26-19 RFP Next-Generation Firewall Replacement Project.pdf

TOWN OF WESTFORD

Request for Proposals

26-19

Next-Generation Firewalls Replacement Project

Office of the Town Manager

55 Main Street Westford, MA 01886

Release Date: May 20, 2026 @ 10:00 AM

Deadline for Questions: May 27, 2026 @ 4:00 PM

Proposal Response Deadline: June 4, 2026 @ 2:00 PM

Town of Westford 26-19 RFP Next-Generation Firewalls Replacement Project Page 1 of 17

1. Overview

1.1 Purpose

1.2 Background

1.3 Project Goals

2. Scope of Work

2.1 Hardware and Software

2.2 Installation and Configuration

2.3 Migration Services

2.4 Network Integration

2.5 VPN Deployment

2.6 Training and Knowledge Transfer

2.7 Support and Maintenance

3. Technical Requirements

3.1 Management Requirements

3.2 Performance Requirements

3.3 Interface Requirements

3.4 WAN and Routing

3.5 DMZ

3.6 Security Services

3.7 Content Filtering

3.8 VPN Requirements

3.9 Logging and Compliance

3.10 Optional Capabilities

4. Vendor Qualifications

5. Proposal Submission Requirements

6. Evaluation Criteria

7. Pricing Requirements

8. Terms and Conditions

9. Project Timeline

10. Attachments

Town of Westford 26-19 RFP Next-Generation Firewalls Replacement Project Page 2 of 17

1. Overview

1.1 Purpose

The Town of Westford (“Town”) is seeking proposals from qualified vendors to provide, install, and configure a next-generation firewall (NGFW) solution to replace its existing firewall and content filtering infrastructure. The Town intends to consolidate its current deployment of nine (9) firewalls and nine (9) content filtering devices into four (4) NGFW appliances deployed across multiple municipal sites.

1.2 Background

The Town operates a multi-site municipal and school network environment supporting administrative operations, public safety, and educational services. The Town currently utilizes a centralized firewall management platform and operates with limited IT staffing resources, requiring solutions that minimize administrative overhead and complexity.

1.3 Project Goals

• Replace existing firewall and content filtering infrastructure

• Consolidate security services into fewer high-capacity devices

• Improve cybersecurity posture with advanced threat protection

• Maintain or improve centralized management capabilities

• Minimize operational overhead

• Ensure CJIS compliance

2. Scope of Work

2.1 Hardware and Software

• Provide four (4) NGFW appliances

• Provide all required licensing and subscriptions

2.2 Installation and Configuration

• Install and configure firewalls

• Configure WAN interfaces and routing

• Enable all required security services

2.3 Migration Services

The solution should maximize reuse of existing firewall objects, policies, and configurations where feasible to reduce implementation time and operational risk.

• Review and migrate firewall rules

• Review and migrate NAT configurations

• Review and migrate network objects

• Minimize downtime during cutover Town of Westford 26-19 RFP Next-Generation Firewalls Replacement Project Page 3 of 17

2.4 Network Integration

• Review internal routing schema

• Assist with WAN failover and load balancing

• Assist with multi-WAN routing design

2.5 VPN Deployment

• Configure remote access VPN with MFA

• Support site-to-site VPN

• Support integration with SSO providers (Azure AD, Google Workspace)

2.6 Training and Knowledge Transfer

Vendor shall provide sufficient training and documentation to ensure Town IT staff can effectively manage the solution.

2.7 Support and Maintenance

• 24x7 support required

• Firmware updates for minimum of seven (7) years

3. Technical Requirements

3.1 Management Requirements

Proposed solutions must support integration with the Town’s existing centralized firewall management environment or provide a migration approach that minimizes administrative overhead and avoids duplication of policy management across multiple systems.

Preference will be given to solutions that allow unified management within a single interface without parallel policy administration.

3.2 Performance Requirements

Minimum 5 Gbps throughput with full SSL/TLS inspection enabled and all security services active.

