24022 RFP Managed Security Service.pdf

THE UNIFIED GOVERNMENT OF

ATHENS-CLARKE COUNTY(ACCGov)

DATE: November 27, 2023

TO: Managed Security Service Providers

SUBJECT: RFP #24022 MANAGED SECURITY SERVICE

You are invited to submit a proposal to provide a Managed Security Service, for the Information Technology Department.

Inquiries regarding proposals should be made to Toro Holt, Senior Buyer, (706) 340-1742, or accbids@accgov.com. Technical questions may be directed Jonathan Carter, Systems Analyst recovery and security, Information Technology at (706) 613-3075, fax: (706) 425-4069 or email: networking@accgov.com

The estimated range of this project is between $150,000 and $200,000.

Attached hereto is the Request for Proposal (RFP) instruction document. The written requirements contained in this (RFP) shall not be changed or superseded except by written addendum from the Unified Government of Athens-Clarke County Purchasing Division of the Finance Department. Failure to comply with the written requirements for this proposal may result in rejection of the proposal by the Unified Government of Athens- Clarke County.

One (1) USB Flash drive with a copy of the Proposal WITHOUT Pricing, One (1) paper copy(s) without pricing, and One (1) Separately Sealed paper copy of section V-D Price Proposal Schedule must be submitted. Proposals are to be sealed, marked with the offeror's name and address and labeled, “RFP #24022 MANAGED SECURITY SERVICE” and delivered to:

The Unified Government of Athens-Clarke County Finance Department, Purchasing Division 375 Satula Avenue

Athens, Georgia 30601

Not later than 3:00 P.M. ET, THURSDAY, JANUARY 11, 2024

A qualified interpreter for the hearing impaired is available upon request at least 10 (ten) days in advance of the proposal opening date. Please call (706) 613-3088 for more information. This service is in compliance with the Americans with Disabilities Act (ADA).

Hand delivered copies may be delivered to the above address ONLY between the hours of 8:00 a.m. and 5:00 p.m. E.T., Monday through Friday, excluding holidays observed by the Unified Government of Athens-Clarke County.

The Unified Government of Athens-Clarke County reserves the right to reject any and all proposals, to waive any technicalities or irregularities, and to award the contract based on the highest and best interest of the Unified Government of Athens-Clarke County.

mailto:accbids@athensclarkecounty.com mailto:networking@accgov.com

Page | 2

TABLE OF CONTENTS

SECTION TITLE

I REQUEST FOR PROPOSAL SUBMISSION INSTRUCTIONS

II REQUEST FOR PROPOSAL OVERVIEW AND PROCEDURES

III SCOPE OF SERVICES

A. INTRODUCTION AND PURPOSE

B. GENERAL REQUIREMENTS

C. ADDITIONAL REQUIREMENTS

D. DEFINITIONS

E. SPECIFIC TASKS

IV SELECTION PROCESS AND EVALUATION CRITERIA

V MANDATORY PROPOSAL FORMS

A: PROPOSAL FORM

B: ADDENDA ACKNOWLEDGEMENT

C: GEORGIA SECURITY & IMMIGRATION COMPLIANCE (GSIC) AFFIDAVIT

CONTRACTOR AFFIDAVIT & AGREEMENT

D: PRICE PROPOSAL SCHEDULE

(Must be submitted in a separately sealed envelope)

VI OPTIONAL FORMS

A: BID LIST APPLICATION – should be submitted prior to the bid submission. If you have never registered to do business with ACCGOV

VII DOCUMENTS CHECKLIST

ATTACHMENT A: WHAT YOUR BUSINESS NEEDS TO KNOW ABOUT GEORGIA’S E- VERIFY

REQUIREMENTS

Page | 3

SECTION I - REQUEST FOR PROPOSAL SUBMISSION INSTRUCTIONS

ALL PROPOSALS RECEIVED WILL BECOME A PART OF THE OFFICIAL CONTRACT FILE AND

MAY BE SUBJECT TO DISCLOSURE.

A complete signed proposal must include the documents listed below:

PROPOSAL FORMAT: Offerors are expected to examine the specifications, price schedule, and all instructions. Failure to do so will be at the offeror’s risk. Each offeror shall furnish the information required by the solicitation. The proposal and price schedule must be signed by an officer of the company, who is legally authorized to enter into a contractual relationship in the name of the offeror.

All proposals received will become a part of the official contract file and may be subject to disclosure.

PROPOSAL FORMAT: All proposals should include the information outlined below and in the following order:

1. Cover Letter: A brief cover letter of introduction and interest.

2. Table of Contents: Including all sections and subsections.

3. Business Information: State the full name and address of your organization and the branch office or subordinate element that will perform the services described in this proposal. Include a telephone number, the point of contact and official signature of an authorized company representative. Indicate whether you operate as a single proprietorship, partnership, or corporation. Include the state(s) in which you are incorporated and/or licensed to operate.

4. Qualifications and Experience: Include an organization chart and summary resumes of key personnel proposed for the project, including designations of the team leader, the consultant responsible for design, the project architect, the person responsible for all proposed communications with the owner and all proposed sub-consultants and a description of their roles.

a. Current Project Assignments: Identify the current project assignment(s) and the currently identified completion date(s) for projects currently being managed by the key individuals proposed for our project.

b. Understanding of the Project: Statement of the firm's understanding of the project and proposed approach for providing requested services.

c. Additional Services Required: Based on the firm's understanding of the project, identify any additional services that might be required for a successful program.

