ATTACHMENT A: REQUEST FOR PROPOSALS

Title: Drupal Website Support, Maintenance and Development Services

The County of San Mateo (County) is seeking proposals for Drupal Content

Management System (CMS) support, development, and maintenance services from qualified proposers.

The selected partner will provide subject matter expertise and development services to maintain the security and enhance the functionality of the County’s Drupal website and content management system.

Solicitation Number ISD-20251905

Number of contracts expected to be awarded 1

Estimated Value or Range per contract $1,000,000

Funding Sources ☐Federal ☐State ☒County ☐Other

Expected Contract Duration 36 months

Options to Renew 1 option of 24 months

Proposal submission format 1 electronic copy, uploaded to OpenGov site

County Mailing Address (for hard-copy communication only)

County of San Mateo- Information Services Department 455 County Center, 3rd Floor Redwood City, CA 94063

Authorized Contact Person Mikey Brogonia

Authorized Contact Person E-mail ISD_Solicitations@smcgov.org

E-mail Address for Protests ISD_Protest_Officer@smcgov.org

RFP Released Friday, April 25, 2025

Pre-proposal meeting date and time Wednesday, May 7, 2025, 10:00 AM PST

Pre-proposal meeting location Via Microsoft Teams, refer to Open Gov.

Deadline for Questions, Comments and Exceptions Friday, May 9, 2025, 1:00 PM PST

Proposal Due Date and Time Friday, May 23, 2025, 1:00 PM PST

Interviews Week of June 9, 2025, tentatively

Submission to County Board for approval TBD

Anticipated Contract Award Date TBD

Attachments:

Attachment B: Price Proposal Template- Required with submissions

Attachment C: References Template- Required with submissions

Attachment D: Technology Security Assessment- Required with submissions

Attachment E: County Standard Contract Template- Review

Attachment F: Vendor Response Template- Required with submissions

Important Reminder: All proposers must complete and submit the required attachments listed above with their proposals. No exceptions will be made to this requirement. Proposals that fail to comply are non-responsive and are ineligible for consideration.

RFP# i

TABLE OF CONTENTS

SECTION I - DEFINITIONS

SECTION II - INSTRUCTIONS FOR PROPOSERS

2.1 PRE-SUBMITTAL ACTIVITIES

A. Registration

B. Questions, Comments, Exceptions

C. Revisions to the Solicitation

D. Contact with County Employees

E. Pre-proposal conference and site visits

2.2 PROPOSAL CONTENT REQUIREMENTS

A. Proposal Format

B. Technical Proposal Contents

C. Supplementary Documents

D. Price Proposal

2.3 PROPOSAL SUBMISSION

A. Submit proposals as directed below

B. Errors in Proposals

2.4 PROPOSER CERTIFICATIONS

2.5 WITHDRAWAL OF PROPOSALS

2.6 NO COMMITMENT

2.7 ESTIMATED QUANTITIES

2.8 PROPOSER SELECTION

A. Determination of Responsiveness

B. Proposal Evaluation

C. Determination of Responsibility

2.9 CONTRACT AWARD

A. Notice of Intent to Award

B. Award Procedure

C. Commencement of Performance

2.10 PROTESTS

A. Protest Eligibility, Format, and Address

B. Protest Deadlines

C. Protest Contents

D. Reply to Protest

E. No Stay of Procurement Action during Protest

2.11 PUBLIC RECORDS

A. General

SECTION III - QUALIFICATIONS, EXPERIENCE, AND EVALUATION CRITERIA

3.1 MINIMUM QUALIFICATIONS

3.2 ORGANIZATIONAL CAPACITY AND EXPERIENCE

B. Experience

3.3 REFERENCES

3.4 EVALUATION CRITERIA

SECTION IV - INSURANCE

RFP# ii

4.1 SPECIAL INSURANCE REQUIREMENTS - CYBER LIABILITY

SECTION V - STANDARD TERMS AND CONDITIONS

SECTION VI - SCOPE OF WORK AND SPECIAL PROVISIONS

6.1 SUMMARY

6.2 REQUIREMENTS AND SCOPE OF WORK

COUNTY OF SAN MATEO’S DRUPAL SYSTEM CONFIGURATION

A. Contributed Modules

B. Integrations

C. Content Types

6.3 FINGERPRINTING AND BACKGROUND CHECKS

6.4 COOPERATIVE AGREEMENT

RFP# 3 Rev 01/24/2025

SECTION I - DEFINITIONS

Business Day: Monday through Friday except for holidays as observed per the California Government Code.

Confidential Information: Information in any form that is not generally known and treated as confidential by a party, including business, financial, statistical, and non-public personal information, trade secrets, know-how, applications, documentation, schematics, procedures, Personally Identifiable Information, information covered by legal privilege, and other proprietary information that may be disclosed or incorporated in materials provided to one party by the other, whether or not designated as confidential, whether or not intentionally or unintentionally disclosed, and whether or not subject to legal protections or restrictions.

Contract Materials: finished or unfinished documents, data, studies, maps, photographs, reports, specifications, lists, manuals, software, and other written or recorded materials produced or acquired by the Contractor pursuant to the Contract for or on behalf of the County, whether or not copyrighted.

Contract: The agreement between the County and Contractor awarded pursuant to this solicitation.

