How to read a website RFP’s hosting requirements

Read the hosting section as four named decisions: which cloud, which data, which security program, and which status. If any of those is blank, vague, or copied from a federal template, vendors will answer the stack they can sell, not the stack your county or city can afford to operate. Name those four items in writing, or you buy hosting, compliance, and support you did not budget.

What does “cloud” vs “on premises” usually mean in a municipal website RFP?

Municipal website RFPs still mix three different ideas under one heading. Cloud often means a commercial managed host. On premises often means servers the agency or a contractor racks in a county facility. Colocation and “city-owned cloud” sit in the middle and get written as if they were the same buy.

They are not. A public information WordPress site for a mid-size city is usually a managed WordPress host: the platform runs the servers, the CDN, the firewall, and the WordPress updates. An on-premises requirement means you are also buying hardware refresh, patching, monitoring, and a recovery plan that lives on your side of the fence. If the RFP says “cloud preferred” and the exhibit still requires agency-owned hardware, strip one of those lines before you release. Vendors will price both and you will evaluate neither cleanly.

TECKpert is a WordPress Public Sector Partner and a Pressable partner. For most municipal public sites we recommend Pressable, Automattic’s managed WordPress platform on WP Cloud, unless the solicitation names a compliance program Pressable does not carry. That recommendation is a hosting choice. It is not a claim that every agency must leave its data center.

Which data is the site allowed to hold?

Hosting requirements only make sense after you name the data. A Florida county brochure site that publishes agendas, park hours, and press releases is not the same buy as a portal that stores resident accounts, payments, or case files.

Write the data classes in the RFP:

• Public content only (pages, posts, media, meeting packets)
• Authenticated staff workflows (intranet-style editing, not resident PII)
• Resident accounts, payments, or records that trigger a higher review

If the CMS is public content only, do not paste a questionnaire written for a system of record. If resident data will sit in the CMS, say so, and require the host and the integrator to say where that data lives, who can access it, and how it leaves at contract end. Ambiguity here is how a mid-size city ends up paying for a compliance-grade platform to hold copy that could live on a standard managed WordPress host.

How should buyers write GovRAMP and federal authorization language?

County and city buyers often inherit federal wording. The federal authorization program exists for federal agencies and federal data. GovRAMP is the NIST-aligned path built for state, local, tribal, and education buyers. It used to operate as StateRAMP. The name changed. The job did not: reuse one assessment across procurements, then keep monitoring the vendor.

Write the program by name, then write the status you can actually evaluate (for example Ready, Provisional, or Authorized). Do not write “federal authorization or equivalent” and hope. Equivalent is how you get a forty-page appendix and a protest.

WordPress VIP, Automattic’s compliance-grade WordPress, published GovRAMP authorization and TX-RAMP certification in September 2025, on top of its federal Moderate authorization. That credential belongs to the platform, not to TECKpert. We name VIP as an unpriced upgrade when a solicitation truly requires GovRAMP or the federal program. We do not put the federal program in every municipal scope. Pressable remains the default for most public WordPress sites. Pressable and VIP are both Automattic managed WordPress, so a later upgrade is a hosting move, not a replatform.

What backup, disaster recovery, and SLA language actually binds?

“Daily backups” and “enterprise SLA” are not requirements. They are adjectives.

Ask for:

• Backup frequency for files and for the database, separately
• Retention, and whether a copy leaves the host (downloadable is not the same as off-platform storage someone actually took)
• Recovery time objective and recovery point objective in hours, not adjectives
• How availability is measured, by whom, and what credit or remedy applies
• Who runs external uptime monitoring, because a host cannot always self-report its own outage

On Pressable, the verified pattern we use in proposals is continuous Jetpack backups, hourly database snapshots, and daily filesystem backups, with a TECKpert weekly export to encrypted storage we control. We commit a four hour recovery time objective and a one hour recovery point objective from the platform backups. We do not invent a platform uptime percentage that Automattic has not put in writing. TECKpert commits availability at the layer we control; platform terms are furnished on request.

If your RFP only says “vendor shall provide backups,” you will get whatever the cheapest host already does.

Who owns the hosting account, the admin, and the exit?

This is the lock-in section that procurement often skips.

Require:

• The agency owns the hosting account, the domain registrar login, and the production DNS. The integrator may be invited. The integrator must not be the sole owner.
• Admin of the CMS and of the host dashboard is accessible to named agency staff, with roles documented.
• Staging and production are separate environments. Say how many non-production environments you need, and that promotion to production is controlled, not automatic.
• Support hours for the host and for the integrator are named in local time, with severity definitions.
• Exit and portability: full content export, media, database, theme and plugin list, DNS cutover plan, and a date certain for credentials handoff. No proprietary format that only the incumbent can open.

A Florida county that leaves the hosting invoice and the DNS under the vendor’s login is not buying a website. It is renting one until the next RFP.

What about security questionnaires and accessibility of the admin?

Security exhibits should match the data class you named earlier. A fifty-page questionnaire copied from an ERP buy wastes evaluator time on a public brochure site. Ask for the host’s current attestations, the shared-responsibility boundary (platform vs integrator vs agency), and continuous monitoring ownership after go-live. If GovRAMP status is required, ask for the named status and a link to the public listing, not a promise to “pursue” it after award.

Accessibility is not only the public theme. Title II of the ADA points state and local web content at WCAG 2.1 Level AA under the Department of Justice rule. Staff who publish agendas still have to use the admin. Require that the CMS admin and the hosting dashboard workflows your clerks actually use are usable with assistive technology, or at least that the vendor documents known gaps and a mitigation. A pretty public site with an unusable editor fails the operational test.

What should a buyer do this month?

Open the website RFP on your desk, or the last one you issued. Find the hosting and security exhibit. Fill in four blanks in plain language: the cloud or facility model, the data the CMS may hold, the named program (GovRAMP or the federal program, if either applies), and the status you will score. Then check account ownership, environments, backup and recovery numbers, support hours, and exit.

If you want a second set of eyes on that exhibit before it goes out, send it. We will tell you whether the language matches a public WordPress site, or whether you have specified a compliance-grade stack you did not mean to buy.

Sources

• GovRAMP, Cloud Security for Government.
• WordPress VIP, GovRAMP and TX-RAMP Certified: Secure WordPress for Government, September 22, 2025.
• U.S. Department of Justice, Fact Sheet: New Rule on the Accessibility of Web Content and Mobile Apps Provided by State and Local Governments.
• W3C Web Accessibility Initiative, WCAG 2 Overview.