5. References: Include a minimum of three references for contracts of a similar nature, preferably public sector references. Include the name, address, telephone number, point of contact and description of the contract for each reference.

6. Other Relevant Information: Include any other relevant information concerning the project in this section.

Page | 4

SUBMITTAL FORMAT: ALL proposal copies must be submitted in a sealed envelope or container with the OUTERMOST container stating the company name, address, telephone number, the RFP number and TITLE (RFP #24022 MANAGED SECURITY SERVICE). If you have an ACCGov Vendor Number please include it on the sealed envelope or container. If you do not know your vendor number, please call (706)-613-3088 or email: vendor@accgov.com If you do not have a vendor number, please fill out a bid list application found at Bid List Application (https://www.athensclarkecounty.com/DocumentCenter/View/45180) so one may be issued to your company. The ACCGov Vendor Number is not required to submit a Bid but we encourage companies to apply.

One (1) USB Flash drive with a copy of the Proposal WITHOUT Pricing One (1) paper copies of the signed proposal WITHOUT price One (1) Separately Sealed paper copy of section V-D Price Proposal Schedule

(Must be submitted separately in a sealed envelope)

Offerors are responsible for informing any commercial delivery service, if used, of all delivery requirements and for ensuring that the required address information appears on the outer wrapper or envelope used by such service.

No responsibility shall attach to the Unified Government of Athens-Clarke County for the premature opening of a proposal not properly addressed and identified, and/or delivered to the proper or Improper address. Proposals via facsimile will NOT be considered.

ALL DOCUMENTS SUBMITTED ON USB FLASH

DRIVE MUST BE IN A SINGLE PDF FILE

mailto:purchasing@accgov.com https://www.athensclarkecounty.com/DocumentCenter/View/45180 https://www.athensclarkecounty.com/DocumentCenter/View/45180

Page | 5

THE UNIFIED GOVERNMENT OF ATHENS-CLARKE COUNTY

REQUEST FOR PROPOSAL (RFP)

MANAGED SECURITY SERVICES

INFORMATION TECHNOLOGY DEPARTMENT

ATHENS, GEORGIA

SECTION II - REQUEST FOR PROPOSAL OVERVIEW AND PROCEDURES

A. INTRODUCTION

PURPOSE

The Unified Government of Athens-Clarke County desires to solicit competitive proposals from responsible vendors to provide managed security services for the Information Technology Department in Athens, Georgia for a one year period with the option to extend the contract for additional terms if agreed upon by all parties.

The contractor will provide services per the scope of services as indicated in Section III of this request for proposal (RFP).

B. RFP TIMETABLE

The anticipated schedule for the RFP and contract approval is as follows:

Proposal Documents Available ......................... November 27, 2023 Deadline for submission of questions ............... January 5, 2024

Deadline for receipt of proposal ....................... 3:00 P.M. ET, THURSDAY, JANUARY 11, 2024 Proposals Valid Until ....................................... March 15, 2024

C. CONTACT PERSON

The contact person for this RFP is Toro Holt, Senior Buyer Explanation(s) desired by the offeror(s) regarding the meaning or interpretation of this RFP must be requested from the contact person, in writing via email at accbids@accgov.com. Technical questions may be directed to Jonathan Carter, Systems Analyst Backup and Security, Information Technology at 706-613-3075, fax: 706-425-4069 or email:

networking@accgov.com.

Offerors are encouraged to contact only the contact persons stated above to clarify any part of this RFP.

Any such unauthorized contact shall not be used as a basis for responding to this RFP and also may result in the rejection of the offeror's submittal.

D. MINIMUM PROPOSAL ACCEPTANCE PERIOD

Proposals shall be valid and may not be withdrawn for a period of 60 days from the date specified for receipt of proposals.

E. ADDITIONAL INFORMATION/ADDENDA

The Unified Government of Athens-Clarke County will issue responses to inquiries and any other corrections or amendments it deems necessary in written addenda issued prior to the proposal due date.

Offerors should not rely on any representations, statements or explanations other than those made in this RFP or in any addendum to this RFP. Where there appears to be a conflict between the RFP and any addenda issued, the last addendum issued will prevail.

mailto:networking@accgov.com

Page | 6

Request for additional information or clarifications must be made in writing no later than the date specified in the RFP Timetable. The request must contain the offeror's name, address, phone number, and fax number, and email address.

Offerors must acknowledge any issued addenda. Proposals which fail to acknowledge the offeror’s receipt of any addendum will result in the rejection of the proposal if the addendum contained information which substantively changed the Owner’s requirements

Offerors who obtain this Request for Proposal from Georgia Procurement Registry or Athens Clarke County/Purchasing (https://www.athensclarkecounty.com/Bids.aspx)or from other than the Purchasing Division are advised to re-visit the above websites to obtain any addenda which may be issued prior to the proposal closing date. The Unified Government of Athens-Clarke County assumes no responsibility for Offerors’ failure to acknowledge any addenda issued

F. LATE PROPOSALS, WITHDRAWALS, MODIFICATIONS AND REJECTIONS

Proposals shall not be modified, withdrawn, or canceled by the offeror for a period of sixty (60) days following the time and date designated for the receipt of proposals, and each offeror so agrees in submitting his proposal. Negligence on the part of the Offeror in the preparation of his proposal shall not be grounds for the modification or withdrawal of a proposal after the time set for proposal closing.