Contractor: The person or other entity awarded a Contract in conformance with the terms of this solicitation and any subsequently agreed upon terms.

County Data: All information, data, and other content, including Confidential Information and other information whether or not made available by the County or the County’s agents, representatives or users, to a Contractor or potential Contractor or their employees, agents, representatives or Subcontractors, and any information, data and content directly derived from the foregoing, including data reflecting user access or use.

County Systems: The information technology infrastructure of the County or any of its designees, including computers, software, databases, networks, and related electronic systems.

County: County of San Mateo

Deliverables: Goods or services required to be provided to the County under the Contract.

Force Majeure: An event or circumstance not caused by or under the control of a party, and beyond the reasonable anticipation of the affected party, which prevents the party from complying with any of its obligations under the Contract, including acts of God, fires, floods, explosions, riots, wars, hurricane, sabotage, terrorism, vandalism, accident, governmental acts, and other events.

Hosting: Storage, maintenance, and management of hardware, software, and the County Data by a party other than the County, on machines and at locations other than those operated by the County, where a party other than the County has regular responsibility for back-up, disaster recovery, security, upgrades, replacement, and overall responsibility for ensuring that all hardware and software continues to function as intended.

Key Employee: Employees of the Contractor jointly identified by the County and the Contractor as possessing unique skill and experience that was a material consideration in the County’s decision to award a contract.

Maintenance Updates: Any revision, update, improvement, modification, enhancement, correction, bug fix, patch, or new release for a system, platform, software or other product, including any change made as a result of applicable federal, State, or local law.

Major Change: A change to the specified performance, maintainability, operation, power requirements, compatibility, measurement, user interface, reliability, quantity, scale, quality, terms, delivery method, or requirement of any product or service that affects the obligations of the parties or reflects a substantial alteration in circumstances surrounding the agreement or is of such a nature that knowledge of the change would affect a person’s decision-making process.

RFP# 4 Rev 01/24/2025

PII (Personally Identifiable Information): information in any format that can be used to identify a specific individual, either used alone or combined with other private or public information that can be linked in some way to a specific individual.

Project Manager: The individual identified by the County as the County’s primary contact for the receipt and management of the goods and services required under the Contract.

PST: Pacific Standard Time, including Pacific Daylight Time when in effect

Subcontractor: Firms engaged by the Contractor to perform work or provide goods pursuant to the Contract, including vendors and suppliers

Task Order or Purchase Order: A written request from the County to a vendor to provide goods or services, indicating types, quantities, prices and delivery criteria.

RFP# 5 Rev 01/24/2025

SECTION II - INSTRUCTIONS FOR PROPOSERS

2.1 PRE-SUBMITTAL ACTIVITIES

A. Registration

(1) Organizations or individuals interested in responding to this solicitation must register online with the County at:

https://procurement.opengov.com/portal/smcgov.

(2) The County does not maintain the eProcurement OpenGov system and is not liable for site failures or technical problems. To resolve technical issues, contact OpenGov Technical Support by using the real time chat located in the lower right hand corner of the screen, or via email at procurement-support@opengov.com at:

B. Questions, Comments, Exceptions

Submit questions, comments, and exceptions, including notifications of apparent errors, to the OpenGov site by the Deadline for Questions, Comments and Exceptions. Questions and comments received after the deadline may not be acknowledged.

Request for Substitution of Specified Equipment, Material, or Process

(a) Unless otherwise stated in the solicitation, references to items or processes by trade names, models or catalog numbers are to be regarded as establishing a standard of quality and not construed as limiting competition.

(b) If requesting a substitution for a required item, submit requests by the Deadline for Questions, Comments, and Exceptions. Furnish all necessary information required for the County, in its sole judgement, to make a determination as to the comparative quality and suitability of any suggested alternatives. The County’s decision will be final. If alternatives are accepted, the County will issue an addendum to the solicitation.

(c) Failure to submit requests by the deadline will be deemed a waiver of any exception. The County’s consideration of a suggestion does not imply acceptance. If sufficient proposals are received with no requested changes, the County may reject those requesting changes.

C. Revisions to the Solicitation

The County may cancel, revise, or reissue this solicitation, in whole or in part, for any reason. Revisions will be posted as addenda on https://procurement.opengov.com/portal/smcgov. No other revision of this solicitation will be valid. Proposers are responsible for ensuring that they have received all addenda from OpenGov.

D. Contact with County Employees

Violation of the following prohibitions may result in a proposer being found non-responsible, barred from participating in this or future procurements, and becoming subject to other legal penalties.

(1) As of the issuance date of this RFP and continuing until it is canceled or an award is made, no proposer or person acting on behalf of a prospective proposer may discuss any matter relating to the RFP with any officer, agent, or employee of the County, other than through OpenGov, to the Authorized Contact Person, or as outlined in the evaluation or protest procedures.

(2) Proposers may not agree to pay any consideration to any company or person to influence the award of a contract by the County, nor engage in behavior that may be reasonably construed by the public as having the effect or intent of influencing the award of a contract.

E. Pre-proposal conference and site visits

If a pre-proposal conference or site visit is scheduled, answers to questions raised prior to and at the events may be posted on OpenGov.

