Web Hosting Services

Managed Web Hosting, Consulting, and Custom Web Development Services
- Hosting platform
• Single-tenant dedicated server (or dedicated single-tenant virtual environment of equivalent isolation, subject to City approval) meeting or exceeding: 8 CPU cores, 32 GB RAM, 1 TB NVMe/SSD storage in a redundant (RAID or equivalent) configuration, 10 TB monthly transfer, minimum two dedicated IPv4 addresses, IPv6 support.
• U.S.-based data center(s) with SOC 2 Type II reporting (or ISO 27001 certification) covering physical and environmental controls; report or certificate furnished on request and at each renewal.
• Current, vendor-supported operating system (e.g., a current enterprise Linux or Ubuntu LTS release) and cPanel/WHM control panel providing site, database, and TLS certificate management.
- Managed services
• Operating system, control panel, and web-stack patch management performed by the Contractor, with security patches applied within timeframes at least as strict as: critical/high within 30 days of release (or sooner for actively exploited vulnerabilities), others within 90 days; patch reporting available to CPH.
• 24×7×365 infrastructure monitoring with proactive incident response; server-down response within 30 minutes.
• Managed network firewall and host firewall configuration; DDoS mitigation; malware/intrusion detection with remediation included.
• Managed backups: at least daily, retained no fewer than 30 days, stored off-server (and off-site or logically separated), with restoration testing at least quarterly and restoration assistance included. Target RPO ≤ 24 hours; RTO ≤ 8 hours.
• Named U.S.-based technical support reachable 24/7 by phone and ticket; support for compliancerelated configuration requests (e.g., hardening changes arising from vulnerability scan findings) included, not billed as professional services.
- Migration and onboarding
1. Migrate websites, databases, TLS certificates, and DNS records from the current environment to the new platform, including all content and configuration required for equivalent function.
2. Stack modernization is part of base scope: sites shall be delivered on a current, vendor-supported OS and a supported PHP release (8.3 or later, or as mutually agreed per application compatibility testing), with end-of-life interpreter versions removed. Contractor shall perform compatibility testing and remediate hosting-layer issues; application-code changes, if any are required, will be identified to CPH with a written assessment.
3. Provide a written migration plan (timeline, test plan, cutover window, rollback procedure) within 15 business days of award; complete migration within 30 calendar days of award.
4. Cutover downtime for each site shall not exceed 4 hours, scheduled outside business hours with CPH approval; a parallel-run/validation period of at least 5 business days precedes DNS cutover.
5. Mailbox services shall not be provisioned; Contractor shall confirm in the migration plan that no mailbox services are enabled on the new environment