Response to Offeror Questions document.docx

Vendor Questions for RFP# SDSU04272026 – SDSU Website Support and Maintenance Service May 4, 2026

Vendor A:

1. How are you currently handling your Drupal support?

0. SDSU currently utilizes a third-party agency to manage Drupal maintenance, security updates, bug fixes and feature development, in coordination with the internal Web Services team within University Marketing and Communications.

1. Is there an incumbent agency submitting a response?

1. While SDSU does have an incumbent agency providing these services, the RFP process is open to all. The university is seeking the best partner for the new contract term starting July 1, 2026.

1. Have you worked with digital agencies that specialize in Drupal before?

2. Yes. The sdstate.edu platform is a complex Drupal environment and SDSU has a history of collaborating with specialized agencies for its development, hosting management (Pantheon) and support.

Vendor B:

1. Accessibility Compliance – Beyond WCAG 2.2 Level AA, does SDSU anticipate adopting higher standards (e.g., WCAG 2.2 AAA) during the contract term?

a. SDSU currently requires WCAG 2.2 Level AA and Section 508 compliance. While there is no immediate mandate for Level AAA, the university expects the vendor to stay abreast of the required standards as they continually evolve and change.

2. Support Scope – For the $5,000 monthly support services, can SDSU clarify the expected balance between maintenance tasks and professional service hours, and whether unused hours may roll over?

a. On average, we usually see about 40% maintenance and 60% professional. And yes the hours may roll over month to month and be utilized where best needed.

3. Project Work – Should vendors propose standard hourly/project rates for out‑of‑scope work, or does SDSU prefer fixed‑rate estimates for each defined project?

a. For specific, large-scale projects, SDSU will request a fixed-rate quote based on hourly rates. Suggestion would be to propose an hourly/project rate for out-of-scope work.

4. Tools & Platforms – The RFP references Tugboat, GitHub, and Slack. Should vendors assume SDSU already license these tools, or must they be included in the vendor’s pricing?

a. SDSU has the contract for Pantheon but does not for tools like Slack, GitHub, Tugboat, etc. If we need to utilize these to do business with you and help to manage tickets and other support tasks, they need to be listed if there is an additional cost or if they will be included.

b. Our team has three main individuals that need access to the ticketing systems.

c. SDSU Web Services personnel must retain full write access to all repositories associated with sdstate.edu and related properties within the SDSU GitHub organization. The awarded vendor is expected to manage the CI/CD pipeline (utilizing tools like Tugboat, GitHub and Pantheon) in a way that facilitates a co-development environment. This includes establishing a branching strategy that allows SDSU staff to commit code, manage configuration exports, or perform emergency hotfixes alongside vendor-led development without deployment bottlenecks.

5. Budget Framework – Beyond the stated $5,000 monthly support fee, does SDSU have an anticipated annual budget range for additional project work, or should vendors propose flexible estimates based on scope?

a. There is not an annual budget range. It is as projects are brought to our attention and funds are available. See 3.a. on how to list this. We would always ask for a scope and a quote before moving forward on projects.

6. Training & Knowledge Transfer – Beyond documentation, does SDSU expect formal training sessions for its web services team, or will knowledge transfer be handled informally through collaboration?

a. Knowledge transfer will be handled informally through collaboration.

Vendor C:

1. Approximate number of hours per week and/or month that is normally spent to take care of your website and maintenance so we can get an estimate of the amount of time per month?

1. The current fixed-fee support model ($5,000/month) is designed to cover the necessary hours for “business as usual” (security, updates, maintenance and troubleshooting). About 25-30 hours a month.

Vendor D:

We request clarification on the following technical and operational items:

I. Infrastructure & CMS Architecture

· Platform Specifications: What version of Drupal is currently serving sdstate.edu, and can a comprehensive module inventory (including custom modules) be provided to assess the complexity of required core and security updates?

