Why the Sprint exists
Most site problems are invisible until they aren't.
A security patch three versions behind. An accessibility gap that surfaces six weeks before the semester. A department site nobody has touched since the last developer left. None of these announce themselves — they wait until they're urgent, usually during enrollment, a giving campaign, a board meeting, or an accreditation review.
Leadership notices the website when something's wrong, not when it's right. By then you're reacting instead of planning — and you're the one who has to explain it.
You can't plan around risk you can't see. So before we recommend a level of support, we measure. The Sprint turns "we think the site is mostly fine" into a scored, prioritized picture you can act on — and hand to your VP.
The Website Risk Sprint
A fixed-scope diagnostic, not an open-ended audit.
Over a few weeks, we work through our full operational playbook against your live sites. Nothing open-ended, nothing hourly — one fixed scope and one fixed price. You come out with a scored Web Operations Radar and a roadmap ranked by risk.
Most support gets scoped wrong because nobody asks the right questions upfront. The Sprint is those questions — asked and answered before anyone proposes a plan.
We measure
We run the playbook across security, accessibility, performance, platform health, documentation, and communication — and score each on a 1-to-5 maturity scale.
You get the radar
A one-page Web Operations Radar shows where you are today against a realistic 90-day target. The widest gap is where your institutional risk concentrates.
You keep the roadmap
A prioritized list of what to fix and in what order — yours to keep either way. If you continue with us, the Sprint fee is credited toward your first month.
The Web Operations Radar
One picture of where your site actually stands.
Illustrative example — sample scoresThe shape tells the story before any number does. A balanced site fills the hexagon evenly; a site carrying hidden risk collapses toward one corner.
In this sample, Documentation scores a 1 — the classic higher-ed pattern where the developer who understood the site left for a private-sector salary and the institutional memory walked out with them. That's where the risk concentrates, and where the roadmap starts.
The dashed outline is a realistic 90-day target — not perfection, but the shape of a site that's stable, compliant, and no longer a source of institutional liability.
What we score
Six dimensions. One shared language for site health.
Each dimension is scored 1 (ad hoc) to 5 (managed) against a documented rubric — so the score is defensible, repeatable, and something your leadership can understand at a glance. Scores shown are illustrative.
Security
2 → 4Patch currency, disclosed-vulnerability exposure, and backup integrity — the risk you know you should be watching but can't fully evaluate on your own.
Accessibility
2 → 4WCAG conformance and the volume and severity of open findings — a legal obligation that keeps resurfacing, monitored on a schedule instead of discovered in an audit six weeks before the semester.
Performance
3 → 4Core Web Vitals and page-speed scores on the pages that carry your traffic, plus caching and asset hygiene.
Platform Health
2 → 4Drupal or WordPress version currency, module and dependency debt, hosting configuration, and uptime.
Documentation
1 → 3Whether how your site is built and run lives in a documented system — or only in the head of whoever set it up last, so a resignation stops being a crisis.
Communication
2 → 5How work gets reported to you and your leadership — in plain English, on a rhythm, so you're never chasing an update or translating one before you forward it.
The maturity model
What each score actually means.
The same five levels apply to every dimension. Most first-time Sprints land between 2 and 3 — reactive, not negligent. That's not a failure of effort; it's what happens when the scope of a website grows faster than the team ever does. The goal isn't a perfect 5 everywhere. It's moving the dimensions that carry real risk into proactive territory.
Ad hoc
Nothing is tracked. Issues are found by accident, usually when something breaks.
Reactive
Problems get fixed once reported, but nobody is watching between fires.
Defined
There's a process on paper. It runs when someone remembers to run it.
Proactive
Monitored continuously. Issues are caught and handled before they reach you.
Managed
Measured, reported, and improving on a rhythm — with no single point of failure.
Support Plans
The Sprint is the diagnosis. These are the treatment plans.
Because the Sprint shows exactly where you stand, the right plan is a decision made on evidence — not a guess. Every plan runs on the same documented playbook and the same account-management layer. The same team stays on your account, so you're never educating a new vendor or explaining the same context twice. The difference between plans is how far up the maturity model we take you.
Core security patching, accessibility compliance, and uptime monitoring. The things that must never slip, handled — with a monthly report you can hand to leadership.
Everything in Foundation, plus performance optimization and proactive improvement sprints that keep moving your scores up instead of just holding the line.
Everything in Standard, plus custom development, platform integrations, and long-term roadmap planning — a true extension of your team.
| What's included | Foundation | StandardMost picked | Strategic |
|---|---|---|---|
| Security patching & monitoring | ✓ | ✓ | ✓ |
| Accessibility compliance | ✓ | ✓ | ✓ |
| Uptime & platform monitoring | ✓ | ✓ | ✓ |
| Monthly plain-English health report | ✓ | ✓ | ✓ |
| Dedicated account manager | ✓ | ✓ | ✓ |
| Performance optimization | — | ✓ | ✓ |
| Proactive improvement sprints | — | ✓ | ✓ |
| Custom development | — | — | ✓ |
| Platform integrations | — | — | ✓ |
| Long-term roadmap planning | — | — | ✓ |
Already a client with a bigger project in mind? We handle custom builds for existing relationships too.
What ongoing looks like
The Sprint is your baseline. Every month after, you watch it move.
The same six dimensions become your monthly report — one you didn't have to write, in language your VP will actually read without translating it first. Not an activity log. What we did, what it means, and what we recommend next.
You feel informed and covered, not managed. That's the whole point.
Common questions
Before you book, you probably want to know.
What exactly do I walk away with from the Sprint?
A scored Web Operations Radar across all six dimensions and a roadmap of what to fix, in priority order. It's a document you keep and can act on with any team — including your own. There's no obligation to continue.
How long does the Sprint take, and is the price fixed?
A few weeks, with one fixed scope and one fixed price agreed up front. No hourly billing, no open-ended discovery, and no complex contract to decode. You know what you're getting and what it costs before we start.
Is the Sprint fee wasted if I don't sign up for a plan?
No. You keep the radar and roadmap regardless. If you do continue with an ongoing plan, the Sprint fee is credited toward your first month — so the diagnosis effectively pays for itself.
How much of my time will it take to manage you?
Less than you spend managing the problem now. We work proactively from the playbook and bring you decisions, not tickets to triage. You won't be educating a vendor, re-explaining the same context, or picking up website operations as a second job.
What happens when a developer leaves — ours or yours?
Nothing breaks. You're working with a documented team, not a single person, so our institutional memory of your site doesn't walk out the door when someone does. And you're never handed off to a junior after onboarding — the people who learn your site are the people who keep running it.
Do you only work in Drupal?
We're Drupal-led and Drupal-deep, and we support WordPress where you need it. Many of our institutions run a mix. The Sprint scores whichever platform your site is on.
Is this built for a school our size?
Yes — it's designed for small-to-mid colleges, universities, and higher-ed-adjacent organizations with two-to-four-person marketing or communications teams and no dedicated developer on staff. If that's you, this is built for you.
Start with the diagnosis.
Most institutions come to us right after something forces the question — a vendor change, an accessibility audit, a security scare, a developer's resignation, or a pointed email from leadership. You don't have to wait for the next one. Book a 30-minute call and we'll talk through where your sites stand and whether a Website Risk Sprint is the right first step. No pressure, no obligation.