1.0 Statement of Work - mccvlc.orgstaff/uploads/ckeditor/files/App-Firewall-Backup... · Web...

Michigan Community College Association

Michigan Colleges Online

Application Firewall/Load Balancer, Backup Solution and Security Solution/Services

May 12th, 2014

MCCA – Michigan Colleges Online – ApplicationFirewall/Load Balancer, Backup and Security RFP

Michigan Community Colleges Association

Request for Proposal for Application Firewall/Load Balancer, Backup Solution and Security Solution/Services

RFP ID No.: MCO 03

Pre-Bid Conference Call: May 15th, 2014

Deadline to Submit Questions: May 22nd 2014

Proposal Due Date: 12:00pm EST June 6th, 2014

Contact/Submit To: Randy MeltonMichigan Community Colleges Association 222 North Chestnut Street, Lansing, Michigan 48933-1000 Phone: (517) 372-4350Fax: (517) 372-0905Email: [email protected]

PLEASE NOTE THE ITEMS IN YELLOW.

In most cases these are the Actions Items required for this Bid.

2Michigan Colleges Online


Table of Contents

1.0 STATEMENT OF WORK.......................................................................................................................4

1.1 PURPOSE..........................................................................................................................................41.2 COVERAGE & PARTICIPATION.........................................................................................................4

2.0 GENERAL INFORMATION..................................................................................................................5

2.1 ORIGINAL RFP DOCUMENT.............................................................................................................52.2 THE ORGANIZATION........................................................................................................................52.3 VENDOR’S UNDERSTANDING OF THE RFP......................................................................................62.4 GOOD FAITH STATEMENT................................................................................................................62.5 BID RESTRICTIONS...........................................................................................................................62.6 BID RESPONSE INSTRUCTIONS.........................................................................................................62.7 COMMUNICATION............................................................................................................................62.8 BID REGISTRATION..........................................................................................................................72.9 PROPOSAL SUBMISSION...................................................................................................................72.10 METHOD OF AWARD........................................................................................................................82.10.1 SELECTION AND NOTIFICATION.......................................................................................................8

3. HOSTING ENVIRONMENT..................................................................................................................9

3.1 TARGETED APPLICATIONS FOR HOSTED ENVIRONMENT...............................................................10

4. APPLICATION FIREWALL AND LOAD BALANCER..................................................................11

4.1 OVERVIEW.....................................................................................................................................114.2 APPLICATION FIREWALL/LOAD BALANCER QUESTIONNAIRE.......................................................12

5. BACKUP SOLUTION............................................................................................................................13

5.1 5.1 BACKUP SOLUTION QUESTIONNAIRE......................................................................................145.2 BACKUP SOLUTION WORKSHEET..................................................................................................15

6. SECURITY SERVICES / SOLUTIONS...............................................................................................16

6.1 16

7. VENDOR QUALIFICATIONS & REFERENCES.............................................................................21

7.1ENGAGEMENT METHODOLOGY...................................................................................................22

7.2 9.1 VENDOR CERTIFICATION.........................................................................................................24



1.0 Statement of Work

1.1 PurposeThe purpose of this Request for Proposal (RFP) is to invite prospective vendors to submit a proposal to supply an Application Firewall/load balancer, Backup solution and Security Services for the Michigan Community College’s Association, Michigan Colleges Online operating unit. This RFP provides vendors with the relevant operational, performance, application, and architectural requirements of the system.

Preference will be given to suppliers who have demonstrated a clear understanding of the requirements and that have core competencies and practices for providing Co-location services. Suppliers are required to propose a solution that best meets MCCA/MCO ’s stated requirements using industry best practices.

1.2 Coverage & ParticipationMCCA/MCO reserves the right not to enter into any contract, to add and/or delete elements, or to change any element of the coverage and participation at any time without prior notification and without any liability or obligation of any kind or amount.

This bid may be sub-divided into the following deliverables:

1. Bid Group 1: Application Firewall / Load Balancer

2. Bid Group 2: Backup Solution

3. Bid Group 3: Security Solutions and Services

2



2.0 General Information

2.1 Original RFP DocumentMCCA/MCO shall retain the RFP, and all related terms and conditions, exhibits and other attachments, in original form in an archival copy. Any modification of these, in the vendor’s submission, is grounds for immediate disqualification.

2.2 The OrganizationThe Michigan Community College Association is a network-centric organization that provides leadership on issues affecting member colleges. In addition to providing core legislative and government advocacy for its members, MCCA members benefit from the activities of four Centers of Excellence including the Center for Student Success, Michigan Community College Virtual Learning Collaborative, Michigan New Jobs Training Program, and the new Center for Global Initiatives.