· Drupal 10.4.34 (recently updated)

· Modules:

· Contrib:

· address, admin_toolbar, allowed_formats, anchor_link, better_exposed_filters, bigmenu, block_field, block_visibility_groups, cas, ckeditor_accordion, ckeditor_bs_grid, ckeditor_codemirror, ckeditor_html_embed, ckeditor5_findandreplace, ckeditor5_plugin_pack, ckeditor5_premium_features, conditional_fields, config_ignore, config_split, content_moderation_notifications, cshs, csv_serialization, ctools, custom_breadcrumbs, date_filter, date_popup, devel, diff, dropzonejs, editor_advanced_link, embed, entity_browser, entity_embed, entity_legal, entity_reference_exposed_filters, entity_reference_revisions, entity_usage, entityreference_filter, environment_indicator, eu_cookie_compliance, externalauth, extlink, facets, facets_date_range, field_defaults, field_formatter_filter, field_group, field_permissions, file_browser, forward, geolocation, hacked, image_url_formatter, inline_entity_form, jquery_ui, jquery_ui_draggable, jquery_ui_droppable, js_cookie, layout_paragraphs, link_field_autocomplete_filter, mailsystem, masquerade, media_entity_file_replace, media_field_formatters, memcache, menu_admin_per_menu, menu_link, menu_link_attributes, menu_link_weight, metatag, migrate_drupal_d8, migrate_plus, migrate_tools, office_hours, openid_connect, optional_end_date, page_manager, panels, pantheon_advanced_page_cache, paragraphs, pathauto, pfm, photoswipe, purge, quick_node_clone, rabbit_hole, redirect, redis, rip, robotstxt, scheduler, search_api, search_api_autocomplete, search_api_glossary, search_api_pantheon, search_api_solr, seckit, security_review, sharethis, shield, simple_sitemap, site_audit, siteimprove, smart_trim, stage_file_proxy, subpathauto, svg_image, token, twig_tweak, ultimate_cron, unused_modules, userprotect, video_embed_field, view_unpublished, views_autocomplete_filters, views_bulk_operations, views_data_export, viewsreference, webform, workbench, workbench_access, workbench_tabs

· Custom

· sdsu_workbench_access, sdsu_admin, sdsu_autocomplete, sdsu_best_bets_filter, sdsu_deans_list, sdsu_editor_menu, sdsu_ems, sdsu_entity_embed, sdsu_formatters, sdsu_graduate_list, sdsu_layouts, sdsu_menu_block, sdsu_migrate, sdsu_panels_label, sdsu_pathauto, sdsu_profiles, sdsu_search, sdsu_sharethis, sdsu_super_landing_page, sdsu_tokens, sdsu_user_toolbar, sdsu_view_entity_ref_select

· Pantheon Workflow: Does the current deployment pipeline utilize Pantheon’s Multidev environments for feature branching, or is the workflow strictly limited to the standard Dev-Test-Live pipeline?

· SDSU utilizes standard Dev-Test-Live

· Delineation of Responsibilities: Regarding the shared responsibility model between the vendor and the hosting provider, what is SDSU’s current Pantheon support tier (e.g., Gold or Platinum), and what is the preferred protocol for escalating infrastructure-level incidents?

· SDSU maintains a Platinum enterprise-level workspace/support tier. Escalation protocols will be finalized during onboarding.

· Automated Quality Assurance: Are there existing automated testing suites (e.g., Behat, Cypress, or Tugboat visual regression tools) currently integrated into the CI/CD pipeline, or is the vendor expected to architect these testing frameworks from the ground up?

· Vendors are encouraged to propose enhancements to automated testing suites.

II. Service Levels & Operational Continuity

· SLA Definitions: What are the specific target Service Level Agreements (SLAs) for uptime, initial response times for varying ticket priorities, and mean time to resolution (MTTR) for critical security patches?

· Standard support is during CDT business hours. Ticket priorities would be discussed between parties at what priority levels things are and what is expected or critical fixes and what other levels of priorities mean.

