How to Write an RFP for a Community Engagement Platform

When the Port of Bellingham opened its draft Climate Action Strategy to online comment in 2023, the three-week period drew 227 comments from 13 commenters (Port of Bellingham). Engagement software makes activity easy to count. Whether it reaches the people a plan affects depends on what the RFP asks it to measure.

A community engagement platform is the software a public agency uses to run online participation: project pages, surveys, comment and mapping tools, notifications, and reports on who took part and how their input was used. You need one when engagement runs across many projects and years rather than one hearing. The RFP succeeds when it buys an accessible platform and a participation record the agency owns.

Two rules changed recently. Purchases under federal awards follow a $15,000 micro-purchase threshold and a $350,000 simplified acquisition threshold for procurements from October 1, 2025 (FEMA Information Bulletin 552), and web content and apps a government provides through a vendor must meet WCAG 2.1 AA from April 26, 2027 for governments of 50,000 or more (28 CFR 35.200).

What this work should deliver

The outcome is a platform residents can use on a phone and in their own language, that your staff can run without the vendor, and a participation record you can analyze, publish and keep after the contract ends.

Who this is for: cities, counties, metropolitan planning organizations, utilities and ports that take public input on plans, capital projects and grant applications, from hazard mitigation and climate plans to transportation programs and HUD consolidated plans. It is the wrong first purchase if you have not decided which decisions are open to the public; buy a stakeholder engagement plan first. An awareness campaign needs a public outreach campaign, not a platform.

Software widens reach; it does not build trust. On the Annapolis Maritime Resilience Initiative, 18 months of bilingual outreach with local organizations produced the 38 sites of concern behind the technical work. A platform can carry that kind of effort across more projects and keep its record, but it cannot stand in for the people doing it.

Match the product category to the job. Many platforms span more than one row.

Rules and standards to cite

Cite the participation rules the platform has to serve, then the rules for buying it.

• Hazard mitigation plans. 44 CFR 201.6 requires an opportunity for public comment during drafting and before approval, and continued public participation while the plan is maintained. FEMA’s Policy Guide lists annual questionnaires or surveys and interactive websites among ways to keep the public involved between updates (D1-a). Our hazard mitigation plan update guide covers the planning side.
• Transportation plans. 23 CFR 450.316 asks metropolitan planning organizations to use visualization techniques, publish information in electronically accessible formats such as the web, and show explicit consideration and response to public input, with at least 45 days of comment before adopting a participation plan.
• HUD consolidated plans. 24 CFR 91.105 sets a comment period of at least 30 days and asks jurisdictions to encourage participation by non-English speaking residents and people with disabilities, naming the Internet among techniques to explore.
• Accessibility. 28 CFR 35.200 covers web content and mobile apps a government provides directly or through contractual, licensing or other arrangements: WCAG 2.1 AA from April 26, 2027 for governments of 50,000 or more, and April 26, 2028 for smaller ones and special districts, under a Justice Department interim final rule of April 20, 2026. Residents’ own posts are exempt under 35.201(c), but the platform and what the agency or its vendor posts are not (ADA.gov). Ask for an Accessibility Conformance Report on ITI’s VPAT template, version 2.5Rev.
• Procurement. With federal money, 2 CFR 200.320 allows micro-purchases without quotes when the price is reasonable and documented and requires quotes from an adequate number of sources up to the simplified acquisition threshold; above it, an RFP must publish every evaluation factor and its relative importance and weigh price. FEMA applies the $15,000 and $350,000 thresholds to procurements from October 1, 2025 and notes the increase does not necessarily change state or local limits. 2 CFR 200.319 bars firms that draft your requirements from competing on them.
• Cooperative contracts. 2 CFR 200.318(e) treats documented intergovernmental and inter-entity purchasing arrangements as meeting the competition rules, and GSA’s Cooperative Purchasing program lets eligible state and local governments buy commercial IT through its Multiple Award Schedule. FEMA advises caution: document how the contract fit what you need and met federal, state and local rules.
• Security and privacy. Ask for GovRAMP status, which is built on NIST SP 800-53 Revision 5, or a SOC 2 report on the vendor’s controls. Wilmington, North Carolina listed ISO 27001, SOC 2 or equivalent certification, regional data residency options and audit trails as critical requirements (Wilmington), and Owosso, Michigan’s agreement requires $1 million in cyber liability insurance (Owosso).
• Records. When federal money pays for the engagement, 2 CFR 200.336 asks for award information in open, machine-readable formats when practicable. Check your state’s records retention schedule for comments and survey responses before you set exit terms.