Industry: Higher Education Member Support Services

Public Sector

28 Community Colleges located in Michigan


Author, 01/03/-1,

Too many spaces after this. It doesn’t match the other heading spacing.


Schedule of EventsThe following is a tentative schedule that will apply to this RFP, but may change in accordance with the organization’s needs or unforeseen circumstances. Changes will be communicated by e-mail to all invited bidders.

Issuance of RFP May 8th, 2014 Bid conference call May 15th, 2014 Technical Questions/Inquiries Due May 22nd, 2014 RFP Closes June 6th, 2014 - 5 pm (Email Submission) Final Award Notification June 12th, 2014

UPON FINAL SELECTION, MCCA/MCO RESERVES THE RIGHT TO EXTEND THE REWARD NOTIFICATION DATE IF NEEDED TO NEOGIGATE FINAL TERMS OR TUNE REQUIREMENTS.

2.3 Vendor’s Understanding of the RFPIn responding to this RFP, the vendor fully accepts the responsibility to understand the RFP in its entirety, and in detail, including making any inquiries to MCCA/MCO as necessary to gain such understanding. MCCA/MCO reserves the right to disqualify any vendor who demonstrates less than such understanding. Further, MCCA/MCO reserves the right to determine, at its sole discretion, whether the vendor has demonstrated such understanding. That right extends to cancellation of award if award has been made. Such disqualification and/or cancellation shall be at no fault, cost, or liability whatsoever to MCCA/MCO .

1. Rights to Reject Bid MCO reserves the right to reject or cancel a Bid on several conditions which are not limited to the following list:

TCO does not align within operating cost parameters (too expensive). Solution does not fully satisfy MCO Use Case due to architecture changes or service model

changes post bid. Viability of solution. Concerns with complexity or security. Limited skill sets within the state for supporting the solution. Alignment concerns.

2.4 Good Faith StatementAll information provided by MCCA/MCO in this RFP is offered in good faith. Individual items are subject to change at any time. MCCA/MCO makes no certification that any item is without error. MCCA/MCO is not responsible or liable for any use of the information or for any claims asserted therefrom.

2.5 Bid Restrictions

Any vendor subject to usage restrictions by the Department of Defense or State Department are prohibited from bidding.

Vendors that do not have a physical service presence within the state of Michigan are prohibited from bidding. Managed services can be provided by resources outside the state but not outside the country.

Co-location and hosting space must be provide within the state of Michigan.

2.6 Bid Response Instructions

Complete the Items Highlighted in Yellow within this Word Document. Save your Word Document as a PDF and email to [email protected].


mailto:[email protected]


Complete the Bid-Response Spreadsheet for each proposed solution. Email the updated spreadsheet and a PDF version to [email protected]. Please send as an unlocked spreadsheet for edits.

2.7 CommunicationVerbal communication shall not be effective unless formally confirmed in writing by a specified procurement official in charge of managing this RFP process. In no case shall verbal communication govern over written communication.

2.7.1 Vendors’ Inquiries. Applicable terms and conditions herein shall govern communications and inquiries between MCCA/MCO and vendors as they relate to this RFP. Inquiries, questions, and requests for clarification related to this RFP are to be directed in writing to:

Michigan Community Colleges Association 222 North Chestnut Street, Lansing, Michigan 48933-1000Phone: (517) 372-4350Fax: (517) 372-0905Email: [email protected]

2.7.2 Informal Communications. Inquiries for clarifications and information that will not require addenda may be submitted verbally to Randy Melton subject to the availability of time.

2.7.3 Formal Communications that are not clarifications shall include, but are not limited to:

Errors and omissions in this RFP and enhancements. Vendors shall recommend to MCCA/MCO any discrepancies, errors, or omissions that may exist within this RFP. With respect to this RFP, vendors shall recommend to MCCA/MCO any enhancements, which might be in MCCA/MCO ’s best interests.

Inquiries about technical interpretations, which must be submitted in writing and be received prior deadline data published above. Inquiries for clarifications/information that will not require addenda may be submitted verbally to the buyer named above at any time during this process.

Addenda to this RFP.

2.7.4 Addenda. MCCA/MCO will make a good-faith effort to provide a response to each question or request for clarification that requires addenda within two business days.

MCCA/MCO will provide limited response to any questions/requests for clarification that require addenda, if received by MCCA/MCO after the deadline date.

2.8 Bid Registration Please register your participation intention by email: [email protected] and specify which Bid Group you intend to submit a proposal for. You will receive a Goto Meeting Invite to the pre-bid meeting.

