MHCC 27-010 Website Maintenance and Support

The Maryland Higher Education Commission (MHCC) is soliciting proposals for website maintenance and support services covering AWS environment management, application support, and infrastructure improvements under MHCC 27-010, with proposals due October 28, 2026.

The contractor will maintain the Commission's AWS infrastructure, support Drupal and .NET applications, manage databases, and provide 24/7/365 technical support with defined Service Level Agreements requiring emergency response within 15 minutes, high-priority response within 30 minutes, and resolution times ranging from 2 hours (emergency) to 72 hours (low-priority). Service availability must be maintained at 99.5% uptime with SLA credits up to 25% of monthly charges for non-compliance. The contractor must conduct disaster recovery testing at least twice annually and maintain backup strategies with 24-hour recovery time objectives and 1-hour recovery point objectives.

Key deliverables include an Integrated Project Schedule, quarterly status reports, technical documentation, security planning, and a SOC 2 Type 2 audit report. Infrastructure management encompasses AWS organization structure, VPC management, security group configuration, and multi-availability zone redundancy across production, staging, and QA environments.

The contractor must comply with State of Maryland IT security policies and federal standards including NIST, FIPS 140-3, and CIS guidelines. Data encryption both in transit and at rest, vulnerability testing, and strong authentication are mandatory. All personnel accessing State systems or data must undergo criminal background checks with restrictions on individuals convicted of felonies or crimes involving fraud or telecommunications. Geographic data residency is limited to the continental United States. WCAG 2.1 Level A and AA accessibility compliance is mandatory. The contractor assumes responsibility for all hardware, software, and network infrastructure costs.

The contract term is two years with pricing structured as firm fixed price for six service categories (Infrastructure Management and Operations, Application and Database Support, Security and Compliance, Backup/Disaster Recovery/Data Retention, Incident Management and Technical Support, and Documentation and Knowledge Transfer) and Time & Materials for ad-hoc work orders across four labor categories (Solutions Architect Principal, Systems Engineer Senior, Systems Administrator Senior, and Information Security Analyst Senior) with estimated 25 hours annually per category.