Sample scope of work

Adapt the bracketed items. Wilmington’s 2025 RFP is a good model: it listed 76 requirements, marked each critical or priority, and made bidders code every one (Wilmington).

1. Requirements matrix. Make every claim specific and priced.

The Proposer shall respond to every requirement in Attachment A with one code: Standard (in the current release), Future (with the planned release date), Custom (with its cost on the price form), Third-party (naming the product and its cost) or No. Requirements left blank shall be scored as No.

2. Accessibility.

All resident-facing pages, forms, maps, surveys, notifications and generated reports, and all staff tools, shall conform to WCAG 2.1 Level AA. The Vendor shall provide a current Accessibility Conformance Report based on the VPAT 2.5 template, offer a text or list alternative for every map-based activity, and correct reported nonconformities within [30] days.

3. Language access. Wilmington required machine translation for the portal and, separately, for documents uploaded to it. Ask for both, and review what matters.

The platform shall present its interface and activities in [English, Spanish and other languages], translate uploaded documents and accept responses in each language. A fluent speaker shall review machine translation of [decision documents and surveys] before release.

4. Participation record. Owosso and Wilmington both asked for participant demographics compared with census data. Count people first; see our guide to cultural awareness in stakeholder engagement for the outreach side.

For each activity, the system shall report unique participants as well as responses and comments, summarize optional demographic answers against [American Community Survey] data for the project area, and keep a log of every comment with the [Agency’s] response or disposition, exportable for plan documentation.

5. Data ownership and export. Put the data terms in the contract itself. The nine-article agreement in Owosso’s council packet incorporates the vendor’s proposal by reference and does not address data ownership, export or what happens when the term ends.

All content, responses, comments, geographic inputs, subscriber lists and consent records are the property of the [Agency]. At no added cost, the [Agency] may export them at any time as raw records with timestamps in CSV, with geographic inputs in GeoJSON and a data dictionary, and may read them through a documented API. The Vendor shall not sell resident data or use it for any purpose other than providing the service without the [Agency’s] written consent.

6. Security, privacy and hosting.

The Vendor shall maintain [GovRAMP status, ISO/IEC 27001 certification or a SOC 2 report dated within the past 12 months], encrypt data in transit and at rest, enforce role-based access and multi-factor authentication for staff, keep audit logs of administrative actions, host data in [the United States], and carry cyber liability insurance of at least [$1,000,000] per occurrence.

7. GIS and other integrations. State what you run, as Wilmington did in its addendum: ArcGIS Enterprise with REST endpoints, its website platform, its email service and Microsoft Entra ID for sign-on.

The platform shall read and publish map layers through the [Agency’s ArcGIS Enterprise REST services], embed activities in the [Agency’s] website, send notices through [the Agency’s email service], and support staff single sign-on through [identity provider]. Each integration shall be priced as a separate line on the price form.

8. Support, training and uptime. Owosso required a 99.9% uptime commitment; by our arithmetic, that allows about 43 minutes of downtime in a 30-day month.

The Vendor shall guarantee [99.9]% monthly availability with service credits, provide a ticketing system and knowledge base, respond to critical issues within [four] business hours, and train staff through [a train-the-trainer model with recorded sessions]. The platform shall go live within [12] weeks of contract execution, with any phasing stated in the proposal.

9. Exit and transition. Plan the exit at the start. One vendor’s published terms keep data and projects for 90 days after a subscription expires (Maptionnaire).

On expiration or termination, the Vendor shall deliver the complete export described in Task 5 within [30] days, keep public project pages available read-only for [90] days or deliver archived copies, and certify deletion of [Agency] data after the [Agency] confirms receipt.

Deliverables to require

• The completed requirements matrix and price form, incorporated into the contract.
• A configured, branded site with a project page template your staff can reuse.
• A current Accessibility Conformance Report and a dated remediation plan.
• A language plan stating which languages are offered, what is machine translated and what is reviewed.
• Security documentation (GovRAMP status, ISO 27001 certificate or SOC 2 report), privacy terms and the incident response procedure.
• Working connections to your GIS, website and email service.
• Participation reports: unique participants, demographics against census data and a comment disposition log.
• Training sessions, recordings and administrator guides.
• A tested full export in the first [90] days.
• An exit plan and a price schedule for the full term, with capped renewals.

