Are you preparing an RFP (Request for Proposal) for a website or a consultation for a digital platform in Morocco? This specifications template guides you to write a complete and structured document, adapted to public sector, banking, e-commerce, or institutional requirements.
💡 Public sector: This template is perfectly suited for tenders published on marchespublics.gov.ma (Moroccan Public Procurement Portal), ensuring compliance with public specifications requirements.
✅ This template covers:
- ✓ Detailed technical specifications
- ✓ Security requirements (OWASP, CNDP)
- ✓ Architecture (Drupal, Next.js, headless)
- ✓ Performance and accessibility (WCAG)
- ✓ Sovereign hosting in Morocco
- ✓ Evaluation criteria
- ✓ Agile phasing and deliverables
- ✓ Bank Al-Maghrib, ACAPS compliance
With 200+ digital projects in Morocco, VOID shares its proven methodology to structure your consultations and obtain quality technical proposals from candidate agencies.
🎯 Customize your specifications
✓ Real-time adapted content The sections below will automatically adjust according to your choices
Current configuration:
1. Project Context
1.1. Organization presentation
Briefly present your organization, sector of activity, and strategic objectives.
- ▸Name and legal status
- ▸Sector : Public, banking, insurance, e-commerce, health...
- ▸Size : Number of employees, national/international presence
- ▸Strategic objectives : Digital transformation, new services, compliance...
1.2. Project objectives
Define precisely what you want to achieve with this new platform.
- ▸Functional objectives : Information portal, online services, e-commerce, connected space...
- ▸Strategic objectives : Improve user experience, automate processes, reduce costs
- ▸Quantified KPIs : -30% processing time, +50% online conversions, 95% satisfaction...
1.3. Target audiences
Identify main user segments and their specific needs.
👥 General public
Citizens, consumers, varied digital skills
🏢 Professionals
Partners, suppliers, advanced specific needs
👨💼 Internal
Employees, administrators, high security requirements
2. Architecture and Technology
✅ VOID Recommendation
Favor a headless architecture (Drupal + Next.js) for demanding institutional projects. It guarantees performance, security, and scalability over 5-10 years.
📖 Learn more: VOID Drupal Expertise · React/Next.js Expertise
2.1. Recommended Technology Stack
| Component | Technology | Justification |
|---|---|---|
| CMS / Back-office | Drupal 10+ | Robustness, enterprise security, native multilingual |
| Frontend | Next.js 15 (React) | SSR/SSG, performance, optimal SEO |
| Database | MySQL 8+ | Reliability, banking compliance, performance |
| API | JSON:API / GraphQL | API-First, interoperability |
| Hosting | Docker + VDC Morocco (inwi/nplusone) | Data sovereignty, CNDP compliance |
2.2. Mandatory Technical Requirements
- ✅ API-First architecture with front/back separation
- ✅ Server-side rendering (SSR) for SEO
- ✅ Compliance with W3C standards
- ✅ WCAG 2.1 Level AA compliance (accessibility)
- ✅ Code versioned on Git with branches (dev, staging, prod)
- ✅ Docker containerization for portability
- ✅ Separate environments (Dev, Testing, Pre-production, Production)
2.3. Certification and Expertise
Requirement: The service provider must demonstrate confirmed expertise in Drupal, ideally with Acquia certification or contributions to the Drupal community.
📖 Discover: Drupal Services in Morocco · Vactory Solution (Drupal + Next.js)
3. Functional Requirements
3.1. Multilingualism
Multilingual requirements:
- ✅ Support for [FR / AR / EN] depending on context
- ✅ Multilingual administration interface
- ✅ Content management by language (translation / creation)
- ✅ Automatic language detection (geolocation + browser)
- ✅ Adapted URLs:
/fr/,/ar/,/en/ - ✅ RTL (Right-to-Left) for Arabic with CSS adjustments
- ✅ Correct hreflang tags for international SEO
3.2. Navigation and Ergonomics
🧭 Main Navigation
- • Main menu with sub-menus (max 2 levels)
- • Mega menu for complex structures
- • Responsive mobile menu (hamburger)
- • Breadcrumbs on all pages
- • Permanent "Home" button
🔍 Search
- • Intelligent search engine
- • Real-time auto-completion
- • Multilingual search
- • Filters by content type
- • Related search suggestions
3.3. Forms
| Form | Fields | Security |
|---|---|---|
| Contact | Name, Email, Phone, Subject, Message | Captcha, server-side validation |
| Newsletter | Email, GDPR Consent | Double opt-in, unsubscribe |
| Complaint | Specific form + attachments | Secure upload, file type validation |
| Recruitment | CV, Cover letter, Information | Antivirus scan, 5MB limit |
⚠️ Critical Requirement
All forms must include an invisible captcha (reCAPTCHA v3 or hCaptcha), strict server-side validation, and compliance with GDPR/Law 09-08 consent requirements.