3.3 Interface Requirements

• Minimum 4 WAN interfaces capable of 10 Gbps

• Minimum 8 LAN interfaces capable of 10 Gbps

• TLS capable of 5 Gbps

3.4 WAN and Routing

• Support multi-WAN failover

• Support load balancing

• Support policy-based routing

Town of Westford 26-19 RFP Next-Generation Firewalls Replacement Project Page 4 of 17

3.5 DMZ

• Must be implemented as a screened subnet architecture (separate security zone with its own interfaces) – not simply a “DMZ zone” on the same firewall without proper isolation.

• Any additional modules, blades, or licenses required for advanced DMZ features (e.g., SSL decryption in DMZ, IPS in DMZ, URL filtering, etc.) must be included and quoted.

3.6 Security Services

• Firewall

• IDS/IPS

• Anti-malware

• Sandboxing

• Anti-ransomware

• SSL inspection

• Application Control

• Anti-Bot

3.7 Content Filtering

• URL filtering

• SSL inspection

• User and IP-based policies

• Reporting and logging

• Directory integration

3.8 VPN Requirements

• Remote access VPN with MFA

• Site-to-site VPN

• SSO compatibility

3.9 Logging and Compliance

• CJIS compliance

• Audit logging

• SIEM integration capability

3.10 Optional Capabilities

Support for east-west traffic inspection is preferred but not required.

4. Vendor Qualifications

• Experience with municipal/public sector deployments

• Relevant certifications

• Minimum three references

• Financial stability

Town of Westford 26-19 RFP Next-Generation Firewalls Replacement Project Page 5 of 17

5. Proposal Submission Requirements

• Non-price (Technical) Proposal (as separate PDF document attached to submission):

• Executive summary

• Technical solution

• Implementation plan (including proposed timeline)

• Migration approach

• Training plan

• Support model

• Certifications

• Attachment B – Certificate of Tax Compliance and Non-Collusion

• Attachment C – Signing Authority (as applicable to corporate form)

• Price Proposal (as separate PDF document attached to submission)

Questions Deadline: May 27, 2026 @ 4:00 PM. Questions must be submitted via email to tmaa@westfordma.gov with the subject line “26-19 RFP Next-Generation Firewall Replacement Project Questions”.

Proposal Due Date: June 4, 2026 @ 2:00 PM Submission Method: All proposals must be submitted electronically, in .pdf format, to the Town Manager’s Office via email at tmaa@westfordma.gov with the subject line “26-19 RFP Next-Generation Firewall Replacement Project Proposal”. Hardcopies will not be accepted. Note Technical Proposal and Price Proposal shall be labeled as such and submitted on the same email submission as separate PDF documents.

6. Evaluation Criteria Proposals will be evaluated first on the merits of the technical solution and overall operational effectiveness. Cost proposals will be considered only after technical evaluation and will be evaluated as a secondary factor.

Criteria

Weight

Technical Solution & Operational Efficiency 35% Cost 25%

Vendor Experience 15% Implementation Approach 15%

Support 10%

7. Pricing Requirements

• Hardware pricing

• Licensing costs

• Professional services

• Training

• Support costs

Town of Westford 26-19 RFP Next-Generation Firewalls Replacement Project Page 6 of 17 mailto:tmaa@westfordma.gov mailto:tmaa@westfordma.gov

• All pricing shall be structured as annual costs for a term not to exceed three (3) years.

Vendors must not require upfront or multi-year prepayment for licensing, subscriptions, or support services. All payments shall be invoiced and payable within the Town’s fiscal year in accordance with Massachusetts municipal finance requirements.

8. Terms and Conditions

• The selected vendor will be required to execute the Town’s Standard Contract

(Attachment A).

• Termination for Cause or Convenience - The Town reserves the right to terminate the contract for cause or convenience with appropriate written notice.

9. Project Timeline Milestone Date

RFP Release May 20, 2026 @ 10:00 AM Proposal Due June 4, 2026 @ 2:00 PM

Award June 9, 2026 Project Start As soon as possible.

