Web-Based Career Information System

Delaware seeks a vendor to provide and host a configurable web-based career information system for grades 6–12, featuring interactive career planning and academic tools.

Provide a high-level conceptual network diagram with details on systems, IP addresses, traffic, port usage, and encryption.
Submit the solution's data dictionary, including key data elements and definitions.
List the five most sensitive customer-relevant data fields stored in the solution.
Describe the release and maintenance approach, including governance, principles, schedules, and documentation.
Explain the managed hosting environment, covering hardware, operating systems, networking, backup, failover, and disaster recovery.
Assure that SAAS solutions maintain an independent tenant for the state's use.
Provide evidence that IPS signatures and event logs are maintained and available for state validation.
Describe managed hosting services, including software/hardware installation, updates, patching, monitoring, performance tuning, backup, disaster recovery, and maintenance.
Assure all supported operating systems and third-party applications are assessed and patched as required.
Provide a description of active services, including web services, and applied hardening standards.
Assure a comprehensive next-generation endpoint security solution with machine learning anti-malware, abnormal detection, file integrity monitoring, log file monitoring, host-based intrusion detection, and file reputation scanning.
Assure auditing on hosts captures all security-related activities, with event logs maintained for up to 7 years.
Assure access to application data is restricted to authorized database administrators.
Describe compatibility with Identity Access Management (OAUTH2, OpenIDC, SAML 2.0) for authentication.
Explain how internet-facing web front-end servers are protected by an enterprise WAF against OWASP Top 10 risks, botnets, DDoS attacks, and virtual patching.
Provide details on how application communication from users and across components is encrypted.
Describe how application security-related events are logged and reviewed for malicious or anomalous activity.
Assure application code is scanned at least annually and prior to deployment.
Assure application undergoes dynamic scanning at least annually and prior to production changes.
Describe the method for notifying System Administrators within 24 hours of third-party software impacts.
Describe the approach to installation and configuration of all software, hardware, and cloud services for a complete, working environment.
Provide a description of ongoing post-deployment support, maintenance, and upgrades.
Describe the approach to operating, maintaining, and administering the centralized web and mobile user interface on a 24x7x365 basis.
Describe the solution's usability and compatibility across current versions of major browsers and mobile platforms, including accessibility assessments.
Provide copies of 3rd party security framework certificates (e.g., IRS Pub 1075, NIST 800-53, ISO 27001, FedRAMP, PCI DSS, HIPAA).
Provide the latest 3rd party audit or assessment reports (e.g., SOC-2, SSAE-18, PCI ROC, CMMC Readiness).
Describe compliance with FERPA, CIPA, COPPA, and provide a Voluntary Product and Accessibility Template (VPAT).
Describe firewall or next-generation network security controls for logical separation.
Describe how firewall rules are justified, documented, and defined to meet application needs.
Describe how all database systems implement encryption beyond default host-level encryption.
Describe how API integrations accessing state data route through the State API Gateway and comply with OWASP Top 10 and XML security controls.
Describe how source network IPs, client certificates, and database queries are authenticated and validated.
Describe how unique database access credentials are established, managed, reset, and revoked.
Describe security incident detection and response management, including log collection, monitoring, and SIEM forwarding.
Assure system vulnerability scans are performed and remediated quarterly.
Assure external penetration testing is conducted annually, with reports provided upon request.
Explain how emergency service tickets are handled outside of normal business hours.
Explain the process and timelines for notifying customers of security threats or breaches.
Assure the solution supports operation on mobile devices in compliance with state encryption protocols.
Assure the solution is highly available, fully web-based, and accessible via a standard web browser with 256-bit encryption.
Assure the system utilizes a scalable, industry-standard relational database management system (RDBMS).
Assure the system utilizes a single, highly available, centralized RDBMS for all schools within the district.
Assure the RDBMS includes integrated data backup and recovery capabilities and supports restoration of pre-rollover database versions.
Assure the RDBMS uses multiple online log files for data recovery, rollback capabilities, and auditing.
Assure the RDBMS enables locking of records to prohibit simultaneous updating by multiple users while allowing viewing.
Describe the method and frequency for monitoring and inventorying authorized and unauthorized users, devices, and software.
Assure the solution utilizes a three-tier or n-tier application model.
Describe how the solution supports horizontal scaling to accommodate growth and workloads.
Describe how the solution supports vertical scaling to accommodate growth and workloads.
List the programming languages on which the system is built.
Assure the solution supports non-production environments and documented data replication procedures.
Assure the solution supports all major browsers without plug-ins.
Assure the solution allows 'back end' access to the database using SQL Developer Tools, ODBC, JDBC.
Assure the solution supports native mobile apps across Android and iOS with adaptive design.