How to evaluate proposals

Denton’s published weights favored track record. The city weighted past performance at 30%, staff experience and qualifications at 30%, project scope at 20%, schedule at 10% and total cost of ownership at 10% (Denton pricing evaluation). Owosso listed responsiveness, ability to perform with Michigan municipal experience preferred, references and three-year cost, without weights (Owosso RFP). Experience-heavy scoring favors firms that have sold to cities before; score what the platform does with your project instead.

When federal money pays, 2 CFR 200.320 requires the RFP to state every factor and its relative importance and to weigh price; selection without price is reserved for architectural and engineering services. Ask finalists for a sample raw export, with personal data removed, before you score data ownership.

Timeline

Wilmington held its 12-week go-live when a bidder asked for about six months, and asked any bidder who found it unrealistic to propose phases listing the features available in each. Phase the features, not the deadline. Line up a real consultation for launch week so staff learn the tool on live work; our stakeholder engagement topic hub collects related guides.

Budget and cost drivers

Owosso, Michigan, a city of about 14,500, gives the most complete public benchmark. Its council discussed a three-year subscription with one vendor in September 2025 and chose an RFP instead (council synopsis); the October 7 bid sheet shows eleven prices from ten firms, from $25,000 to $285,000 over three years. The city signed at $7,500 a year for licensing, hosting, maintenance and support, with a $2,500 implementation fee waived because it also bought a related water portal from the same firm (Owosso).

Denton, Texas sits at the other end. It budgeted $80,000 a year in licenses, $400,000 over five years, for combined engagement and sentiment software (Denton), and its three bids ran from $391,760 to $462,500 over five years (pricing evaluation). The bids priced five modules separately, and by our arithmetic the engagement platform line was 20% to 52% of each five-year total; social media management, sentiment monitoring, surveys and media reports made up the rest.

Grant budgets can carry the cost. The Port of Bellingham’s amended EPA Clean Ports planning budget includes $16,000 for a three-year membership in the Konveio online engagement platform, for hybrid open houses and an online engagement hub (Port of Bellingham). Vendors rarely publish prices: Go Vocal’s plans page asks buyers to talk to its team for an offer, and Maptionnaire quotes by organization size and portfolio, with both reserving single sign-on and ArcGIS integration for their enterprise tiers.

What moves the price:

• Modules. Social media management, sentiment monitoring, surveys and media reports can be separate lines, as Denton’s price form shows.
• Projects and seats. Go Vocal’s Essential plan allows one active project and one admin seat; its Standard plan allows unlimited projects and four admin seats.
• Languages. Go Vocal’s auto-translation covers up to 3 languages in Premium and up to 10 in Enterprise; human review is extra work to price.
• Text messages and notices. Wilmington made targeted email and text notifications critical requirements; price them as their own lines.
• Integrations. Wilmington asked bidders to list any added licensing or costs for each integration, a question worth copying.
• Implementation and training. Owosso’s quote carried a $2,500 implementation fee, and Wilmington accepted a train-the-trainer model.
• Term and renewals. Price every option year, as Denton’s one-plus-four structure does, and cap increases.

Red flags in proposals

• Participation reported as page views, visits or comment counts, with no count of unique participants.
• Exports limited to PDF summaries, or raw data and API access priced as extras.
• An accessibility statement with no Accessibility Conformance Report, or map activities with no accessible alternative.
• Machine translation of the interface only, leaving uploaded plans and notices in English.
• AI summaries or sentiment scores that do not link back to the comments behind them.
• Single sign-on and GIS integration quoted in a tier the price form leaves out.
• A contract that leaves data ownership and exit terms to the vendor’s proposal.
• First-year discounts with uncapped renewals.

How we’d approach it

We would choose the platform last. Decide which decisions are open, who must be reached and how you will report back, then buy the tool that carries that plan; our how-to on building a stakeholder engagement plan and our Stakeholder Engagement Scorecard, built on the AA1000 standard and the IAP2 Spectrum, are places to start. In our work with Chesapeake Watershed Restoration Professionals, we sequenced outreach around the 2025 Maryland legislative session with survey options to track awareness; the session calendar set the tools. Where no product handles a step in your process, such as an intake form or a scorecard tied to your own data, CF Labs does custom software development.