CPH - Web Hosting Services

Scope of Work
Managed Web Hosting, Consulting, and Custom Web Development Services - PCI DSS
and HIPAA Capable
Issuing agency Columbus Public Health (CPH), City of Columbus, Ohio
Contract term The term of this contract is scheduled to begin November 2026 with the
migration phase completed no later than December 31, 2026. The
contract will be awarded for a one (1) year period, with an option to
renew for two additional one-year periods, at the City's sole discretion.
Pricing No pricing appears in this Scope of Work. Bidders shall submit the
separate Pricing Schedule (Attachment B) covering three (3) years of
service and hosting, with hosting/managed services and
consulting/development services priced separately (see 5, item 5).
Proposed pricing for each contract year shall be firm as stated in
Attachment B, regardless of the initial term length the City selects. Pricing
for any renewal period shall be mutually agreed and shall not increase by
more than five percent (5%) over the prior year's pricing.
1. Background and purpose
Columbus Public Health operates public-facing websites on a single dedicated server at a commercial
hosting provider. The sites support an e-commerce function in which clients are directed to a PCI DSS-
validated third party's hosted payment portal to make payments; no cardholder data is stored,
processed, or transmitted on the hosted server. The hosting environment is therefore within the scope
of the City's annual PCI DSS validation (SAQ A) as infrastructure supporting the payment channel.
The City's compliance program requires that hosting for this environment be delivered under a contract
that includes documented PCI DSS service-provider validation for the hosting services provided. The
purpose of this procurement is to obtain fully managed, single-tenant hosting delivered under PCI DSS
service-provider validation and HIPAA-aligned safeguards with an executed BAA, to support potential
future public-health applications; to migrate existing web services onto a current, vendor-supported
software stack; and to establish ongoing consulting and custom development capacity for public-health-
related web services (Section 3.6).
Eligible bidders. Proposals are welcome from web hosting providers, managed services providers, and
professional services or consulting firms serving as prime contractor. A bidder need not own the
underlying infrastructure: where hosting infrastructure or data center services are delivered through a
subcontractor or third-party platform, the bidder shall identify each such entity in its proposal, the
compliance evidence required by Section 3.3 shall be furnished for each entity providing in-scope
services, and the prime contractor remains the single point of accountability for all services under this
Scope of Work, including execution of the acknowledgments and agreements in Section 3.3.
Subcontractor or platform changes during the contract require prior written City approval. The prime
contractor shall also provide the consulting and custom development capabilities described in Section
3.6, whether through its own staff or identified subcontractors.

Additionally, bidders must:
* All Contractor employees or subcontractor employees working on the project must perform all related
Work in the United States. All locations of work to be performed, including subcontractor work, must be
disclosed.
* All City data must be maintained within the continental United States. City data may not be created,
modified, transmitted, accessed, or otherwise held outside the continental United States.
* Be registered with Vendor Services and have an active Contract Compliance Number. Register with
Vendor Services, to obtain a number. User guide available.
* Be registered with the Ohio Secretary of State to conduct business in the state of Ohio;
* Not be debarred or suspended from working on federally assisted projects or projects in Ohio or with
the City of Columbus;
* Adhere to all terms and conditions found in the accompanying Terms and Conditions document.
2. Current environment (for bidder reference)
* One dedicated (single-tenant) Linux server managed through a commercial web hosting control
panel, running an Apache-family web stack, a MySQL-compatible database service, and PHP-based
websites.
* Websites with associated databases; approximate combined footprint 50GB of site data and 30GB of
database content.
* Current traffic profile: roughly 50GB/transfer per month. No email mailbox services are in scope;
existing server-based mail services will be decommissioned. Outbound transactional messaging is
required as a contracted service - see Section 3.7.
3. Scope of services - base scope
3.1 Hosting platform
* Single-tenant dedicated server (or dedicated single-tenant virtual environment of equivalent
isolation, subject to City approval) meeting or exceeding: 8 CPU cores, 32 GB RAM, 1 TB NVMe/SSD
storage in a redundant (RAID or equivalent) configuration, 10 TB monthly transfer, minimum two
dedicated IPv4 addresses, IPv6 support.
* U.S.-based data center(s) with SOC 2 Type II reporting (or ISO 27001 certification) covering physical
and environmental controls; report or certificate furnished on request and at each renewal.
* Current, vendor-supported operating system (e.g., a current enterprise Linux or Ubuntu LTS release)
and cPanel/WHM control panel providing site, database, and TLS certificate management.
3.2 Managed services
* Operating system, control panel, and web-stack patch management performed by the Contractor,
with security patches applied within timeframes at least as strict as: critical/high within 30 days of
release (or sooner for actively exploited vulnerabilities), others within 90 days; patch reporting
available to CPH.
* 24x7x365 infrastructure monitoring with proactive incident response; server-down response within
30 minutes.

