RFQ Services - Provision of website maintenance, hosting and design services for the purposes of ensuring smooth running of Cities Alliance’s Drupal based website

New clarification added: Question 110. The hosting requirements mention that the proposed package should be capable of hosting multiple websites. Is Cities Alliance planning to add additional websites during the contract period, and if so, should this be included in the proposed pricing? What would be the techstack of such website?​Answer: No additional website expected during the contract period,Question 111    Existing Environment / Technical Architecture / Pg. 1-4 :    Could you please provide details of the current hosting environment, including hosting provider, Number of environments (Dev/UAT/Stage/Prod), Drupal version, database version, Solr version, operating system, CI/CD process or manual deployment, and infrastructure architecture?Answer: The current Drupal version is 10.6.5, answers to the additional questions have been provided in other questions thus bidders are requested and encouraged to review all the answers shared during clarificationQuestion 112   Existing Environment / Website Statistics / Pg. 3-4:    Could you provide the current website statistics, including number of content types, content records/pages, users, traffic details?Answer: Traffic is seasonal. Could go roughly 5–6x a normal day, answers to the additional questions have been provided in other questions thus bidders are requested and encouraged to review all the answers shared during clarificationQuestion 113    Maintenance Services / Pg. 2:    The RFQ mentions implementation of small to medium enhancements up to 20 hours per month. Are these 20 hours included within the contracted monthly support scope or expected to be billed separately?Answer: The 20 hours are included within the contracted monthly support.Question 114    Maintenance Services / Pg. 2:    The RFQ indicates that unused hours shall not be billed and rolled over to the following month. Could you please clarify the rollover mechanism and whether any maximum accumulation limit applies?Answer: The rollover mechanism and any maximum accumulated limit if applicable will be agreed upon with the awarded contractorQuestion 115    Maintenance Services / Pg. 2:    Could Cities Alliance provide examples of activities classified as Small Enhancements, Medium Enhancements, and activities that would be considered out of scope and managed as separate projects?Answer: The details in the scope Question 116    UX/UI Design Services / Pg. 2-3:    The RFQ references user research, personas, wireframes, design systems, and visual redesign. Is a complete website redesign expected during the contract period or only incremental design improvements?Answer: A complete website redesign is not expected under this contract. The RFQ refers to incremental UX/UI, design and functionality improvements to be carried out as needed during the contract period, within the agreed maintenance and support arrangements. Bidders should therefore price and describe their capacity to support smaller design improvements, usability enhancements, editor-function improvements, template adjustments and related light design work, rather than a full website redesignQuestion 117    UX/UI Design Services / Pg. 2-3:    If a redesign is expected, could you please provide an estimated number of page templates, layouts, and key user journeys that are expected to be redesigned?Answer: Estimated 13 content types plus Layout Builder-based landing pages — roughly 15–20 distinct templates/layoutsQuestion 118    Hosting & Migration / Pg. 3-4:    Please confirm whether website migration from the current hosting provider is expected as part of the onboarding phase and provide any target migration timelines.Answer: Migration from the current hosting environment is expected as part of the onboarding and transition phase. The migration should be planned and implemented in coordination with Cities Alliance to avoid service interruption and minimise any downtime.A specific migration timeline has not been defined at this stage. Bidders should propose a realistic migration approach and timeline in their quotation, including any assumptions, required inputs, content freeze or maintenance window. The final migration schedule will be agreed with the selected contractor after contract award.Question 119   Commercial & Pricing / Pg. 7:For Objective 01, should bidders propose a fixed monthly support fee, or should services be billed strictly based on the agreed hourly and daily rates provided in the financial proposal?Answer: Fixed monthly support fee.  Please note the quantity of hourly rates and daily rates indicated in Form B: Price Schedule Form are an example bidders are encouraged to refer to detailed TOR RFQ_Section_II_Schedule of Requirements. Refer also to answer given in 106.Question 120    Commercial & Scope Management / Pg. 2 & 7:    In case of significant new functionality, major redesign initiatives, Drupal major version upgrades, or substantial increases in website traffic, will such activities be managed through separate Statements of Work (SOWs) and change request processes?Answer: Yes. Activities involving significant new functionality, major redesigns, Drupal major version upgrades, or substantial traffic growth would typically be addressed through a separate SOW and/or formal change request process, subject to scope assessment and mutual agreement.

