Question:
Hello City of Townsville Team,

We note that the RFT states: "Council invites suitably qualified suppliers to propose a secure, scalable Digital Asset

Management solution to manage the full digital content lifecycle."

Can the Council please provide information on:

1. The size of the current assets held

2. The nature of the assets maintained ie media, engineering plans, video, other documents and their respective quantities

3. Number of users likely to work with the system as Subject Matter Experts and those that would merely be consumers of the system

4. Are the current assets held on-premise or in the cloud. If the latter, what cloud is currently being used?

5. Are digital assets held in the Technology One ECM, or currently only references to them

6. Are you looking for full ECM capabilities with full ifecycle governance and retention policies in this system or will that be maintained by the Technology One ECM

7. WHat tools are being used for media production etc now that would need to be integrated with?

The RFT also states:

"The successful supplier will design, configure, integrate and migrate existing assets."

Can the Council please elaborate on the existing systems that those assets will be migrated from?

Thank you for your consideration of these questions

Best Regards

John

Answered on 22/Sep/2026 08:12 AM:


Thank you for your questions and query, please find the attached responses below **

From John Baker - john.baker@hyland.com | 0422946173

Question:

Hello City of Townsville Team,

We note that the RFT states: "Council invites suitably qualified suppliers to propose a secure, scalable Digital Asset

Management solution to manage the full digital content lifecycle."

Can the Council please provide information on:

1. The size of the current assets held

2. The nature of the assets maintained ie media, engineering plans, video, other documents and their respective quantities

3. Number of users likely to work with the system as Subject Matter Experts and those that would merely be consumers of the system

4. Are the current assets held on-premise or in the cloud. If the latter, what cloud is currently being used?

** Response for Questions 1-4

Refer to last answer below.

The current asset types include mp4, jpeg, png, PDF and Word.doc.

It is estimated the initial upload of historical content will be 5TB, with an estimated 5TB of new assets created and requiring storage in the DAM each year.

It is anticipated 6 staff will require access to upload content, while all staff will need to be able to view, search and download digital assets that have been approved for use – preferably through an online portal / shopping cart style experience.

5. Are digital assets held in the Technology One ECM, or currently only references to them

** Currently, no assets are held in Technology One.

6. Are you looking for full ECM capabilities with full ifecycle governance and retention policies in this system or will that be maintained by the Technology One ECM

7. WHat tools are being used for media production etc now that would need to be integrated with?

** Response for Question 6 & 7

It is expected that the asset lifecycle could be managed within the DAM.

Having proven capability to integrate with TechnologyOne and/or Adobe Suite is desirable, but not essential at initial implementation.

The RFT also states:

"The successful supplier will design, configure, integrate and migrate existing assets."

Can the Council please elaborate on the existing systems that those assets will be migrated from?

** Only a limited number of existing assets will be migrated into the new system, which are stored on network drives and external hard drives. It is anticipated this will be done by Townsville City Council staff with direction/support from the vendor during the implementation and onboarding period, which should include setting up of required accounts/users, configuration of metadata fields, asset status options etc.

Thank you for your consideration of these questions

Best Regards

John

Question:
1. Schedule 2 identifies 92 functional requirements as “Mandatory”, while many non-functional requirements use the term “MUST”. Are these strict pass/fail requirements, or will Council evaluate the overall degree of compliance and proposed solution approach?

2. May mandatory requirements be satisfied through an integrated combination of specialist platforms—for example, a DAM, creative proofing platform and Council’s TechnologyOne Enterprise Content Management system—or must every mandatory requirement be provided natively within a single DAM product?

3. For requirements LCM-005 to LCM-013, does Council expect the DAM itself to perform formal retention, legal hold, disposal and records-management functions, or may TechnologyOne remain the authoritative records system, with the DAM transferring or linking nominated records and associated evidence?

4. Please identify Council’s current systems and repositories for managing Marketing and Communications images, videos, design files, consent records and approvals. Is Council currently using a DAM or media-library product that the proposed solution will replace?

5. Please provide the approximate current asset count, storage volume, annual growth, largest file size and anticipated numbers of administrators, contributors, reviewers, internal users and external users.

6. Please identify the integrations required for the initial implementation, including the relevant TechnologyOne product, Council website/CMS, creative applications and publishing channels. Does Council expect all integrations to be fully delivered within the initial quoted implementation price?