RFP# 6 Rev 01/24/2025

2.2 PROPOSAL CONTENT REQUIREMENTS

A. Proposal Format

Number all pages of the proposal. Label and order each section as follows:

(1) Cover letter - no longer than one page

(2) Authorized contacts - identify the name and title the person to contact regarding the proposal, as well as all other individuals authorized to represent the organization in contract negotiations.

(3) Table of Contents, listing all major topics and their respective page numbers.

(4) Exceptions to the solicitation, or to the final revised solicitation, if any. Exceptions must have been submitted by the RFP’s deadline for Comments, Questions, and Exceptions. Exceptions requested after the RFP Deadline for Comments, Questions, and Exceptions will not be considered and/or accepted.

(5) Technical Proposal

(6) Supplementary Documents, as requested

(7) Price Proposal

Proposers are strictly prohibited from submitting internet links (URLs) in place of the required proposal materials. All required information and supporting documents must be included as complete, self-contained files. Submissions that rely on or include links to external files, unless explicitly requested by the County, are considered non-responsive.

B. Technical Proposal Contents

(1) Explain responses to be understood by people unfamiliar with industry jargon. Use drawings, diagrams, schematics, and illustrations as needed, but do not simply refer readers to an exhibit or other section of the proposal in lieu of a complete response.

(2) Addressing each requirement outlined in this solicitation in the order presented, describe how the requested goods and services will be provided.

(3) If applicable or requested, include a project schedule with milestones, deliverables, dates, and a project management plan.

(4) Specify any needs for physical space or equipment that the County must provide during the engagement.

(5) Explain how work, equipment, and knowledge will be transitioned to the County or a new vendor at the end of the contract period.

C. Supplementary Documents

(1) References for Proposer

(2) Technology Security Assessment, as applicable

(3) Evidence Proposer is Registered, active, and in good standing on sam.gov.

(4) Evidence of insurance, per requirements and minimum coverages listed in Section IV.

(5) All other attachments, certifications, and forms executed as requested.

D. Price Proposal

(1) Place all cost and pricing data in a separate file clearly marked “PRICE PROPOSAL”.

(2) Use forms and templates provided for the Price Proposal, use them without modification. Failure to use the forms or templates provided, or modification of them, may result in rejection of the entire proposal.

RFP# 7 Rev 01/24/2025

(3) Alternative Price Proposals may be submitted, but only in addition to, not in lieu of, the requested Price Proposal. If submitting an alternative Price Proposal, clearly identify it as an alternative.

(4) Include prices for the base period of service and if applicable, for each additional year including option years.

(5) Unless otherwise indicated, when applicable, in the price of an item, include all licenses required for operation, as well as upgrades and revisions to software over the term.

2.3 PROPOSAL SUBMISSION

A. Submit proposals as directed below.

(1) Electronic Submissions

Include the proposer’s name and the RFP title and number in each filename. Submit proposals via the OpenGov website, allowing sufficient time for the upload to complete by the Due Date and Time.

Partial uploads will automatically terminate, and proposals will be rejected. The OpenGov submission time will be the official submission time. Contact OpenGov with technical questions regarding the site. The County will not be responsible for and may not accept proposals that are late due to slow internet connections or for any other failure of the OpenGov system.

(2) Conflicts between Certain Requirements

Prior to the submission deadlines and solely relating to a determination of the timeliness of questions, comments, and proposal submissions, information displayed on the OpenGov site will take precedence in the event of a discrepancy between that information and the information within the solicitation documents. For all other discrepancies, the information in the solicitation documents will take precedence.

(3) Hand-written responses, whether or not submitted electronically, will be rejected, with the exception that signatures may be hand-written.

B. Errors in Proposals

The County will not be liable for any errors in proposals. Proposals may be rejected as unresponsive if they are incomplete, are missing pages or information, or cannot be opened for any reason. The County may waive minor irregularities, but such waiver will not modify any remaining RFP requirements.

2.4 PROPOSER CERTIFICATIONS

By submitting a proposal, each proposer certifies under penalty of perjury that:

Its submission is not the result of collusion or any other activity that would tend to directly or indirectly influence the selection process; and

Proposer is able to comply with all requirements of this solicitation at the time of proposal submission;

and

Neither proposer, its employees, nor any affiliated firm providing the requested goods and services has prepared plans, specifications, terms or requirements for this solicitation, or has any other actual or potential conflict of interest; and

Proposer is aware of the provisions of Section 1090 et seq. and Section 87100 et seq. of the California Government Code relating to conflict of interest of public officers and employees and is unaware of any financial or economic interest of any County officer or employee relating to this solicitation.

2.5 WITHDRAWAL OF PROPOSALS

Proposals may be withdrawn, modified, or replaced at any time prior to the Due Date and Time. After that time, whether or not a new solicitation is issued for the same subject matter, withdrawal of a proposal may preclude the

RFP# 8 Rev 01/24/2025 proposer from participating in the procurement as a proposer or subcontractor, except that an original equipment manufacturer may participate indirectly through a reseller.

2.6 NO COMMITMENT

Neither submission of a proposal nor the County’s receipt of proposal materials confers any right to the proposer nor any obligation on the County. This RFP does not commit the County to award a contract, nor will the County defray any costs incurred in preparing proposals or participating in any presentations or negotiations.