Proposals received after the proposal due date and time are late and will not be considered. Modifications received after the proposal due date are also late and will not be considered

G. PROPOSAL CLOSING

Proposal schedule prices will not be opened or read aloud publicly. A list of names of firms providing proposals may be obtained from Georgia Procurement Registry or Athens Clarke County Bids or via email request to E-Mail: accbids@accgov.com after the proposal due date and time stated herein. A tabulation of prices may be obtained upon award.

H. NON-COLLUSION AFFIDAVIT

By submitting a proposal, the offeror represents and warrants that such proposal is genuine and not sham or collusive or made in the interest or on behalf of any person not therein named and that the offeror has not directly or indirectly induced or solicited any other offeror to put in a sham proposal, or any other person, firm or corporation to refrain from proposing and that the offeror has not in any manner sought by collusion to secure to that offeror any advantage over any other offeror.

By submitting a proposal, the offeror represents and warrants that no official or employee of the Unified Government of Athens-Clarke County has, in any manner, an interest, directly or indirectly in the proposal or in the contract which may be made under it, or in any expected profits to arise therefrom.

I. GEORGIA SECURITY AND IMMIGRATION COMPLIANCE ACT AFFIDAVIT

By submitting a proposal and executing the attached Affidavits, the offeror verifies its compliance with O.C.G.A. §13-10-91. The offeror further agrees to maintain records of such compliance and shall provide a copy of each such verification to Unified Government of Athens-Clarke County, at the time the subcontractor(s) is retained to perform such services.

http://ssl.doas.state.ga.us/PRSapp/PR_index.jsp http://www.athensclarkecounty.com/index.aspx?NID=375 http://www.athensclarkecounty.com/index.aspx?NID=375 https://www.athensclarkecounty.com/Bids.aspx http://ssl.doas.state.ga.us/PRSapp/PR_public_routing.jsp?route_code=nigp_list http://ga-athensclarkecounty.civicplus.com/Bids.aspx

Page | 7

J. COST INCURRED BY OFFERORS

All expenses involved with the preparation and submission of proposals to the Unified Government of Athens-Clarke County, or any work performed in connection therewith shall be borne by the offeror(s).

No payment will be made for any responses received or for any other effort required of or made by the offeror(s) prior to the commencement of work as defined by a contract approved by the governing body of the Unified Government of Athens-Clarke County.

K. EQUAL OPPORTUNITY POLICY STATEMENT

It is the policy of the Athens-Clarke County government that no person or business shall be excluded from participation, denied the benefits of, or otherwise discriminated against in relation to the award and performance of any contract or subcontract on the grounds of race, color, creed, national origin, age, or sex.

L. HOLD HARMLESS AND INDEMNIFICATION

The Offeror agrees, insofar as it legally may, to indemnify and hold harmless the Unified Government of Athens-Clarke County, its officers, employees and agents from and against all loss, costs, expenses, including attorneys' fees, claims, suits and judgments, whatsoever in connection with injury to or death of any person or persons or loss of or damage to property resulting from any and all operations performed by Offeror, its officers, employees, and agents under any of the terms of this contract.

M. SITE VISIT:

Offerors are urged and expected to inspect the site where services are to be performed and to satisfy themselves regarding all general and local conditions that may affect the cost of contract performance, to the extent that the information is reasonably obtainable. In no event, shall failure to inspect the site constitute grounds for a claim after contract award.

N. AWARD OF CONTRACT

This is a past performance/technical/price trade-off source selection in which competing offeror’s past and present performance history and technical ability will be evaluated on a basis approximately equal to price. Award will be made to the responsible offeror whose proposal represents the best value after evaluation in accordance with the factors listed in Section IV herein. The Unified Government of Athens- Clarke County may reject any or all proposals if such action is in the Unified Government’s interest.

O. MULTIPLE AWARDS

The Unified Government of Athens-Clarke County reserves the right to make multiple awards or to award a contract by individual line items or alternatives, by a group of line items or alternatives, or to make an aggregate award, whichever is deemed most advantageous to the Unified Government. If the Unified Government determines that an aggregate award to one offeror is not in the Unified Government's best interest, "all or none" offers shall be rejected.

P. PLACE OF PERFORMANCE

The Unified Government of Athens-Clarke County will not contemplate traveling outside the City of Athens to the contractor’s facility for custom fitting or alterations. The offeror shall insert in the spaces provided in the price schedule the address of the plants or facilities location(s) that he intends to use.

Q. QUALIFICATION OF OFFERORS

The Unified Government of Athens-Clarke County may make such reasonable investigations as deemed proper and necessary to determine the ability of the offeror to perform the work and the offeror shall furnish to the Unified Government all such information and data for this purpose as may be requested.

The Unified Government reserves the right to reject any proposal if the evidence submitted by, or investigations of, such offeror fails to satisfy the Unified Government that such offeror is properly qualified to carry out the obligations of the contract and to complete the work contemplated therein.

Page | 8

The Unified Government of Athens-Clarke County contractors/vendors must have a current Athens-

Clarke County business license if they are physically located in Athens-Clarke County or if they perform a service in Athens-Clarke County.

Proposals from any offeror that is in default on the payment of any taxes, license fees, or other monies due to the Unified Government will not be accepted.