New clarification added: Question 103. Will periodic vulnerability assessments and penetration testing be required under this contract?​Answer: The RFQ requires the contractor to provide a secure, monitored and maintained hosting environment, including malware scanning, patching, automatic security updates, firewalls, DDoS protection, logging and related protective measures.Periodic vulnerability assessments and penetration testing are not specified as a fixed requirement in the RFQ. Bidders should indicate in their quotation whether such services are included in their proposed security approach, including the proposed scope, frequency and reporting arrangements. Compliance will be assessed during evaluationQuestion 104. Besides EU hosting, are there any specific data residency or data processing restrictions that must be observed?​Answer: Beyond the requirement for EU-based hosting, there are no additional specific data residency or data processing restrictions currently identified. However, the service provider will be expected to comply with all applicable data protection regulations and any additional requirements that may be communicated during the course of the engagement.Question 105. The TOR states that at least 50% of company staff should be female. Could Cities Alliance clarify whether:This applies to the bidder's overall workforce, orSpecifically to the personnel assigned to this contract?​Answer: Refer to answer to question 2Question 106. Table 2A – you have already defined the quantity. Is this fixed? Or Can vendor revise it?   ​Answer: The quantities contained in 2A are an example.Please note the quantity of hourly rates and daily rates indicated in Form B: Price Schedule Form are an example: bidders are encouraged to refer to detailed TOR RFQ_Section_II_Schedule of Requirements in order to compute their cost. This has been explained in the instructions above Table 1 on Form B: Price Schedule Form. Bidders are encourage to provide detailed cost breakdown for the price reasonability assessment purposes as well as the calculation of price in the event that both parties agree to a contract amendment in the future.Question 107. We note that Table 2A of the Price Schedule includes a predefined quantity of 580 person-hours (72.5 person-days) for Objective 01: Cities Alliance Website Content Maintenance Services.Given that Objective 01 appears to encompass not only routine website maintenance and support activities, but also UX/UI-related services such as user research, personas, user journeys, wireframes, design system development, usability improvements, navigation enhancements, and other design-related changes, we would appreciate clarification on the intended scope covered by the stated quantity.Could Cities Alliance kindly confirm whether the estimated quantity of 580 person-hours is intended to cover all activities under Objective 01, including UX/UI design and usability enhancement requirements, or whether it primarily represents the anticipated effort for ongoing maintenance, support, and minor design updates?​Answer: Refer to answer given in Question 106 aboveQuestion 108. In the event that Cities Alliance requests significant UX/UI redesign activities, new information architecture, extensive user research, creation of new design systems, or substantial functionality enhancements beyond the effort assumed in the quantity specified under Table 2A, would such activities be expected to be delivered within the quoted quantity, or would they be treated as separately scoped and approved assignments under the contract?​Answer: As addressed in answer 106 above the quantities contained in 2A are an example.Please note the quantity of hourly rates and daily rates indicated in Form B: Price Schedule Form are an example: bidders are encouraged to refer to detailed TOR RFQ_Section_II_Schedule of Requirements in order to compute their cost. This has been explained in the instructions above Table 1 on Form B: Price Schedule Form. Bidders are encourage to provide detailed cost breakdown for the price reasonability assessment purposes as well as the calculation of price in the event that both parties agree to a contract amendment in the future. However, Yes, Activities involving significant new functionality, would typically be addressed through a separate SOW and/or formal change request process, subject to scope assessment and mutual agreement.Question 109. How should bidders account for support requested outside regular working hours and weekends?​Answer: As stated in the RFQ_Section_II_Schedule of Requirements these requirements will be addressed by and agreed to by Cities Alliance and the vendor prior to contract issuance.Bidders are encouraged to give a breakdown of all costs expected during the execution of this contract.

New clarification added: Question 93. Is there a maximum allowable downtime during migration and cutover activities?​Answer: A specific maximum downtime for migration and cutover has not been defined. Migration and cutover activities should be planned to avoid service interruption and minimise any downtime.Bidders should propose a migration and cutover approach in their quotation, including the expected maintenance window, any required content freeze, rollback plan and measures to ensure service continuity. The final migration schedule and acceptable maintenance window will be agreed with the selected contractor during transition planning.Question 94. The hosting specifications mention IMAP and POP3. Is the contractor expected to provide email hosting services, or are these currently managed by another provider?​Answer: Email mailbox services are not a core requirement of the website maintenance and hosting scope. The reference to IMAP and POP3 should be understood as part of the generic hosting technical specifications.Refer to question/Answer no. 14Question 95. The TOR references up to 20 hours of enhancement work per month. Could Cities Alliance clarify whether:These hours include bug fixes and security updates, orThey are exclusively allocated for enhancement requests?​Answer: The 20 hours per month refer to the standard monthly support required to keep the website running smoothly. This includes routine bug fixes, Drupal/security updates, technical troubleshooting, minor incident support and small to medium enhancement requests.Exceptional or urgent issues, such as the website being offline, should be handled as high-priority support in line with the response requirements set out in the TOR.Question 96. Could you provide examples of the typical "small to medium enhancements" requested during the past two years?​Answer: Examples of small to medium enhancements requested in the past include adjustments to font sizes and styling, improvements to image display, integration of interactive elements such as maps, refinements to page layouts and templates, and improvements to the content editing interface.These enhancements are generally intended to make the backend more user-friendly for editors and to improve the user experience on the public websiteQuestion 97. Are there different priority levels (Critical, High, Medium, Low) with corresponding response and resolution times, or only the response times specified in the TOR?