The verdict in three sentences
For a life or property and casualty insurer in New York, a corporate website with online services costs between 80,000 and 250,000 USD in 2026, depending on the number of calculators and the depth of the policyholder portal. A well-built RFP shortlists 3 to 5 bidders, applies a 60 % technical and 40 % financial scoring grid and demands evidence on data security. The realistic timeline is 4 to 6 months, because compliance reviews and the connection to the policy administration system take as long as development.
The scope to describe in the RFP
An insurer regulated by the New York Department of Financial Services (NYDFS) does not publish a website like an SME. Its Cybersecurity Regulation (23 NYCRR 500) applies to systems handling customer data, and the site must meet ADA accessibility expectations (WCAG 2.1 AA in practice).
| Module | Indicative 2026 budget (USD) | Watch point |
|---|---|---|
| Corporate site 25 to 40 pages, CMS | 25,000 to 60,000 | Compliance approval workflow before publishing |
| Premium calculators (auto, health, home, life) | 8,000 to 20,000 per calculator | Formulas validated by actuarial team |
| Policyholder portal (policies, ID cards, payments) | 25,000 to 80,000 | API connection to policy admin system |
| Online claims filing with attachments | 12,000 to 35,000 | Claim tracking, SMS notifications |
| Premium payments (card, ACH, Apple Pay) | 8,000 to 20,000 | Automatic reconciliation |
| Security, penetration testing, hosting | 10,000 to 30,000 | External audit before launch |
| Total project | 80,000 to 250,000 | Excl. annual maintenance 15 to 20 % |
Maintenance and hosting then represent 15 to 20 % of the initial budget per year, so 12,000 to 50,000 USD.
A scoring grid that picks the right vendor
Publish the grid in the RFP. It prevents choosing the lowest bidder who underestimates integration with the policy system.
| Criterion | Weight | What is actually scored |
|---|---|---|
| Understanding of needs and methodology | 15 % | Schedule, workshops, risk management |
| Insurance or banking references | 15 % | At least 2 comparable projects, verifiable contacts |
| Architecture and systems integration | 15 % | APIs, connectors, data migration |
| Security, NYDFS and ADA compliance | 10 % | Encryption, hosting, incident response plan |
| Proposed team | 5 % | Project manager and lead developer resumes |
| Technical subtotal | 60 % | Elimination below 36 out of 60 |
| Total price and breakdown | 30 % | Consistency of person-days and rates |
| 3-year maintenance cost | 10 % | Avoids cheap maintenance repriced later |
Require a 60-minute presentation with a working calculator mockup. It is the best filter to separate an agency that knows the business from one adapting a template.
Typical RFP and project calendar
- Weeks 1 to 3: write the RFP, sign-off by IT, compliance and executive team.
- Weeks 4 to 7: send to 3 to 5 vendors, written Q&A, proposal submission.
- Weeks 8 to 9: analysis, presentations, negotiation, award.
- Months 3 to 6: design, development, systems integration, penetration tests, business acceptance, phased launch.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Rachel, marketing director of a property and casualty insurer in Manhattan, runs an RFP with a ceiling of 180,000 USD. The winning bid comes in at 165,000 USD with three calculators and a policyholder portal. Today, the service center handles 1,200 ID card and certificate requests a month at 15 minutes each, so 300 hours. If the portal absorbs 60 % of those requests, the saving is 180 hours a month. At a loaded cost of 45 USD an hour, that is 8,100 USD a month, before counting faster premium collection online. Estimated payback: about 20 months on that line alone, as a 2026 ballpark.
FAQ
How many bidders should we invite?
Three to five vendors are enough: beyond that, analysis takes more than 3 weeks without improving the choice. Pre-screen on industry references before sending the RFP.
What does NYDFS cybersecurity regulation change for the website?
Systems handling nonpublic customer data must follow 23 NYCRR 500, including multi-factor authentication and encryption. Expect 10 to 15 % of the budget for these controls.
How much of the budget should go to security?
Count 8 to 12 % of the budget, so 10,000 to 30,000 USD, for audit and penetration testing. Auditors and the risk team examine this first.
Is ADA compliance mandatory?
Courts regularly apply the ADA to websites, and New York sees many accessibility lawsuits. A WCAG 2.1 AA audit costs 5,000 to 15,000 USD and is far cheaper than a settlement.
Why does the technical score weigh 60 %?
Because integration with the policy administration system is the main overrun risk. A 20,000 USD price gap matters little against a 3-month delay.
Let's scope your project. We answer your RFP or help you frame the requirements (modules, systems integration, security) with an indicative USD budget and a 4 to 6 month schedule. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