R. ALTERNATE PROPOSALS

Alternate proposals or proposals that deviate from the requirements of this solicitation will not be considered. Offerors shall not insert in their proposal any written statement which will have the effect of making any material change or changes in the Scope of Services or in any contract between the parties covering subject matter thereof.

S. OPEN RECORDS

In accordance with OCGA Section 50-18-72(a)(34) Any trade secrets obtained from a person or business entity that are required by law, regulation, bid, or request for proposal to be submitted to an agency. An entity submitting records containing trade secrets that wishes to keep such records confidential under this paragraph shall submit and attach to the records an affidavit affirmatively declaring that specific information in the records constitute trade secrets pursuant to Article 27 of Chapter 1 of Title 10. If such entity attaches such an affidavit, before producing such records in response to a request under this article, the agency shall notify the entity of its intention to produce such records as set forth in this paragraph. If the agency makes a determination that the specifically identified information does not in fact constitute a trade secret, it shall notify the entity submitting the affidavit of its intent to disclose the information within ten days unless prohibited from doing so by an appropriate court order. In the event the entity wishes to prevent disclosure of the requested records, the entity may file an action in superior court to obtain an order that the requested records are trade secrets exempt from disclosure. The entity filing such action shall serve the requestor with a copy of its court filing. If the agency makes a determination that the specifically identified information does constitute a trade secret, the agency shall withhold the records, and the requester may file an action in superior court to obtain an order that the requested records are not trade secrets and are subject to disclosure;

Page | 9

SECTION III - SCOPE OF SERVICES

The contractor shall provide all personnel, equipment, tools, materials, supervision, and other items and services necessary for implementing managed security services as per the scope of services outlined below for the period outlined.

A. INTRODUCTION AND PURPOSE

The Unified Government of Athens-Clarke County (ACCGov) is a unified city/county government located in the northeast section of the state of Georgia and is approximately sixty (60) miles northeast of Atlanta, Georgia. The Unified Government of Athens-Clarke County (the government’s official name) was formed in 1991 by a referendum which required the combining of The City of Athens and Clarke County. ACCGov serves an area population of approximately 100,000 with annual growth projected at 1% per year. ACCGov provides a multitude of local and state-funded services, which includes, but is not limited to, Public Safety, Utility, Courts, Corrections, Tax and Fire Services. ACCGov employs approximately 2,200 people.

With security threats becoming more prevalent, ACCUG is looking for a Managed Security Services Provider (MSSP) to augment our internal security by working as an extension to our internal security team within the Information Technology Department (IT) to monitor systems in order to detect threats and malicious activity.

To that end, we are requesting bids for a Managed Security Service Provider capable of providing managed network monitoring of endpoint devices, servers, Local- & Wide-Area Network, and remote users. The Provider must be able to contain threats when identified and quickly and effectively notify Information Technology of any threats detected in order to mitigate the threat either locally on the network, an endpoint device, or a remote user device.

The Information Technology Department manages and supports all information systems and infrastructure for ACCUG. With a staff of 23 full-time employees, IT supports approximately 200 servers (both physical & virtual), 2000 Windows-based workstations, 15 MacOS-based workstations, an IBM AS/400, hybrid on-premise Microsoft Exchange and O365, Cisco Unified Call Manager, all running on a Cisco-based

WAN.

IT operates two redundant data centers, each with an independent Internet connection. The data centers are connected via a 40GB dedicated fiber connection. Servers, virtual server nodes, and network components are located in both data centers.

The network infrastructure is based on CISCO routers and switches. Security is provided by two Cisco FTD (4110/2130) firewalls and at two different Internet points. Internet access is provided by two separate service providers with the main connection providing 2Gbps synchronous speeds and the backup connection providing 500Mbps synchronous speeds.

The core network consist of two Cisco 6880 switches configured in a VSS with 40 Gbps of redundant connectivity. The core also contains four (4) Cisco Nexus 9000 series switches to support servers and redundant paths to both datacenters. The edge switches throughout the network are Cisco 2960-x POE switches connected back to the core via copper and fiber, operating at speeds of at 1Gbps and 10Gbps.

Our physical servers run on a mix of Dell PowerEdge and HP Proliant servers. The virtual server environment runs on VMware with Simplivity, with redundant nodes in each data center. This cluster provides redundancy for over 200 servers, with the ability for each location to become primary and continue to provide server access if the other location loses network connectivity.

Page | 10

B. GENERAL REQUIREMENTS

1. Physical Security: The contractor shall safeguard all Unified Government of Athens-Clarke County property provided for contractor use. At the close of each work period, vehicles, facilities, support equipment, and materials shall be secured.

2. Access Control: All on-site work and access will be coordinated through the designated IT contact.

The IT contact will arrange for access to secured areas. Vendors will be escorted by IT staff at all times. Remote work will be performed utilizing a Cisco Anyconnect VPN connection provided by IT. The contractor shall install any remote client software required to perform services indicated in this contract.

3. Contract Performance Period: Contract performance period shall be from the date of award unless terminated by either party giving to the other written notice of termination in writing thirty (30) days prior to the proposed date of termination. Termination by the Unified Government of Athens- Clarke County can be immediate upon contractor failure to comply with any of the terms.