Installation Summer 2026

10. Attachments

The following documents and attachments, including any requirements or standards set forth within, are hereby incorporated into this Request for Proposals:

Attachment A – Town of Westford Standard Contract Attachment B – Certificate of Tax Compliance and Non-Collusion Attachment C – Signing Authority (as applicable to corporate form) Attachment D – TOW Digital ADA Procurement Clause

Town of Westford 26-19 RFP Next-Generation Firewalls Replacement Project Page 7 of 17

TOWN OF WESTFORD, MASSACHUSETTS

AGREEMENT

THIS AGREEMENT made this ____ day of __________, 20__ by and between the TOWN OF WESTFORD, a municipal corporation duly organized under the laws of Massachusetts and having a usual place of business at 55 Main Street, Westford, MA 01886, hereinafter referred to as the “TOWN”, and ___________________________,[a _____________ corporation] having a usual place of business at ___________________________, hereinafter referred to as the

“CONTRACTOR”.

WITNESSETH:

WHEREAS, the TOWN invited the submission of proposals for the purchase and delivery of ___________________________________________, hereinafter “the Project”; and

WHEREAS, the CONTRACTOR submitted a proposal to perform the work required to complete the Project; and

WHEREAS, the TOWN has decided to award the contract therefor to the CONTRACTOR.

NOW, THEREFORE, the TOWN and the CONTRACTOR agree as follows:

1. CONTRACT DOCUMENTS. The Contract Documents consist of this Agreement, _______________, _______________ and the CONTRACTOR’s Proposal. The Contract Documents constitute the entire Agreement between the parties concerning the work, and all are as fully a part of this Agreement as if attached hereto. If there is any inconsistency between any of the Contract Documents, the terms most favorable to the Town shall govern.

2. THE WORK. The Work consists of providing the services required of the Project, as more fully described in the Contract Documents.

3. TERM OF CONTRACT. This Agreement shall be in effect from ___________and shall expire on _________________, unless terminated earlier pursuant to the terms hereof.

4. COMPENSATION.

A. The TOWN shall pay the CONTRACTOR as full compensation for performance of the Work outlined in Section 2 above in accordance with the payment schedule included herein as Attachment A.

Attachment A - Standard Contract

Town of Westford 26-19 RFP Next-Generation Firewalls Replacement Project Page 8 of 17

B. The acceptance by the CONTRACTOR of final payment for performance of the Work provided herein shall be deemed a release of the TOWN from any and all claims and liabilities under this Agreement.

C. Neither the TOWN’s review, approval or acceptance of, nor payment for performance of any of the Work provided herein shall be construed to operate as a waiver of any rights of the TOWN under the Agreement or any cause of action arising out of the performance of this Agreement.

D. The TOWN shall cancel this Agreement if funds are not appropriated or otherwise made available to support continuation of performance of the Work in any fiscal year succeeding the current fiscal year as required by G.L. c. 30B, sec. 12(c)(3).

5. PAYMENT OF COMPENSATION. The TOWN shall make payments within thirty (30) days after its receipt of a complete and satisfactory written Invoice.

6. LIABILITY OF THE TOWN. The TOWN’s liability hereunder shall be to make all payments when they shall become due, and the TOWN shall be under no further obligation or liability. Nothing in this Agreement shall be construed to render the TOWN or any elected or appointed official or employee of the TOWN, or their successors in office, personally liable for any obligation under this Agreement.

7. INDEPENDENT CONTRACTOR. The CONTRACTOR acknowledges and agrees that it is acting as an independent contractor for all Work and services rendered pursuant to this Agreement, and shall not be considered an employee or agent of the TOWN for any purpose.

8. INDEMNIFICATION. The CONTRACTOR shall indemnify, defend, and hold the TOWN harmless from and against any and all claims, demands, liabilities, actions, causes of actions, costs and expenses, including attorney’s fees, arising out of the CONTRACTOR's breach of this Agreement or the negligence or misconduct of the CONTRACTOR, or the CONTRACTOR's agents or employees. This obligation shall survive the termination or expiration of this Agreement.

9. INSURANCE.

A. The CONTRACTOR shall obtain and maintain during the term of this Agreement the insurance coverage in companies licensed to do business in the Commonwealth of Massachusetts, and acceptable to the TOWN, as set forth below:

Town of Westford 26-19 RFP Next-Generation Firewalls Replacement Project Page 9 of 17

General Liability with liability coverage for personal injury, bodily injury and property damage including Products and Completed Operations with limits not less than $1,000,000 per occurrence and $3,000,000 aggregate. Such insurance shall be written on an occurrence basis. This policy shall provide coverage on a primary and non-contributory basis and should name the Municipality as an "Additional Insured".