​Answer: Yes. Issues will be classified by priority level, for example Critical, High, Medium and Low, depending on their impact on website availability, security, functionality and user experience. Bidders should include in their quotation their proposed priority classification, escalation process, response times and target resolution times for different issue levels. Compliance will be assessed during evaluation. Question 98. The TOR states that content-related activities are covered by Cities Alliance. At one section it was outlined that support to create content is required  and on another section  it was outlined that Content related activities will be covered by Cities Alliance and do not require support. Would you please clarify what kind of content related activities you are expecting from vendor​Answer:  Content creation, drafting, editing, translation, editorial planning and routine content upload will be handled by Cities Alliance and are not expected from the contractor.The contractor may be asked to provide technical support related to content management, for example troubleshooting CMS/editor issues, creating or adjusting content types, templates or fields, fixing display issues, supporting layout or formatting problems, improving editor usability, or advising on how content can be structured within Drupal.Therefore, “support to create content” should be understood as technical CMS support to enable Cities Alliance to create and manage content, not as editorial support.Question 99. Extent of RedesignIs Cities Alliance expecting:Incremental design improvements to the existing website, orA complete redesign and redevelopment of the user interface during the contract period?​Answer: Incremental design improvements to the existing websiteQuestion 100. Existing Design AssetsWill Cities Alliance provide:Brand guidelinesDesign systemExisting UI componentsStyle guidesat contract commencement?​Answer: YesQuestion 101. UX Research ActivitiesFor the requested user research, personas, journeys, site maps, and wireframes:Is this expected once at project initiation?Or on an ongoing basis throughout the contract?​Answer: UX research activities, such as personas, journeys, site maps and wireframes, are not expected as a full standalone exercise at project initiation. They may be requested only where relevant to specific UX/UI, usability or functionality improvements during the contract period.Bidders should describe how they would support light UX research and design work on an as-needed basis, in line with the maintenance and improvement scope of the RFQ.Question 102 . Does the website currently support multiple languages, or are additional languages expected during the contract period?​Answer: Refer to answer 31

New clarification added:           Current infrastructure & metricsQuestion 76: Could you please share current performance metrics for citiesalliance.org, including peak traffic, monthly bandwidth/egress volumes, current storage used, and any known performance bottlenecks or constraints?Answer: Detailed performance metrics, including peak traffic figures, bandwidth/egress volumes, storage utilization, and system-level performance observations, are not disclosed as part of the RFQ process. The current environment is designed to meet expected usage levels and ensure stable performance under normal operating conditions. Any performance considerations relevant to the migration or future hosting will be shared with the selected contractor as needed.Question 77: Is there a CDN (e.g. Cloudflare, Fastly, AWS CloudFront) or WAF currently in use as part of the hosting solution?​Answer: A Cloudflare CDN and WAF            Site architectureQuestion 78: Can you confirm that citiesalliance.org is a standalone Drupal installation and not part of a multisite configuration?​Answer: Confirmed — standalone Drupal installation.Question 79: What version of Solr is currently in use, and are there specific configuration constraints (e.g. schema, index size, plugins) that the incoming hosting provider must replicate or support?​Answer: Apache Solr 9.x is recommended, with the standard Search API Solr schema. Facets and spellcheck functionality must be replicated.Technical specificationsQuestion 80: Are the caching layer specifications listed in the Schedule of Requirements (APCu 128 MB, Varnish 128 MB, RamDisk 128 MB, Redis 64 MB) hard minimum requirements, or are they indicative of the current setup? Would equivalent architectures be considered compliant — for example, container-based hosting with a CDN and reverse-proxy caching layer where traditional server-side caching components may not apply in the same way?​Answer: Indicative of the current production setupQuestion 81: Is MySQL 5.7 a hard requirement, or would a compatible version (e.g. MySQL 8.0 or MariaDB equivalent) be acceptable?​Answer: The site runs MariaDB 10.11.16.       EU hosting & accessQuestion 82: Does "hosted in EU region" imply a specific country or data centre location, or is any EU-based data centre acceptable?​Answer: Any EU-based date centre is acceptableQuestion 83: Are administrative and/or technical support actions (e.g. server management, monitoring, helpdesk) permitted from outside the EU, or must all access to the hosted environment originate from within the EU?​Answer: Yes, they are permitted.        Certifications & securityQuestion 84: For the ISO 27001 requirement, what forms of evidence are acceptable from a hosting subcontractor — for example, a current ISO 27001 certificate, SOC 2 Type II report, an audit letter, or a detailed security posture document?​Answer: A current ISO 27001 certificate. Question 85: For GDPR compliance, does UNOPS require a specific Data Processing Agreement (DPA) to be signed with the hosting subcontractor? Is a subprocessor list, data residency statement, or breach notification SLA required as part of the technical proposal, or only upon contract award?​Answer: A data processing agreement and any other required contractual data protection provisions will be addressed with the selected contractor, in line with applicable UNOPS contractual requirements.Question 86: Could you please confirm the current Drupal version, hosting specification/plan, and architecture of the Cities Alliance website (e.g., single-site, multisite, multilingual, custom distribution)?​Answer:The current Drupal version is 10.6.5, single site, English only.Question 87:. How many custom modules, integrations, and custom themes are currently deployed on the website?​Answer: 4 custom modules, 1 custom theme, and 12 third-party integrationsQuestion 88:  Could you provide details of any existing third-party integrations that must be maintained after migration?