4. Hours Of Operation: ACCUG operates 24 hours per day, seven days per week, including holidays.

Work performed by the vendor will be performed between the hours of 8:00AM and 5:00PM Eastern Time, Monday through Friday, unless previously arranged with IT.

5. Ordering and Payment: Performance will be ordered by issuance of a purchase order for the period of performance. Payment for work performed shall be paid monthly upon receiving invoicing with an attached copy of each certificate of receipt of service for that month signed by Department Director or designee. The contractor shall ensure that all invoices clearly reflect the purchase order number. All original invoices must be mailed or hand-delivered to Athens-Clarke County Accounts Payable, P.O. Box 1748, Athens, GA 30603 or Athens-Clarke County Accounts Payable, 375 Satula Avenue, Room 175, Athens, GA 30601. A duplicate invoice may be submitted to the department. Failure to comply with this provision may result in delayed payments for services rendered.

Page | 11

a. The Contractor shall prepare and submit invoices to the Finance Office address specified on individual orders. If the invoice does not comply with these requirements, the Finance Office will return it with the reasons why it is not a proper invoice. A proper invoice must include the items listed below.

(i) Name and address of the Contractor.

(ii) Invoice date and invoice number. (The Contractor should date invoices as close as possible to the date of the mailing or transmission.)

(iii) Purchase order number for supplies delivered or services performed.

(iv) Description, quantity, unit of measure, unit price, and extended price of supplies delivered or services performed.

(v) Shipping and payment terms (e.g., shipment number and date of shipment, discount for prompt payment terms).

(vi) Name and address to whom payment is to be sent.

(vii) Name (where practicable), title, phone number, and mailing address of the person to notify in the event of a defective invoice.

(viii) Any other information or documentation required by the contract (e.g., evidence of shipment).

b. In the event orders are made via monthly or period purchase orders, the contractor may provide a summary invoice for all deliveries made during a billing period, identifying the delivery tickets covered therein, stating their total dollar value. A summary invoice shall be supported by receipt copies of the delivery tickets. Delivery tickets or sales slips shall contain:

(i) Name of supplier

(ii) Purchase Order number

(iii) Ship to Department and Address

(iv) Description, Quantity, unit price, and extension of each item.

(v) Date of delivery or shipment.

C. ADDITIONAL REQUIREMENTS

1. TERMINATION FOR CAUSE: The Unified Government of Athens-Clarke County reserves the right to terminate the resulting contract, in whole or in part, for failure to comply with any provisions of the contract as outlined by providing a written notice to the successful vendor at least ten (10) days before the effective date of termination. The successful vendor will not be relieved of any outstanding responsibilities or unfinished obligations under this contract.

The successful vendor has the right to terminate this contract for cause by providing a written notice of intent to the Purchasing Administrator to terminate at least thirty (30) days prior to the effective date of the contract termination.

2. CONTRACT RENEWAL TERMS

The term of this contract shall be automatically extended for four (4) additional periods of one (1) year each (collectively “Renewal Term”) unless either party gives written notice of its intention not to renew, or the intention to modify, the agreement 90 days before expiration of the effective renewal term.

3. TERMINATION WITHOUT CAUSE: The Unified Government of Athens-Clarke County reserves the right to terminate the contract at any time without cause, in whole or in part, by providing a written notice to the other party at least thirty (30) days before the effective date of termination. The other party will not be relieved of any outstanding responsibilities or unfinished obligations under this contract that were incurred prior to termination.

Page | 12

5. REPORTING DISPUTES: The contractor shall report any contract disputes and/or problems to the Purchasing Administrator, both verbally and in writing, within 48 hours of their occurrence.

6. INDEPENDENT CONTRACTOR: The contractor shall not be an employee of the Unified

Government of Athens-Clarke County, but shall be an independent contractor. Nothing in this agreement shall be construed as authority for the contractor to make commitments which shall bind the Unified Government or to otherwise act on behalf of the Unified Government, except as the Unified Government may expressly authorize in writing.

7. SAFETY: The contractor shall take every precaution at all times for the protection of persons and property, including the Unified Government of Athens-Clarke County's employees and property and its own. The contractor shall be responsible for initiating, maintaining and supervising all safety precautions and programs in connection with the work under this contract.

The contractor shall maintain an adequate safety program to ensure the safety of contractor employees, subcontractor employees, and all other individuals working under this contract. In addition, the contractor must also provide the Unified Government of Athens-Clarke County with a written safety program that he intends to follow in pursuing work under this contract. No work under this contract will be permitted until the Unified Government is assured that the contractor has an adequate safety program in effect.

8. SUBCONTRACTS: No portion of the work shall be subcontracted without the prior written consent of the Unified Government of Athens-Clarke County Purchasing Division. If a portion of the work is approved for subcontracting, the contractor shall remain fully liable and responsible for the work to be done by the subcontractor(s) and shall assure compliance with all requirements of this contract.

