How Universities Should Evaluate a Drupal Agency? 14 RFP Questions That Separate Specialists from Generalists
Most higher ed Drupal RFPs test for portfolio and price, and neither predicts delivery. The questions that separate specialists from generalists cover open source contribution credits, student system integrations, decentralized editorial governance, WCAG 2.1 AA remediation, and exit rights. Fourteen of them are below.
Every university RFP produces the same pile of responses.
Fourteen agencies, all “Drupal experts.” All with a university logo on slide four. All within 15 percent of each other on price. The committee scores them, picks one, and discovers around the third missed deadline that the team who pitched is not the team building, and that nobody on the project had ever touched Banner.
That is not a procurement failure. It is a question design failure. Standard RFP questions can be answered by anyone with a case study library and a proposal writer. The fourteen below cannot.
Why higher ed breaks generalist agencies
A university website is not a large corporate website. It is four hard problems stacked on top of each other.
Governance. You do not have one content owner. You have Admissions, forty academic departments, Athletics, Advancement, Research, and a president’s office, each convinced their needs are the exception. An agency that has only built centrally governed marketing sites will architect for a customer who does not exist on your campus.
Integration. Your website is a front end for a student information system, a CRM, a course catalog, an events platform, and an identity provider. The CMS is the easy part.
Accessibility as law, not preference. On April 20, 2026, four days before the original deadline, the Department of Justice issued an interim final rule extending ADA Title II digital accessibility compliance by one year. Public institutions in jurisdictions of 50,000 or more, which because population is calculated at the state level covers nearly all public universities, now have until April 26, 2027. Smaller jurisdictions have until April 26, 2028. The extension moved the date and nothing else. WCAG 2.1 Level AA and the underlying obligation are unchanged, and the DOJ said plainly that it expects to implement the regulation at the new deadline. The current dates are published in the Department of Justice Title II compliance guidance.
If your agency treats accessibility as a QA phase, you are buying a remediation project you will pay for twice.
Institutional memory. Your web director will move on. Your CMS will not. Whatever gets built has to be maintainable by people who were never in the room.
Here are the questions that surface all four.
Category A: Prove the Drupal (questions 1 to 4)
1. What is your organization profile on Drupal.org, and how many contribution credits do you hold?
Drupal is one of the few platforms where expertise is publicly auditable. Every agency has a Drupal.org organization page, and every credited contribution is timestamped and attributable to a named person. Ask for the URL and open it during the presentation. BinaryWorks holds 256 organization contribution credits and Drupal Certified Partner status at drupal.org/binary-works, with 29 team members holding individual contributor profiles.
Red flag: No organization profile, or a profile whose last credited contribution predates Drupal 10.
2. Which modules do you maintain, and what have you credited in the last twelve months?
Credits tell you whether an agency contributes. Module maintenance tells you what it understands. A team maintaining or co-maintaining contributed modules has read Drupal core internals under pressure. A team that has only ever installed modules hits a wall the first time your requirement does not map to something already on the marketplace.
Red flag: “We contribute back where we can,” offered without a single issue number.
3. Name the engineers who will work on this project, and put those names in the contract.
The most common failure in agency selection is the pitch team vanishing at kickoff. Ask for named engineers, their Drupal.org handles, their Acquia certifications, and their allocation percentage. Then ask for a contract clause requiring your written approval before any substitution. Agencies that staff with dedicated Drupal developers rather than a floating pool can answer this in the room.
Red flag: Named roles instead of named people. “A senior Drupal architect” is not an answer.
4. Walk me through a Drupal 7 to Drupal 11 migration you delivered end to end, including what went wrong.
Drupal 7 reached end of life in January 2025, and thousands of institutional sites still run it unsupported. This is the defining higher ed engagement of the decade, so everyone claims it. The tell is the failure story. An agency that has actually done this can name the content model decision it got wrong, the module with no Drupal 11 equivalent, or the redirect map that cost three weeks of organic traffic. Our Creighton University modernization lifted enrollment conversions 30 percent while cutting security incidents 40 percent, and Roger Williams University (RWU) upgraded the website from Drupal 9 to Drupal 11 for long-term platform support. For the platform case underneath the migration, see why universities are replatforming to Drupal in 2026.
Red flag: A migration story with no problems in it.
Category B: The higher ed operating reality (questions 5 to 8)
5. How do you handle forty departments that each want to be the exception?
This is a governance question wearing an engineering costume. A strong answer covers content moderation workflows, role-based permissions, and the architectural choice between Drupal multisite, the Group module, and Domain Access, with reasoning tied to who is accountable for which content. A weak answer is a design system with no governance model behind it, which is how universities end up with eleven brand variants inside one CMS. Where the model is genuinely unsettled, resolve it in a Drupal consulting engagement before scoping the build.
Red flag: The answer begins and ends with “component library.”
