Government Website Hosting Requirements for 2026
Every government hosting proposal in 2026 opens with the same three things: a local region, a certification badge and an uptime number. None of them answers the question that decides whether a public site survives the next four years, which is who operates the platform and who can switch it off.
A government website can sit in a data center inside the country and still be run from another continent. WebinOne hosts US and Australian government clients, and that work shapes the position taken here: region selection is the easiest claim to verify and the weakest one to rely on. What follows is the requirement set we would apply to any supplier, including ourselves, before a shortlist gets drawn.
Table of Contents
- Government Website Hosting Requirements You Can Score
- Security Evidence Instead of a One-Time Audit
- Data Residency Versus Operational Sovereignty
- Availability When the Public Depends on the Site
- Accessibility Across Procurement and Maintenance
- Government Sites Delivered with Integrator Partners
- What a Government Hosting Decision Comes Down To
Government Website Hosting Requirements You Can Score
Six requirements decide whether a host makes the shortlist. Each one has to be answered with evidence a buyer can read rather than a claim a buyer has to trust.
Most hosting questions in a public-sector solicitation get written as specifications: region, cores, storage, backup window. That produces comparable quotes and incomparable risk. The rows below turn the specification into pass or fail, and they work on any supplier.
| Requirement | What passing looks like | Question to ask |
|---|---|---|
| Security evidence | Monthly inventory, findings, remediation and change records | Can you show last month's evidence, not a certificate? |
| Availability | A published availability commitment plus a tested restore path | What is the restore test, who declares an incident, and which region takes traffic if the primary is impaired? |
| Accessibility | Testing covers templates, documents and every later edit | Who audits, who fixes, and is the fix rechecked after the next publishing cycle? |
| Data residency | Named region, with DNS, support access and failover written down | Who operates the network path, and which subprocessors can reach production? |
| Compliance duties | Each control assigned to agency, provider or both | Which controls are yours, and which contract clause binds the provider? |
| Exit | Continuity documented if the supplier changes | What keeps the sites running and editable if the provider stops? |
Availability is the row most suppliers answer with a number and no mechanism. A signed SLA states a target. A restore you have watched run proves the path works. Buyers keep accepting the first in place of the second, so ask to see the restore record before you score the row.
The compliance row goes wrong when nobody writes the split down. CISA's cloud security reference architecture directs US executive agencies to use FedRAMP when assessing cloud services and granting an authority to operate, and to carry those requirements into contracts, incident response duties and traffic routing. A proposal that treats authorization, contract language and traffic architecture as three separate work packages fails the row before anyone opens the pricing. For federal and GovCloud workloads, the path we work is a licensed deployment with a systems integrator, agreed with our team rather than inferred from a marketplace listing.
A row answered with "available on request" fails on the spot. Scoring exists to surface that answer before award, not after.
Exit is the row buyers skip because it feels hypothetical. Government estates outlive suppliers, funding cycles and occasionally the platforms themselves. Ask for the continuity document and read what happens to exports, redirects, archives and legal records if the contract ends badly. Our own answer is written into our terms: if the WebinOne platform is closed or discontinued, we commit to open-sourcing it so every reseller can keep hosting its trial and live sites, the WebinOne Portal and the SSO service without our support.
When the requirements have to become a solicitation, compare RFP and RFQ requirements before drafting, because the two instruments ask for different evidence and the scorecard has to match the one you use. Then run the table against every bidder, WebinOne included, and keep the answers on file for the next renewal.
Security Evidence Instead of a One-Time Audit
An asset inventory refreshed this month, a change approval for the release that shipped last week, an incident record closed with a timestamp. That packet proves more than any authorization letter in the proposal. Authorizations are granted on a specific architecture, and every change after launch starts aging them.
The clean split comes from CISA's technical reference architecture. Agencies stay responsible for securely configuring their cloud business applications and for collecting the logs and telemetry their own security requirements demand, while the cloud provider secures the underlying infrastructure. CISA identifies FedRAMP as the standardized authorization approach for federal cloud offerings and states that compliance is mandatory for executive-agency cloud deployments at low, moderate and high impact levels.
A provider's authorization never makes a deployed site compliant. Identity, permissions, application settings, logging and data protection are still configured by the team that deploys the site. Write each control into the contract as agency, provider or both, and make the same assignment visible in the runbook the operations team uses.
What one month of evidence looks like
FedRAMP's continuous monitoring guidance, built on NIST SP 800-137, describes the operating pattern: maintained operational visibility, managed change control and active incident response. A real month looks like this.
- Inventory first. An authoritative asset and software inventory, refreshed at least monthly and on every infrastructure change. FedRAMP names inventory control CM-8 as requiring updates at least monthly or whenever infrastructure changes.