9. ESTIMATED QUANTITIES: The quantities of items specified in the Proposal Schedule are estimates only and are not purchased by this contract. Except as this contract may otherwise provide, if the Unified Government of Athens-Clarke County requirements do not result in orders in the quantities described as "estimated", that fact shall not constitute the basis for an equitable price adjustment. Delivery shall be made only as authorized by orders issued in accordance with the Ordering clause. Subject to any limitations in the Order clause or elsewhere in this contract, the Contractor shall furnish to the Unified Government all items specified in the Proposal Schedule and called for by orders issued in accordance with the Ordering clause

10. CHANGES: Changes in the terms and conditions of this contract may be made only by written agreement of the parties.

11. INSURANCE.

a. The Contractor shall, at its own expense, provide and maintain during the entire performance of this contract, at least the kinds and minimum amounts of insurance specified below. The insurer shall be in good standing within the state of Georgia through the Insurance Commissioner’s Office and must be rated “A” or better, with AM Best Company.

b. Before commencing work under the contract, the Contractor shall provide to Athens Clarke

County, Attn: Purchasing Administrator, a Certificate of Insurance evidencing the required kinds and amounts of insurance. The minimum kinds and amounts of insurance shall be:

i. Workers’ Compensation – Contractors are required to comply with applicable Federal and Georgia State workers’ compensation statutes. Policies covering Workers’

Page | 13

Compensation liability shall provide coverage of statutory benefits and employers liability of at least $1,000,000 each accident; at least $1,000,000 each employee for disease and $1,000,000 policy limit for disease.

ii. General Liability - $2,000,000 aggregate; $1,000,000 per occurrence; 50,000 fire damage; 5,000 medical expenses; 1,000,000 products completed operations; 1,000,000 personal and advertising injury or greater. Coverage should be on a per occurrence basis.

iii. Automobile Liability – Automobile liability insurance shall be written on the comprehensive form of policy – Combined single limit of at least $1,000,000 to include Hired Autos and Non-owned Autos. The policy shall provide for bodily injury and property damage liability covering the operation of all automobiles used in connection with performing the contract.

iv. Excess Liability - $1,000,000 on a per occurrence basis

c. The Certificate of Insurance evidencing required insurance shall contain an endorsement to the effect that any cancellation or any material change adversely affecting The Unified Government of Athens Clarke County’s interest shall not be effective until 60 days after the insurer or the Contractor gives written notice to the Purchasing Administrator.

d. The Certificate of Insurance shall reference the proposal and project name as evidencing this requirement.

e. The Contractor shall insert the substance of this requirement, including this paragraph, in subcontracts under the contract that require work on The Unified Government of Athens- Clarke County property and shall require subcontractors to provide and maintain a copy of all subcontractors’ proofs of required insurance, and shall make copies available to the Purchasing Administrator upon request.”

f. The following persons or entities are to be listed on the Contractor’s general liability policy of insurance as additional insureds:

i. Unified Government of Athens-Clarke County, Georgia g Cyber Liability – If applicable to project and/or services, a minimum of $5,000,000 limit.

Additional coverage may be required per Safety and Risk assessment of data breach and/or sensitivity and volume of data, security, etc. Check with Safety and Risk as n eeded.

D. DEFINITIONS: N/A

E. SPECIFIC TASKS:

Work shall include, but not be limited to the following:

Provide 24x7 Security Operations Center (SOC):

The MSSP must be able to provide a 24x7 Security Operations Center (SOC) staffed by Security Analysts with the ability to continuously and proactively monitor the network to identify vulnerabilities in existing systems in order to prevent intrusions, including but not limited to malicious files/EXEs, malicious traffic, bad IP addresses/domains, and east/west traffic through Windows event log and sysmon monitoring. It is preferred that a named Security Analyst be assigned that will provide direct and timely security remediation if the need arises. Advanced machine learning and up-to-the-minute threat intelligence along with routine and non-routine task should also be utilized to help protect the network. The SOC should have the capability to prioritize remediation based on the potential business impact and should also provide information on common threats to my industry and/or geography

Page | 14

Monitoring of all ingress and egress network traffic via external endpoints:

The MSSP must be have the capapbility to monitor all ingress and egress network traffic via the two external endpoints on a 24x7 schedule to help protect our organization’s infrastructure from potential cybersecurity threats. This includes continous network traffic inspection to and from suspicious IP addresses and domains.

Monitor remote users:

The MSSP must be able to monitor remote users whether they are connected via our Cisco AnyConnect VPN client or connected only to the Internet. The MSSP must be able to detect malicious content and block data exfiltration and propogation by preventing the host from communicationg externally to help prevent its spread. The MSSP must notify IT of the detected threat in a timely manor based on the severity of the threat.

Respond to and contain detected threats:

The MSSP must be able to communicate effectively and in a timely manner with IT to warn of potential threats in order to provide IT with adequate time to mitigate internal threats. The MSSP must have the ability to contain threats and block data exfiltration and propogation by preventing host from communicating externally when detected to help prevent its spread. The MSSP must also have a proven method to mitigate false positive/false negatives to aid in time management/value of their solution.

Log retention and search capabilities:

The MSSP must be able to automatically collect, normalize, analyze and retain log data from existing networks, systems, and applications with the ability to easily and effectively search log files as needed.

This data should be presented in an easy to read and understand format along with quick and easy search capabilities. Logs must be retained for at least 180 days with the ability to automatically extend log retention when investigating specific threats that may cause required logs to extend outside of the 180 day retention period. It is prefered that log rentention remain in the United States, but if not possible the MSSP must explain where our data will be stored and what steps are taken to insure our data remains secure and separate from other customers data.