* Managed network firewall and host firewall configuration; DDoS mitigation; malware/intrusion
detection with remediation included.
* Managed backups: at least daily, retained no fewer than 30 days, stored off-server (and off-site or
logically separated), with restoration testing at least quarterly and restoration assistance included.
Target RPO 24 hours; RTO 8 hours.
* Named U.S.-based technical support reachable 24/7 by phone and ticket; support for compliance-
related configuration requests (e.g., hardening changes arising from vulnerability scan findings)
included, not billed as professional services.
3.3 Compliance requirements (mandatory)
Requirement Deta
PCI DSS service-provider Current PCI DSS service-provider validation shall be maintained for the
validation hosting services provided under this contract, whether delivered directly by
the Contractor or through disclosed subcontractors/platform providers. An
Attestation of Compliance (AOC) shall be furnished for each entity providing
in-scope hosting services at contract execution and annually thereafter
without request. Loss of validated status by any such entity must be reported
to CPH within 10 business days and constitutes grounds for termination.
Responsibility matrix Contractor shall provide and annually update a written matrix identifying
which PCI DSS requirements are managed by the Contractor, which by CPH,
and which are shared (PCI DSS Req. 12.8.5).
Written acknowledgment The contract shall include Contractor's written acknowledgment of
responsibility for the security of the account data environment components it
manages, per PCI DSS Req. 12.8.2.
External vulnerability scan Contractor shall permit quarterly external vulnerability scans of the hosted
support environment by a PCI SSC Approved Scanning Vendor designated by the City,
and shall remediate infrastructure-layer findings within the scan cycle at no
additional charge.
HIPAA capability Contractor shall execute the City's Business Associate Agreement (or provide
its standard BAA for City legal review) and shall maintain administrative,
physical, and technical safeguards consistent with the HIPAA Security Rule for
the hosted environment.
Vendor access transparency All Contractor accounts, service accounts, and SSH keys with access to the
CPH environment shall be documented in writing at onboarding and upon
change, including purpose, authentication method, and source networks.
Contractor administrative access shall be individually attributable and logged.
Breach notification Contractor shall notify CPH of any confirmed or suspected security incident
affecting the hosted environment within 24 hours of discovery and shall
cooperate with City incident response and any forensic investigation.
3.4 Migration and onboarding
1. Migrate websites, databases, TLS certificates, and DNS records from the current environment to the
new platform, including all content and configuration required for equivalent function.
2. Stack modernization is part of base scope: sites shall be delivered on a current, vendor-supported

OS and a supported PHP release (8.3 or later, or as mutually agreed per application compatibility
testing), with end-of-life interpreter versions removed. Contractor shall perform compatibility
testing and remediate hosting-layer issues; application-code changes, if any are required, will be
identified to CPH with a written assessment.
3. Provide a written migration plan (timeline, test plan, cutover window, rollback procedure) within 15
business days of award; complete migration within 30 calendar days of award.
4. Cutover downtime for each site shall not exceed 4 hours, scheduled outside business hours with
CPH approval; a parallel-run/validation period of at least 5 business days precedes DNS cutover.
5. Mailbox services shall not be provisioned; Contractor shall confirm in the migration plan that no
mailbox services are enabled on the new environment. Application-generated notifications shall be
delivered through the transactional messaging services in Section 3.7 rather than a local mail server.
3.5 Ongoing operations and reporting
* Uptime service level of at least 99.9% monthly for network and hardware availability, with defined
service credits; planned maintenance windows announced at least 5 business days in advance.
* Quarterly service report: uptime, patches applied, backup/restore test results, open items.
* Annual compliance package furnished without request: current AOC, SOC 2/ISO certificate, updated
responsibility matrix.
* Termination assistance: upon expiration or termination, Contractor shall provide full exports of all
site and database content in standard formats and reasonable cutover cooperation at no charge
beyond contracted rates for a period of 60 days.
3.6 Consulting and custom development services
In addition to hosting and managed services, the Contractor shall provide consulting and custom
development services for public-health-related web services upon CPH request. Anticipated work
includes, without limitation: design and development of online forms, data-collection tools, dashboards,
and service-request features for the hosted websites; user-experience and accessibility improvements;
integrations with department systems; and advisory services on web strategy, analytics, and security for
public-health digital services.
1. Task-order process. Services under this section are initiated only by written task order: CPH
describes the need, Contractor provides a written estimate (scope, deliverables, hours by role,
schedule) against the Attachment B rate card, and work begins only upon written CPH approval. No
consulting or development work may be billed without an approved task order.
2. Standards. Deliverables shall meet WCAG 2.1 AA accessibility, follow secure development practices
consistent with PCI DSS Requirement 6, and preserve the payment architecture: no functionality
that captures, stores, or transmits cardholder data on the hosted environment - payment
functions remain on validated third-party hosted portals.
3. Ownership and delivery. All custom code, configurations, and work product developed under task
orders are the property of the City; source code and documentation are delivered to CPH at task-
order completion. Delivered work carries a 90-day warranty against defects.
4. Access. Development staff access to the hosted environment is governed by the vendor-access
transparency and attribution requirements of Section 3.3.
5. Pricing separation. Consulting and development services are priced separately from hosting on the