​Answer: 12 third-party integrations. The information requested relates to technical and operational aspects of the current website environment. At this stage of the procurement process, detailed information of this nature is not being shared. Bidders should prepare their quotations based on the requirements and specifications set out in the RFQ.Question 89. Could you share the approximate number of:Content typesNodes/pagesMedia assets/documentsTaxonomiesUser accountsNumber of average users per month that currently exist on the website?​Answer: Detailed information regarding the current hosting infrastructure and system configuration is not being disclosed during the quotation stage. Bidders should prepare their quotations based on the requirements and specifications set out in the RFQ.Question 90. Is the existing Solr implementation managed by the current hosting provider, or is it deployed on a separate infrastructure?​Answer: Search is managed within the same hosting infrastructure.Question 91. Does Cities Alliance have any preferred hosting providers (e.g., Acquia, Pantheon, Platform.sh, AWS, Azure, etc.), or may bidders propose any hosting platform meeting the stated requirements?​Answer: Cities Alliance does not have a predefined or exclusive preferred hosting provider. Bidders may propose any suitable managed hosting platform, provided it meets the technical, security, performance, scalability, GDPR, EU-hosting and support requirements set out in the RFQ.Bidders should clearly describe the proposed hosting platform and explain how it meets the stated requirements. Compliance will be assessed during evaluation.Question 92. The TOR mentions archiving portions of the website before migration. Could you provide:Estimated volume of content to be archived?Preferred archival approach?Whether archived content must remain searchable and publicly accessible?​Answer: Archiving scope will be defined at a later stage. Sizing reference: ~3,766 nodes and 44,194 media items

New clarification added:  Migration & Current LandscapeQuestion 61: Please share details of the current hosting setup, Drupal version, modules, integrations, and traffic volumes.​Answer: The current Drupal version is 10.6.5. Additional responses refer to 18. Detailed information regarding the current hosting infrastructure and system configuration is not being disclosed during the quotation stage. Bidders should prepare their quotations based on the requirements and specifications set out in the RFQQuestion 62: Are there any downtime constraints, phased migration expectations, or support from the incumbent vendor during transition?​Answer: Migration and transition activities should be planned to avoid service interruption and minimise any downtime. Bidders should propose their recommended migration approach, including any phased migration, content freeze, maintenance window, rollback plan and support required during transition.Any required coordination with the current provider will be managed as part of the transition planning after contract award.      Support & MaintenanceQuestion 63:Does the 20 hours/month include bug fixes, incident support, and enhancements, and can unused hours be carried forward?​Answer: Yes to bothQuestion 64: Kindly confirm support model expectations including support window (time zone), on-call support for critical issues, and SLA for response/resolution (P1–P4).​Answer:As described under Contractor’s responsibility sectionQuestion 65: Please provide insights on ticket volumes (incidents, service requests), change requests, and current support team structure (L1/L2/L3).​Answer:3 tickets / month average.      Environments & OperationsQuestion 66: Kindly confirm the number of environments to be supported (Dev, Test, UAT, Prod, DR) and tools used for ticketing and monitoring.​Answer:  Development, Staging and Production environments. Ticketing via a dedicated Jira service desk; monitoring via Sentry, with Gleap for user feedback.   Commercials & ContractQuestion 67: Please confirm pricing expectations (fixed price vs T&M vs hybrid) and whether alternative pricing models can be proposed.​Answer: The prices proposed by the contractor will be fixed for the entire duration of the contract. Bidders are encouraged to refer to Form B: Price Schedule Form and additional reference to answer given in question 106.Question 68: Is there any indicative budget range, and are there SLA-linked penalties or incentives?​Answer:There's no indicative budget range, and there are no SLA-linked penalties or incentives.However performance of the contractor will be monitored and if applicable SLA Linked penalties may be introduced.Question 69: Kindly confirm payment terms and evaluation criteria weightage (technical vs commercial).​Answer: Payment terms are 30 days after issuance of approved invoice, evaluation is Pass/Fail and not point score.Question 70: Clarification on handling effort beyond the defined monthly scope and whether migration costs should be considered separately.​Answer:  The monthly support hours are intended to cover standard maintenance, support, bug fixes, updates and small to medium enhancement requests. Any effort beyond the agreed monthly scope should be clearly identified, estimated and agreed before work is undertaken.Migration-related effort should be presented separately in the quotation, including any assumptions, required inputs, expected timeline and measures to minimise service interruption.        Delivery & Future ScopeQuestion 71: Is the engagement expected to be fully remote or require any onsite presence?​Answer: Fully remoteQuestion 72: Are there any planned future enhancements, redesign initiatives, or roadmap items beyond the current scope?​Answer: No specific roadmap items have been defined at this stage. Future enhancements will be identified during contract implementation based on operational needs and priorities, and addressed through the agreed monthly support hours and, where required, ad hoc requests.Question 73: Kindly clarify the UI/UX scope, including whether a full redesign, user research, accessibility compliance (WCAG), and interactive features are expected.​Answer: A full website redesign is not expected under this contract. The UI/UX scope refers to incremental design, usability, accessibility and functionality improvements as needed during the contract period. This may include template or layout adjustments, editor-function improvements, light UX research where relevant, and interactive features such as maps or collapsible menus. Bidders should describe their proposed approach to accessibility, UI/UX improvements and interactive features in their quotation.Question 74: Kindly confirm the testing scope and approach, including functional/regression/performance testing, automation expectations, and availability of test environments and data.​Answer:The information requested relates to technical and operational aspects of the current website environment. At this stage of the procurement process, detailed information of this nature is not being shared. Bidders should prepare their quotations based on the requirements and specifications set out in the RFQQuestion 75: Kindly confirm the number of environments to be supported (Dev, Test, UAT, Production, DR) and tools used for ticketing/monitoring.​Answer: Refer to answer to question 66