Software:

Software used such as remote agents must be free of exploits and bugs. Software should be evaluated and updated on a regular basis in order to detect exploits and to provide the highest security and threat detection possible. If possible, software should be customizable to meet the specific needs of our organization. Software must also be able to integrate and/or work in conjunction with corporate level Antivirus. In order to search for threats across all infrastructure including cloud and private, from a single portal, it is preferred that the MSSP have a single console solution that is capable of providing such search capabilities and access to real time monitoring.

Pricing:

ACCUG requires that the chosen solution be finely defined in terms of cost without any variables that will make cost prediction difficult. For that reason, we can not select a solution that is priced based on things like logs that can be highly variable.

Page | 15

SECTION IV - SELECTION PROCESS AND EVALUATION CRITERIA

The Unified Government of Athens-Clarke County intends to evaluate proposals and award a contract after conducting discussions with offerors whose proposals have been determined to be within the competitive range.

If it is determined that the number of proposals that would otherwise be in the competitive range exceeds the number at which an efficient competition can be conducted, the Unified Government may limit the number of proposals in the competitive range to the greatest number that will permit an efficient competition among the most highly rated proposals. Therefore, the offeror's initial proposal should contain the offeror's best terms from a price and technical standpoint.

EVALUATION CRITERIA

Evaluation criteria to be used in determining the selected firm in order of importance are:

1. FIRM EXPERIENCE in providing services to public sector organizations.

2. QUALIFICATIONS of staff assigned to the contracts.

3. UNDERSTANDING OF THE REQUIREMENT and the ability to Provide services.

4. REFERENCES including applicable past work with the Unified Government of Athens-Clarke County.

5. CONTRACTOR FURNISHED EQUIPMENT including adequacy and relevancy for the performance of the requirements of the contract.

Page | 16

SECTION V – PROPOSAL FORMS

A: PROPOSAL FORM

Proposal of___________________________________________________________

(Hereinafter called "Offeror"), organized and existing under the laws of the State of

__________________________, doing business as ________________________________*.

In compliance with your RFP, the Offeror hereby proposes and agrees to perform and furnish all work for the requirement known as RFP #24022 MANAGED SECURITY SERVICE in strict accordance with the Proposal Documents, within the time set forth therein, and at the price proposed.

By submission of this Proposal, the Offeror certifies, and in the case of a joint Offer, each party thereto certifies as to its own organization that:

1. The Offeror has examined and carefully studied the Proposal Documents and the Addenda, receipt of all of which is hereby acknowledged at Section V-B.

2. The Offeror agrees that this proposal may not be revoked or withdrawn after the time set for the opening of proposals but shall remain open for acceptance for a period of sixty (60) days following such time.

Company:

Contact:

Address:

Phone: Fax

Email:

By checking this box, I acknowledge that I have read all insurance requirements and will meet requirements listed in RFP #24022 MANAGED SECURITY SERVICE if awarded.

Authorized Representative/Title (print or type)

Authorized Representative (Signature)

Date

MANDATORY SUBMITTAL

Page | 17

B: ADDENDA ACKNOWLEDGEMENT

The Offeror has examined and carefully studied the Specifications and the following Addenda, Receipt of all of which is hereby acknowledged:

Addendum No.

dated

Acknowledgement

Initial

Offerors must acknowledge any issued addenda. Proposals which fail to acknowledge the offeror’s receipt of any addendum will result in the rejection of the proposal if the addendum contained information which substantively changes the Owner’s requirements.

Company Name (printed):

Page | 18

C: GEORGIA SECURITY & IMMIGRATION COMPLIANCE (GSIC) AFFIDAVIT

The Unified Government of Athens-Clarke County and Contractor agree that compliance with the requirements of O.C.G.A.

§ 13-10-91, as amended, and Rule 300-10-1-.02 of the Rules of the Georgia Department of Labor are conditions of this Agreement for the physical performance of services.

The Contractor further agrees that its compliance with the requirements of O.C.G.A. § 13-10-91, as amended, and DOL Rule 300-10-1-.02 is attested to on the executed Contractor Affidavit and Agreement attached hereto.

If employing or contracting with any subcontractor(s) in connection with this Agreement, Contractor further agrees:

(1) To secure from the subcontractor(s) an affidavit attesting to the subcontractor’s compliance with O.C.G.A. § 13-10-91, as amended, and DOL Rule 300-10-1-.02; such affidavit being in the form attached hereto; and

The failure of Contractor to supply the affidavit of compliance at the time of execution of this Agreement and/or the failure of Contractor to continue to satisfy the obligations of O.C.G.A. § 13-10-91, as amended, and DOL Rule 300-10-1-.02 as set forth in this Agreement throughout the contract period shall constitute a material breach of the contract. Upon notice of such breach, Contractor shall be entitled to cure the breach within ten days, upon providing satisfactory evidence of compliance with the terms of this Agreement and State law. Should the breach not be cured, Athens-Clarke County shall be entitled to all available remedies, including termination of the contract and damages.

SEE AFFIDAVIT ON FOLLOWING PAGE

Page | 19

C: CONTRACTOR AFFIDAVIT & AGREEMENT UNDER O.C.G.A. § 13-10-91(b)(1)

By executing this affidavit, the undersigned contractor verifies its compliance with O.C.G.A. § 13-10-91, as amended, stating affirmatively that the individual, firm or corporation which is engaged in the physical performance of services on behalf of The Unified Government of Athens-Clarke County, Georgia, has registered with, is authorized to use, and uses the federal work authorization program commonly known as E-Verify, or any subsequent replacement program, in accordance with the provisions and deadlines established in O.C.G.A. § 13- 10-91, as amended.