Automobile Liability with limits of not less than $1,000,000 covering all owned, non-owned, hired, rented or leased vehicles. The Municipality shall be named as an "Additional Insured".

Workers' Compensation and Employers' Liability Insurance including (i) Workers' Compensation Insurance providing statutory coverage as required by the Commonwealth of Massachusetts, and (ii) Employers' Liability Insurance coverage with limits of not less than $500,000 per accident. Each contractor, subcontractor, and consultant performing work on or about the Premises shall have similar policies covering their employees.

Umbrella Liability of at least $2,000,000 per occurrence with a $2,000,000 Annual Aggregate. The Municipality shall be named as an “Additional Insured”.

B. All policies shall identify the TOWN as an additional insured (except Workers' Compensation) and shall provide that the TOWN shall receive written notification at least 30 days prior to the effective date of any amendment or cancellation. Certificates evidencing all such coverages shall be provided to the TOWN upon the execution of this Agreement. Each such certificate shall specifically refer to this Agreement and shall state that such insurance is as required by this Agreement. Failure to provide or to continue in force such insurance shall be deemed a material breach of this Agreement and shall be grounds for immediate termination.

10. ASSIGNMENT. The CONTRACTOR shall not assign, sublet or otherwise transfer this Agreement, in whole or in part, without the prior written consent of the TOWN, and shall not assign any of the moneys payable under this Agreement, except by and with the written consent of the TOWN.

11. TERMINATION.

A. Termination for Cause. If at any time during the term of this Agreement the TOWN determines that the CONTRACTOR has breached the terms of this Agreement by negligently or incompetently performing the Work, or any part thereof, or by failing to perform the Work in a timely fashion, or by failing to perform the Work to the satisfaction of the TOWN, or by not complying with the direction of the TOWN or its agents, or by otherwise failing to perform this Agreement in accordance with all of its terms and provisions, the TOWN shall notify the CONTRACTOR in writing stating therein the nature of the alleged breach and directing the CONTRACTOR to cure such breach within ten (10) days. The CONTRACTOR specifically agrees that it shall indemnify and hold the TOWN harmless from any loss, damage, cost, charge, expense or claim arising out of or resulting from such

Town of Westford 26-19 RFP Next-Generation Firewalls Replacement Project Page 10 of 17 breach regardless of its knowledge or authorization of the actions resulting in the breach. If the CONTRACTOR fails to cure said breach within ten (10) days, the TOWN may, at its election at any time after the expiration of said ten (10) days, terminate this Agreement by giving written notice thereof to the CONTRACTOR specifying the effective date of the termination. Upon receipt of said notice, the CONTRACTOR shall cease to incur additional expenses in connection with this Agreement. Upon the date specified in said notice, this Agreement shall terminate. Such termination shall not prejudice or waive any rights or action which the TOWN may have against the CONTRACTOR up to the date of such termination, and the CONTRACTOR shall be liable to the TOWN for any amount which it may be required to pay in excess of the compensation provided herein in order to complete the work specified herein in a timely manner. Upon such termination, the CONTRACTOR shall be entitled to compensation for all satisfactory Work completed prior to the termination date, as determined by the TOWN.

B. Termination for Convenience. The TOWN may terminate this Agreement at any time for convenience by providing the CONTRACTOR written notice specifying therein the termination date which shall not be sooner than ten (10) days from the issuance of said notice. Upon receipt of said notice, the CONTRACTOR shall cease to incur additional expenses in connection with this Agreement. Upon such termination, the CONTRACTOR shall be entitled to compensation for all satisfactory Work completed prior to the termination date, as determined by the TOWN, such payment not to exceed the fair value of the services provided hereunder.

12. INSPECTION AND REPORTS. The TOWN shall have the right at any time to inspect the Work of the CONTRACTOR, including the right to enter upon any property owned or occupied by CONTRACTOR, whether situated within or beyond the limits of the TOWN.