New clarification added:    Support, SLA & OperationsQuestion 45. Is a toll-free phone support number mandatory, and for which countries/regions must it be reachable?Answer: No but a reliable support system must be in place as per requirement outlined under the “Contractors Responsibility" sectionQuestion 46. How are support issues classified by priority, and is there an SLA matrix beyond the stated 8h/12h response and emergency response?Answer:  Support issues will be classified by priority based on their impact on website availability, security, functionality and user experience. Typical categories may include Critical, High, Medium and Low.No detailed SLA matrix beyond the stated response requirements has been defined at this stage. Bidders should propose their priority classification, escalation process, response times and target resolution times as part of their support model. Final arrangements will be agreed with the selected contractor during contract implementation.Question 47. Roughly how many support tickets/incidents per month has the site historically generated?Answer: Approx. 3 tickets/ monthQuestion 48. The 20 hrs/month covers enhancements — are hosting platform operations (monitoring, patching, server ops) separate from and additional to these 20 hours?Answer: The 20h month also covers hosting                 Design ScopeQuestion 49. Is a full website redesign expected within this contract, or only incremental 'light' design changes within the 20 hrs/month? Or Vendor can consider adding per month additional hours on top of the traditional S&M to cater to these additional development requirements.Answer: Only incremental within the 20h/month and ad-hoc hours            Commercial & ContractualQuestion 50. Should the hosting be quoted as an annual fixed fee, and the maintenance as a per-hour rate (per the invoicing schedule)?Answer: Please refer to Schedule of payment in RFQ_Section_II_Schedule. Bidders are encouraged to provide detailed cost breakdown for the evaluators to understand their costingQuestion 51. In which currency must the quotation be submitted?Answer  : The preferred currency is USD however bidders can quote using the currency of their choice. Should be noted that to ensure fairness during evaluation UNOPS shall convert prices to a single currency (USD) using the United Nations operational rate of exchange applicable on the deadline date for receipt of offers.Question 52. What is the clarification-request deadline and the quotation submission deadline?Answer : The clarification deadline was 2026-06-08 09:00 UTC and the quotation deadline is 2026-06-19 09:00 UTC. Bidders are encouraged to monitor the countdown on the esourcing portal.   Female Staff RequirementQuestion 53. Kindly confirm whether the requirement that at least 50% of the contractor's staff are female is mandatory for this tender.Answer :  The requirement "At least 50% or above of the staff are female" shall be assessed at the level of the personnel proposed for execution of the assignment/contract.Bidders shall demonstrate that at least 50% of the proposed project team members are female through the submission of the team composition and staffing details.This requirement is a mandatory pass/fail criterion.​         Hosting & InfraQuestion 54: Kindly confirm if there is any preferred cloud platform/vendor (AWS/Azure/GCP) and whether auto-scaling is expected as part of the hosting solution.Answer: There is no preferred cloud platform/vendor. Service providers may propose an appropriate hosting solution based on the requirements, provided it meets all applicable security, performance, availability, compliance,  data residency, GDPR, EU-hosting and support  requirements. Auto-scaling capabilities are desirable where appropriate to support performance, reliability, and fluctuations in website traffic; however, the specific hosting architecture and scaling approach should be proposed and justified by the service providerQuestion 55: Hosting is required in the EU region—can DR/backup environments be hosted outside the EU for redundancy?Answer: Any EU-based date centre is acceptable, administrative and/or technical support actions (e.g. server management, monitoring, helpdesk) are permitted from outside the EU. Refer to question/answer to 82 and 83Question 56: Are the provided infrastructure specifications (2 vCPU, 3.1 GB RAM, 25–50 GB storage) baseline, and should the solution support dynamic scaling?​Answer: Development, Staging and Production environments. Ticketing via a dedicated Jira service desk; monitoring via Sentry, with Gleap for user feedbackQuestion 57: Please confirm uptime SLA expectations, performance KPIs (page load, response time), and whether CDN integration is required.​Answer: The expected uptime SLA is 99.99%. Specific page-load time or server-response KPIs have not been defined at this stage. Bidders should describe how they will monitor, optimise and report on website performance, including any proposed KPIs, tools and reporting frequency.The website currently uses Cloudflare. Bidders should take this into account in their proposed hosting, performance, security and migration approach. Detailed configuration and related security settings will not be disclosed during the quotation stage.Question 58: Kindly specify backup strategy, retention policy, and DR expectations (RTO/RPO).​Answer: The RFQ requires daily automatic backups, backup retention of 14 days and above, uptime monitoring, and a 99.99% uptime guarantee. Specific RTO and RPO values have not been defined at this stage. Bidders should propose appropriate disaster recovery arrangements, including proposed RTO and RPO, based on the requirements set out in the RFQ.Disaster recovery expectations, including Recovery Time Objective (RTO) and Recovery Point Objective (RPO), will be defined in alignment with project requirements and agreed service levels. These parameters will be finalized during contract negotiations based on the selected solution architecture and operational needs   Security & ComplianceQuestion 59: Apart from SSL and GDPR compliance, are additional security measures (WAF, DDoS protection, monitoring tools) required?​Answer: Refer to answer shared on question 36 to 40. Bidders are also encouraged to offer their own methods and solution to demonstrate capacity to carry out this requirement.Question 60: Is ISO 27001 mandatory, and are there any periodic audit or compliance reporting requirements?​Answer: ISO 27001 certificate is mandatory.