Assure the solution is fully compatible for end-user access across MacOS and Microsoft Windows platforms.
Assure the hosted solution datacenter utilizes isolated-parallel (IP) UPS topology.
Assure the hosted solution datacenter complies with ASHRAE standards for temperature and humidity.
Assure the hosted solution datacenter utilizes a Tier 1 Carrier Internet backbone with a minimum 10 Gigabit Ethernet connection.
Assure the hosted solution datacenter utilizes biometric scanners and card readers for physical access.
Assure the hosted solution datacenter utilizes 24x7x365 internal and external CCTV video surveillance with a 90-day retention policy.
Assure the hosted solution incorporates XTS-AES 256-bit (or greater) encryption for data at rest.
Assure the hosted solution incorporates CA-signed certificates with SHA-2 hashing and 256-bit cryptographic strength.
Describe how the hosted solution utilizes next-generation firewall (NGFW) technology with integrated intrusion detection system (IDS).
Describe how the hosted solution is protected by perimeter-based Distributed Denial of Service (DDoS) prevention and mitigation controls.
Assure the hosted solution's redundant backup levels incorporate daily full backups and offsite storage with a minimum 30-day retention policy.
Assure the hosted solution maintains multiple online log files across multiple redundant disks and/or SAN LUNS.
Describe the Disaster Recovery plan, including offsite recovery location and Recovery Point Objective (RPO).
Describe how the hosted solution supports a unique, secure, and fully isolated instance for each district.
Assure the hosted solution will sustain 99.9% uptime and supports system restoration within one hour.
Assure the solution supports outbound traffic routing through the State of Delaware proxy system.
If on-premises, assure installation on Windows Server 2019+ or VMWare ESXi/OVF Appliance, integrating with Delaware's cloud-based SIS without Docker/Kubernetes.
Assure the proposed solution uses Microsoft SQL Server 2019 as the minimum supported RDBMS version.
Describe connectivity methods and data transfer capabilities to exchange data between the solution and student database.
Attach signed Conditions Governing Cloud Services and Data Usage Agreement.
Include in the agreement permission for Department-level audit.
Provide experience of staff working on implementation.
List all cybersecurity committees or Information Security and Analysis Center (ISAC) participation.
Agree to work with the Department and State to develop approved detailed network design.
Vendor must provide a Lead Contact for services.
Vendor must participate in virtual meetings, conference calls, and correspondence as needed.
Vendor must provide advice and expertise related to the CIS as requested by DDOE, including documentation of work performed.
Vendor must attest to providing academic and career planning CIS to at least 70,000 users for a minimum of four years.
Vendor must be able to deploy and implement CIS for all students in grades 6-12 in all 42 local education agencies by fall 2027.
Vendor must provide dedicated staff for onboarding, technical support, and training for educators.
Vendor must provide minimum required data reports to schools, LEAs, and DDOE.
CIS must provide DDOE with ongoing performance analytics and service delivery reports.
CIS must provide comprehensive, current, and accurate information on all postsecondary education and training pathways.
CIS must utilize assessments and adult-led activities to help students identify career interests, skills, and work values.
CIS must provide students with current labor market information specific to Delaware, including various career profiles.
CIS must enable educators to directly connect with local employers for work-based learning opportunities, with school-level toggle.
CIS must provide access to a student dashboard and personal portfolio, allowing saving, transferability, and retention of information post-graduation.
Students in grades 6-12 must be able to create, update, review, download, and share SSP goals.
Students in grades 6-12 must be able to view and select their course schedules.
CIS must allow students to use and navigate with engaging, easy, and intuitive graphics, content, layout, and interaction elements.
CIS must differentiate between middle and high school content for age/developmental appropriateness.
CIS must provide and update features for educators to utilize, manage, and maintain.
All CIS features must be accessible for all students, including those with disabilities or English learners.

$2,712,395 – $10,849,580

Public Notice: February 27th, 2026

Pre-Bid Meeting: March 16th, 2026

Deadline for Questions: March 31st, 2026

Response to Questions Posted by: April 7th, 2026

Deadline for Receipt of Proposals: April 16th, 2026 at 2:00 PM (Local Time)

Estimated Notification of Award: June 2026

Delaware Department Of Education

Organization overview and procurement intelligence available on paid plans.

The State of Delaware is seeking a vendor to provide a configurable, vendor-hosted web-based Career Information System (CIS) accessible to all students in grades 6–12. The system must be interactive and user-friendly, allowing students to build electronic portfolios, explore career and postsecondary options, set academic and career goals, create resumes, participate in work-based learning, access financial aid information, conduct job searches, and select coursework aligned with their objectives.

This opportunity includes a pre-bid meeting on March 16, 2026. All questions regarding the RFP must be submitted by March 31, 2026. The awarded contract will span a period of five years, supporting comprehensive and secure online career guidance for Delaware students.

Web-Based Career Information System

Overview

Fit Score

SUMMARY

KEY REQUIREMENTS

BUDGET

CONTRACT DURATION

TIMELINE

QUESTION DEADLINE

Issuing Agency

DESCRIPTION

Similar RFPs