2.7 ESTIMATED QUANTITIES

If the solicitation results in an indefinite quantity or a requirements Agreement, the goods and services actually requested by the County may be less than the maximum value of the Agreement and there is no guarantee, either expressed or implied, as to the actual quantity of goods and services that will be authorized under the Agreement.

2.8 PROPOSER SELECTION

At any time in the evaluation process, the County may request clarifications from proposers.

A. Determination of Responsiveness

A responsive proposal conforms to the instructions set forth in this solicitation and any modifications to it.

B. Proposal Evaluation

The County will establish an evaluation committee which will evaluate responsive proposals based on the criteria specified in the solicitation. The committee may then recommend one or more top-ranked proposers for final negotiation of contract terms or may invite one or more proposers for oral presentations and demonstrations, following which those proposers may be allowed to amend their proposals. After evaluating presentations and amended proposals, the committee may recommend one or more top-ranked proposers for final negotiation of contract terms.

C. Determination of Responsibility

The County will make a determination of the responsibility of any proposer under consideration for award, taking into consideration matters such as the proposer’s integrity, compliance with public policy and laws, past performance, fiscal responsibility, trustworthiness, financial and technical resources, capacity, and experience to satisfactorily carry out its responsibilities.

By submitting a proposal, the proposer certifies that, to the best of its knowledge, the proposer maintains financial resources sufficient to satisfy the terms of the proposed project, if awarded.

2.9 CONTRACT AWARD

A. Notice of Intent to Award

Once a decision has been made to award a contract to one or more proposers, the County will post a Notice of Intent to Award, notifying the remaining proposers of their non-selection. The posting may be inclusion of the recommendation to award as an agenda item on the Board of Supervisors schedule.

B. Award Procedure

Contract negotiations are neither an offer nor an implicit guarantee that a contract will be executed.

Award, if made, will be to the responsive, responsible proposer offering the overall best value to the County for the services and goods described in this solicitation, or as applicable, for a specific portion of the services and goods described. Any agreement reached will be memorialized in a formal agreement using the attached Standard Agreement template.

RFP# 9 Rev 01/24/2025

C. Commencement of Performance

After all parties have signed the Agreement, the County will notify the proposer and performance may proceed. Prior to County execution of the Agreement, no County employee may authorize work. Any work performed prior to that time may be uncompensated.

2.10 PROTESTS

Protests that do not comply with the protest procedures outlined below will be rejected.

A. Protest Eligibility, Format, and Address

(1) Protests or objections may be filed regarding the selection process and/or the defective content of the solicitation or any addenda.

(2) In accordance with Sections B and C below, the County will only review protests submitted by an interested party, defined as an actual or prospective proposer to this solicitation whose direct economic interest could be affected by the County’s conduct of the solicitation. Subcontractors do not qualify as interested parties.

(3) Submit protests by e-mail to ISD_Protest_Officer@smcgov.org.

B. Protest Deadlines

Submit protests with any supplemental materials by 5 p.m. PST, as appropriate, on the deadlines set forth below. The date of filing is the date the County receives the protest, unless received after 5 p.m. PST, or on other than a Business Day, in which case the date of filing will be the next Business Day. Failure to file by the relevant deadline constitutes a waiver of any protest on those grounds. Supplemental materials filed after the relevant deadline will be rejected by the County.

If relating to the defective content of the solicitation or to an addendum, file within five Business Days after the date the County releases the solicitation or addendum.

C. Protest Contents

(1) The letter of protest must include all of the following elements:

(a) Detailed grounds for the protest, fully supported with technical data, test results, documentary evidence, names of witnesses, and other pertinent information related to the subject being protested; and

(b) The law, rule, regulation, ordinance, provision or policy upon which the protest is based, with an explanation of the violation.

(2) Protests that simply disagree with decisions of the Evaluation Committee will be rejected.

(3) Except for protests related to defective content filed by the relevant deadline, protests from parties who did not submit a proposal prior to the proposal due date and time will be rejected.

D. Reply to Protest

The County will send a written response to the protestor and to any other party named in the protest.

E. No Stay of Procurement Action during Protest

Nothing in these protest requirements will prevent the County from proceeding with negotiations or awarding a purchase order or contract while a protest is pending.

2.11 PUBLIC RECORDS

A. General

(1) All proposals, protests, and information submitted in response to this solicitation will become the property of the County and will be considered public records. As such, they may be subject to public review.

RFP# 10 Rev 01/24/2025

(2) Any contract arising from this RFP will be a public record.

(3) Submission of any materials in response to this RFP constitutes:

(a) Consent to the County’s release of such materials under the Public Records Act without notice to the person or entity submitting the materials; and

(b) Waiver of all claims against the County and/or its officers, agents, or employees that the County has violated a proposer's right to privacy, disclosed trade secrets, or caused any damage by allowing the proposal or materials to be inspected; and

(c) Agreement to indemnify and hold harmless the County for release of such information under the Public Records Act; and

(d) Acknowledgement that the County will not assert any privileges that may exist on behalf of the person or entity submitting the materials.

RFP# 11 Rev 01/24/2025

SECTION III - QUALIFICATIONS, EXPERIENCE, AND EVALUATION CRITERIA

3.1 MINIMUM QUALIFICATIONS

Proposals will be accepted only from proposers that meet the following required minimum qualifications and requirements at the time of proposal submission. Proposals that fail to meet these criteria are considered non-responsive and are ineligible for consideration.

