Job Vacancies
Work with Us

RFP-2026-EA-007: Terms of Reference 007 for Website Migration and Improvement Consultancy – MSF

  • Doctors Without Borders / Médecins Sans Frontières (MSF), Nairobi, Kenya, Communications and Digital Team is inviting bids for TOR-007: Website Migration and Improvement Consultancy, under RFP-2026-EA-007.
  • Assignment: Migration and improvement of the existing Drupal website to WordPress. Estimated implementation: 11 to 16 weeks, followed by 60 calendar days of post launch support. Agreed start date and milestone schedule will be recorded in the contract.
  • Vendors must pass 5 mandatory pass or fail items, then score on a 100 point evaluation. Non price criteria: 80 percent. Price criteria: 20 percent. Complete the common price schedule A1 to A10.

Introduction and Overview

  • Procuring entity: Doctors Without Borders / Médecins Sans Frontières (MSF), Nairobi, Kenya.
  • Requesting unit: Communications and Digital Team.
  • Current and target platform: Drupal to WordPress.
  • Type of engagement: Website migration, configuration, performance improvement, training and post launch support consultancy.
  • Contract form: Website migration and improvement consultancy.
  • Background: MSF currently operates its main website on Drupal. The requesting unit reports increasing challenges with maintenance and scalability. It intends to migrate to WordPress while improving user experience, performance and the long term ability of internal staff to manage the site.

Purpose and Objectives

  • Appoint a qualified consultant to plan and execute the migration of the MSF website from Drupal to WordPress, deliver an operational and maintainable website aligned with MSF brand and digital requirements, and complete testing, handover and 60 days post launch technical support.
  • Migrate existing Drupal pages, posts, files, media, custom fields and relevant metadata with verified integrity and no unapproved content loss.
  • Improve website speed, responsiveness, mobile compatibility and user navigation, with measurable baseline and post migration checks.
  • Configure WordPress so that MSF designated team can manage content, users and routine updates independently.
  • Improve user experience, visual structure and accessibility within the agreed MSF branding and design scope.
  • Maintain search engine continuity through URL mapping, permanent redirects, canonical URLs, metadata and technical SEO and GEO work.
  • Provide system documentation, practical staff training, backup and recovery guidance, and defined post launch assistance.

Scope, Lots and Eligibility

  • Scope: Single service lot covering migration and improvement of the MSF main website from Drupal to WordPress.
  • Discovery requirement: Consultant shall establish the technical baseline inventory during discovery and document the scope and acceptance tests for MSF approval.
  • Eligibility: Open to bidders who meet the 5 mandatory requirements in Section 8 and can deliver the full scope including the 60 day support period.
  • Bespoke work rule: Any new bespoke plugin development or customisation outside the approved scope requires separate written agreement. Bidders shall identify any required bespoke work and quote it separately. Such work is excluded from the core scope unless expressly authorised by MSF.

Required Services

  • Discovery, inventory and migration planning: Audit the existing Drupal environment, all content types, pages, posts, media, PDF files, URLs, custom fields and active functionality. Identify owners and migration dependencies. Identify integrations, redirects, current hosting and deployment constraints, active forms, access roles, analytics arrangements and any donation related features confirmed in scope. Produce content mapping, migration method, risk register, detailed project plan, staging strategy and proposed acceptance and test plan for MSF review.
  • WordPress architecture, configuration and design: Design WordPress architecture, theme approach, taxonomy, navigation, user roles and plugin stack. Document proposed dependencies, licensing and security implications. Configure and customise a professional mobile responsive theme aligned with MSF approved visual identity and approved UX and UI design. Configure existing plugins and required integrations within the agreed scope.
  • Content, URLs and search continuity: Migrate existing approved content, downloadable documents, media and metadata to the agreed structure and verify completeness through reconciliation. Prepare a complete mapping of existing Drupal URLs to WordPress destinations, apply 301 redirects where required, and validate navigation, internal links, XML sitemaps and canonical rules. Establish baseline analytics and search console evidence where available. Track post launch indexation and material SEO changes without guaranteeing an external search engine ranking.
  • Security, data protection and resilience: Configure HTTPS and SSL, administrator roles, authentication controls, updates, backup, recovery and core WordPress security protections. Review potential vulnerabilities, configuration exposures, plugin dependencies, user permissions and any sensitive or donation data flows. Deliver a tested backup and restoration approach and a launch rollback plan. Coordinate privileged access and data handling with designated MSF ICT and Data Protection focal points.
  • Testing, go live and ongoing assistance: Prepare staging and production environments. Execute functional, regression, browser, mobile, accessibility, SEO, integration and performance tests against the approved test plan. Conduct and document final MSF user acceptance testing, remediation of agreed defects, deployment rehearsal, launch checklist and rollback readiness. Provide site management documentation, 2 to 3 live training sessions, optional recorded tutorials and quick reference guides. Provide detailed documentation of all technical customisations made to plugins, themes and other site components, including what was changed, why, where in the codebase or settings, and any dependencies, to enable future maintenance and handover without reliance on the developer. Provide 60 calendar days of post launch support covering agreed issue resolution, monitoring and bug fixes.
  • Exclusions: Content copywriting or substantive rewriting of existing website copy. Standalone graphic design production beyond agreed WordPress theme customisation. Cloud hosting and domain registration fees. Indefinite maintenance or technical support beyond the initial 60 days. New bespoke plugin development beyond configuration and agreed customisation of existing plugins.
  • Donation and events linking: Ensure reliable links, tracking continuity and consistent user experience between the migrated main website and the existing WordPress donation and events platform. Migration or replacement of that separate platform or its payment gateway is not included unless separately specified in the agreed scope.