7. NFR 2.7.8 states that Council data has been classified as PROTECTED but also contains the instruction “delete if not appropriate”. Has Council confirmed that information stored in the proposed DAM will be classified PROTECTED? Are the stated RTO of 10 minutes and RPO of five minutes also firm mandatory requirements?

8. Please provide the evaluation weightings for Capability, Capacity and Pricing, and confirm whether functional compliance, non-functional compliance, implementation methodology and local economic contribution are separately weighted.

Answered on 22/Sep/2026 08:26 AM:


Thank you for your questions and query, please find the attached responses below **

18/Sep/2026 03:07 PM

From Ricky Patten - ricky.patten@databasics.com.au | 0408212061

Question:

1. Schedule 2 identifies 92 functional requirements as “Mandatory”, while many non-functional requirements use the term “MUST”. Are these strict pass/fail requirements, or will Council evaluate the overall degree of compliance and proposed solution approach?

2. May mandatory requirements be satisfied through an integrated combination of specialist platforms—for example, a DAM, creative proofing platform and Council’s TechnologyOne Enterprise Content Management system—or must every mandatory requirement be provided natively within a single DAM product?

3. For requirements LCM-005 to LCM-013, does Council expect the DAM itself to perform formal retention, legal hold, disposal and records-management functions, or may TechnologyOne remain the authoritative records system, with the DAM transferring or linking nominated records and associated evidence?

**Response for Questions 1-3:

These will not be assessed as pass/fail, but rather will be used to assess the overall capabilities of each potential supplier.

Having proven capability to integrate with TechnologyOne and/or Adobe Suite is desirable, but not essential at initial implementation.

It is expected that the asset lifecycle could be managed within the DAM.

4. Please identify Council’s current systems and repositories for managing Marketing and Communications images, videos, design files, consent records and approvals. Is Council currently using a DAM or media-library product that the proposed solution will replace?

5. Please provide the approximate current asset count, storage volume, annual growth, largest file size and anticipated numbers of administrators, contributors, reviewers, internal users and external users.

** Response for Questions 4-5:

Only a limited number of existing assets will be migrated into the new system, which are stored on network drives and external hard drives. It is anticipated this will be done by Townsville City Council staff with direction/support from the vendor during the implementation and onboarding period, which should include setting up of required accounts/users, configuration of metadata fields, asset status options etc.

The current asset types include mp4, jpeg, png, PDF and Word.doc.

It is anticipated minimum of 6 staff will require access to upload content, while all staff will need to be able to view, search and download digital assets that have been approved for use – preferably through an online portal / shopping cart style experience.

It is estimated the initial upload of historical content will be 5TB, with an estimated 5TB of new assets created and requiring storage in the DAM each year.

6. Please identify the integrations required for the initial implementation, including the relevant TechnologyOne product, Council website/CMS, creative applications and publishing channels. Does Council expect all integrations to be fully delivered within the initial quoted implementation price?

** Please refer to response for questions 1-3.

7. NFR 2.7.8 states that Council data has been classified as PROTECTED but also contains the instruction “delete if not appropriate”. Has Council confirmed that information stored in the proposed DAM will be classified PROTECTED? Are the stated RTO of 10 minutes and RPO of five minutes also firm mandatory requirements?

** Suppliers should respond to all tender requirements as practical to be considered in the evaluation process.


8. Please provide the evaluation weightings for Capability, Capacity and Pricing, and confirm whether functional compliance, non-functional compliance, implementation methodology and local economic contribution are separately weighted.

** Council does not disclose evaluation weightings as part of this procurement.

Suppliers should respond to all tender requirements as practical to be considered in the evaluation process.

Question:
Good Afternoon,

Council's RFQ appears to contemplate the provision and implementation of a nominated Digital Asset Management platform. Would Council consider a response from a technology-independent System Integrator acting as the prime contractor, where the respondent provides requirements validation, solution architecture, technology evaluation/selection, configuration, integration, migration and implementation services, with the final DAM technology selected collaboratively with Council during the initial project phase? Alternatively, does Council require respondents to nominate and price the proposed DAM software/platform as part of their RFQ submission?

Thank you in advance for your consideration.