- Findings, then fixes. Review vulnerability and configuration results on a fixed cadence, and record remediation in a plan of action and milestones rather than a chat thread.
- Evidence retained. Keep the artifacts an authorization official would ask for: scan output, change approvals, incident records and backup-restore tests.
- Named ownership. Every item above has one owner. Shared responsibility without named owners is a euphemism for nobody's job.
The cause and effect is plain. A fresh inventory shortens the time it takes to identify affected systems during an incident. Undocumented cloud changes invalidate the authorization that was granted on the old architecture.
Test the controls, not the slide
Administration is where weak hosting shows first. CISA's cloud use guidance specifies protected transport such as TLS or VPN and strong authentication, including FIPS 140-compliant multifactor authentication, for cloud service administration, and expects agency data stored in cloud environments to be encrypted so a breach doesn't hand over readable records.
Zero trust finishes the job. NIST SP 800-207 rejects implicit trust based on network location or asset ownership and evaluates every request on identity, device or workload context, policy and the sensitivity of the target. Applied to a government site, content management, deployment, database, storage and administrative functions sit as separate protected resources, privileged users get phishing-resistant authentication, credentials are short-lived, and authorization decisions are recorded for later investigation.
Ask for the change record for the release that shipped this week, then ask who approved it. A host that answers with a meeting instead of a document has already given you the answer.
The payoff is causal rather than theoretical. Remove broad network trust and a compromised administrator account can't wander into an unrelated agency system. That is the gap between a managed hosting platform and a shared server with a compliance PDF stapled to it.
Data Residency Versus Operational Sovereignty
WebinOne can place a site in a named AWS region, and that is residency, not sovereignty. The two get conflated in every public-sector hosting bid, and the space between them is where continuity risk lives.
We host across six AWS regions. Each site can sit in USA (Oregon), USA (Virginia), UK (London), Australia (Sydney), EU (Germany) or Canada, with dedicated infrastructure available by agreement. That answers where copies of the data sit. It says nothing about who can reach them.
The 2026 EU eGovernment Benchmark found that 37.2% of government websites relied on network infrastructure ultimately controlled by organizations headquartered outside the EU, and more than half of government email services showed similar foreign-operator dependence, as Capgemini's analysis of hidden dependencies sets out. The same analysis flags uneven compliance with security controls and secure internet standards across public-sector sites.
Here is what the distinction looks like once a site is live.
A server inside the country can shrink one legal exposure and leave DNS, the delivery network, routing, support logins and upstream infrastructure under someone else's control. A procurement file that records only the region records a hosting preference.
| Concern | What residency settles | What sovereignty still asks |
|---|---|---|
| Physical location | Which of our six AWS regions runs the site | Who operates the network path and support access |
| Legal reach | Where copies of the site data sit | Jurisdiction of the operator and subprocessors |
| Privileged access | That storage can be encrypted | Who can log in, from where, and with what approval |
| Continuity | Whether failover has a named geography | What keeps working if that operator stops |
A region can pass every residency check and still fail in operation. Say the site sits in Sydney and the paperwork confirms it. The engineers holding production access work from another jurisdiction, support sessions route through a third party, and the failover geography was never written into the contract. An incident lands on a weekend, the data never leaves the country, and the agency still cannot say who touched the system or how quickly service returns. Residency held throughout. Control was never there.
The contract should state failover geography alongside the primary region, on the same page. For the longer argument, data sovereignty versus data residency sets out the distinction in detail.
Location reduces exposure. Supplier-chain transparency decides continuity. Score the table before accepting a local data center as proof of sovereignty.
Availability When the Public Depends on the Site
A benefits portal publishes a deadline extension at 4pm on a Friday. Traffic triples inside the hour, half of it arriving on phones, and the page has to hold through the weekend while caseworkers still need the administrative side working on Monday. A brochure site can wait until then. This one can't.
That audience is large. Eurostat's digitalisation publication reported that in 2024, 47% of people in the EU who had used the internet during the preceding 12 months used public-authority websites to obtain information, covering public services, benefits, entitlements, laws and opening hours. Nearly one in two internet users in a major digital market makes continuity a baseline requirement.
What a restore drill actually proves
A backup schedule tells you files get copied. The evidence that matters is the last restore: when it was performed, what was restored and how long the site took to come back. A drill worth trusting restores a real copy of the site, times how long content and forms take to return, and records who ran it and what failed along the way. The output is a recovery time you can hold a provider to. A backup nobody has restored is a hope with a schedule attached.
Capacity follows the same logic. Size for the spike rather than the average day, with room to absorb a denial-of-service attempt without the site going dark, and put the failover region in writing rather than on a diagram.