New clarification added: Question 30. How many content editors / CMS user accounts and what roles exist (relevant for sizing and access)?Answer: 20 content editors and 5-7 adminsQuestion 31. Which languages does the site currently support, and is the RTL requirement for an existing language or a planned new one?Answer: English only Question 32. Are there third-party integrations (CRM, newsletter, analytics, maps, APIs) that must keep working post-migration?Answer: Yes , 12 active integrations including Zendesk, Mailchimp, GA4 + GA Reports, Mapbox/Leaflet, reCAPTCHA, Sentry, ShareThis, Gleap and a JSON:API + OAuth2 public API surface; all must keep working post-migration.   Environments & CI/CDQuestion 33. How many environments should the new platform provide (dev / staging / production), and are separate URLs required for each?Answer: Yes , separate development, staging and production environments with separate URLs are recommended, matching the current setupQuestion 34. Is there a preferred deployment workflow or branching model, and are database/file sync between environments required?Answer: The current workflow is Git-based branching with database/file syncs between environments, which should be anticipated.Question 35. 'Multiple websites / unlimited domains' is specified but scope says one site — does Cities Alliance anticipate adding sites under this contract?Answer: No  Security, Compliance & StandardsQuestion 36. Beyond ISO 27001 and GDPR, are there specific UNOPS ICT Information Security Requirements documents we must comply with, and can they be shared pre-bid?Answer: Beyond ISO 27001 and GDPR, The specific UNOPS ICT Information Security Requirement will be shared with the selected contractor to ensure compliance and there is no pre-bid as all the received questions submitted is esourcing are herein responded to and shared will all bidders.Question 37. Is a specific accessibility conformance level required (e.g. WCAG 2.1 AA)?Answer:  The RFQ requires a high level of compliance with accessibility standards and compliance with applicable web accessibility requirements. A specific WCAG conformance level has not been defined in the RFQ. Bidders should describe the accessibility standards and conformance level applied in their proposed solution, including any relevant WCAG level, and explain how accessibility will be tested and maintained. Compliance will be assessed during evaluation.Question 38. Are periodic penetration tests / vulnerability scans / security audit reports required, and at what frequency?Answer : The RFQ requires the contractor to provide a secure, monitored and maintained hosting environment, including malware scanning, patching, security updates, firewalls, DDoS protection, logging and related protective measures.A specific frequency for penetration tests, vulnerability scans or security audit reports has not been defined in the RFQ. Bidders should describe the security testing, vulnerability management and reporting measures included in their proposed solution, including the proposed frequency of scans, audits or reports. Compliance will be assessed during evaluation . Question 39. Is the 'DDoS protection with NAWAS filter' a hard requirement (NAWAS is NL-specific), or is an equivalent DDoS mitigation acceptable?Answer:  DDoS protection is a mandatory requirement to ensure service availability and resilience. However, the use of a specific provider or country-specific solution (such as NAWAS) is not required. Equivalent, industry-standard DDoS mitigation services that provide comparable protection are acceptable, subject to meeting the project’s security,availability, GDPR and EU-hosting requirements set out in the RFQ. Bidders should describe the proposed solution in their quotation. Compliance will be assessed during evaluationQuestion 40. Does any personal/sensitive data require specific data-residency, encryption-at-rest, or processing-agreement (DPA) terms?Answer: Any handling of personal or sensitive data must comply with applicable data protection including GDPR, and the website must be hosted in the EU region as specified in the RFQ.  Bidders should describe the data protection, encryption, access control and security measures included in their proposed hosting and maintenance solution, including encryption at rest where available or applicable.A data processing agreement and any other required contractual data protection provisions will be addressed with the selected contractor, in line with applicable UNOPS contractual requirements Backup, DR & AvailabilityQuestion 41. What Recovery Time Objective (RTO) and Recovery Point Objective (RPO) are expected for disaster recovery?Answer:  The RFQ requires daily automatic backups, backup retention of 14 days and above, uptime monitoring, and a 99.99% uptime guarantee. Specific RTO and RPO values have not been defined at this stage. Bidders should propose appropriate disaster recovery arrangements, including proposed RTO and RPO, based on the requirements set out in the RFQ.Disaster recovery expectations, including Recovery Time Objective (RTO) and Recovery Point Objective (RPO), will be defined in alignment with project requirements and agreed service levels. These parameters will be finalized during contract negotiations based on the selected solution architecture and operational needs.Question 42.  Does the 99.99% uptime guarantee carry contractual penalties/SLA credits, and how is uptime measured/reported?Answer: The RFQ requires a 99.99% uptime guarantee, uptime monitoring, and regular reporting. Specific contractual remedies, service credits or penalties are not defined in the RFQ and will be addressed, where applicable, in line with the contract terms and applicable UNOPS conditions.Bidders should describe in their quotation how uptime will be monitored, measured and reported, including the proposed monitoring tools, reporting frequency, and any exclusions or assumptions.Question 43. Is High Availability (redundant/failover infrastructure) mandatory, or is single-node with automatic reboot acceptable?Answer: High availability is a requirement under the RFQ. Bidders should propose a hosting solution that ensures service continuity and resilience, including appropriate failover, recovery or equivalent availability measures. The proposed solution must meet the RFQ’s uptime, availability and resilience requirements. Compliance will be assessed during evaluation.Question 44. What backup retention is required beyond '14 days and above' — is there a maximum or long-term archival requirement?Answer: Backups are currently retained for up to 90 days