Furthermore, the undersigned will continue to use the federal work authorization program throughout the contract period and the undersigned contractor will contract for the physical performance of services in satisfaction of such contract only with subcontractors who present an affidavit to the contractor with the information required by O.C.G.A. § 13-10-91(b). Contractor hereby attests that its federal work authorization user identification number and date of authorization are as follows:

Federal Work Authorization Company Identification Number Date of Authorization

Name of Contractor: _______________________________________________________________

Name of Project: _______________________________________________________________

Name of Public Employer: The Unified Government of Athens-Clarke County

I hereby declare under penalty of perjury that the foregoing is true and correct.

Executed on ____, ___________, 202__ in _______________________, _____________________.

Signature of Authorized Officer or Agent

Printed Name and Title of Authorized Officer or Agent

SUBSCRIBED AND SWORN BEFORE ME ON THIS THE

____ DAY OF ____________, 202_

Notary Public My Commission Expires:

Page | 20

D: SCHEDULE OF SUPPLIES/SERVICES OR PRICE/PROPOSAL SCHEDULE

(Must be submitted separately in a sealed envelope)

Company Name (printed):

Page | 21

SECTION VI – OPTIONAL FORMS

A. BID LIST APPLICATION

We would like for this form to be turned in a minimum of four (4) days prior to bid

If you have an ACCGov Vendor Number please include it on the sealed envelope or container.

If you do not know your ACCGov Vendor Number, please call 706-613-3088 or email:

vendor@accgov.com

If you DO NOT HAVE an ACCGov Vendor Number, please fill out the bidder’s list application attached below.

mailto:accpurchasing@athensclarkecounty.com

Page | 22

SECTION VII DOCUMENTS CHECKLIST:

PROPOSAL DOCUMENTS CHECKLIST:

1. Cover Letter

2. Table of Contents

3. Business Information

4. Qualifications and Experience

5. References/Reference Projects

6. Other Relevant Information

MANDATORY PROPOSAL FORMS (SECTION V) Offeror must complete, execute and include with the proposal the following mandatory documents:

A. Proposal form

B. Acknowledgement of Addenda

C. Georgia Security & Immigration Compliance (GSIC) Act Affidavit

D. Schedule of Services/Supplies and Price Proposal (Must be submitted separately in a sealed envelope)

Page | 23

ATTACHMENT A

What Your Business Needs to Know about Georgia’s E- Verify Requirements

(Effective July 1, 2013) E-Verify Contractor Requirements Georgia law, O.C.G.A. § 13-10-91, requires all businesses that contract with a public employer for labor or services by bid or by contract in which the labor or services exceed $2499.99 to sign an affidavit attesting that they are registered for and use E-Verify unless 1) the contractor has no employees (in which case they must present an approved state issued identification card/drivers’ license from an approved state as provided on the Attorney General’s website ) or, 2) the contract is with an individual licensed under Title 26, Title 43, or the State Bar of Georgia who is in good standing and that individual is performing that service. Anyone your business subcontracts with for labor and services, as well as the subcontractors of your subcontractors, in furtherance of that contract is also subject to this requirement. E-Verify Contractor, Subcontractor, and Sub-Subcontractor affidavits can be found here.

E-Verify Private Employer Requirements Georgia law, O.C.G.A. § 36-60-6, requires all businesses, with more than 10 employees that are seeking an occupation tax certificate/business license or other document required to operate a business with a county or city to sign an affidavit attesting that they are registered for and use E-Verify. Businesses with 10 or fewer employees are required to sign an affidavit attesting that they are exempt from this requirement. Once a business has provided this affidavit to the county, all subsequent renewals can be provided with the submission of the E-Verify number, as long as it is the same number as provided on the affidavit, or assertion that your business is exempt. The county will provide the format in which renewal information is collected. E-Verify Private Employer and Exemption Affidavits can be found here.

What Is E-Verify?

E-Verify is a federal Web-based system that electronically verifies the employment eligibility of newly hired employees.

It works by allowing participating employers to electronically compare employee information taken from the I-9 Form (the paper-based employee eligibility verification form used for all new hires) against records in the Social Security Administration's database and the records in the Department of Homeland Security immigration databases.

Where Do I Find My E-Verify Number?

The Human Resources Department for your business should have that information, if you have registered. The E-Verify number, which consists of four to six numerical characters, is located directly below the E-Verify logo on the first page of the memorandum of understanding (MOU) entered into between your business and the Department of Homeland Security (DHS) to use E-Verify.

What if I cannot locate or do not have access to my MOU?

If the HR director/program administrator for E-Verify from your business has taken the E-Verify tutorial, you may obtain your company ID number by: 1) Logging in to E-Verify with your assigned user ID and password; 2) From 'My Company,' select 'Edit Company Profile;' 3) The Company Information page will display the company ID number. If your HR director/ program administrator has not completed the tutorial, you must contact E-Verify Customer Support at 888-464-4218 or at E-Verify@dhs.gov for assistance.

Is the Federal Tax Identification Number/Employer Identification Number (EIN) the same as the E-Verify Number?

No. While you will be required to provide the Federal Tax Identification Number/EIN for your business to DHS in order to register for E-Verify, a separate number, which consists of four to six numerical characters, will be…