Technical, ICT and WordPress Standards

  • Drupal content inventory: Exportable inventory of content types, records, language versions where present, media and functionality. Record excluded or problematic records. Applies to: All migration phases.
  • Migration integrity: Reconciliation of content counts, media links, metadata and key user journeys. Documentary evidence of exceptions and applied fixes. Applies to: Content migration.
  • WordPress build: Documented theme, architecture, permissions, installed plugin inventory, versions, configurations, licences and support dependencies. Applies to: Setup and handover.
  • SEO and GEO continuity: Complete relevant URL map, verified redirects, sitemap, canonical rules, metadata transfer and checks for broken links or indexing errors. Applies to: Migration and launch.
  • UX and UI and responsive design: Approved layouts, mobile and desktop testing, navigation assessment and accessibility checks. State WCAG level supported and propose objective evidence for acceptance. Applies to: Design and testing.
  • Performance: Provide baseline and post migration speed and availability measurements on comparable terms. Propose measurable targets and verification methods for MSF acceptance. Applies to: QA and launch.
  • Security and backups: HTTPS, roles and access review, security hardening, documented backup and restore test, and rollback plan. Applies to: Prior to launch.
  • Integrations: List of each existing email, analytics, fundraising or other system integration, its owner, required behaviour and acceptance evidence. Applies to: Discovery and QA.
  • Handover: Full administrator access, documentation, configuration inventory, reusable code and files and training material. Pre existing third party licence rights disclosed. Applies to: Completion.
  • Support: 60 day support window, severity classification, response commitments and issue log. Applies to: After launch.

Safety, Data Protection, Health and Emergency Requirements

  • Access to live systems: Access via MSF approved accounts and principle of least privilege. Credentials, secrets and backups handled securely. Supplier shall describe privileged access controls, MFA use, secure credential exchange and staff access restrictions.
  • Personal and donor data: Identify any personal data collection, payment or donation flows. Define access, retention, transfers and responsibilities before migration. Supplier shall describe relevant personal data or payment flows, roles, sub processors, cross border transfers and safeguards.
  • Backups and recovery: Pre migration Drupal archive, WordPress backups, restore test and documented recovery procedure. Supplier shall provide backup frequency, recovery procedure, restoration test method and named recovery responsibility.
  • Go live controls: Final approval, tested redirect mapping, deployment and rollback plan, communication and incident escalation contacts. Supplier shall submit a go live approval checklist, deployment plan, downtime assumptions, rollback steps and escalation contacts.
  • Plugins, code and licences: Disclose all paid third party elements and renewal costs. Document licence ownership, updates and dependencies. Supplier shall identify each third party component, licence holder, duration, renewal cost, update policy and dependencies.
  • Post launch security: Security findings, prioritised remediation, maintenance boundary and handover of identified risks. Supplier shall state coverage hours, security related support process and residual risk handover after the 60 day period.

Confidentiality and Data Protection

  • Professional conduct: Consultant shall declare any material subcontractors, licences, conflicts of interest, third party commissions and dependencies. No change to the approved scope or third party expenditure may be committed without authorised MSF approval.
  • Confidentiality: Consultant shall maintain confidentiality and secure MSF systems and information in accordance with the signed agreement.
  • Data handling: Coordinate privileged access and data handling with designated MSF ICT and Data Protection focal points. Define access, retention, transfers and responsibilities before migration for any personal data, payment or donation flows.

