards applied.
Assure a comprehensive next-generation endpoint security solution is in place.
Assure auditing on hosts captures security-related activities, with event logs maintained for up to 7 years.
Assure access to application data is restricted to authorized database administrators.
Describe compatibility with Identity Access Management (OAUTH2, OpenIDC, SAML 2.0).
Describe protection of internet-facing web front-end servers against OWASP Top 10 risks, botnets, DDoS attacks, and virtual patching.
Provide details on application communication encryption for users and across components.
Describe how application security-related events are logged and reviewed for malicious activity.
Assure application code is scanned at least annually and prior to deployment.
Assure application undergoes dynamic scanning at least annually and prior to production changes.
Describe the method for System Administrators to be notified within 24 hours of third-party software releases impacting the vendor software version.
Describe the approach to installation and configuration of all software, hardware, and cloud services.
Describe the approach to ongoing post-deployment support, maintenance, and upgrades.
Describe the approach to operating, maintaining, and administering the centralized web and mobile user interface on a 24x7x365 basis.
Describe the solution's usability and compatibility across current versions of major browsers, operating systems, devices, and assistive technologies, including VPATs.
Provide copies of 3rd party security framework certificates (e.g., IRS Pub 1075, NIST 800-53, ISO 27001, CSA STAR, FedRAMP, PCI DSS, HIPAA).
Provide the latest 3rd party audit or assessment report(s) (e.g., SOC-2, SSAE-18, PCI ROC, SCA, CMMC).
Describe compliance with FERPA, CIPA, COPPA, and VPAT.
Describe firewall or next-generation network security controls for logical separation.
Describe how firewall rules are justified, documented, and defined.
Describe how all database systems implement encryption beyond the default host-level encryption.
Describe how all API integrations accessing state data route through the State API Gateway and comply with OWASP Top 10 and XML security controls.
Describe how all source network IPs, client certificates, and database queries are authenticated and validated.
Describe how unique database access credentials are established, managed, reset, and revoked.
Describe security incident detection and response management.
Assure system vulnerability scans are performed and remediated quarterly.
Assure the system undergoes external penetration testing at least annually.
Explain how emergency service tickets are handled outside of normal business hours.
Explain the process and timelines for notifying customers of security threats or breaches.
Assure the solution supports operation on mobile devices in compliance with State's encryption protocols.
Assure the solution is highly available, fully web-based, and accessible via a standard web browser with at least 256-bit encryption.
Assure the system utilizes a scalable, industry-standard relational database management system (RDBMS).
Assure the system utilizes a single, highly available, centralized RDBMS for all schools within the district.
Assure the RDBMS includes integrated data backup and recovery capabilities and supports restoration of pre-rollover database versions.
Assure the RDBMS includes the use of multiple online log files for data recovery, rollback capabilities, and auditing.
Assure the RDBMS enables locking of records to prohibit simultaneous updating by multiple users.
Describe the method and frequency for monitoring and inventorying authorized and unauthorized users, devices, and software.
Assure the solution utilizes a three-tier architecture or n-tier application model.
Describe how the solution supports horizontal scaling to accommodate growth and workloads.
Describe how the solution supports vertical scaling to accommodate growth and workloads.
List the programming languages on which the system is built.
Assure the solution supports use of non-production environment(s) and current documented data replication procedures.
Assure the solution supports all major browsers without the use of browser 'plug-ins'.
Assure the solution allows 'back end' access to the database using SQL Developer Tools, ODBC, JDBC.
Assure the solution supports native mobile apps across both Android and iOS with adaptive design.
Assure the solution is fully compatible for end user access across both MacOS and Microsoft Windows based platforms.
Assure the hosted solution datacenter utilizes isolated-parallel (IP) UPS topology.
Assure the hosted solution datacenter complies with ASHRAE standards for temperature and humidity.
Assure the hosted solution datacenter utilizes a Tier 1 Carrier Internet backbone with a minimum 10 Gigabit Ethernet connection.
Assure the hosted solution datacenter utilizes a minimum combination of biometric scanners and card readers for physical access.
Assure the hosted solution datacenter utilizes 24x7x365 internal and external CCTV video surveillance with a minimum 90-day video retention policy.
Assure the hosted solution incorporates XTS-AES at least 256-bit encryption for data at rest.
Assure the hosted solution incorporates CA-signed certificates with SHA-2 hashing and at least 256-bit cryptographic strength.
Describe how the hosted solution utilizes next-generation firewall (NGFW) technology with integrated intrusion detection system (IDS).
Describe how the hosted solution is protected by perimeter-based Distributed Denial of Service (DDoS) prevention and mitigation controls.
Assure the hosted solution's redundant backup levels incorporate daily full backups and offsite storage with a minimum 30-day retention policy.
Assure the hosted solution maintains multiple online log files across multiple redundant disks and/or SAN LUNS.
Describe the Disaster Recovery plan including offsite recovery location and Recovery Point Objective (RPO).
Describe how the hosted solution supports a unique, secure, and fully isolated instance for each district.
Assure the hosted solution will sustain 99.9% uptime excluding planned outages and supports system restoration within one hour.
Assure the solution supports outbound traffic routing through the State of Delaware proxy system.
If an on-premises solution is proposed, assure installation on Windows Server 2019+ or VMWare ESXi/OVF Appliance and integration with Delaware's cloud-based SIS without Docker or Kubernetes.
Assure the proposed solution uses Microsoft SQL Server as its RDBMS, with SQL Server 2019 as the minimum supported version.
Describe connectivity methods and data transfer capabilities to exchange data between solution and student database.
Attach signed Conditions Governing Cloud Services and Data Usage Agreement.
Include in the agreement to permit Department-level audit.
Provide experience of the staff that will be working with the Department on implementing the solution.
List all cybersecurity committees or Information Security and Analysis Center (ISAC) participation.
Agree to work with the Department and the State to develop approved detailed network design for implementation.

BUDGET

Estimate

$2,712,395 – $10,849,580

CONTRACT DURATION

84 months

TIMELINE

Public Notice: February 27th, 2026

Pre-Bid Meeting: March 16th, 2026

Deadline for Questions: March 31st, 2026

Response to Questions Posted by: April 7th, 2026

Deadline for Receipt of Proposals: April 16th, 2026 at 2:00 PM (Local Time)

Estimated Notification of Award: June 2026

QUESTION DEADLINE

March 31st, 2026

Issuing Agency

Delaware Department of Education

Organization overview and procurement intelligence available on paid plans.

See Issuer Research

DESCRIPTION

The organization is seeking a vendor to provide a configurable, vendor-hosted, web-based career information system (CIS) designed to assist students in exploring career paths, developing electronic portfolios, setting academic and career goals, creating resumes, and participating in work-based learning opportunities. The CIS should support postsecondary education and training planning, offering interactive, user-friendly tools for students and families to access comprehensive information on educational pathways, conduct job searches, and select coursework aligned with their goals.

The CIS must allow for the creation and management of student surveys, including career interest, skill, and work value assessments, with the option for custom surveys. It should identify any third-party plug-ins or integrations required for full functionality, such as Campus SIS, Common App, Google, and Schoology. The platform should enable educators to directly connect with local employers for work-based learning opportunities and provide caregiver access to support student planning.

The contract period will last for five years, with a pre-proposal meeting scheduled for March 16, 2026. All questions regarding the RFP must be submitted no later than March 31, 2026.

Source attribution

This Settle analysis is based on the issuing organization’s public RFP listing.