📖 Learn more: GDPR and Compliance in Morocco
4. Design and User Experience
4.1. Graphic Proposal
The service provider must propose at least 2 design directions, including:
- • Homepage: Complete desktop + mobile version
- • Standard page: Typical content page
- • Variations: 3 languages (FR, AR, EN)
- • Format: Interactive mockups (Figma / Adobe XD)
4.2. Design System
A complete Design System must be delivered, including:📖 Read also: UX Design & Design Systems
🎨 Foundations
- • Color palette
- • Typography
- • Grid & spacing
- • Iconography
🧩 Components
- • Buttons & links
- • Forms
- • Cards & blocks
- • Navigation
📱 Responsive
- • Defined breakpoints
- • Mobile behaviors
- • Touch-friendly
- • Multi-device testing
4.3. Responsive Design
The website must be 100% responsive and optimized for:
- ✅ Desktop: 1920px, 1366px, 1024px
- ✅ Tablet: 768px (iPad portrait/landscape)
- ✅ Mobile: 375px, 414px (iPhone, Android)
- ✅ Testing on BrowserStack or equivalent
5. Information System Security
🔒 Absolute Priority
Security must be integrated from the design phase (Security by Design). All OWASP Top 10 vulnerabilities must be prevented.
📖 Complete guide: Web Security, XSS & OWASP 2026
5.1. Authentication and Access
- ▸Individual accounts: Generic accounts prohibited (admin, root)
- ▸Strong passwords: Minimum 12 characters, forced complexity, 90-day expiration
- ▸Two-factor authentication (2FA): Mandatory for back-office access (Google Authenticator, SMS)
- ▸Principle of least privilege: Granular roles and permissions
- ▸Session management: 15min inactivity timeout, invalidation on logout
5.2. Data Protection
Mandatory requirements:
- 🔐 HTTPS/TLS 1.3 mandatory across entire site (SSL/EV certificate)
- 🔐 HSTS (HTTP Strict Transport Security) enabled
- 🔐 Bcrypt hashing for all passwords (minimum cost 12)
- 🔐 At-rest encryption for sensitive database data
- 🔐 No sensitive data in logs or URLs
- 🔐 CSP (Content Security Policy) strict enforcement
- 🔐 Secure cookies: HttpOnly, Secure, SameSite=Strict
5.3. OWASP Top 10 - Prevention
| Vulnerability | Countermeasure |
|---|---|
| SQL Injection | ORM (Eloquent/Doctrine), prepared statements, strict validation |
| XSS (Cross-Site Scripting) | Automatic escaping (React), CSP headers, input validation |
| CSRF (Cross-Site Request Forgery) | CSRF tokens on all forms, SameSite cookies |
| Broken Authentication | 2FA, rate limiting connections, blocking after 5 attempts |
| Sensitive Data Exposure | TLS encryption, no plaintext data, log masking |
| XXE (XML External Entity) | Disable external XML entities, schema validation |
| Broken Access Control | Server-side authorization validation, least privilege principle |
| Security Misconfiguration | Server hardening, disable debug in prod, security headers |
| Vulnerable Components | Dependency scanning (Snyk), regular updates |
| Insufficient Logging | Complete logs, timestamped, secured, automatic alerts |
5.4. Secure Infrastructure
- 🛡️ WAF (Web Application Firewall): Cloudflare, AWS WAF or equivalent
- 🛡️ Anti-DDoS Protection: Rate limiting, IP blocking
- 🛡️ Network segmentation: Public DMZ, private backend network, isolated DB
- 🛡️ Back-office access: VPN + IP whitelisting + 2FA
- 🛡️ Environment separation: Dev / Testing / Preprod / Prod isolated
- 🛡️ Regular patching: Security updates within 48h
5.5. Regulatory Compliance
🇲🇦 Law 09-08 (CNDP)
- • CNDP declaration if personal data processing
- • Explicit user consent
- • Right to access, rectification, deletion
- • Limited retention period
- • Breach notification within 72h
🇪🇺 GDPR (if applicable)
- • Privacy by Design & Default
- • Processing registry
- • DPIA if high risk
- • Data portability
- • DPO if necessary
5.6. Security Audit
Mandatory requirement: The service provider must deliver a complete security audit report before production launch, including:
- • Automated scanning (Acunetix, Netsparker, OWASP ZAP)
- • Manual penetration testing (Burp Suite)
- • Code review (static analysis)
- • Load and resilience testing
- • Report with vulnerability remediation plan
📖 Methodology: Technical SEO Audit · Security Testing
6. Performance and Accessibility
6.1. Performance Objectives (Core Web Vitals)
📖 Learn more: Core Web Vitals & Lighthouse Guide · Web Performance Optimization
| Metric | Target | Definition |
|---|---|---|
| LCP (Largest Contentful Paint) | < 2.5s | Loading time of largest visible element |
| FID (First Input Delay) | < 100ms | Response time to first interaction |
| CLS (Cumulative Layout Shift) | < 0.1 | Visual stability during loading |
| TTFB (Time to First Byte) | < 600ms | Initial server response time |
| Lighthouse Score | > 90/100 | Google overall performance score |
6.2. Mandatory Technical Optimizations
⚡ Frontend
- • Automatic code splitting (Next.js)
- • Lazy loading images and components
- • Image optimization (WebP, AVIF, responsive)
- • CSS/JS minification
- • Tree shaking (dead code removal)
- • Preload critical resources
- • Service Worker (offline-first)
⚡ Backend
- • Redis/Memcached cache
- • Global CDN (Cloudflare, Fastly)
- • Gzip/Brotli compression
- • HTTP/2 or HTTP/3
- • Database query optimization
- • Drupal cache (BigPipe, Dynamic Page Cache)
- • API rate limiting
6.3. Accessibility (WCAG 2.1 AA)
♿ Mandatory Compliance
The website must comply with WCAG 2.1 Level AA criteria, with RGAA audit if public sector.
📖 Resource: Web Accessibility in Morocco
- ✅ Compliant color contrasts (minimum 4.5:1 ratio)
- ✅ Complete keyboard navigation (Tab, Shift+Tab, Enter, Esc)
- ✅ Properly implemented ARIA attributes
- ✅ Text alternatives for images (alt)
- ✅ Semantic HTML5 structure (h1-h6, nav, main, footer...)
- ✅ Accessible forms (labels, explicit errors)
- ✅ Screen reader compatibility (NVDA, JAWS)
- ✅ Text zoom up to 200% without loss of functionality
6.4. Browser and Device Compatibility
🖥️ Desktop
- • Chrome (last 2 versions)
- • Firefox (last 2 versions)
- • Safari (last 2 versions)
- • Edge (last 2 versions)
📱 Mobile
- • iOS Safari (last 2 versions)
- • Android Chrome (last 2 versions)
- • Samsung Internet
💻 OS
- • Windows 10/11
- • macOS (last 3 versions)
- • iOS 15+
- • Android 11+
7. SEO and Analytics
7.1. SEO Fundamentals
📖 Learn more: SEO Services in Morocco · Technical SEO Audit
- ▸SEO-friendly URLs: Clear structure, keywords, no unnecessary parameters
✅ /services/business-credit/❌ /node/123?lang=en - ▸Optimized meta tags: Title (50-60 chars), Description (150-160 chars), unique per page
- ▸Consistent Hn structure: Single H1, respected H2-H6 hierarchy
- ▸XML Sitemap: Automatic, multilingual, submitted to Google Search Console
- ▸Robots.txt: Optimized, crawl budget managed
- ▸Schema.org: Organization, Article, BreadcrumbList, FAQPage
- ▸301 Redirects: Old site migration without SEO loss
- ▸Hreflang: Correct tags for international multilingual
7.2. Google Analytics 4
Complete GA4 implementation with:
- • Page view tracking, custom events
- • Conversion tracking (forms, downloads, CTA clicks)
- • Cookie consent compliance (GDPR/Law 09-08)
- • IP anonymization enabled
- • Internal traffic filtering (office IPs)
- • Google Search Console integration
7.3. Tagging Plan and Dashboard
The service provider must deliver:
- 📊 Tagging plan: Comprehensive document of tracked events
- 📊 Looker Studio dashboard: Real-time KPIs (traffic, conversions, journeys)
- 📊 Automated monthly reports: PDF or Google Sheets
- 📊 Automatic alerts: Traffic drops, 404 errors, loading times
✅ VOID Deliverable
VOID systematically provides a custom Looker Studio dashboard, with real-time business KPI tracking and automatic alerts.