Whenever requested, CONTRACTOR shall immediately furnish to the TOWN full and complete written reports of his operation under this Contract in such detail and with such information as the TOWN may request.

13. SUCCESSOR AND ASSIGNS. This Agreement is binding upon the parties hereto, their successors, assigns and legal representatives. Neither the TOWN nor the CONTRACTOR shall assign or transfer any interest in the Agreement without the written consent of the other.

14. COMPLIANCE WITH LAWS. The CONTRACTOR shall comply with all Federal, State and local laws, rules, regulations and orders applicable to the Work provided pursuant to this Agreement, such provisions being incorporated herein by reference, and shall be responsible for obtaining all necessary licenses, permits, and approvals required for the performance of such Work.

Town of Westford 26-19 RFP Next-Generation Firewalls Replacement Project Page 11 of 17

15. NOTICE. Any and all notices, or other communications required or permitted under this Agreement, shall be in writing and delivered by hand or mailed postage prepaid, return receipt requested, by registered or certified mail or by other reputable delivery service, to the parties at the addresses set forth on Page 1 or furnished from time to time in writing hereafter by one party to the other party. Any such notice or correspondence shall be deemed given when so delivered by hand, if so mailed, when deposited with the U.S. Postal Service or, if sent by private overnight or other delivery service, when deposited with such delivery service.

16. SEVERABILITY. If any term or condition of this Agreement or any application thereof shall to any extent be held invalid, illegal or unenforceable by the court of competent jurisdiction, the validity, legality, and enforceability of the remaining terms and conditions of this Agreement shall not be deemed affected thereby unless one or both parties would be substantially or materially prejudiced.

17. GOVERNING LAW. This Agreement shall be governed by, construed and enforced in accordance with the laws of the Commonwealth of Massachusetts and the CONTRACTOR submits to the jurisdiction of any of its appropriate courts for the adjudication of disputes arising out of this Agreement.

18. ENTIRE AGREEMENT. This Agreement, including all documents incorporated herein by reference, constitutes the entire integrated agreement between the parties with respect to the matters described. This Agreement supersedes all prior agreements, negotiations and representations, either written or oral, and it shall not be modified or amended except by a written document executed by the parties hereto.

19. ELECTRONIC SIGNATURES. Each party agrees that the electronic signatures, whether digital or encrypted, of the parties included in this Agreement, if any, are intended to authenticate this writing and to have the same force and effect as manual signatures. The term “electronic signature” means any electronic sound, symbol, or process attached to or logically associated with a record and executed and adopted by a party with the intent to sign such record, including facsimile or email electronic signatures. Without limiting the generality of the foregoing, delivery of an executed counterpart’s signature page of this Agreement, by facsimile, electronic mail in portable document format (.pdf) or by any other electronic means intended to preserve the original graphic and pictorial appearance of a document, has the same effect as delivery of an executed original of this Agreement.

Town of Westford 26-19 RFP Next-Generation Firewalls Replacement Project Page 12 of 17

IN WITNESS WHEREOF, the parties hereto have executed this Agreement on the day and year first above written.

I certify that an appropriation TOWN OF WESTFORD is available in the amount of this

Contract. By its Town Manager

Town Accountant (Signature)

CONTRACTOR

(Signature)

(Name and Title)

Town of Westford 26-19 RFP Next-Generation Firewalls Replacement Project Page 13 of 17

CERTIFICATIONS REQUIRED BY LAW

You must COMPLETE and SIGN the following certifications. You must also print, at the bottom of this page, the name of the contractor for whom these certifications are submitted.

TAX COMPLIANCE

Pursuant to Chapter 62C of the Massachusetts General Laws, Section 49A(b), I, the undersigned, authorized signatory for the below named contractor, do hereby certify under the pains and penalties of perjury that said contractor has complied with all laws of the Commonwealth of Massachusetts relating to taxes, reporting of employees and contractors, and withholding and remitting child support.

