2-1. RFP-309-26 Scope of Work.pdf

Statement of Work (SOW)

Website Maintenance and Support Services

1. Project Overview

Boulder County seeks a qualified vendor to provide comprehensive website maintenance, support, hosting management, accessibility oversight, and ongoing development services for the County’s enterprise WordPress environment and supporting AWS infrastructure. The selected vendor will deliver secure, scalable, and accessible digital services aligned with industry standards, Boulder County policies, and best practices. The qualified vendor will complete and coordinate this work with Boulder County IT resources as well as Boulder County web content authors from various departments and offices.

Boulder County has a portfolio of 11 public facing websites that are built using a highly customized versions of WordPress that are hosted in the AWS platform. Our current contract has a not to exceed limit of $175,000 per year value and our intention is to keep our budget to this limit. Boulder County is seeking a website maintenance and support vendor that will assist with the following tasks on an as needed basis:

• Creation of new partnership sites (i.e. Wildfire Partners - https://wildfirepartners.com )

• Enhancements of existing partnership sites

• Enhancements of bouldercounty.gov website

• Enhancements of boulderodm.gov website

• Enhancement of key applications hosted on the AWS platform (i.e. Election Night Reporting and REDCap)

• Maintenance of AWS hosting platform and services

2. Scope of Services

A. WordPress Maintenance, Development, and Support The vendor shall provide expert-level WordPress support including:

• Multi-site WordPress administration and configuration

• Child theme development, customization, and maintenance

• Child plugin development and custom plugin engineering

• Custom theme development aligned with Boulder County brand standards https://wildfirepartners.com/

• Integration of website services with third-party systems (e.g., GovDelivery)

• Modern website design adhering to current UX/UI best practices

• Information architecture services to ensure intuitive navigation and content find ability

B. AWS Hosting & Infrastructure Management The vendor shall maintain and enhance Boulder County’s AWS hosting environment, providing:

• Reserved instance planning, purchasing, and resource allocation strategies

• IAM user, role, and permission management aligned with security best practices

• Load-balancing strategies for availability and performance

• Scalable resource deployment and autoscaling configuration

• Implementation of AWS security best practices and routine infrastructure hardening

• Database optimization, resource management, and backup and recovery protocols

• Overall infrastructure monitoring, health management, and modernization recommendations

C. Website Process Workflow & Development Lifecycle The vendor shall implement and maintain structured workflows for ongoing development and maintenance activities:

• Agile software development life cycle (SDLC) management

• Source control best practices using Git or comparable tools

• Secure and repeatable deployment practices for code updates

• Release planning, documentation, versioning, and communication protocols

• Coordination with Boulder County’s change management practices

D. Website Performance Monitoring & Optimization The vendor shall ensure proactive monitoring and optimization of website performance:

• Continuous resource utilization and performance monitoring

• Scalability tuning and optimization for high-traffic periods

• Downtime and outage monitoring with escalation protocols

• Security detection, incident response, and remediation workflows

• Reporting of performance trends and recommendations

E. Website Accessibility & Compliance Services The vendor shall support ongoing accessibility compliance in accordance with WCAG 2.1–

2.2 standards:

• Auditing and customizing design elements and components for accessibility compliance

• Customization of styling, layouts, and ARIA attributes

• Monitoring and reporting of accessibility compliance trends

• Manual testing using assistive technologies (e.g., JAWS, NVDA), consistent with Boulder County’s accessibility working groups

• Recommendations for remediation and continuous improvement

F. Resource Training & Development The vendor shall provide ongoing training and knowledge-sharing support for county staff, including:

• Best practices for AWS configurations, security, and resource optimization

• Accessibility guidance, training sessions, and hands-on demonstrations in coordination with our internal Digital ADA team

• WordPress configuration, maintenance, and customization tutorials

• Recommendations for custom application development or modernization

G. Resource Management, Communication & Responsiveness The vendor shall deliver timely and effective operational support through:

• Clear communication protocols and timely responsiveness

• High first-time-resolution rates for support tickets and issues

• Defined escalation pathways for high-impact issues

• Reliable availability during business hours and for preapproved after hours work, including but not limited to natural disasters, large-scale emergencies, and Election night support

H. Value-Added Capabilities Vendors may receive additional consideration for:

• Experience implementing AI tools, content automation, or agent workflows (aligned)

I. Deliverables

• Monthly performance and availability reports

• Documented SDLC processes and deployment checklists

• Annual AWS infrastructure assessment and cost-optimization report

• Updated website documentation, including architecture and design specifications

• Training materials and knowledge-transfer deliverables

J. Vendor Qualifications

The selected vendor must demonstrate:

• Proven experience supporting enterprise WordPress environments

• Expertise in AWS cloud hosting and infrastructure design

• Familiarity with accessibility compliance requirements and assistive technologies

• Ability to deliver high-quality communication, project documentation, and timely support

K. Term & Renewal

The County anticipates awarding a multi-year contract with annual performance reviews and potential renewals based on service quality, responsiveness, and adherence to requirements.

L. Summary of Deliverables

The descriptors of Creation, Enhancement and Maintenance are intentionally vague. This work includes configuration of services within AWS, custom code development in PHP, custom code development within WordPress (child themes and child plugins or fully custom plugins), configuration of third-party applications like REDCap, source code manipulation, code deployment services, system monitoring, escalation of support for after hours and security issue response - just to capture some of the more critical services. The nature of work to maintain and enhance our portfolio of websites includes accessibility enhancements to remain compliant with State and Federal Accessibility laws, security monitoring and enhancements to WordPress, WordPress themes and plugins, as well as the AWS platform and services. Other work includes training our internal teams with industry best practices for website management, content management, and keeping current with hosting best practices and services.

Additionally, awarding of this new contract should include a full technical assessment of our current workflow, hosting configuration, hosting services, WordPress configuration and WordPress customizations for optimization and ongoing ease of maintenance. Finally, consideration for large effort implementations, enhancements, or projects will be asked to be submitted as fixed bid efforts.

Boulder County acknowledges that we are looking for a comprehensive partnership with a vendor to support our web assets, but it should also be noted that the awarded vendor will not be asked to be our sole provider for any of the following:

• Web Accessibility

• UX/UI Design

• Information Architecture

Support and experience in these areas is preferred.

M. Cost and Proposed Pricing Structure:

Boulder County prefers proposals that include more creative payment options other than Time and Material. We strive to provide clear instructions in our requests for enhancements, while relying on our support vendor to fill in the gaps and ask the questions we may not know to ask.

We want to avoid ongoing costs for work that lacked details and require additional work.

N. Minimum Qualifications:

• Vendors must have experience with WordPress (version 6.8.6 and newer), including WordPress multi-site (version 6.8.6 and newer).

• Vendors must have experience with the Unicon theme and the 7 theme, as well as WP Bakery page builder.

• Vendors must have experience using the following set of WordPress plugins:

1. Admin Columns Pro

2. Advanced Custom Fields PRO

3. Debug This

4. Duo Two-Factor Authentication

5. Easy Tables

6. Enhanced Media Library PRO

7. Post SMTP

8. PublishPress Capabilities Pro

9. PublishPress Permissions Pro

10. PublishPress Planner Pro

11. Query Monitor

12. Solid Security Pro

13. TablePress (Premium)

14. TAO Schedule Update

15. The Events Calendar Pro

16. Unicon Core

17. User Role Editor Pro

18. W3 Total Cache

19. WP Crontrol

20. WP Bakery Page Builder

21. Yoast Duplicate Post

22. Yoast SEO

23. Yoast SEO Premium

• Vendors must have experience creating child plugins for the following:

24. PublishPress Revisions

25. Active Directory Login

26. Autocomplete search for admin menu

27. Hiding approve button within PublishPress

28. Clear cache and new page tag removal

29. Display PublishPress editorial comments

30. Allow Revisers to publish within PublishPress

31. Enable media replace

32. Future publish within PublishPress in 12 o’clock format

33. Modify Revisor Edit Page within PublishPress

34. Move editorial comments to top within PublishPress

35. Change new page revisions within PublishPress

36. News import from GovDelivery or an equivalent news feed source using an RSS feed

37. Redirect on decline from previews within PublishPress

38. Restrict revisor view within PublishPress

39. Revision approved email send within PublishPress

40. Revision declined email send within PublishPress

41. Revision queue filter within PublishPress

42. Revision restore override within PublishPress

43. Revision submitted email send within PublishPress

44. Revision count visible within PublishPress

45. Add custom templates to Visual Composer editor

• Vendors must have experience creating custom post types - please reference the following types of data as examples:

46. Grants

47. Bidding Opportunities

48. Work Sites

49. Departments

50. Housing Rentals

51. Staff Directory

52. Volunteer Opportunities

• Vendors must have experience using source control services, preferably using Beanstalkapp

• Vendors must have experience using code deployment services, preferably using DeployBot

• Vendors must have experience using project management planning tools like Trello

• Vendors must have experience hosting 3rd party applications within AWS like REDCap

• Vendors must have experience developing custom software for high volume, scalable solutions like our Election Night Reporting results (https://electionresults.bouldercounty.gov/)

• Vendors must have experience with the following AWS infrastructure:

53. Aurora and RDS, AWS User Notifications, Certificate Manager, CloudFront, Control Tower, EC2, EFS, ElastiCache, Elastic Beanstalk, GuardDuty, IAM, Lambda, Route 53, S3, Secrets Manager, Simple Email Service, Systems Manager, VPC, WAF & Shield https://electionresults.bouldercounty.gov/

• Secure Jump Host Management and OS Patching (Amazon Linux and Ubuntu Mandatory): Vendors must possess proven experience in the secure configuration, maintenance, and patching of Linux-based jump hosts used for administrative access to front-end web servers. These jump hosts run Ubuntu; vendor proficiency with this specific distribution is required. Experience must include:

• Configuration of least privilege IAM roles, rigorously enforced to restrict access solely to necessary resources.

• Implementation and maintenance of automated patching processes that incorporate vulnerability scanning and rapid remediation cycles. Patching frequency should be aligned with security best practices, including but not limited to monthly patching windows, verified through documentation or a similar commitment.

• Comprehensive auditing of jump host access logs – vendor must detail procedures for incident response related to these logs.

• Demonstrated ability to troubleshoot and resolve compatibility issues arising from OS upgrades on Amazon Linux, minimizing disruption to web server accessibility. The vendor must provide specific examples of instances where they’ve mitigated PHP or other service incompatibilities due to OS version changes.

• Front-End Web Server Configuration & Automation (Amazon Linux/Elastic Beanstalk Mandatory): Vendors must demonstrate expert competency in configuring and maintaining web server environments on AWS EC2 instances deployed within Elastic Beanstalk, with a firm commitment to automation. This includes proficiency in:

• Configuration of Apache web servers, including advanced .htaccess file management for performance optimization and security hardening – specific examples must be provided.

• Client-side asset build processes utilizing Gulp for automated minification, concatenation, and deployment to Elastic Beanstalk environments. Vendor must describe their experience integrating Gulp into CI/CD pipelines.

• Implementation of Elastic Beanstalk extensions (ebextensions) for persistent storage with Amazon EFS. Vendor must provide concrete examples demonstrating successful configuration and maintenance of EFS volumes within Elastic Beanstalk environments, including solutions for data consistency across environments.

• Deep understanding of the impact of OS upgrades on PHP installations and dependent services (e.g., MySQL/MariaDB) within the Elastic Beanstalk environment. Vendors must detail their processes for identifying, evaluating, and resolving compatibility conflicts between new operating system releases (including updates to PHP versions), EFS integration, and overall application functionality. This must include documented mitigation strategies that prevent production outages.