Minimum Qualification Requirements

  • Mandatory evaluation, pass or fail: 5 items. Failure on any item disqualifies the bid.
  • 1. Legal identity and eligibility: Appropriate registration, tax and required supplier information.
  • 2. Relevant website migration capability: At least one comparable migration reference and accessible portfolio.
  • 3. Core technical skills: Evidence of WordPress, PHP and MySQL, security and migration experience.
  • 4. Availability and acceptance of scope: Team, timeline, 60 day support availability and declared exceptions.
  • 5. Commercial completeness: Completed Annex A and declared third party and licensing costs.
  • Essential skills: Minimum five years of professional WordPress development and site management experience. Demonstrated migration experience from Drupal or other CMS platforms to WordPress at comparable scale. Strong PHP, MySQL, WordPress database, theme and plugin skills, including configuration and customisation. Knowledge of technical SEO and GEO, redirects, sitemaps, canonical URLs and basic search continuity. WordPress security, user authorisation, SSL, backup and performance optimisation experience. Ability to explain technical decisions to non technical stakeholders and manage approvals and delivery risks.
  • Desirable evidence: Past work for nonprofit, humanitarian and development organisations, and relevant Drupal knowledge. Experience with multilingual websites, donation and fundraising platform integrations and accessibility practices. Portfolio or case studies, client references for completed projects and evidence of relevant technical training or certification. Capacity to coordinate with East Africa time zone or demonstrate practical local availability.

Framework Agreement and Booking Mechanism

  • Contract: Estimated implementation 11 to 16 weeks, followed by 60 calendar days of post launch support. Agreed start date and milestone schedule will be recorded in the contract. The 60 calendar day support period begins after go live and is additional to implementation.
  • Reporting: Consultant shall deliver the project plan, migration, QA, weekly progress and risk reports, handover materials and issue log.
  • Coordination: MSF Digital Manager is the main operational contact for requirements, reviews and documented implementation approvals. Head of Communications is the escalation contact for material project issues and communications related decisions. MSF ICT and Data Protection review system access, security, infrastructure, interfaces and applicable personal data processing. Fundraising and relevant system owners confirm existing donation and events links and operation of any in scope integrations. Procurement and Finance coordinate contractual matters, acceptance and compliant invoicing.
  • Coordination cadence: Biweekly project check in calls of 30 to 60 minutes, weekly status reporting and monthly summary reports.
  • Support response commitments: Critical: 4 hours. High: 24 hours. Medium: 48 hours. Low: 5 business days. Bidders shall state support coverage hours and response channels.
  • Issue log: Consultant shall maintain a shared issue log, report progress at the end of each phase, and communicate through agreed channels with MSF. Formal approval of milestones and changes must be obtained from the authorised MSF representative.
  • Payments: Commercial payments shall be linked to agreed contractual milestones and accepted evidence. Invoices alone do not constitute proof of delivery.