· Monitoring & Support Window: Does "continuous monitoring" require a 24/7/365 human-on-call rotation for "urgent needs," or is after-hours intervention limited to automated alerting with manual response during standard CDT business hours?

· "Continuous monitoring" implies 24/7 automated alerting for site-down emergencies, with a human response required for critical outages. Standard support is during CDT business hours.

· Disaster Recovery: Beyond standard backups, does SDSU have defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) that the vendor must validate through the recovery process?

· SDSU follows standard Disaster Recovery protocols facilitated by Pantheon’s automated backup systems.

III. Accessibility & Compliance Standards

· Backlog Management: For the mandate to remediate content to WCAG 2.2 Level AA standards, how will SDSU prioritize accessibility debt remediation against new feature development within the $5,000 monthly service cap?

· Accessibility remediation is a priority. If debt exceeds the monthly retainer capacity, it will be handled as separate "Project Work" billed at the hourly rate.

· Validation Tooling: Are there specific assistive technologies (e.g., JAWS, NVDA, or VoiceOver) required for manual validation beyond the automated Site improve reporting?

· No

· Document Remediation: Does the vendor’s scope include the remediation of non-HTML digital assets (e.g., legacy PDFs and Word documents), or is this managed by University Marketing and Communications?

· The vendor is primarily responsible for the HTML/CMS environment. Remediation of PDFs/Word docs is managed by University Marketing and Communications.

IV. Contract Governance & Pricing

· Resource Utilization: If SDSU-submitted tickets do not exhaust the professional service hours available within the $5,000 monthly budget, do these hours roll over to subsequent months, or is the contract structured as a fixed monthly retainer?

· Yes the hours may roll over month to month and be utilized where best needed.

· Engagement Model: Does SDSU require a named, dedicated Lead Developer during business hours, or is it acceptable to provide a consistent pool of hours from a specialized project team?

· SDSU prefers a consistent point of contact (Account/Project Manager) and a consistent lead developer to ensure institutional knowledge.

· Licensing & Tooling: Regarding the inclusion of Tugboat, GitHub, and Slack in the vendor's pricing, does SDSU have existing enterprise seats the vendor will join, or is the vendor expected to provision and fund new licenses for SDSU staff?

· SDSU has the contract for Pantheon but does not for tools like Slack, GitHub, Tugboat, etc. If we need to utilize these to do business with you and help to manage tickets and other support tasks, they need to be listed if there is an additional cost or if they will be included.

· Our team has three main individuals that need access to the ticketing systems.

· SDSU Web Services personnel must retain full write access to all repositories associated with sdstate.edu and related properties within the SDSU GitHub organization. The awarded vendor is expected to manage the CI/CD pipeline (utilizing tools like Tugboat, GitHub and Pantheon) in a way that facilitates a co-development environment. This includes establishing a branching strategy that allows SDSU staff to commit code, manage configuration exports, or perform emergency hotfixes alongside vendor-led development without deployment bottlenecks.

V. Transition & Integrations

· Knowledge Transfer: Are there a formal onboarding period and existing technical documentation (architecture diagrams, API documentation) available to facilitate the transition from the current incumbent?

· Unknown

· External Integrations: Beyond the Drupal ecosystem, what specific third-party integrations (e.g., CRM, authentication providers, or payment gateways) are currently active and require ongoing maintenance?

· Siteimprove (module), Banner Profiles (custom module), Slate (iframes), Webhook emails (custom module), SDSU Formsite (iframes), Payment gateways all handled by SDSU OIT.

Vendor E:

1. The RFP mentions that SDSU is using Drupal and the Pantheon web hosting platform, and the solicitation for proposals is for a Support and Project Work Contract. Is SDSU - University Marketing and Communications interested in leaving their current provider Drupal? If so, would they prefer an open-source CMS? Or a Commercial CMS?

a. We are only interested in Drupal and Pantheon at this time. We just redesigned the site in January 2025 and just switched to Pantheon September 2025.