Pricing Schedule (hourly rate card by role, firm for three years, with optional prepaid block-hour
pricing) and shall not be bundled into hosting or managed-service fees.
3.7 Transactional messaging services
The contract shall include outbound transactional messaging in support of the hosted websites and
public-health web services, at the following included monthly volumes:
* Transactional email - up to 50,000 messages per month, delivered through a reputable
transactional email service with sender authentication (SPF, DKIM, DMARC alignment) configured
for City-approved sending domains, bounce and complaint handling, and delivery logging/reporting
available to CPH.
* Transactional SMS - up to 10,000 messages per month, delivered through a carrier-compliant
messaging service; Contractor is responsible for A2P 10DLC (or equivalent) campaign registration on
the City's behalf, opt-out (STOP) handling, and delivery logging/reporting.
* Messages under this section are transactional (e.g., appointment reminders, confirmations, receipts,
service notifications) initiated by the hosted applications or approved integrations - not bulk
marketing. Sending use cases are subject to CPH approval.
* Included volumes and per-message overage rates shall be itemized on the Pricing Schedule; unused
monthly volume does not roll over. Where messaging is delivered through a third-party platform,
that platform shall be identified per the subcontractor disclosure requirements of Section 1, and
message logs/metadata shall be handled consistent with the security obligations of Section 3.3.
4. Deliverables and milestones
Milestone Due
Written migration and onboarding plan 15 business days after award
Executed BAA and PCI 12.8.2 acknowledgment; initial AOC and At contract execution
SOC 2/ISO evidence; vendor-access documentation
Migration complete; sites live on supported stack; incumbent 30 calendar days after award; completed no
decommission confirmed later than December 31, 2026
Initial responsibility matrix 30 calendar days after migration
Quarterly service reports; annual compliance package Ongoing per 3.5
Task-order process and consulting/development rate card in At contract execution; task orders as
effect requested per 3.6
5. Vendor qualifications and proposal content
All proposals must be uploaded as an attachment to the bid in the City's Vendor Services Portal to be
considered. Proposals must not exceed 10 pages and include, at minimum:
1. Company profile: years providing managed hosting or managed IT services, staffing/support model,
and whether the bidder will deliver infrastructure directly or through subcontractors/platform
providers.
2. Identification of every subcontractor or platform provider delivering in-scope services, with a

description of the division of responsibilities between the prime contractor and each such entity.
3. Evidence of current PCI DSS service-provider validation (AOC cover pages acceptable) for each
entity providing in-scope hosting services, and SOC 2 Type II or ISO 27001 coverage for proposed
data centers.
4. Proposed platform specification, migration approach and timeline, and support/SLA
documentation.
5. Completed Pricing Schedule (Attachment B) covering three (3) years, with hosting and professional
services priced separately:
* Section A - hosting and managed services, monthly recurring, with annual totals, for
Years 1, 2, and 3;
* Section B - one-time migration/onboarding;
* Section C - consulting and custom development hourly rate card by role, firm for three
years, with optional prepaid block-hour pricing;
* Section D - transactional messaging per 3.7 (included volumes of 50,000 emails/month
and 10,000 SMS/month, itemized, with per-message overage rates);
* Section E- alternates. Hosting and consulting/development pricing shall not be bundled.
6. Alternates (priced separately; may be awarded at the City's option)
Alt Description
A-1 Managed web application firewall (WAF) and/or CDN service for both sites.
A-2 Warm disaster-recovery replica in a geographically separate data center, with documented failover
RTO/RPO.
A-3 Staging/test environment mirroring production for site updates and compatibility testing.
7. Proposal Scoring
The contract will be awarded to the most reasonable and responsive bidder based on the following criteria:
Competency: (max: 40 points)
The bidder must have overall capability and technical expertise to handle the project. This score is based on
the vendor's years of providing managed or hosted services as well as the infrastructure, tools, and staffing
model required to start and finish the project successfully.
Quality and Feasibility: (max: 30 points)
The bidder must submit a thorough plan and approach proposed for execution. Points are awarded based
on how logical, realistic, and achievable the project timeline and milestones are.
Cost and Price: (max: 30 points)
The Cost category evaluates the financial viability, clarity, and overall competitiveness of the bidder's
financial proposal, and based on whether the pricing is sufficiently detailed, itemized, and inclusive of all
potential fees to prevent any hidden costs during execution.