NON-COLLUSION

The undersigned certifies under the penalties of perjury that this bid or response (as applicable) is in all respects bona fide, fair and made without collusion or fraud with any other person. As used in this subsection the word "person'' shall mean any natural person, joint venture, partnership, corporation or other business or legal entity.

COMPLETE AND SIGN BELOW:

Authorized Person’s Signature Date

Print Name & Title of Signatory

Name of Contractor

Attachment B - Required Certifications

Town of Westford 26-19 RFP Next-Generation Firewalls Replacement Project Page 14 of 17

CERTIFICATE OF CORPORATE AUTHORITY

At a duly authorized meeting of the Board of Directors of ________________________ (Name of Corporation) held on _________________ it was VOTED that:

(Date)

(Name) (Title) of this corporation, be and he/she hereby is authorized to submit bids and proposals, execute contracts, deeds and bonds in the name and on behalf of said corporation, and affix its corporate seal thereto; and such execution of any contract, deed or obligation in this corporation's name on its behalf by such _________________________ under seal of the company, shall be valid and binding upon this corporation.

A True Copy, ATTEST: _____________________________________

TITLE: _______________________________________

PLACE OF BUSINESS: _________________________

DATE OF THIS CERTIFICATE: __________________

I hereby certify that I am the clerk of the _____________________________ (Corporation) that _________________________ is the duly elected ________________________ of (Name) (Title) said corporation, and that the above vote has not been amended or rescinded and remains in full force and effect as of the date of this Certification.

(Clerk)

CORPORATE SEAL:

241362/kope/0003

Town of Westford 26-19 RFP Next-Generation Firewalls Replacement Project Page 15 of 17

, MASSACHUSETTS

LLC Certificate of Incumbency and Authority

, LLC

I, , do hereby certify that:

1. I am the duly elected and acting of LLC, a limited liability company organized and existing in good standing under the laws of the State of (the “Company”).

2. Attached hereto as Exhibit A is a true and correct copy of resolutions which were duly adopted by the members of the Company on , 20 .

3. The attached resolutions have not been amended, rescinded or modified and are in full forces and effect on the date hereof in the form originally adopted, and are in conformity with the Articles of Organization and Operating Agreement of the Company.

4. Attached hereto as Exhibit B is a true and correct copy of the Articles of Organization dated

, 20___ and the Operating Agreement dated , 20___.

5. The attached Articles of Organization and Operating Agreement have not been amended, rescinded, or modified and are in full forces and effect on the date hereof.

6. The following person are the Authorized Officers of the Company in the capacities indicated, and the signatures set forth after their names and titles are their true and genuine signatures.

Name Office Signature

Witness, my signature and the seal of the Company this day of , 20__.

Name:

Title:

844378/90002/0047

Town of Westford 26-19 RFP Next-Generation Firewalls Replacement Project Page 16 of 17

Digital ADA Compliance Procurement Clause

As a condition of this agreement, the Contractor shall ensure that all digital documents created, provided, or delivered under this contract for the Town of Westford comply with the Americans with Disabilities Act (ADA) and meet the accessibility standards set forth in the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA, or any superseding standard recognized by the U.S. Department of Justice.

This requirement applies to, but is not limited to, digital formats such as PDF, Word, Excel, PowerPoint, HTML, and other electronic documents intended for public distribution or internal use by Town staff.

The Contractor shall:

1. Deliver accessible digital documents that are fully navigable by screen readers and assistive technologies.

2. Ensure that all documents provided to the Town include (and is not limited to):

• Document Title

• Properly formatted headings

• Alt text on all images

• Logical reading order

• Tab order

• Tagged text

• Color contrast check

• Proper text size

• Properly formatted tables

• Bookmarks

3. Provide certification or documentation verifying accessibility compliance upon delivery.

4. Provide contact information for the party responsible for remediation of any accessibility barriers found by the Town of Westford.

5. Promptly remediate any identified accessibility barriers at no additional cost to the Town.

The Town of Westford reserves the right to audit delivered documents for accessibility compliance at any time.

Failure to meet these requirements may result in the withholding of payment, contract termination, or other remedies as deemed appropriate by the Town.

Town of Westford 26-19 RFP Next-Generation Firewalls Replacement Project Page 17 of 17