Minimum Qualifications and Requirements of Proposed Platform(s):

Minimum five (5) years operating in a production environment and supporting government customers with the requirements detailed in this RFP.

Minimum Qualifications and Requirements of Proposer(s):

The proposer has a minimum three (3) years’ experience implementing the proposed solution(s), performing similar services as those detailed in this RFP.

The proposer has completed at minimum three (3) successful implementations for government agencies of similar size and requirements within the last five (5) years.

Provide evidence of the insurance requirements and coverage limits for each of the checked categories as outlined in Section IV-Insurance. Expired certificates will not meet this requirement.

Provide evidence the proposer is registered, active, and in good standing with sam.gov and is not barred from public contracting by any federal or state authority. Incomplete registrations will not meet this requirement.

3.2 ORGANIZATIONAL CAPACITY AND EXPERIENCE

Provide all of the following regarding the prime proposer.

Organizational Capacity:

(1) Titles and names of staff members who will be on the team responsible for the project, as well as the expected availability of the various individuals. If requested, include the resume of a dedicated, full-time project manager.

(2) All applicable licenses and license numbers relevant to the project, the names of the holders of those licenses, and the names of the agencies issuing the licenses.

B. Experience

(1) The number of years providing services similar to those contemplated

(2) The number of years providing services to government entities

3.3 REFERENCES

Provide at least three references from successfully completed projects of similar nature to that described in this solicitation, including the name of the organization for which work was performed, and the name, phone number, and e-mail address of an individual at the organization who was responsible for managing and accepting the work.

Ensure that contact information is current. If the County cannot contact the reference because of incorrect or out-of-date information, the reference will be deemed not to have been provided. References cannot include the County of San Mateo or any employees thereof.

3.4 EVALUATION CRITERIA

Proposals will be evaluated in accordance with the following evaluation criteria:

Phase I: Evaluation of Technical Proposal

40% - Method and approach

RFP# 12 Rev 01/24/2025

Apparent understanding of the scope of services to be provided

Appropriateness of the proposed solution/services

35% - Experience and organizational capacity

Qualifications and experience of both the proposer and key personnel

Experience with other public agencies

Organizational resources and staff, apparent ability to meet any required timelines or other requirements

25% - Price (Minimum)

Phase 2: Evaluation of Demonstration/Interviews of elevated proposals

1. 100% - Presentation of Demonstration Script & Interview

After evaluating proposals and presentations, the committee may recommend one or more top-ranked proposers for final negotiation of contract terms. Award, if made, will be to the responsive, responsible proposer offering the overall best value to the County for the services and goods described in this solicitation, or as applicable, for a specific portion of the services and goods described.

RFP# 13 Rev 01/24/2025

SECTION IV - INSURANCE

Include evidence of insurance in your proposal submission for each of the checked categories.

General Liability (Including operations, products and completed operations, as applicable.)

$1,000,000 - per occurrence for bodily injury, personal injury and property damage. If Commercial General Liability Insurance or other form with a general aggregate limit is used, the general aggregate limit either must apply separately to this project or must be twice the required occurrence limit.

To be carried at all times during the term of the Contract

☐ Automobile Liability

$1,000,000 - per accident for bodily injury and property damage.

To be carried at all times during the term of the Contract

☒ Workers’ Compensation As required by the State of California

To be carried at all times during the term of the Contract

☒ Employers’ Liability

$1,000,000 - each accident, $1,000,000 policy limit bodily injury by disease, $1,000,000 each employee bodily injury by disease.

To be carried at all times during the term of the Contract

Professional Liability (Errors and Omissions)

$1,000,000 - per occurrence.

To be carried at all times during the term of the Contract

☒ Cyber Liability

$5,000,000 per occurrence for Privacy and Network Security, $1,000,000 per occurrence for Technology Errors and Omissions

To be carried at all times during the term of the Contract and for three years thereafter.

4.1 SPECIAL INSURANCE REQUIREMENTS - CYBER LIABILITY

If the work involves services or goods related to computers, networks, systems, storage, or access to County data or to any data that may, alone or in combination with other data, become Confidential Information or Personally Identifiable Information, the following insurance is required.

(1) Privacy and Network Security

During the term of the Contract and for three years thereafter, maintain coverage for liability and remediation arising out of unauthorized use of or access to County data or software within Contractor’s network or control. Provide coverage for liability claims, computer theft, extortion, network breach, service denial, introduction of malicious code, loss of Confidential Information, or any unintentional act, error, or omission made by users of Contractor’s electronic data or systems while providing services to the County. The insurance policy must include coverage for regulatory and PCI fines and penalties, crisis management expenses, and business interruption. No exclusion/restriction for unencrypted portable devices/media may be on the policy.

(2) Technology Errors and Omissions

During the term of the Contract and for three years thereafter, maintain coverage for liabilities arising from errors, omissions, or negligent acts in rendering or failing to render computer or

RFP# 14 Rev 01/24/2025 information technology services and technology products, including at a minimum, coverage for systems analysis, design, development, integration, modification, maintenance, repair, management, or outsourcing any of the foregoing.

RFP# 15 Rev 01/24/2025

SECTION V - STANDARD TERMS AND CONDITIONS

Note to proposers: These are attached for information only. Do not complete this form. The final agreement between the County and any successful proposer will be based on this template.