2.9 Proposal SubmissionProposals must be delivered by email: [email protected]. On or prior the deadline date stated above within the schedule of events. MCCA/MCO shall not accept proposals received by fax. Vendors are to submit one electronic PDF copy of proposal marked “Original”.






2.10 Method of AwardThe evaluation of each response to this RFP will be based on its demonstrated competence, compliance, format, and organization. The purpose of this RFP is to identify those suppliers that have the interest, capability, and financial strength to supply MCCA/MCO with a Hosting and Managed Services identified in the Scope of Work.Evaluation Criteria:

1. Features and Functionality

2. Leadership in the Market

3. Engagement methodology

4. Security: The proposed solution must clearly demonstrate that it will introduce no unacceptable business risk to the integrity, confidentiality, and availability of MCO information assets or resources.

5. Architecture: The solution must be scalable, flexible, robust, and perform well.

6. Vendor’s qualifications and references.

7. Cost and TCO

2.10.1 Selection and NotificationVendors determined by MCCA/MCO to possess the capacity to compete for this contract will be selected to move into the negotiation phase of this process. Written notification will be sent to these vendors via –e-mail. Those vendors not selected for the negotiation phase will not be notified.

3. Hosting Environment The following sections provide a brief overview of the hosting environment planned for MCO. This is subject to change based upon the final architected solution.

MCO has selected a virtualization strategy utilizing VMWare as the virtual host manager for three physical servers.


Author, 01/03/-1,

Is this page left intentionally blank?-+


3.1 Targeted Applications for Hosted Environment

Targeted Applications for Virtual Infrastructure (This list is subject to change and is a draft list of services)

ApplicationLayer

Application Presentation Instances Memory Storage Within Scope of this RFP

CMS ColdFusion10.x based

Instance 1

< 20 Gigs per

instance

NoInstance 2 NoInstance 3 NoInstance 4 No

Core Application Services

Inventory System Up to 4 medium VM Instances

2 Gigs No

Custom Service – DOL Services

Multiple 1 Gig No

Custom Service – Integration Services

Up to 60 small VM Instances

1 Gig No

Data Services Up to 4 small VM instances

4 Gigs No

Enterprise BUS

TBD Two 2 Gigs 100 Gigs

No

Data Layer

MS SQL Server Data Warehouse

One 16 GigsApprox. of 25 Gigs (SSD) per instance

No

MongoDB Two 16 Gigs NoData warehouse Two 16 Gigs No Postgre SQL Two 16 Gigs No

SecurityLayer

Security Application Firewall One 1 Gigs Throughput No

OS Layer

Windows Enterprise

Two Instances Yes

Red Hat Linux

Three Host Physical Servers

Yes

Hypervisor VMWare Three Host Physical Servers

Yes

3.2



4. Application Firewall and Load Balancer

4.1 Overview

MCO requires a proactive security appliance/service protects information assets against cyber-attacks and that that also provides load balancing and SSL, digital certificate services.

Requirements

Targeting 200 Megs of throughput; actually needs may be much lower. Please provide pricing for each tier of throughput. HA is NOT needed; however, 24 hour warranty replacement is required or warm failover to VM is required.

1) Load Balancer a) Affinity Management b) Failover Detection c) Alerting

2) Application Firewalla) Deep Packet Inspection support with customization for filtersb) Injection detection c) Signature Based d) Throttle detection for abnormal traffic patterns e) Virus Detection (Optional) f) Alerting

3) Certification Managementa) SSL management b) Cert provisioning

Bid Instructions:

Complete the Questionnaire below. Complete the Bid Response “Application Firewall/Load Balancer” worksheet.



4.2 Application Firewall/Load Balancer Questionnaire

Ref Requirements Please describe or provide collateral material that outlines how your solution satisfies these requirements.

Q1 Load Balancer Function

a. Affinity Management b. Failover Detection c. Alerting

Q2 Application Firewall Function

a. Deep Packet Inspection support with customization for filters

b. Injection detection c. Signature Based d. Throttle detection for abnormal

traffic patterns e. Virus Detection (Optional) f. Alertingg. Detection techniquesh. Protection techniquesi. Traffic processingj. Connection handling.k. Honeypot Support (Optional)

Q3 Certification Management

a. SSL management b. Cert provisioning

Worksheet Questionnaire

Please complete in workbook.

Application Firewall ApplianceWarranty Selected

$0.00$0.00$0.00$0.00$0.00

Three Year Maintenance

Implementation Three Year TCOVM (Yes, No)Cost

Model 20 Megs 200 Megs 500 Megs50 Megs 100 Megs



5. Backup Solution MCO desires a low service overhead backup solution that supports a backup to cloud archiving model. Due to the low volume of change, we are targeting a tapeless backup solution that archives to a Cloud and provide sufficient alerting and robust monitoring tools.