📖 Learn more: Google Analytics Tagging Plan · Google Tag Manager
8. Artificial Intelligence and Automation
🤖 AI Serving User Experience
Integrating artificial intelligence into your platform is no longer a "nice-to-have" but a strategic differentiator. In 2026, users expect personalized, instant, and intelligent experiences.
📖 Learn more: VOID AI Expertise · Agentic AI for Platforms
8.1. Intelligent Chatbot and Conversational Support
Essential Features:
🎯 Level 1: FAQ Chatbot
- • Pre-configured responses (decision tree)
- • Multilingual support (FR/AR/EN)
- • Knowledge base integration
- • 24/7 availability
- • Escalation to human if needed
🚀 Level 2: Advanced AI Chatbot
- • NLP (Natural Language Processing)
- • Intent understanding
- • Continuous learning (Machine Learning)
- • User profile personalization
- • CRM/ticketing integration
Recommended Technology Stack:
| Solution | Type | Advantages | Use Case |
|---|---|---|---|
| OpenAI GPT-4 | Cloud LLM | Advanced understanding, multilingual | Sophisticated conversational chatbot |
| Dialogflow (Google) | NLP Platform | Easy integration, intent recognition | Task-oriented chatbot (FAQ, appointments) |
| Rasa (Open Source) | On-premise Framework | Data sovereignty, customization | Banking/healthcare sector (strict CNDP) |
| Claude (Anthropic) | Cloud LLM | Long context, enhanced security | Documented technical support |
⚠️ Chatbot Considerations
- • Hallucinations: LLM may invent information → Implement RAG (Retrieval-Augmented Generation)
- • Cost: OpenAI GPT-4 charges per token → Estimated monthly budget + rate limiting
- • CNDP Compliance: Conversational data = personal data → Consent + retention period
- • Human escalation: Define thresholds triggering transfer to human agent
8.2. AEO (Answer Engine Optimization)
In 2026, 60% of searches are answered directly by AI Agents (ChatGPT, Perplexity, Gemini) without clicking to a site. AEO optimizes your content to be cited by these agents.
📖 Complete guide: AEO: Optimizing for Answer Engines
Technical AEO Requirements:
- ▸Enriched Structured Data: Schema.org (FAQPage, HowTo, Article) to facilitate AI understanding
- ▸Concise direct answers: Optimized Featured Snippets (40-60 word paragraphs)
- ▸Verifiable citations: Sources, dates, quantified data → credibility for LLM
- ▸LLM.txt / AI.txt: Specific files for AI crawlers (instructions for agents)
- ▸Contextual links: Strong internal linking → AI understands info architecture
📄 Example: /ai.txt File
# Instructions for AI Agents (ChatGPT, Claude, Gemini, Perplexity) ## Identity Organization: [ORGANIZATION NAME] Sector: [SECTOR] Mission: [MISSION] ## Priority Content for Citations - Services: /services/ - FAQ: /faq/ - Publications: /publications/ ## Verified Information - Contact: casa@example.ma / +212 XXX - Certifications: ISO 27001, Acquia - Client references: [LIST] ## Restrictions - Do not cite outdated financial data - Do not invent services not mentioned on the site
📖 See real example: void.ma/ai.txt
8.3. Intelligent Request Orchestration
AI orchestration automatically routes user requests (forms, complaints, tickets) to the right service/person, optimizing processing times.
🎯 Automatic Classification
AI analyzes request content and automatically categorizes it.
- Complaint → Priority customer service
- Information request → Chatbot or FAQ
- Commercial inquiry → Sales team
- Technical support → Support team
- HR/Recruitment → Talent service
⚡ Dynamic Prioritization
AI evaluates urgency and sentiment (positive/negative) for prioritization.