Our published SLA commits to 99.95 percent availability, and measured uptime over the last 12 months has held at that figure. Those numbers describe the platform. The restore record and the recovery time describe your site, and they belong in writing before a cutover date is set. For the operating side of keeping that performance predictable, see how we approach system stability across the platform.
Accessibility Across Procurement and Maintenance
Section 508 puts accessibility inside the buying decision. CISA's accessibility guidance says agencies must provide comparable access to information and data during procurement, development, maintenance or use of information and communication technology, unless doing so would impose an undue burden; the same guidance points to measurable criteria such as live captions and minimum color contrast at WCAG Level AA, while the older federal baseline references WCAG 2.0.
The verbs matter: procurement, development, maintenance, use. Accessibility runs through the contract, the template, the authoring tool and every edit after launch, which is why a launch audit proves so little.
Where compliance breaks after launch
Documents. A clean template does not protect a resident from the scanned PDF uploaded in month four. Test the files people download, especially forms, agendas, reports and meeting minutes.
Video and audio. Captions and transcripts belong in the publishing checklist. A retrofit project with no owner becomes a backlog item that survives every budget cycle.
Embedded third-party components. A form, map, payment step or chat widget inherits none of the template's guarantees. Ask where that component is served from, who can patch it, and how fast an accessibility defect gets fixed when the vendor sits outside your hosting arrangement.
Later edits. Contrast, heading order, link text and table structure degrade with content churn, one campaign page at a time.
Run a cycle instead of a launch audit. Name who tests, who fixes, and who confirms the fix held after the next publishing cycle. If one person does all three, add a second reviewer for anything published as a public service page.
An accessible homepage at launch proves the template. It says nothing about the ten thousand pages and files behind it.
Set the target standard in the contract before the build starts. Many US and Australian public-sector buyers specify WCAG 2.2 AA, which is stricter than the WCAG 2.0 reference in older standards; agreeing the version early avoids a remediation round nobody budgeted for. We audit and remediate sites to WCAG 2.2 AA, and accessibility compliance should be written into procurement, publishing and maintenance rather than treated as a final check.
Government Sites Delivered with Integrator Partners
One platform to patch, one monitoring stack, one accessibility suite, one incident process, one set of skills. A server per department multiplies all five by the number of departments, which is why a public-sector estate gets bought as a program with an accountable delivery partner attached, not as a signup form.
Governments made that choice at the platform level some time ago. The OECD's 2025 Digital Government Index survey found that 31 of 36 member countries, or 86 percent, provided shared cloud-computing environments and hosting services, while 30 countries, 83 percent, had shared cloud-storage initiatives. Earlier OECD surveys pointed the same direction, with departments expecting shared services to cut both duplicated infrastructure and operating cost. By 2025, the World Bank's GovTech Maturity Index counted 103 countries reporting a shared government cloud platform available to all government entities.
We host US and Australian government clients today, and every site on the platform is physically hosted on Amazon Web Services infrastructure. The platform is AWS Qualified Software listed on AWS Marketplace.
What integrators can license
The standard platform runs in WebinOne's AWS account as a managed service. For qualifying integrators, a licensed version can run in the integrator's own AWS account or the customer's, by agreement, including AWS GovCloud. Federal and GovCloud projects are delivered with the integrator under that license, which is why the conversation starts with the delivery partner rather than a product page.
Residency and control are separate questions. A licensed deployment in the customer's own account means the data center region, the support access and the operator can sit inside the jurisdiction the buyer governs, rather than inheriting whoever the vendor happens to be. The exit deserves the same scrutiny as the entry: if the platform is ever discontinued, WebinOne commits to open-sourcing it so resellers can keep hosting their sites, portal and single sign-on service without vendor support.
A marketplace listing is a procurement convenience, not an authorization. Ask separately for the evidence that supports the authority to operate.
Migration is the other half of the work, and it is where public-sector programs most often lose a year. A government move should be staged, tested on both sides of cutover and reversible: accessibility, records, integrations and redirects checked on the old estate and the new one, with rollback available until the redirects have held through a full publishing cycle.
What a Government Hosting Decision Comes Down To
A government hosting decision should end with evidence that survives procurement, audit and renewal. Region pins, badge logos and a confident sales deck are inputs. The decision rests on who operates the service, where administrative control sits, how traffic behaves under failure and whether the public can still reach records, payments and notices when the team changes.
WebinOne is a white-label digital experience platform on AWS used by agencies, enterprises and government organizations, but the buying test stays the same for any platform: demand named responsibilities, proof that can be rechecked each year, and an operating model that remains governed after launch.
The strongest close is simple. Choose the option whose controls can be scored again in year two, under a new owner, during an incident, without relying on memory or goodwill.