Backup Requirements

Estimated: 2 – 3 Terabytes Change rate per Month: < 100 MegsTargeted RTO from Backup Repository (Cloud Store): 4 Hours



Bid Instructions:

Complete the Backup Solution questionnaire Complete the Bid Response “Backup Solution” worksheet for pricing details.

5.1 5.1 Backup Solution Questionnaire

Ref Functions Please explain or provide supporting documentation for how your solution supports this function.

1 Deduplication support.

2. MS SQL integrated backup support (Optional).

3. PostgreSQL support for integrated backup. (Optional).

4. Encrypted cloud backup support.

5. VM Image backup support. Backup/Restore in Virtual Server Infrastructure.

6. Encrypted key management.

7. Integration with Storage Arrays.

8. Capabilities across Multiple Backup Targets.

9. Support for Multiple Platforms (Redhat, Windows, VMware).

10. Restore Granularity.

11. Usability/Manageability.



5.2 Backup Solution Worksheet

Please complete in workbook.

Backup Solution VM Appliance Size

Solution Yes No Yes No 2 TB 3 TB 5 TB 10TB Warranty Selected Implementation Three Year Maintenance Three Year TCO

Add ons$0.00$0.00$0.00$0.00$0.00$0.00

$0.00



6. Security Services / Solutions

6.1MCO desires to review the options for following solutions for safeguarding key services and data assets:

Desired Solutions / Services

1. Host Vulnerability Scanning – Safeguard host services by providing external vulnerability scan for known exploits.

2. Website Malware Vulnerability Scanning - Safeguard websites from malware infections.

3. Web and Perimeter Vulnerability Management. – Safeguard edge based services from malformed configurations and exploits.

4. Host Policy Compliance Scanning – Safeguard host services from malformed configurations.

5. Intrusion Prevention Solution / Intrusion Detection Solutions - Safeguard core services from DoS and other exploits.

Bid Instructions:

Complete the questionnaire for the Intrusion Prevention Solution / Intrusion Detection Solution Please attach a summary of the key features for your Host Vulnerability Scanning Solution. Please attach a summary of the key features for your Perimeter Vulnerability Management

Solution. Please attach a summary of the key features for your Host Policy Compliance Management

Solution. Please attach a summary of the key features for Website Malware Vulnerability Scanning

Services. Please attach any additional options for managing security. Complete the Bid Response for pricing within “Security” worksheet

Worksheet Pricing Detail: Please complete in workbook.

Solution / Service Cost Per Device / IPCloud Based

CostVM

ApplicanceWarranty Period if

Applicable

Selected Item (Completed by

MCOImplementation

Three Year Maintenance

Three Year TCO

$0.00$0.00

$0.00$0.00$0.00$0.00

On Premises Cost

Intrusion Prevention Solution \ Intrusion Detection Solutions Feature Service Response

1. Detection & Analysis Indicate whether your solution

supports the following correlation capabilities and describe your specific



capability in that area:

o Signature and heuristic detection and updates.

o Lossless packet analysis at wire speed.

o Encrypted traffic inspection.o Advanced botnet and

malware detection.

2. Prevention & Protection Indicate whether your

solution supports the following correlation capabilities and describe your specific capability in that area:

o Virtual infrastructure protection

o DoS/DDoS protectiono Zero-Day protectiono APT protection

3. Control Indicate whether your solution

supports the following forensic analysis capabilities and describe your specific capability in that area:

o Traffic shapingo Pre-built compliance

settings

4. Implementation & Configuration

Describe the process by which IDPS devices/licenses for your solution are deployed. Include any tasks that must be performed on systems or devices already deployed (e.g. network configuration and third-party integration).



Describe the process by which the management devices/licenses for your solution are deployed. Include any tasks that must be performed on systems or devices already deployed (such as network configuration and third-party solution integration).

Describe the process by which the reporting devices/licenses for your solution are deployed. Include any tasks that must be performed on systems or devices already deployed (such as network configuration and third-party solution integration).

Describe the process by which the command console(s) for your solution(s) is initially configured. Include the creation of administrative accounts, key databases, audit and reporting functions, policy creation, etc.

5. On-going Operations Describe the process

by which the initial configuration of your solution is performed. Include the implementation of any signature database(s), the creation of any rules, and the configuration of any and all settings required for optimal operations.

Describe the process by which the initial configuration of your solution is updated and maintained. Include the update of any signature database(s), the



update and/or modification of any rules, etc.