6. Which student systems have you integrated with, by name?
Banner or Workday Student. Slate or Salesforce Education Cloud. CourseLeaf or Acalog for catalog. Shibboleth, CAS, or SAML for single sign-on. Emergency notification. Each has its own quirks and its own way of failing during peak enrollment traffic. Ask how the system integration layer is designed and tested, not whether it is possible.
Red flag: “We can integrate with anything via API.” Everyone can. Ask which ones they have.
7. What happens to our program finder when the academic calendar changes?
Program pages and course catalogs are where prospective students convert, and they are the content most likely to rot. A specialist describes a structured content model with defined entity types, taxonomies, and a sync or import strategy. A generalist describes staff hand-editing 300 program pages every August. This distinction moves enrollment growth and yield more than any homepage redesign.
Red flag: Program pages modeled as basic pages.
8. How will you train and support 200 non-technical editors after launch?
Your editors are faculty coordinators and department admins with a fraction of their week allocated to the website. If authoring requires thinking about layout, they will produce inaccessible, off-brand pages at volume. Look for editorial guardrails, constrained component choices in the design system, role-specific documentation, and post-launch office hours. Editor enablement is what protects operational efficiency two years after go-live, and it is the difference between a platform that ages well and one that becomes a rebuild request.
Red flag: Training scoped as one two-hour session in week 20.
Category C: Accessibility and compliance (questions 9 to 11)
9. What is your remediation plan against WCAG 2.1 AA, and how do you keep us compliant after launch?
Accessibility is not a phase. A specialist answers with an audit against WCAG 2.1 and 2.2 AA and Section 508, a prioritized remediation plan, fixes made at the theme and component layer rather than page by page, and monitoring folded into a maintenance and support retainer. Typical remediation runs 4 to 10 weeks depending on site size. Compliance is a standing obligation, so treat any plan that ends at launch as incomplete.
Red flag: An automated scanner report presented as an audit. Automated tools catch roughly a third of WCAG failures.
10. How do you handle third-party and vendor-embedded content?
This is where institutions actually fail. Your athletics feed, your Slate application forms, your video captions, your twelve thousand legacy PDFs, your learning management system materials. The Title II rule reaches public-facing, student-facing, and employee-facing content whether the university provides it directly or through a third party. An agency that scopes only what it builds has scoped maybe 40 percent of your exposure. The same pattern plays out across the public sector, which we covered in our ADA and WCAG analysis for government platforms.
Red flag: Third-party content marked “out of scope” with no mitigation strategy attached.
11. Can you produce a VPAT or ACR, and can you support us through an OCR complaint?
Many institutions are already operating under an Office for Civil Rights resolution agreement, and accessibility conformance reports get requested by procurement, by legal, and by complainants. An agency that has drafted these documents and sat in those conversations is materially different from one that has not. This is the same discipline as governance, risk, and compliance work in any regulated sector.
Red flag: They ask what a VPAT is.
Category D: Money, risk, and what comes next (questions 12 to 14)
12. What is your security patch SLA, and what happens at 2am?
Drupal security advisories publish on a predictable schedule. The response window is not predictable at all. You need a named SLA for critical advisories, a defined escalation path, and clarity on whether patching sits inside the retainer or gets billed hourly. Ask whether the agency will support a platform it did not build, because most institutions are handing over someone else’s code.
Red flag: Security patching described as “best effort.”
13. What does year two cost, and what happens if we leave?
Ask for a three-year total cost of ownership rather than a build price. Then ask the harder question: on exit, do we own the code, the repository, the documentation, and the deployment pipeline? Some agencies build on a proprietary distribution layered over Drupal, which quietly converts an open source platform into a vendor lock. For budgeting reference, a Drupal 7 to Drupal 11 migration runs $75,000 to $150,000 for mid-size institutions and $150,000 to $240,000 at enterprise scale. Cross-platform CMS replatforming runs longer and costs more.
Red flag: Any hesitation on code ownership. There is no good reason for hesitation here.
14. How will this platform behave when a prospective student asks an AI assistant about our programs?
Students now build shortlists through AI answers before they ever reach your homepage. That makes structured content, schema markup, entity-rich program copy, and answer-formatted content an enrollment concern rather than an SEO one. One Drupal-powered education portal lifted organic visibility 45 percent through answer engine optimization alone, without touching the platform. It is the discipline behind GEO and AEO and a core part of digital and AI readiness. Worth noting for anyone mid-roadmap: AI personalization and intelligent search can be layered onto an existing Drupal site without a rebuild.
Red flag: The answer is a keyword strategy.
How to score the answers
Weight the categories, because these fourteen questions do not carry equal risk.
| Category | Weight | What a failure here costs you |
|---|---|---|
| A. Drupal depth (questions 1 to 4) | 30% | Rework, missed deadlines, escalating change orders |
| B. Higher ed operations (questions 5 to 8) | 30% | A platform your staff cannot run |
| C. Accessibility (questions 9 to 11) | 25% | Legal exposure plus a second remediation budget |
| D. Money and continuity (questions 12 to 14) | 15% | Vendor lock-in and year three surprises |
Score each question 0 to 3. Any zero in Category A or Category C should be disqualifying regardless of total, because those are the two areas where a weak answer cannot be coached out during delivery.