See Attachment E- County Standard Contract Template

Please note that the redline requests by proposer are for review by County only. Proposers should not rely on the County’s agreement to modified terms.

RFP# 16 Rev 01/24/2025

SECTION VI - SCOPE OF WORK AND SPECIAL PROVISIONS

6.1 SUMMARY

The County of San Mateo seeks proposals from qualified proposers to deliver the following development, support, and project management services for the County’s Drupal website and content management system

(CMS):

Maintenance of the Drupal platform and existing features and functionality. At least 80 hours per month of Drupal developer resource support for routine maintenance, enhancements, bug fixes and projects.

o Maintain platform security and stability through regular Drupal core and contributed module updates following Drupal Security Team best practices (https://www.drupal.org/drupal-security-team). Chosen vendor must ensure that Drupal Core and contributed modules are kept up to date. Routine updates must be tested and updated at least monthly. Security updates/patches must be tested and deployed to production within 1 week for vulnerabilities rated low or medium severity and within 48 hours if the vulnerability severity is rated High or Critical.

o 24/7 support for emergencies, critical problems and urgent support requests o Maintain existing custom features and integrations o Address reported bugs/issues and document resolution. When issues or bugs are identified and reported, chosen vendor will be responsible for investigating the root cause, identifying a solution, and deploying the approved solution.

o Maintain and provide access to runbooks and documentation o Maintain WCAG accessibility compliance o Maintain system and application performance and responsiveness:

Front-end: Ensure consistent performance for website visitors. As measured by Google Core Web Vitals, Largest Contentful Paint (LCP) for desktop pages should not exceed 3 seconds.

Administrative pages and functions: Navigating the administrative menus, interface and content editing workflows should be fluid and responsive. Admin pages, content lists and node editing pages should load and render in less than 3 seconds.

Support continued enhancement of website usability and functionality o Consult on design, development and delivery of enhancements to platform features and integrations. Chosen vendor must be able to gather business requirements, develop technical requirements and provide subject matter expertise and guidance when evaluating and proposing solutions.

o The following projects are anticipated during the period of the awarded contract term and will be included in the scope of work of the awarded contract:

Upgrade CKEditor 4 to CKEditor 5 – The County currently has an extended support license for CKEditor 4. We will need to upgrade to CKEditor 5 or similar WYSIWYG editor replacement.

Drupal 11 upgrade – As of February 2025, the smcgov.org Drupal platform is on Drupal version 10.3.9. We will need to upgrade to a stable and supported version of Drupal 11 before Drupal 10 reaches end of life.

For future minor and major Drupal version upgrades, the chosen vendor is expected to provide the County with a detailed schedule and plan outlining the rollout process, including pre-assessment and testing.

Implement multi-language solution – The County is currently using the free Google Translate solution. The County anticipates replacing the free Google Translate module with a more flexible and feature-rich solution for serving content in multiple languages. The chosen vendor will support the implementation and integration with the Drupal CMS and website front-end.

Domain name transition from smcgov.org to sanmateocounty.gov. Assembly Bill 1637 (AB 1637), mandates that California cities and counties transition their public

RFP# 17 Rev 01/24/2025 internet websites to either a ".gov" or ".ca.gov" domain. The chosen vendor will support the County in transitioning the primary website domain and implementing URL redirects.

Onboard and migrate website to a new hosting provider. The hosting provider will be selected via a separate solicitation (RFP ISD-20251904). We will require project management and technical implementation services related to the following activities:

o Migration of the County’s Drupal platform into a new hosting provider.

o Retain all existing website functionality o CDN integration o Cutover and go-live support o Liaise with hosting provider as necessary to ensure ongoing stability, reliability and maintenance of the Drupal platform, hosting infrastructure and all integrations.

The chosen proposer must have a proven track record of accomplishment in designing, building, deploying, maintaining and performing major version upgrades of large-scale Drupal websites. The County is a complex organization with many departments and business units. It is essential that the proposer have experience working with similarly large organizations.

Proposals will be fully responsive to the documentation, descriptions, and specifications contained in this RFP. The successful proposer will be singularly responsible for the proposed solution and will not use subcontractors to perform the services.

6.2 REQUIREMENTS AND SCOPE OF WORK

Considering the objectives outlined above, describe how your company will approach development work, system administration and incident response management, including:

1.0 Proposal Requirement

1.1 Your company’s methodology and experience onboarding new customers with existing codebases. Please include a sample project plan and approximate timeline for onboarding the County’s Drupal website including migration to a new hosting provider.

1.2 The methodology your company uses to assess the existing website’s design, architecture, performance and codebase and how opportunities for improvements and optimizations to the existing platform, design, or architecture are identified and presented to customers.

1.3 How your company typically works with client staff to prioritize new development objectives, including scope definition, requirements gathering and resource planning.

1.4 How your company typically shares roles and responsibilities with client staff.

1.5 Hourly rates for your company’s service offerings, e.g. Drupal development, project management, etc.

1.6 Describe your company’s methodologies, tools, and approaches for project management, software development and maintenance, change control procedures, and communication methods. Please include system(s) your organization uses to track tickets, incidents, requests and project deliverables. The County will require access to these systems for visibility into the status of work requests, problem tickets and projects.

