Web Application Hosting

This Tender is invited by the Issuer. Overview The Department of Veterans' Affairs is seeking a provider to deliver a secure, reliable and supported dedicated hosting environment located in Australia for the ATDP web applications, replacing the existing server hosting arrangements. About The web applications and domains covered by this opportunity are already operational. Purpose The problem to be addressed is the replacement of the existing server hosting arrangements for the ATDP web applications with a secure, reliable and supported dedicated hosting environment located in Australia. The selected provider will be required to migrate the existing web applications, databases and related services to the new environment and operate the hosting service so the Department can continue delivering the program to external stakeholders. Scope The scope includes: Migration of the existing web applications, databases and related services to the new hosting environment Operation of the hosting service, including server administration, availability monitoring, backup and recovery, vulnerability scanning, security patching and reporting Cooperation with the Department's vulnerability assessment and penetration testing activities Provision of dedicated infrastructure, or infrastructure demonstrably isolated from other customers, with functional separation between web and database servers Support for the existing PHP and MySQL application stack, including supported PHP 8+ versions and a migration path from the current AlmaLinux/CloudLinux environment At least 200 GB active storage with capacity for growth, supporting workloads of fewer than 50 concurrent users Keeping all production data, backups, administration, support and access, including supplier and subcontractor access, within Australia Use of unique accounts and MFA for privileged access, with central logging of privileged access and account-management events Encryption of buyer data, databases and backups at rest using ASD-approved cryptographic algorithms Daily vulnerability scanning of online services and internet-facing server operating systems, and at least fortnightly scanning of applications Mitigation of critical vulnerabilities or vulnerabilities with working exploits within 48 hours, with other patches applied within two weeks, and monthly and on-request reporting of results and remediation status Vulnerability assessment and penetration testing of the hosting environment before go-live, following significant changes and periodically thereafter Centralised security event logging covering operating systems, web servers, databases, control panels, authentication and privileged access, together with availability and performance monitoring At least 500 GB backup capacity with minimum 30-day retention, Australian storage, a 2-hour RTO and 24-hour RPO, and documented and tested restoration procedures Management and transfer support for the domains atdp.org.au and advocateregister.org.au, subdomains and domain-based email, while retaining Government ownership of the domains A documented migration, rollback and contingency approach with little to no interruption to existing services Provision of WHM access for the Department to manage website and hosting configuration, install required extensions, manage email and perform other application-level administration Contractor Requirements The proposed service must have a current applicable IRAP assessment and appropriate Australian Government Hosting Certification Framework certification Instructions to Tenderers This opportunity is at the planning stage for an RFQ, with a target service commencement within the next 6 months.