Answered on 22/Sep/2026 08:28 AM:


Thank you for your questions and query, please find the attached responses below **

From Peter Nicholson - tenders@iq-im.com | 0407997171

Question:

Good Afternoon,

Council's RFQ appears to contemplate the provision and implementation of a nominated Digital Asset Management platform. Would Council consider a response from a technology-independent System Integrator acting as the prime contractor, where the respondent provides requirements validation, solution architecture, technology evaluation/selection, configuration, integration, migration and implementation services, with the final DAM technology selected collaboratively with Council during the initial project phase? Alternatively, does Council require respondents to nominate and price the proposed DAM software/platform as part of their RFQ submission?

Thank you in advance for your consideration.

** Council requires respondents to address the requirements set out in the RFQ documentation. Suppliers may propose their preferred delivery approach, provided the submission clearly demonstrates how the requirements will be met.

Suppliers should address all tender requirements, as capability, capacity, pricing, functional compliance, non functional compliance and implementation methodology will all be considered during the evaluation process. Respondents should ensure their proposed solution and delivery model are fully described and appropriately priced within their submission.

Question:
Good Morning,

Thank you for the clarifications provided so far.

We have a few additional questions to help us understand the requirements and appropriately size the proposed solution:

1) NFR 2.2.1 permits hosting within Australia or in “allied nations”. Can Council please confirm which countries or jurisdictions it considers acceptable under the term “allied nations”?

2) Further to the previous clarification regarding NFR 2.7.8, can Council please confirm whether data stored and used within the DAM will be classified as PROTECTED?

3) Further to the previous clarification regarding NFR 13.1.1, can Council please confirm whether the stated RTO target of 10 minutes and RPO target of 5 minutes are expected to be met by the proposed solution, or whether suppliers may propose alternative contractual RTO/RPO commitments?

4) DST-008 refers to integration with Council website and content-management platforms. Can Council please identify the website/CMS platform or platforms the DAM will be expected to integrate with? For NFR 3.7.2, can Council also identify the federated identity/access management platform the proposed solution will be expected to integrate with?

5) Further to the previous user-volume clarification and NFR 6.3.1, can Council please provide the approximate number of authorised users and expected concurrent users?

6) Schedule 2 refers to Production and Non-Production environments, including development and User Acceptance Testing. Can Council please confirm whether a separate customer-accessible non-production/UAT environment is expected to be included in the proposed solution?

7) Schedule 2 references IS18:2025 under NFR 1.3.6 and IS18:2018 under NFR 1.3.17. NFR 1.3.16 and NFR 1.3.20 also reference ISO/IEC 27001:2013. Can Council please confirm whether suppliers should assess compliance against the versions stated in Schedule 2 or the current versions of these standards?

8) NFR 2.11.4 states that vulnerability scan reports must be provided to Council on request within “XX business days”. Can Council please confirm the required number of business days?

9) NFR 1.3.21 includes the PCI-DSS requirement together with the wording “delete if not applicable”. Can Council please confirm whether PCI-DSS compliance is applicable to the proposed DAM solution?

10) NFR 2.8.2 requires the Supplier to maintain an ISO 22301 certified Business Continuity Plan. Where the respondent is acting as the prime contractor and proposes a third-party SaaS platform, can Council please confirm whether this requirement is expected to be met by the prime contractor, the SaaS platform provider, or both?

11) Can Council please confirm the anticipated project commencement date, implementation timeframe and target go-live date?

12) The RFQ Reference Schedule describes the contract term as “3 years to 2029” and “1 year + 1 Year extension option to 2031”. Can Council please confirm the intended initial contract term and extension structure, and whether respondents should include pricing for each extension year in their quotation?

Thank you for your consideration.

Answered on 29/Sep/2026 08:37 AM:
(edited on 29/Sep/2026 01:22 PM)


29/9/26 - Additional information added to response for question 5

Thank you for your questions and query, please find the attached responses below **

24/Sep/2026 11:47 AM

From Rupa Mistry - rupa.mistry@materialgrowth.com | 0470573805

Question:

Good Morning,

Thank you for the clarifications provided so far.

We have a few additional questions to help us understand the requirements and appropriately size the proposed solution:

1) NFR 2.2.1 permits hosting within Australia or in “allied nations”. Can Council please confirm which countries or jurisdictions it considers acceptable under the term “allied nations”?

** The preference is within Australia. Within AU or other countries with prior approval on a case by case basis with sufficient contractual and compensating controls in regions with privacy principles that align with the Australian Privacy Principles and obligations.

2) Further to the previous clarification regarding NFR 2.7.8, can Council please confirm whether data stored and used within the DAM will be classified as PROTECTED?