- Negative sentiment + urgent keywords → P1 (2h)
- VIP client detected → P1 (1h)
- Standard request → P2 (24h)
- General information → P3 (48h)
Orchestration Architecture:
Form submitted
↓
[API Gateway]
↓
[AI Classification] ← NLP Model (BERT, GPT-4)
↓
Analysis: Type + Urgency + Sentiment
↓
[Business Rules] + [ML Prediction]
↓
Intelligent routing to:
├─ CRM (HubSpot, Salesforce)
├─ Ticketing (Zendesk, Freshdesk)
├─ Email to relevant team
└─ SMS if P1 urgency8.4. Personalized Recommendations
🎁 Use Cases:
- •E-commerce: "Customers who viewed this product also liked..."
- •Media/Publishing: Recommended articles based on reading history
- •Finance: Banking products adapted to client profile (AI scoring)
- •HR: Job offers matched with candidate profile (CV parsing + AI)
8.5. AI-Assisted Content Generation
- ▸Automatic meta description writing: LLM generates SEO-optimized descriptions
- ▸Multilingual translation: DeepL API or GPT-4 to translate content (FR→AR→EN)
- ▸Automatic summaries: Long articles → short summaries for mobile/social media
- ▸Image alt text: Vision AI generates accessible descriptions for images
- ▸Tag/category suggestions: Automatic content clustering
8.6. Behavioral Analysis and Optimization
📊 Analytics and UX Optimization
- • Anomaly detection: Unusual traffic alerts, 404 errors
- • UX optimization: Heatmaps + AI suggest interface improvements
- • Intelligent A/B Testing: AI identifies high-performing variants
- • User journey analysis: Friction point detection
- • Traffic spike prediction: Anticipate load increases
8.7. Ethical Considerations and AI Governance
🛡️ Mandatory Governance
Using AI on a public platform involves legal and ethical responsibilities.
- • Transparency: Clearly indicate when user interacts with AI
- • Explainability: Ability to explain automated decisions (scoring, refusal...)
- • Algorithmic bias: Regular testing to detect discrimination
- • Right to object: User can refuse 100% automated decision (GDPR Art. 22)
- • Regular audit: Performance + ethics verification (quarterly minimum)
✅ VOID Recommendation
Progressive approach: Start with FAQ chatbot + AEO (quick wins), then iterate toward advanced features (orchestration, ML) based on observed ROI.
📖 Use case: RAG & CAG for Production AI
9. Hosting and Infrastructure
🇲🇦 VOID Recommendation: Sovereign Hosting
Favor hosting in Morocco to ensure data sovereignty, CNDP compliance, and optimal performance for your local users.
9.1. Recommended Providers in Morocco
🇲🇦 inwi Cloud
- • VDC (Virtual Data Center) dedicated
- • Casablanca Datacenter (Technopark)
- • ISO 27001 Certification
- • 24/7 technical support in French
- • Native CNDP compliance
- • Dedicated fiber connectivity
🇲🇦 nplusone
- • Sovereign private cloud
- • Tier III+ Datacenter Casablanca
- • Highly secure infrastructure (banking-grade)
- • Multi-site redundancy
- • Daily automated backup
- • 99.9% SLA
9.2. Hosting Architecture
Typical Infrastructure (VDC):
- 🖥️ Web servers: 2+ load-balanced instances (HAProxy/Nginx)
- 🗄️ Database: MySQL 8+ in master-slave replication
- ⚡ Cache: Redis cluster for sessions and application cache
- 📦 Storage: NFS or S3-compatible for shared media
- 🔒 Firewall: WAF + granular firewall rules
- 📊 Monitoring: Prometheus + Grafana or New Relic
- 💾 Backup: Daily automated, minimum 30-day retention
9.3. Docker Containerization
The application must be fully dockerized with:
- 🐳 Docker Compose for local orchestration
- 🐳 Kubernetes for production (optional depending on volume)
- 🐳 Optimized images: Alpine Linux, multi-stage builds
- 🐳 Private registry: Harbor, AWS ECR or equivalent
- 🐳 CI/CD: GitLab CI, GitHub Actions or Jenkins
9.4. Environments and Deployment
| Environment | Usage | Access | Data |
|---|---|---|---|
| Development | Daily dev, unit tests | Technical team | Test/anonymized data |
