The verdict in three sentences
Redesigning the website of a mutual insurance group in New York typically costs USD 80,000 to 200,000 for the build, with a multi-year support retainer that procurement should price in the same RFP. A well-run process invites 4 to 6 agencies, scores proposals on a weighted rubric, and treats SOC 2 evidence and ADA accessibility as pass or fail gates rather than nice-to-haves. Get those gates wrong and you will either shortlist vendors your security team later rejects, or launch a site that invites a demand letter.
An RFP timeline that closes in one quarter
Mutual insurers are not bound by public procurement rules, but boards and auditors expect a documented, defensible selection. This schedule gives agencies enough time to respond properly without stretching the decision past 12 weeks.
| Stage | Duration | Output |
|---|---|---|
| Internal discovery and RFP drafting | 2 to 3 weeks | RFP, scoring rubric, budget ceiling, security questionnaire |
| Vendor longlist and NDA | 1 week | 4 to 6 agencies with insurance or financial services references |
| Response window | 3 weeks | Technical proposal, staffing plan, itemized pricing |
| Written Q and A | During week 2 | Answers shared with every bidder |
| Security and compliance review | 1 week, in parallel | SOC 2 Type II report or bridge letter, pen test summary |
| Scoring and shortlist | 1 week | Weighted scores, 2 or 3 finalists |
| Finalist presentations and negotiation | 2 to 3 weeks | 90-minute orals, MSA, SOW and support agreement |
Pass or fail gates, then the weighted rubric
Some requirements should eliminate a vendor outright. An agency that cannot provide a SOC 2 Type II report (or a credible hosting partner who can) should not reach scoring if the site will connect to member portals or quote engines. Insurers licensed in New York also need to map vendor obligations against the NYDFS cybersecurity regulation (23 NYCRR Part 500); involve your CISO when drafting the third-party requirements.
On accessibility, the ADA does not spell out a technical web standard for private companies, but WCAG 2.1 AA is the benchmark courts and the Department of Justice refer to most often. Make WCAG 2.1 AA conformance, an independent audit and remediation of findings contractual deliverables.
| Criterion | Weight | What you actually score |
|---|---|---|
| Understanding of member journeys and approach | 15% | Discovery plan, research with members and brokers |
| UX and design | 15% | Quote and enrollment flows, comparable insurance work |
| Architecture, security and integrations | 15% | CMS choice, hosting, SSO, portal and CRM integration |
| Accessibility and QA | 10% | WCAG 2.1 AA method, audit partner, assistive tech testing |
| Support model and SLAs | 5% | Response times, on-call coverage, reporting |
| Build price | 25% | Score = 25 x lowest price / bidder price |
| 3-year support cost | 15% | Same formula applied to 36-month total |
Scoring the build and the retainer separately stops the classic move where a vendor underbids the project and recovers margin on a USD 8,000 monthly retainer.
Realistic 2026 budgets in New York
The ranges below are a 2026 market ballpark for New York agencies, excluding CMS licenses and hosting.
| Scope | Build | Monthly retainer | 3-year total |
|---|---|---|---|
| 60-page corporate site, open source CMS | USD 80,000 to 110,000 | USD 3,000 to 4,500 | USD 188,000 to 272,000 |
| Site with premium calculators and quote flow | USD 110,000 to 150,000 | USD 4,500 to 6,500 | USD 272,000 to 384,000 |
| Site integrated with member portal and SSO | USD 150,000 to 200,000 | USD 6,500 to 9,000 | USD 384,000 to 524,000 |
| Independent WCAG 2.1 AA audit and retest | USD 8,000 to 20,000 | Quarterly checks optional | USD 8,000 to 35,000 |
Present the 3-year figure to your board: support usually accounts for 40 to 60 percent of total cost in this market.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Illustrative example: Rachel, Director of Digital at a mutual insurance group in New York with 300,000 members, receives 5 proposals; 3 pass the SOC 2 and accessibility gates. Builds: Agency A USD 168,000, Agency B USD 132,000, Agency C USD 110,000.
On build price (25 points), C scores 25, B scores 25 x 110 / 132 = 20.8, A scores 25 x 110 / 168 = 16.4. Retainers: B quotes USD 4,800 per month (USD 172,800 over 36 months) and earns the full 15 points, C at USD 6,200 (USD 223,200) earns 11.6, A at USD 5,400 (USD 194,400) earns 13.3. Technical scores out of 60: A 55, B 50, C 41. Totals: A 84.7, B 85.8, C 77.6. B wins with a 3-year cost of USD 304,800, while C, the cheapest build, would have cost USD 333,200.
FAQ
How many agencies should we invite?
Four to six gives real competition without scaring off strong agencies. Beyond six, response quality drops and scoring can take your team more than 40 hours.
Should the RFP disclose a budget?
Yes, a range such as USD 120,000 to 160,000 lets agencies size their proposal. Without it you will receive bids from USD 50,000 to 300,000 that cannot be compared.
Is SOC 2 mandatory for a marketing website vendor?
Not for a static brochure site, but as soon as the site touches member data, SSO or quote engines it should be a gate. Accept a hosting provider's SOC 2 Type II report plus the agency's own security policies if the agency never stores member data.
How do we reduce ADA risk at launch?
Contract for WCAG 2.1 AA, an independent audit before go-live and remediation within a defined window, for example 30 days. Budget USD 8,000 to 20,000 for the audit and retest.
Why sign the support agreement with the build contract?
Once the site is live you negotiate without competition. A 3-year support agreement with response times, service credits and exit assistance protects a cost line worth USD 100,000 to 300,000.
Let's scope your project. Share your RFP or scope summary and we will reply with an indicative build budget, a 3-year support cost and a delivery plan. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