Describe the processes by which the command console can be backed up. Address whether the back-up process in any way compromises operations and/or security.

6. Alarming & Alerting

Describe the process by which the command console can be configured to issue alarms and alerts. Detail the different alarming/alerting mechanisms that can be configured and the manner in which those alarming/alerting mechanisms are configured.

Indicate whether your solution can integrate with third-party ticketing and workflow systems, and where integration is possible, indicate with which platforms your solution integrates and describe the integration process.

7. Auditing & Reportingo Describe the auditing and

reporting capabilities for captured logs. Address whether standard report templates exist, whether they must be constructed, or whether the system supports ad hoc reporting only. Where standard templates exist, indicate what types of reports they represent and in all cases indicate what types of



information can be presented in reports. Specify if specific compliances mandates can be reported against.

o Indicate whether your solution can integrate with third-party reporting solutions, and where integration is possible. Indicate with which platforms your solution integrates and describe the integration process.

8. Customer supporto Do you provide toll-free

customer support 24 hours a day, seven days a week? Please specify all paid and unpaid support options.

Implementation supporto Do you provide complete

turnkey, onsite implementation, and project management support? Please specify which support will be included and which is provided for an additional fee. Also specify whether support is available direct from the vendor or provided through a partner.

Trainingo Describe the type of training

provided to administrators. Specify whether training is available direct from the vendor or provided through a partner.

Software updateso Do you provide future

software releases and updates to all applications as part of regular software maintenance fees?



7. Vendor Qualifications & ReferencesAll vendors must provide the following information in order for their proposal to be considered:

1. A brief outline of the vendor company and services offered, including:

a. Full legal name of the company.

b. Year business was established.

2. Contact information for three references (if possible) from projects similar in size, application, and scope, and a brief description of their implementation.

Relevant Client List:Reference 1

Organization Name

Industry

Contact Name and Title

Phone Number

Email Address


Organization Name

Industry


Phone Number

Email Address


Organization Name

Industry


Phone Number

Email Address



7.1 Engagement Methodology

Please describe your engagement methodology for how you manage customer relationships:

Ref Service Please explain your practices in this area1. Account Relationship Management

2. Project management Practices

3. Service Level Agreements



DEBARRED VENDORS AND EXCLUDED PARTIES SCREENING(Fill out completely and return with RFP)

CERTIFICATE OF COMPLIANCE

I certify, buy submission of this offer, that neither __________________________________, (name of vendor, independent contractor, or offering party)

nor any of its principals, or sub-contractors that are a part of this offer is presently debarred, suspended,

proposed for disbarment, declared ineligible, or voluntarily excluded from participation in Federal assistance

programs or activities, and neither ____________________________________, nor any of its principals or (name of vendor, independent contractor, or offering party)

sub-contractors, is listed on the General Services Administration’s list of Parties Excluded from Federal Programs and

the HHS/OIG List of Excluded Individuals/Entities (available through the internet at: www.sam.gov).

Where the party is unable to certify to any of the statements in this certification, such party shall attach an

explanation to this offer.

Where a party fails to submit and complete this certification, such party’s offer shall be determined to be an

incomplete submission.



7.2 9.1 Vendor CertificationThis certification attests to the vendor’s awareness and agreement to the content of this RFP and all accompanying calendar schedules and provisions contained herein.The vendor must ensure that the following certificate is duly completed and correctly executed by an authorized officer of your company.This proposal is submitted in response to Request for Proposal for Collaboration Solution(s) issued by MCCA/MCO .

The undersigned, who is a duly authorized officer, hereby certifies that:

(Vendor Name)

agrees to be bound by the content of this proposal and agrees to comply with the terms, conditions, and provisions of the referenced RFP and any addenda thereto in the event of an award. Exceptions are to be noted as stated in the RFP. The proposal shall remain in effect for a period of [ Please Define ] calendar days as of the Due Date of the RFP.

The undersigned further certify that their firm (check one): IS IS NOT

currently debarred, suspended, or proposed for debarment by any federal entity. The undersigned agree to notify MCCA/MCO of any change in this status, should one occur, until such time as an award has been made under this procurement action.

Person(s) authorized to negotiate on behalf of this firm for the purposes of this RFP are:Name: Title:

Signature: Date:

Name: Title:

Signature: Date:

Signature of Authorized Officer:Name: Title:

Signature: Date:

_____________________________________________________


1.0 Statement of Work - mccvlc.orgstaff/uploads/ckeditor/files/App-Firewall-Backup... · Web...

Documents

Transcript of 1.0 Statement of Work - mccvlc.orgstaff/uploads/ckeditor/files/App-Firewall-Backup... · Web...