New clarification added:                  Current Hosting & InfrastructureQuestion 8. Who is the current hosting provider, and what is the underlying platform (e.g. Acquia, Pantheon, Platform.sh, self-managed VPS)?Answer: The current website is hosted by an external provider. OVH cloud infrastructure a managed hosting environment with a high availability setup. Further operational details will be shared with the selected contractor as needed for migration and onboardingQuestion 9. Can you share the current infrastructure/architecture diagram (web, DB, cache, search, CDN layers) and a list of running services?Answer : Detailed information regarding the current hosting infrastructure and system configuration is not being disclosed during the quotation stage. Bidders should prepare their quotations based on the requirements and specifications set out in the RFQ.Question 10. What is the actual current storage consumption split (DB size vs. files/media vs. logs/backups), within the 25 GB?Answer: The majority is consumed by files/media — the site holds 44,194 media itemsQuestion 11. Is the 2.09 vCPU / 3.1 GB RAM the current allocation or the target requirement? Are there observed CPU/RAM peak utilisation figures?Answer: This is the current allocation. Utilisation rises significantly during seasonal peak periods.Question 12. Which Solr version is currently in use, and roughly how large is the search index / how many indexed items?Answer: Apache Solr 9.x is recommended (via Drupal's Search API Solr module). The index covers ~3,766 nodesQuestion 13. MySQL 5.7 is end-of-life; is Cities Alliance open to migrating to a supported version (MySQL 8 / MariaDB) on the new platform?Answer: The site runs MariaDB 10.11.16.Question 14. Are email mailboxes (IMAP/POP3) actually in scope, or is this a generic spec line? If in scope, how many mailboxes and what volume?Answer: Email mailbox services are not a core requirement of the website maintenance and hosting scope. The reference to IMAP and POP3 should be understood as part of the generic hosting technical specifications.Question 15. Is a CDN currently used (e.g. Cloudflare, Fastly), and should it be retained/provided in the new hosting?Answer:Cloudfare and it should be retained            Traffic & PerformanceQuestion 16. What are the average and peak monthly pageviews / visits and concurrent users?Answer: Trailing 12 months: roughly 19,000 sessions and 26,000 pageviews per month on average; peak month around 44,000 sessions / 49,000 pageviews. Roughly 183,000 annual unique visitors. Concurrency data is not available.Question 17. What is the geographic distribution of visitors (to confirm EU-only hosting vs. need for CDN/edge)?Answer:Global Question 18. Are there known traffic spikes (campaigns, events, reports launches) and their typical magnitude?Answer:Yes — traffic is seasonal. Could go roughly 5–6x a normal dayQuestion 19. What is the average page weight / current page-load performance baseline expected to be maintained or improved?Answer:Not tracked in GA4; the baseline is sourced from Core Web Vitals in Google Search Console and Current performance is expected to be maintained or improved                                 MigrationQuestion 20. How many sites in total?Answer: 1Question 21. What downtime/maintenance window is acceptable for cutover, and is a content freeze period permitted during migration?Answer: A few hoursQuestion 22. What are the details of the content to be archived before migration (volume, format, where stored, retention)?Answer: Archiving details will be confirmed at a later stage. For sizing: ~3,766 nodes and 44,194 media items across 13 content types and 15 taxonomy vocabulariesQuestion 23. Who controls the citiesalliance.org DNS and domain registrar? Is it fair to assume that citiesalliance team will own the DNS records update?Answer: Yes, potentially — DNS record updates would be owned by the Cities Alliance teamQuestion 24. Will the contractor get read access to the current production server/codebase/database export to plan and execute the migration?Answer: The selected contractor will be provided with the access and information necessary to perform the agreed scope of work. Access to systems, code, and data will be granted on a need-to-know basis and in accordance with applicable security, confidentiality, and project governance requirements.Question 25. Is a single big-bang migration expected, or a phased/batch plan, and must a per-site migration project plan be submitted before execution?Answer: Single migration                           Drupal Application & ArchitectureQuestion 26. Is the website on Drupal 10.6.5 exactly, and is it standard Drupal core or a heavily customised/forked codebase?Answer: Drupal core 10.6.5, Detailed information regarding the current hosting infrastructure and system configuration is not being disclosed during the quotation stage. Bidders should prepare their quotations based on the requirements and specifications set out in the RFQ.Question 27. Can you provide a list of contributed and custom modules in use (especially custom modules requiring PHP/extension dependencies)?Answer: 31 directly required contributed modules. Detailed information regarding the current hosting infrastructure and system configuration is not being disclosed during the quotation stage. Bidders should prepare their quotations based on the requirements and specifications set out in the RFQQuestion 28. What PHP version and extensions does the current site require, and any non-standard system libraries?Answer: Detailed information regarding the current hosting infrastructure and system configuration is not being disclosed during the quotation stage. Bidders should prepare their quotations based on the requirements and specifications set out in the RFQQuestion 29. Is the codebase managed in Git? Can the repository be shared, and is there an existing CI/CD pipeline to be replicated?Answer: Yes — Git-managed with a CI/CD deployment pipeline, including a full build with automated testing, which is expected to be maintained. The repository will be made available to the selected vendor.

New clarification added: Question 7: Form E: Previous Experience Form " Minimum 4 Experience in the past 5 years in similar types of services indicated in the Section II: Schedule of Requirements. Bidders must share links to the websites mentioned below.  At least 4 proofs of experience are submitted by providing either client reference letters/ Signed PO/Signed Contracts for similar service. Bidder must submit proof of the mentioned experience below" As per the table given, there are only 3 rows to provide similar expereinces, can you please confirm if we can add one more row to present all the 4 expereinces and also can we include website links in the "Detailed Description of services" column along with services offeredAnswer 7: Bidders are allowed and expected to add more row in Form E: Previous Experience Form. As indicated in the criteria its "minimum of 4 experience" thus, there is no maximum number of similar experiences that bidders can add provided they are within the past 5 years.

