Website Hosting Maintenance and Support Services

The vendor required to provide website hosting, maintenance and support services to the people’s law library (PLL) website.
- Web hosting:
•    Hosting site on secure, enterprise-grade servers. 
•    Transfer of site to the offeror’s hosting environment. 
•    Dual hosting environment (development and production site) and a separate staging and QA environment for testing updates before deployment. 
•    As-needed bandwidth transfer and site storage with ability to scale resources to meet traffic surges. 
•    DNS hosting and configuration of all related domains. 
•    SSL and TLS certificate management, including automatic renewal using acme protocol and let’s encrypt. 
•    Enterprise-level server uptime and end-user page-load time with minimum SLA of 99.9% uptime and average page load under three (3) seconds. 
•    Redundancy, failover and disaster recovery planning, with defined recovery point objective (RPO) and recovery time objective (RTO). 
•    Logging, analytics, and retention of system logs (minimum 90 days). 
•    Regular site monitoring, including web and database server performance and page load time. 
•    Website search functionality via Solr search or equivalent, maintained and tuned by the successful offeror.
- Website maintenance:
•    Provide regular management of hardware and software updates, including Drupal security updates for modules, themes, and other components. 
•    All software updates must be tested in the staging environment before release to preserve all existing website functionality. 
•    Critical security patches must be applied within 24-48 hours of release. 
•    Code management using version control and documented deployment workflow. 
•    Daily website backup with weekly availability of site archive and full database backup retention.
•    Website performance reporting, including database and server uptime and average and high response times for page requests and traffic analytics. 
•    Ongoing compliance with accessibility standards with periodic accessibility audits. 
•    Annual security audit or penetration test, and vulnerability scanning at least quarterly. 
•    Support for future Drupal upgrades (Drupal 12+). 
•    Maintenance of all third-party integrations to ensure compatibility with Drupal updates. 
•    Ensure compliance with applicable security standards and applicable data privacy regulations.
•    All personal information collected through the site (e.g., chat, forms) must be encrypted in transit TLS and SSL and at rest. 
•    Maintain documented data retention and disposal policies.
- Website support services:
•    Provide ticket-based issue reporting, with guaranteed personal response times, categorized by severity:
o    Critical (site down): response within one (1) hour.
o    High (major functionality loss): response within four (4) hours.
o    Medium (content or feature issues); response within one (1) business day.
o    Low (minor issues, requests): response within three (3) business days
•    Provide enterprise-level server security, including firewalls, DDoS protection, intrusion detection and prevention, and encryption of data in transit and at rest. 
•    Provide monitoring and alerts for downtown or suspicious activity, with notifications to the agency contract manager.
- Client development access:
•    Provide PLL with administrator-level access to the development environment (or an alternative sandbox environment) to enable installation and configuration of Drupal modules for proof-of-concept and testing purposes.
•    Deployment of any modules, configurations, or features to the staging or production environments shall remain the sole responsibility of the offeror, in coordination with PLL staff. 
•    Offeror shall review, validate, and manage any proof-of-concept work identified by PLL for potential deployment. 
•    Offeror shall refresh the development environment periodically to maintain alignment with production, while preserving PLL’s ability to test proof-of-concept functionality. 
•    Provide documentation and training on the workflow for coordinating proof-of-concept features into staging and production.

- Contract Period/Term: 1 year
- Intent to Bid Due Date: December 19, 2025
- Pre-Proposal Conference Date: December 1, 2025
- Questions/Inquires Deadline: December 8, 2025