One last move worth making: ask each finalist which question they would have added to this list. Specialists always have one.
Frequently asked questions
How do I verify a Drupal agency’s expertise independently?
Open the agency’s Drupal.org organization profile. Contribution credits, certified partner tier, team contributor profiles, and published case studies are public and timestamped. BinaryWorks holds 256 organization contribution credits with 29 team members on Drupal.org. It is the only claim in an RFP response you can verify without calling a reference.
What should a university Drupal migration cost?
A Drupal 7 to Drupal 11 migration typically runs $75,000 to $150,000 for mid-size institutions and $150,000 to $240,000 for enterprise or multisite environments. Cost is driven by content volume, custom module count, integration depth, and design scope, not by page count alone.
How long does a university Drupal migration take?
A Drupal 7 to Drupal 11 migration takes 12 to 20 weeks. A Drupal 10 to Drupal 11 upgrade takes 8 to 12 weeks. Replatforming from a legacy CMS takes longer, depending on content volume and integration depth. Add time if your student information system integration has never been documented.
What is the deadline for university website accessibility compliance?
April 26, 2027 for public institutions in jurisdictions of 50,000 or more, which covers nearly all public universities, and April 26, 2028 for smaller jurisdictions, measured against WCAG 2.1 Level AA. The Department of Justice extension issued in April 2026 changed the compliance date only, leaving the standard and the ongoing obligation in place.
How long does WCAG 2.1 AA remediation take on a university site?
Typical remediation runs 4 to 10 weeks depending on site size, template count, and how much third-party embedded content is in scope. Fixes made at the theme and component layer resolve issues across thousands of pages at once. Legacy PDF remediation is usually the longest tail and is scoped separately. Monitoring belongs in the support retainer, because compliance is ongoing.
Why do most large universities run Drupal?
Drupal handles what a university website actually is: a complex content model, forty departments with different permissions, multilingual requirements, and accessibility standards that carry legal weight under ADA Title II. Its permission and workflow layer was built for organizations where no single team owns the content. That is why it is standard across research universities, public agencies, and health systems.
Can we add AI personalization without rebuilding our CMS?
Yes. Personalization, intelligent site search, chatbots, and program recommendations integrate into an existing Drupal platform using large language models from OpenAI, Anthropic, and AWS Bedrock. No rebuild is required. This matters for budget cycles, because AI readiness does not have to wait for the next capital request.
Who is BinaryWorks, and what happened to Drupal Partners?
BinaryWorks is the current name of Drupal Partners, the same team, leadership, and client relationships under a new identity. The company was founded in 2009, is headquartered in Atlanta, Georgia, and holds Drupal Certified Partner status with 256 contribution credits on Drupal.org. References under either name describe one organization.
Does BinaryWorks only work with universities?
No. BinaryWorks is a Drupal specialist working across eight regulated sectors: higher education, healthcare, government, financial services, nonprofits, media and publishing, enterprise B2B, and manufacturing. Higher education is where the deepest track record sits, because WCAG obligations, decentralized governance, and student system integration all land on one platform at once.
Does BinaryWorks contribute to the Drupal open source project?
Yes. BinaryWorks is a Drupal Certified Partner with 256 organization contribution credits on Drupal.org and 29 team members holding contributor profiles. The company is a Drupal Association member and has sponsored DrupalCon Portland 2024, DrupalCon Atlanta 2025, and DrupalCon Chicago 2026.
About BinaryWorks
BinaryWorks, formerly Drupal Partners, is a Drupal specialist founded in 2009 and headquartered in Atlanta, Georgia. The original name was literal. Drupal has been the primary engineering discipline for sixteen years, and it shows up in the public record: Drupal Certified Partner status, 256 organization contribution credits on Drupal.org, 29 team members holding individual contributor profiles, Acquia Certified Partner status, Drupal Association membership, and DrupalCon sponsorship in 2024, 2025, and 2026.
The team is 50-plus certified engineers, designers, accessibility specialists, and growth marketers who have delivered more than 500 projects since 2009, rated 4.9 on Clutch. Higher education clients include MIT, Georgia State University, and Creighton University.
Higher education is where Drupal depth compounds hardest, because WCAG obligations, decentralized governance, and student system integration all land on the same platform at once. That same combination appears in government, healthcare, and financial services, which is why BinaryWorks works across eight regulated sectors rather than one. The engineering discipline underneath all of them is Drupal, delivered with compliance, AI, and growth marketing from a single team rather than three vendors.
Explore the higher education practice, covering enrollment growth and yield, student retention and graduation, institutional brand and reputation, operational efficiency, and digital and AI readiness, or read the higher education case studies. If you are still building a shortlist, our roundup of the best Drupal agencies for universities includes us alongside the other credible options. If you are hiring in-house instead, start with how to hire a Drupal developer.