| Testing | Client functional validation | Client + provider | Realistic test data |
| Pre-production | Load tests, final validation | Project team | Prod data copy (anonymized) |
| Production | Live public site | Restricted admin (2FA + VPN) | Real data |
9.5. SLA and Availability
- 📈 Availability: Minimum 99.9% (max 8.76h downtime/year)
- 📈 RPO (Recovery Point Objective): < 1h (acceptable data loss)
- 📈 RTO (Recovery Time Objective): < 4h (restoration time)
- 📈 Support: 24/7 for critical incidents (P1)
- 📈 Backup: Daily + quarterly restoration test
10. Phasing and Deliverables
Scoping & Launch
Estimated duration: 2-3 weeks
🎯 Objectives:
- • Deep understanding of requirements
- • Scope and planning validation
- • Definition of design directions
📋 Deliverables:
- ✅ Scoping document
- ✅ Detailed planning (Gantt)
- ✅ Homepage + standard page mockups (minimum 2 directions)
- ✅ Design System v1
- ✅ Target technical architecture
Design & Development
Estimated duration: 8-12 weeks
🎯 Objectives:
- • Complete UX/UI design
- • Backend (Drupal) + frontend (Next.js) development
- • Multilingual content integration
- • Hosting configuration
📋 Deliverables:
- ✅ Complete mockups (all pages, 3 languages)
- ✅ Finalized Design System
- ✅ Detailed functional specifications
- ✅ Technical documentation
- ✅ Site in testing environment
- ✅ Integrated content (FR/AR/EN)
Testing & User Acceptance
Estimated duration: 3-4 weeks
🎯 Objectives:
- • Exhaustive functional testing
- • Security audit (pentest)
- • Performance and load testing
- • WCAG accessibility validation
- • Bug fixes
📋 Deliverables:
- ✅ User acceptance test plan with results
- ✅ Security audit report (pentest)
- ✅ Performance test report (Lighthouse, GTmetrix)
- ✅ WCAG accessibility report
- ✅ Fixed bugs list
- ✅ Signed acceptance certificate
Training & Production Launch
Estimated duration: 2 weeks
🎯 Objectives:
- • Team training (functional + technical admin)
- • Secure production deployment
- • DNS migration
- • Post-deployment checks
- • Knowledge transfer
📋 Deliverables:
- ✅ Operational production site (FR/AR/EN)
- ✅ Completed training (in-person + videos)
- ✅ Administrator guide
- ✅ Technical operations guide
- ✅ Complete documentation (code, architecture, API)
- ✅ Source files (Git repository)
- ✅ Secure access and credentials
- ✅ 12-month warranty activated
💡 Agile Methodology
VOID favors an Agile (Scrum) approach with 2-week sprints, regular client demos, and iterative adjustments to maximize delivered value.
📖 Learn more: Agile Methodology in Morocco · VOID Agile Squad
11. Proposal Evaluation Criteria
| Criterion | Weight | Details |
|---|---|---|
| Price | 30% | Competitiveness, breakdown clarity, payment terms |
| Technical Expertise | 25% | Drupal+Next.js mastery, certifications, similar references |
| Creative Proposal | 15% | Mockup quality, UX, innovation, brand adaptation |
| Methodology & Planning | 15% | Planning realism, Agile approach, project governance |
| Warranties & Maintenance | 10% | Warranty duration, SLA, post-delivery support |
| Understanding of Requirements | 5% | Proposal relevance, questions asked, added value |
Documents to Provide in Proposal
- 📄 Company presentation (company profile, team, resources)
- 📄 Similar project references (minimum 3, with verifiable contacts)
- 📄 Certifications (Acquia, ISO, etc.)
- 📄 Detailed CVs of dedicated team
- 📄 Technical memorandum (point-by-point response to specifications)
- 📄 Detailed commercial proposal (price breakdown)
- 📄 Projected planning (Gantt)
- 📄 General terms and conditions
- 📄 Tax and social security certificates (if applicable)
📖 Useful guide: How to Choose a Digital Agency in Casablanca
📥 Need Assistance?
VOID assists project owners in writing their RFP specifications,selecting service providers, and project management. Our expertise ensures high-quality consultations and successful projects.