** Most information stored within the solution is expected to be classified as Official or Official-Sensitive, and will primarily comprise marketing, media, and communications content. The solution should support role-based access controls to restrict access to sensitive information, including internal-use imagery and personal information, and ensure compliance with applicable privacy and information security requirements.

3) Further to the previous clarification regarding NFR 13.1.1, can Council please confirm whether the stated RTO target of 10 minutes and RPO target of 5 minutes are expected to be met by the proposed solution, or whether suppliers may propose alternative contractual RTO/RPO commitments?

** Suppliers may propose alternative commitments. This is expected to be a non-critical system. Council could take 4 - 8 hours RTO, and in fact, up to 3 days as a non-critical system. We just don't want any data loss.

4) DST-008 refers to integration with Council website and content-management platforms. Can Council please identify the website/CMS platform or platforms the DAM will be expected to integrate with? (refer to my comment in Teams) For NFR 3.7.2, can Council also identify the federated identity/access management platform the proposed solution will be expected to integrate with?

** SQUIZ / SharePoint / ECM (TechOne). MFA Entra ID.

5) Further to the previous user-volume clarification and NFR 6.3.1, can Council please provide the approximate number of authorised users and expected concurrent users?

** The primary user / case will be councils marketing team. The application may expand use cases across broader council. So, it could range from 50 1700. It is expected that concurrent users would be less than 50.

It is estimated we will require up to 6 authorised back-end users. All back-end users with unique access credentials (individual username and password) should be able to log in concurrently. It is not a requirement for multiple users to be able to log in concurrently using the same unique credentials (multiple people using the same username and password).

Front end users (people searching and downloading approved assets for use) is not expected to exceed 50-100 at a time.

6) Schedule 2 refers to Production and Non-Production environments, including development and User Acceptance Testing. Can Council please confirm whether a separate customer-accessible non-production/UAT environment is expected to be included in the proposed solution?

** No prem DEV / UAT environment, but if there is an option to allow for testing of API and changes to the platform where it needs to be integrated to others at different points during it lifecycle e.g. moving SSO, feature updates then the option to have access to a short term test/ dev environment before changes is desired (even if costed), or operating on a shared pre-release demo version like some vendors do before major upgrades.

7) Schedule 2 references IS18:2025 under NFR 1.3.6 and IS18:2018 under NFR 1.3.17. NFR 1.3.16 and NFR 1.3.20 also reference ISO/IEC 27001:2013. Can Council please confirm whether suppliers should assess compliance against the versions stated in Schedule 2 or the current versions of these standards?

** Yes. Assessment would be against ISO 27001:2022 (or ASNZ version 2023) with amendments as 2013 attestations would have ended in 2025. In relation to IS18 the latest revision is June 2026 v10.0.0, so unless there are mapping from previous versions to the current framework, the latest policy version should be used.

8) NFR 2.11.4 states that vulnerability scan reports must be provided to Council on request within “XX business days”. Can Council please confirm the required number of business days?

** Within a reasonable timeframe / on request.

9) NFR 1.3.21 includes the PCI-DSS requirement together with the wording “delete if not applicable”. Can Council please confirm whether PCI-DSS compliance is applicable to the proposed DAM solution?

** Some solutions offer the ability to purchase / license pictures for public use so there is an option to collect payment through the platform. If the platform will not be offering any payment management solutions, or integrating with something that will then the PCI-DSS requirements can be ignored.

10) NFR 2.8.2 requires the Supplier to maintain an ISO 22301 certified Business Continuity Plan. Where the respondent is acting as the prime contractor and proposes a third-party SaaS platform, can Council please confirm whether this requirement is expected to be met by the prime contractor, the SaaS platform provider, or both?

** The Supplier.

11) Can Council please confirm the anticipated project commencement date, implementation timeframe and target go-live date?

** Nov / Dec 2026. It would be preferable if respondents provide an implementation plan to assess the level of effort council side.

12) The RFQ Reference Schedule describes the contract term as “3 years to 2029” and “1 year + 1 Year extension option to 2031”. Can Council please confirm the intended initial contract term and extension structure, and whether respondents should include pricing for each extension year in their quotation?

** The intended initial term is for 3 years commencing on completion of the awarding of the contract, estimated to be November 2026, with 2 x 1 year options for extension. The pricing for the extensions are to be included in the quotation.