Deliverables, Reporting and Acceptance

msf.or.ke
  • Phases and indicative duration: Discovery and Planning, 1 to 2 weeks, Drupal audit, requirements and architecture proposal, migration workplan. Setup and Configuration, 1 to 2 weeks, WordPress installation, staging, theme and plugins. Content Migration, 3 to 4 weeks, content and media migration, URL mapping and integrity review. Testing and QA, 1 to 2 weeks, functional, accessibility, SEO, performance and security testing. Training and Documentation, 1 to 2 weeks, team training, documentation and handover readiness. Launch Preparation, 1 week, final approvals, deployment and rollback checks. Post Launch Support, 60 days, monitoring, incident resolution and bug fixes. Bidders must submit a detailed milestone schedule and identify any phase overlaps or dependencies.
  • D1 Inception and content audit: Inventory, scope assumptions, dependencies and agreed workplan. Due: Discovery phase.
  • D2 WordPress architecture and configuration: Documented staging environment, solution design, theme and plugin stack and integration register. Due: Setup phase.
  • D3 Migration and redirect mapping: Migrated test site, count reconciliation, media and metadata review, redirect map. Due: Migration phase.
  • D4 UX, SEO, performance and security testing: QA test results, baseline and comparison metrics, security findings, defects and remediation evidence. Due: Before launch.
  • D5 Go live approval and production site: Approved launch checklist, rollback plan, working production site and monitored release. Due: Go live milestone.
  • D6 Administration, plugin and integration documentation: Admin, plugin, troubleshooting, content, backup and recovery and integration guides. Code and configuration handover. Due: Before final handover.
  • D7 Training and knowledge transfer: Minimum 2 to 3 live sessions, attendance, practical demonstration, reference guides. Videos if agreed. Due: Handover.
  • D8 Post launch support and close out: 60 day ticket and issue log, fixes, monitoring summary and end of support report. Due: 60 days after go live.
  • Review and acceptance: MSF designated Digital Manager, supported by ICT and applicable functional owners, shall review submitted outputs against the agreed scope and documented acceptance checklist. Testing shall cover representative content, media links, URL redirects, access permissions, mobile and browser behaviour, forms, integrations, performance and security findings identified by MSF. Critical defects and material content losses must be reported and resolved before go live, unless expressly accepted by MSF in writing. Consultant shall provide final migration reconciliation, complete technical documentation, handover, training evidence and privileged access transfer before final implementation acceptance. Post launch support shall be separately documented after the full 60 day period and resolution or approved treatment of outstanding issues.
  • Proposal submission: Company or consultant profile and relevant registration, tax and supplier onboarding documentation as applicable. Technical proposal describing migration methodology, discovery plan, architecture approach, risks, content verification, security, QA and rollout. Workplan and resource allocation with implementation phases, milestones, proposed team and availability for the 60 day support period. CVs, relevant WordPress and Drupal portfolio, two or three recent client references and examples of comparable projects. List of software and plugins, existing MSF licences assumed, proposed paid licences, third party costs, hosting dependencies and support assumptions. Completed financial proposal schedule in Annex A, identifying all mandatory fees, taxes and exclusions separately. Proposed post launch service levels, maintenance exclusions, change control process and professional liability coverage details. Written list of exceptions and clarification questions, including assumptions about linking to the existing WordPress donation and events platform and any separate payment gateway work.
  • Technical and financial evaluation, 100 percent total: WordPress expertise and proven track record, 35 percent. Technical skills in PHP, MySQL, theme and plugin development, 25 percent. Project management and communication, 15 percent. Understanding of nonprofit and development sector, 5 percent. Cost effectiveness and value for money, 20 percent. Selection process may include portfolio and CV screening, technical discussion, proposal review, reference checks and final interview. Where used, these steps will be applied consistently to eligible bidders. MSF will compare complete prices for the same mandatory scope in Annex A, including the 60 day support period. Optional services and third party costs will be reviewed separately. Applicable price scoring formula and any qualification threshold will be stated in the Request for Proposals.
  • Financial assessment, Annex A, standard pricing schedule: A1 Discovery, Drupal content audit and migration plan, 1 package. A2 WordPress architecture, staging environment and configuration, 1 package. A3 Content, media and metadata migration and URL and redirect mapping, 1 package. A4 Theme adaptation, UX and UI and responsive design within agreed scope, 1 package. A5 Integration configuration, SEO and performance optimisation, 1 package. A6 Security hardening, backup and restore and recovery arrangements, 1 package. A7 QA, regression tests, remediation and go live support, 1 package. A8 Documentation, code and configuration handover and 2 to 3 live trainings, 1 package. A9 60 day post launch support, monitoring and in scope bug fixes, 1 period. A10 Project management, meetings and reporting, if not allocated above, 1 package. Total core consultancy, before tax. All lines: Bidder to quote. Bidders must quote the complete mandatory scope on a common basis, including 60 calendar days of post launch support. Quantities represent one project milestone or service package, not estimated labour hours. Any third party licences, subscriptions, optional services or reimbursable expenses must be identified separately. Bidders shall provide the requested quote currency, applicable tax treatment and any exclusions.
  • Optional and separately disclosed costs: Licences and third party subscriptions, name, licence holder, period, number of users, renewal and tax, identify if included or excluded. Hosting, domain, CDN and server expenses, excluded from core consultancy fees, declare any third party or MSF infrastructure dependencies separately. Additional time beyond original scope, quote hourly or daily rate and written change control requirements, work outside the agreed scope requires written authorisation. Ongoing support after the initial 60 days, quote separately as an optional service, exclude from the mandatory core price. Donation gateway and fundraising integrations, quote separately only for additional work outside the required linking with the existing WordPress donation and events platform, if requested by MSF. Other reimbursable expenses and tax, identify each charge and tax treatment clearly.
DOWNLOAD THE FULL PDF FOR THE FULL TOR
RFP-2026-EA-007: Terms of Reference 007 for Website Migration and Improvement Consultancy – MSF pdf — 637.57 KB

Download View online