1.7 Provide a sample design, development and implementation/testing protocol your company

RFP# 18 Rev 01/24/2025 uses and examples of successful implementations of relevant Drupal design and development projects.

1.8 Your company’s incident response and escalation procedures including service levels and severity definitions. Please include detailed definitions, processes and policies as it relates to your proposed SLA, and what recourse will be available to the County if an SLA is not met.

1.9 Describe in detail your company’s service offerings as it relates to Drupal and the objectives of this RFP, including costs and price structure associated with each level of support or service offering.

1.10 Your company’s experience with website design and development in accordance with common web accessibility standards, including federal Section 508 accessibility guidelines and WCAG.

1.11 The capabilities, qualifications and experience of your company and the team that will be assigned to the County as it relates to supporting and maintaining a complex Drupal 10 implementation. Please outline in detail their relevant qualifications, certifications, experience and expertise.

1.12 Your company’s experience working with complex local government organizations of similar size to the County.

1.13 Your company’s approach to maintaining system security, integrity and how you will comply with County IT security standards.

1.14 Drupal hosting providers with which your company has experience, e.g. Acquia, Pantheon, Amazee.io, etc.

Describe your company’s competence, skillset and experience as well as the practices your organization has adopted with regards to building, maintaining and supporting large-scale Drupal implementations. Provide examples you believe demonstrate your company’s ability to deliver on the objectives and services outlined in this RFP and are pertinent to the technologies and system configuration details documented in the table below (2.0 Support team Competency, Skillset and Experience) and section COUNTY OF SAN MATEO’S DRUPAL

SYSTEM CONFIGURATION.

2.0 Support team Competency, Skillset and Experience

2.1 Drupal development experience. Include certifications held by members of your team (e.g.

Drupal Certified Partner, Acquia Triple Certified Drupal Expert), contributions to Drupal core or contributed modules, contribution to the Drupal community, such as code (e.g., core, modules, patches) and non-code contributions (e.g., organizing community events, providing documentation).

2.2 Project management experience. Include certifications held by members of your team (e.g.

Project Management Professional (PMP), Certified ScrumMaster (CSM), etc.) and descriptions of successful implementation projects.

2.3 Front-end development experience. Describe your development and design team’s experience with front-end web development frameworks, including but not limited to React, Storybook, Web Components, Typescript, and Tailwind CSS.

2.4 User Experience (UX), including conducting user research and creating user journeys, site maps, and wireframes.

RFP# 19 Rev 01/24/2025

2.5 Custom search engine implementations, including but not limited to Apache SOLR, Swiftype, Elasticsearch, etc.

2.6 Drupal Migrate API

2.7 Custom Drupal module development

2.8 Third-party integrations using Drupal 10 APIs

2.9 Single Sign On (SSO) via SAML 2.0

COUNTY OF SAN MATEO’S DRUPAL SYSTEM CONFIGURATION

The system configuration details below are accurate as of February 2025, subject to change.

A. Contributed Modules

Access unpublished 8.x-1.6

Address 8.x-1.12

Address Map (& Directions) Link 8.x-1.4

Admin Toolbar 3.5.1

Allow a content type only once (Only One) 2.0.0

Allowed Formats 2.0.0

Automated Logout 8.x-1.5

Better Exposed Filters 6.0.6

Block In Page Not Found 8.x-4.3

Block permissions 8.x-1.3

CAPTCHA 2.0.6

Chaos Tool Suite (ctools) 4.1.0

Chosen 4.0.3

CKEditor 4 LTS - WYSIWYG HTML editor 1.0.3

CKEditor Accessibility Checker 2.0.0-alpha1

CKEditor Balloon Panel 2.0.0-alpha1

CKEditor CodeMirror 8.x-2.5-beta1

CKEditor CSV Table 1.0.0-alpha4

CKEditor custom config 8.x-3.4

CKEditor4-Height (obsolete) 8.x-1.9

Components! 3.1.0

Conditional Fields 4.0.0-alpha5

Config Filter 8.x-1.13

Config Ignore 8.x-2.4

Configuration Split 8.x-1.9

Crop API 8.x-2.4

CSV Serialization 4.0.1

Date Augmenter API 1.1.1

Date Content Augmenter 1.0.0-alpha8

Deployment identifier status 1.0.2

Diff 8.x-1.8

Dynamic Entity Reference 3.2.0

Editor Advanced link 2.2.6

Editor Button Link 2.0.0

Editoria11y Accessibility Checker 2.1.21

RFP# 20 Rev 01/24/2025

Embed 8.x-1.9

Encrypt 8.x-3.2

Entity Browser 8.x-2.12

Entity Embed 8.x-1.6

Entity Print 8.x-2.15

Entity Reference Override 2.0.0-beta2

Entity Reference Revisions 8.x-1.12

Environment Indicator 4.0.19

EVA: Entity Views Attachment 3.1.0

External Authentication 2.0.6

Facet granular date 8.x-1.0

Facets 2.0.9

Facets Block 2.0.2

Facets Reset Button 1.0.3

Fastly 4.0.3

Field Group 8.x-3.6

Field Permissions 8.x-1.4

File metadata manager 3.1.0

Filtered Text Wrapper 1.1.0

Force Password Change 2.0.1

Geofield 8.x-1.62

Gin Login 2.1.3

Gin Toolbar 8.x-1.0-rc6

Google Tag 2.0.8

Google Translator 2.3.0

Honeypot 2.1.4

Iframe 8.x-2.24

Image Style Generate 1.2.0

Image Style Quality 8.x-1.7

Image Widget Crop 8.x-2.4

ImageMagick 8.x-3.7

Inline Entity Form 2.0.0-rc10 jQuery UI 8.x-1.7 jQuery UI Datepicker 2.1.1 jQuery UI Slider 2.1.0 jQuery UI TouchPunch 1.1.1

