Hosting, security and migration requirements

All production infrastructure for the platform must be provisioned inside a cloud account owned and contracted by [Organization] (AWS, Azure, Google Cloud or DigitalOcean). The supplier may be granted delegated administrative access, but [Organization] must retain owner-level access, the billing relationship, and the ability to continue operating the environment without the supplier.

Evidence · Ask each vendor to name the account owner and show, in a demonstration, where the root credentials and billing console sit.

The application must run on a standard, documented runtime stack (for example PHP-FPM behind Nginx or Apache, MySQL or MariaDB, Redis or Memcached) that can be reproduced outside the supplier's tooling. Custom runtime agents are permitted only where the supplier documents a supported removal procedure.

Evidence · Ask for the runtime manifest and a written removal procedure. If removal requires the supplier, the dependency is real.

The supplier must document how a new environment (development, staging or production) is created, and must demonstrate that [Organization] staff can create one after a half-day handover session.

Evidence · Make the handover session a contractual milestone, not a training slide in the final week.

Infrastructure costs must be billed to [Organization] directly by the cloud provider. The supplier must separately identify management, support and professional-services fees. Pass-through infrastructure charges, if any, must be shown at cost with the underlying invoice available for audit.

Evidence · Ask for a specimen invoice. If infrastructure and management are bundled into one per-site figure, you cannot audit either.

On termination or expiry, the supplier must provide, within [30] days and at no additional charge, a complete export of application code, configuration, content, media and database dumps in standard formats, infrastructure-as-code or documented runbooks describing the live environment, and [20] hours of transition assistance to the successor provider.

Evidence · Confirm the export formats in writing, and whether any egress or extraction fee applies. 'No export fee' is a specific claim worth testing.

The supplier must provide at least three persistent environments (development, staging, production) that share the same runtime configuration, with a documented list of permitted differences. Additional ephemeral environments per feature branch must be available on request.

Evidence · Ask for the list of permitted differences. An empty list is a red flag; an honest list is a good sign.

Deployments must run from version control through an automated pipeline that includes a Composer build, configuration import, database update and cache rebuild. Any deployment must be reversible to the previous release within [15] minutes without data loss.

Evidence · Ask for a live rollback in the demonstration. Rollback claims are the most commonly overstated in Drupal proposals.

All site configuration must be exported to code and deployed through the pipeline using a documented strategy (for example configuration split) covering environment-specific settings. Direct configuration changes in production are not permitted.

Evidence · Ask what happens when an editor changes a view in production. The answer should be 'it is blocked' or 'it is overwritten at next deploy'.

The supplier must support refreshing a non-production environment from production data, with an automated anonymization step for personal data, completed within [4] hours of request.

Evidence · Ask which fields are anonymized. 'All of them' is rarely true; ask for the mapping.

Production changes outside the pipeline must follow a documented change process with a named approver at [Organization], a maintenance window, a tested rollback path and a post-change record.

Evidence · Ask how many emergency production changes occurred in the last 12 months and why.

The platform must run a currently supported PHP major version (8.3 or later at the time of writing) with OPcache enabled, and must support Drupal 11 for the full contract term. The supplier must state its deprecation policy for PHP minor versions.

Evidence · Ask which PHP version is running in production today, and when it last changed.

A persistent object cache (Redis or Memcached) must be available to the application and enabled in all environments, with cache hit rate reported monthly.

Evidence · Ask for the current cache hit rate of a comparable site. Numbers below 85 per cent on a content site suggest misconfiguration.

The platform must provide page-level caching at the edge (CDN or reverse proxy) with cache-tag based invalidation on content change, so that published edits appear within [60] seconds without a full cache purge.

Evidence · Ask them to publish a change in the demonstration and time how long it takes to appear to an anonymous visitor.

The supplier must meet the following production budgets at the 75th percentile for the agreed reference pages: Largest Contentful Paint under 2.5 seconds, Interaction to Next Paint under 200 milliseconds, Cumulative Layout Shift under 0.1, and server time to first byte under 800 milliseconds, measured with a named, agreed tool.

Evidence · Name the tool in the RFP. Hourly field-data and lab-data measurements disagree, and vendors will pick the flattering one.

The platform must scale horizontally without manual intervention to handle [3x] baseline traffic, and the supplier must provide evidence of a load test at that level on a comparable site.

Evidence · Ask when the last load test was run and what failed. A vendor who has never tested will improvise the answer.

The supplier must take automated backups of the database and uploaded files at least every [24] hours, retain daily backups for [35] days and monthly backups for [12] months, store them encrypted in a separate availability zone or region from production, and make them available to [Organization] on request.

Evidence · Ask for a copy of a backup index. If backups are described as 'managed by the provider' with no buyer access, you cannot test them.

The platform must meet a recovery point objective of [15] minutes and a recovery time objective of [4] hours for production. The supplier must record and report actual recovery times for any real incident.

Evidence · Ask for the last three incident post-mortems with actual recovery times.

The supplier must perform and document a full restore into a clean environment at least quarterly, and provide the most recent report, including the data point restored and the elapsed time, on request.

Evidence · This one clause removes most of the value of a vague DR promise, because it requires a document that either exists or does not.

Production must run across at least two availability zones with automated failover, and the supplier must state the measured availability for the last [12] months against the contracted target of [99.9] per cent monthly.

Evidence · Ask for the availability report, not the architecture diagram. Diagrams show intention; reports show performance.

Critical Drupal core security advisories must be applied to production within [24] hours of release and non-critical advisories within [7] days. The supplier must notify [Organization] of each applied advisory and report the current patch status of core and contributed modules monthly.