New clarification added: Question 6 Clarification on "Relevant Experience" (Form C, Section 1.2)We would like to ask for a clarification about the experience requirements in Form C (Section 1.2 Relevant Experience). This section requests a minimum of 4 previous contracts for "similar types of services".Answer 6 : These references should be relevant to the scope of services requested, including website maintenance, Drupal development/design support, hosting and related technical services.We understand that these 4 projects must collectively cover all the required areas mentioned in Section II (website design, content maintenance, and hosting). We understand it is not mandatory for each individual project to include all these different services at the same time, as long as the 4 contracts combined cover the full scope of Section II.Please, could you confirm if our understanding is correct? If it is not correct, please clarify.Answer 6: The four references should demonstrate relevant experience in similar services. It is not mandatory for each individual contract to cover every element of the full scope, provided that the bidder’s submitted references, taken together, demonstrate sufficient relevant experience across the required areas. Compliance will be assessed based on the documentation submitted and the requirements set out in the solicitation documents.

New clarification added: Clarification on Experience RequirementsWe would like to ask for a clarification about the experience requirements for this tender. Our understanding is the following: Please, could you confirm if our understanding is correct? If it is not correct, please clarifyQuestion 3 : The Pass/Fail criteria for company experience is indicated in Form C (Sections 1.2 and 1.3) and Form E. This means we need to provide a minimum of 4 previous contracts in the past 5 years.Answer 3: This is correct Question 4: The points listed under "Experience of the contractor (specific details and number of years of experience)" in Section II: Schedule of Requirements (Objective 01) are not related to the 4-contract Pass/Fail criteria mentioned above.Answer 4: The requirements listed under “Experience of the contractor” in Section II form part of the technical requirements of the solicitation and should be addressed in the bidder’s technical submission. The four-contract requirement in Form C relates to relevant previous experience and references. Compliance will be assessed against the full set of requirements included in the solicitation documents.Question 5: Instead, we understand that these specific details from Objective 01 (for example, having 20% Drupal experts, 50% female staff, and the specific Drupal developments) are part of our general technical proposal. Therefore, we should demonstrate them in Form C, specifically in Section 2.7 Gender and Diversity Considerations, Section 3.1 Proposed Team Structure, and Section 3.2 Qualifications of Key Personnel Proposed. Furthermore, our understanding is that the specific requirements regarding staff percentages (such as having 50% female staff and 20% Drupal experts) are evaluated on a Pass/Fail basis strictly at the level of the specific team proposed for this project, and not at the overall company level.Please, could you confirm if our understanding is correct? If it is not correct, please clarify.Answer 5:The requirements listed under Objective 01 should be addressed in the bidder’s technical submission, using the relevant sections of the quotation forms.The staff-percentage requirements, including the requirements on Drupal expertise and female staff, will be assessed at the level of the personnel proposed for execution of the assignment/contract, not at the level of the bidder’s wider corporate group or overall workforce.For the Drupal expertise requirement, bidders should indicate the proposed delivery structure, including the core team and any technical or backstopping staff who will be available for contract delivery, and specify the total number of staff in that structure and the number of Drupal experts.For the female staff requirement, bidders should provide the proposed team composition and staffing details, in line with the clarification provided under Question 2.These requirements are mandatory pass/fail requirements. Compliance will be assessed based on the information and supporting documentation submitted by the bidder.

New clarification added: Question 2: Please clarify how the requirement “At least 50% or above of the staff are female” will be assessed: at group level, legal-entity level, business-unit level, or proposed-team level? For example, in group level, out of 1500+ staff, 35% of our employees are females. Please confirm whether this is a mandatory pass/fail requirement or an evaluation consideration under Gender and Diversity.Answer 2:The requirement "At least 50% or above of the staff are female" shall be assessed at the level of the personnel proposed for execution of the assignment/contract.Bidders shall demonstrate that at least 50% of the proposed project team members are female through the submission of the team composition and staffing details.This requirement is a mandatory pass/fail criterion.

New clarification added: Question 1: Please clarify how the requirement “At least 20% of the staff in the company are Drupal experts” will be assessed. Should “company” be understood as the legal entity submitting the quotation, the wider corporate group, the specific business unit proposed for contract delivery, or the proposed project/delivery team? For example, we have a Drupal capabilty of 80+ Drupal specialists, but the wider group has approximately 1,500 employees. Please confirm which denominator should be used for this requirement and what evidence is expected.Answer 1:The requirement “At least 20% of the staff in the company are Drupal experts” shall be assessed at the level of the personnel proposed for execution of the assignment/contract, not at the level of the bidder’s wider corporate group or overall workforce.For this requirement, bidders should identify the proposed delivery structure, including the core team and any technical or backstopping staff who will be available for contract delivery. Bidders should indicate the total number of staff in this proposed delivery structure and the number of Drupal experts within it.Bidders should provide supporting information demonstrating Drupal expertise, such as staffing details, staff profiles, certifications, relevant project experience, or other evidence considered relevant.