JSON Field 8.x-1.4

Key 8.x-1.19

Lagoon Logs 2.1.1

Link Allowed Hosts 1.0.0

Linkit 6.1.6

Media Entity Download 8.x-2.4

Media entity inline frame (media_iframe) 1.0.0

Media Library Theme Reset 8.x-1.5

Media Revisions UI 2.1.0

Menu Item Extras 3.1.0

Menu Link Attributes 8.x-1.5

Metatag 2.1.0

Micro-content 8.x-1.9

Migrate Files (extended) 2.1.2

RFP# 21 Rev 01/24/2025

Migrate Plus 6.0.4

Migrate QA 8.x-1.0-alpha9

Migrate Source CSV 8.x-3.6

Migrate Tools 6.0.5

Moderated Content Bulk Publish 2.0.32 oEmbed Providers 2.2.1

Office Hours 8.x-1.19

Override Node Options 8.x-2.8

Papaparse 1.0.0

Paragraphs 8.x-1.18

Password Policy 4.0.3

Path redirect import 2.0.9

Pathauto 8.x-1.13

Preprocess 2.2.0

Prevent page deletion 2.0.4

Purge 8.x-3.6

Quick Node Clone 8.x-1.19

Rabbit Hole 2.0.0-alpha5

Real AES 8.x-2.6

Rebuild Cache Access 8.x-1.12 reCAPTCHA 8.x-3.4

Redirect 8.x-1.10

Redis 8.x-1.8

Responsive Tables Filter 8.x-1.19

Role Delegation 8.x-1.3

Route Condition 2.0.3

Scheduled Transitions 2.5.0

Schema.org Metatag 3.0.3

Search API 8.x-1.35

Search API Field Map 8.x-3.3

Search API Solr 4.3.5

Search Overrides 2.1.0

Security Kit 2.0.3

Selective Better Exposed Filters 3.0.3

Session Timeout Notification 2.0.0

Shield 8.x-1.8

Simple XML sitemap 4.2.1 simpleSAMLphp Authentication 4.0.0

Site Settings and Labels 8.x-1.20

Siteimprove 2.0.2

Sitewide Alert 2.2.1

Smart Date 4.2.1

Sophron 2.1.0

Stage File Proxy 2.1.5

Summary Options 2.1.2

Textarea widget for text fields 8.x-1.3

Token 8.x-1.15

Twig Tweak 3.4.0

Upgrade Status 4.3.6

Views Bulk Edit 8.x-2.9

RFP# 22 Rev 01/24/2025

Views Bulk Operations (VBO) 4.3.2

Views data export 8.x-1.4

Views entity embed 2.0.2

Webform 6.2.7

Webform Encrypt 2.0.0-alpha1

WebP 8.x-1.0-rc2

B. Integrations

Okta SSO using SAML 2.0

Google Translate

Google Analytics

Google Tag Manager

SiteImprove

Granicus Communications Cloud (formerly GovDelivery) o Subscribe to newsletters and mailing lists

Granicus Legistar – Query API to retrieve meeting details (meeting name, date/time, video link, meeting agenda link, meeting details link) into Drupal Meeting content items o https://sanmateocounty.legistar.com/Calendar.aspx o API home: https://webapi.legistar.com/ o All methods: https://webapi.legistar.com/Help o Examples: https://webapi.legistar.com/Home/Examples

ArcGIS o Embed maps and apps into content items o ArcGIS Online for displaying location maps

YouTube and Vimeo video embeds

Twitter embeds

Flexible page editor - https://react-page.github.io/

Outline design system - https://github.com/phase2/outline o Web Components - https://www.webcomponents.org/introduction o Lit 2.0 - https://lit.dev o Storybook - https://storybook.js.org/ o Tailwind CSS - https://tailwindcss.com/ o TypeScript - https://www.typescriptlang.org/

C. Content Types

Department Landing Page

Front Page

Profile

News Article

Informational page

Flexible page

Location

Event

Meeting

Park

Trail

Facility

RFP# 23 Rev 01/24/2025

6.3 FINGERPRINTING AND BACKGROUND CHECKS

In some instances, may be required if the proposed contract requires access to certain sensitive groups or proprietary materials. Fingerprinting and background checks are administered at the discretion of the County based on project and/or contract requirements. The vendor must provide the County with confirmation when the fingerprinting and background checks have cleared.

6.4 COOPERATIVE AGREEMENT

This competitive solicitation is being conducted as a Cooperative Procurement. The services, terms and conditions of any agreement resulting from this solicitation may be used by other organizations as a Cooperative Agreement.

This provision in no way commits any affiliate to procure services from any awarded contractor, nor does it guarantee that any additional orders will result. At their discretion, and subject to their own procurement policies, interested organizations may make use of this competitive procurement and contract directly from the awarded contractor.