Evidence · Ask what happened at the last critical Drupal advisory: when it was applied, by whom, and what the notification looked like.

Production must sit behind a web application firewall and DDoS mitigation service with OWASP core-rule coverage, rate limiting on authentication endpoints, bot mitigation, and administrative access restricted to named networks or a zero-trust proxy.

Evidence · Ask for a screenshot of the WAF console and the current rule set version. Ask whether /user/login is rate limited.

All traffic must use TLS 1.2 or later with HSTS enabled. Data at rest, including backups and media, must be encrypted. [Organization] must be able to specify the geographic region in which data is stored, and the supplier must not replicate data outside that region without written approval.

Evidence · Ask which region hosts production and which regions hold backups. These are frequently different and undisclosed.

Supplier access to production must use named individual accounts with multi-factor authentication and least-privilege roles. Shared credentials are prohibited. Privileged actions must be logged with a retained audit trail of at least [12] months, available to [Organization] on request.

Evidence · Ask how many shared accounts exist and who holds them. The honest answer is usually 'a few, for emergencies'.

The supplier must provide, within five business days of request, its current SOC 2 Type II report or ISO 27001 certificate with statement of applicability, the scope of coverage including whether hosting infrastructure is in scope, a summary of the most recent external penetration test with remediation status, and a completed security questionnaire.

Evidence · Read the scope paragraph of the SOC 2 report. Many cover the application but not the underlying infrastructure you are relying on.

The supplier must notify [Organization] of any confirmed or suspected security incident affecting its data within [24] hours of detection, provide a written timeline within [72] hours, and participate in a joint post-incident review within [10] business days.

Evidence · Ask for the incident response plan and the name of the role that makes the notification call.

The supplier must run authenticated vulnerability scanning against production at least monthly, maintain a remediation target of [14] days for high-severity findings and [30] days for medium, and provide scan summaries on request.

Evidence · Ask for the last three scan summaries, including open findings and their age.

The platform must provide application performance monitoring with transaction traces, error tracking with stack traces, uptime checks at [60]-second intervals from at least two regions, and alerting to [Organization]'s named contacts. [Organization] must have read access to the monitoring dashboards.

Evidence · Ask to see a live dashboard for a comparable site during the demonstration.

Application, web server and access logs must be aggregated in a searchable system with at least [90] days of retention and be exportable to [Organization] on request.

Evidence · Ask whether the buyer can run their own query, or whether every log request becomes a support ticket.

The supplier must respond to Severity 1 incidents (production unavailable or data loss) within [30] minutes, 24 hours a day, and to Severity 2 incidents (major function impaired) within [2] business hours, with resolution targets of [4] hours and [1] business day respectively.

Evidence · Ask when the on-call rotation last ran a live test, and who is on call tonight.

The supplier must operate a public or buyer-accessible status page updated within [30] minutes of a declared incident, and provide a monthly service report covering availability, incidents, patching, backup verification and support volumes.

Evidence · Ask for last month's service report. Its existence tells you more than any promise in the proposal.

The supplier must produce a content inventory listing every content type, entity count, media asset and user role to be migrated, and a URL inventory of all existing addresses, before migration work begins.

Evidence · Ask how they would handle a URL that no longer has a corresponding node. The answer reveals whether they have done this before.

A one-to-one redirect map must be delivered and tested for the top [1,000] existing URLs by traffic, plus all URLs with inbound links from [Organization]'s top [50] referrers, with a 301 to the closest equivalent page. No production URL may return a 404 after cutover.

Evidence · Ask for the redirect QA method. Crawl-and-compare is the only defensible answer.

At least [2] full migration rehearsals must be completed into a staging environment, each including content, media, configuration and redirects, with a written delta report and a time estimate for the production run.

Evidence · Dry runs are the single best predictor of cutover risk. Vendors who propose one rehearsal are proposing to discover problems on launch night.

The supplier must deliver a cutover plan with a timed sequence, named owners, a content freeze window, DNS TTL strategy, a go/no-go checklist, and a pre-agreed rollback trigger that requires no further approval to execute.

Evidence · Ask who has authority to call the rollback. If the answer is a committee, you do not have a rollback plan.

A [30]-day hypercare period must be included at no additional cost, covering daily monitoring of error rates, 404s, redirect coverage and Core Web Vitals, with a weekly written report and a [4]-hour response target for regression defects.

Evidence · Ask what happens on day 31. The answer should not be 'support begins at our standard rate'.

On request at any time during the contract, and within [5] business days of termination, the supplier must deliver a complete export of content (structured, not HTML-only), media in original formats, database dumps, configuration and code repositories, and analytics data in an open format.

Evidence · Ask for a sample export of a comparable site. Structured content export is the requirement most often quietly unmet.

No fee, penalty or notice period beyond [90] days may apply to the export of data or the termination of hosting services, and the supplier must not withhold data or access as leverage in a commercial dispute.

Evidence · Ask whether the clause is acceptable, in writing, before award. A refusal is useful information.

The supplier must maintain, and deliver on request, architecture documentation, a runbook covering deployment, restore and incident response, credential inventory with ownership, and a list of all third-party services with their renewal dates.

Evidence · Ask to see the runbook for an existing client, redacted. Documentation that exists is obvious; documentation that does not is improvised.

If the supplier ceases trading or the contract is terminated for cause, [Organization] must be able to continue operating the platform without supplier intervention, using the documentation, infrastructure and credentials held under R7.1 and R15.3.

Evidence · This is the clause that makes 'no vendor lock-in' a contractual statement rather than a marketing one.