41-DIT-1421525913 CLOUDFLARE ZTNA LICENSES IFB.pdf

Rev. 2025/02/06

STATE OF NORTH CAROLINA INVITATION FOR BIDS NO. 41-DIT-1421525913

CLOUDFLARE ZTNA LICENSES IFB

THE NORTH CAROLINA DEPARTMENT OF

INFORMATION TECHNOLOGY

Agency Procurement

Offers will be publicly opened: 2/21/2025

Issue Date: 2/6/2025

Refer ALL inquiries regarding this IFB to:

Kelley Fore

Kelley.fore@nc.gov

919-754-6665

Commodity Number: 811620 – Cloud-based software as a service

Description of Solicitation: ZTNA licenses and migration services from Cloudflare

Using Agency: The North Carolina Department of Information Technology

See page 2 for mailing instructions. Requisition No.: RQ151118

OFFER AND ACCEPTANCE

The State seeks offers for the Software, Services and/or goods described in this solicitation. The State’s acceptance of any offer must be demonstrated by execution of the acceptance found below and any subsequent Request for Best and Final Offer (BAFO), if issued. Acceptance shall create a contract having an order of precedence as follows:

In cases of conflict between documents comprising the contract, the order of precedence shall be (1) Best and Final Offers, if any, (2) special terms and conditions specific to this Invitation for Bids (IFB), (3) specifications, (4) NC Department of Information Technology (NCDIT) Terms and Conditions of this IFB, and (5) the agreed portions of the awarded Vendor’s offer. No contract shall be binding on the State until an encumbrance of funds has been made for payment of the sums due under the contract.

EXECUTION

In compliance with this IFB and subject to all the conditions herein, the undersigned offers and agrees to furnish any or all Services or goods upon which prices are offered, at the price(s) offered herein, within the time specified herein.

By executing this offer, I certify that this offer is submitted competitively and without collusion.

Failure to execute/sign offer prior to submittal shall render offer invalid. Late offers are not acceptable.

OFFEROR:

STREET ADDRESS: P.O. BOX: ZIP:

CITY, STATE & ZIP: TELEPHONE NUMBER: TOLL FREE TEL.

NO

PRINT NAME & TITLE OF PERSON SIGNING: FAX NUMBER:

AUTHORIZED SIGNATURE: DATE: E-MAIL:

Offer valid for sixty (60) days from date of offer opening unless otherwise stated here: ____ days

ACCEPTANCE OF OFFER

If any or all parts of this IFB are accepted, an authorized representative of Department of Information Technology shall affix their signature hereto. A copy of this acceptance will be forwarded to the successful vendor(s).

FOR STATE USE ONLY

Offer accepted and contract awarded _____________________________________, as indicated on attached certification, by _____________________________________________ (Authorized representative of Department of Information Technology ).

TABLE OF CONTENTS

1.0 INTENT, USE, DURATION AND SCOPE

2.0 GENERAL INFORMATION

2.1. VENDOR QUESTIONS

2.2. ADDENDA

2.3. OFFER SUBMITTAL

2.4. BASIS FOR REJECTION

2.5. LATE OFFERS

2.6. NON-RESPONSIVE OFFERS

2.7. NOTICE TO VENDOR(S)

2.8. E-PROCUREMENT SOLICITATION

2.9. DISTRIBUTORS AND RESELLERS

2.10. POSSESSION AND REVIEW

2.11. BEST AND FINAL OFFERS (BAFO)

2.12. AWARD

2.13. POINTS OF CONTACT

3.0 SPECIFICATIONS

3.1. VENDOR STANDARD AGREEMENT(S)

3.2. VENDOR UTILIZATION OF WORKERS OUTSIDE U.S

3.3. E-VERIFY

3.4 BRAND SPECIFIC PRODUCT

3.5. SECURITY SPECIFICATIONS

3.7. DELIVERY

3.8. CONTRACT TERM

4.0 FURNISH AND DELIVER

5.0 HISTORICALLY UNDERUTILIZED BUSINESSES

6.0 NC DEPARTMENT OF INFORMATION TECHNOLOGY INSTRUCTIONS TO VENDORS

7.0 NC DEPARTMENT OF INFORMATION TECHNOLOGY TERMS AND CONDITIONS………………………. 18

1.0 INTENT, USE, DURATION AND SCOPE

The purpose of this IFB is to obtain pricing for and procure Cloudflare ZTNA licenses and migration services for the North Carolina Department of Information Technology (NCDIT). Products and Services will be provided in accordance to the terms and conditions of this IFB.

Contract Term: The Term of this contract will be three (3) years with two (2) one-year options to renew at the sole discretion of the State.

2.0 GENERAL INFORMATION

Action Responsibility Date

IFB Issued Agency 2/6/2025

Written Questions Deadline Potential Vendors 2/12/2025

Agency’s Response to Written Questions - Addendum Issued Agency 2/13/2025

Vendor Submittal Opening

Deadline Vendor(s) 2/21/2025

2.1. VENDOR QUESTIONS

Upon review of the IFB documents, Vendors may have questions to clarify or interpret the IFB in order to submit the best bid possible. To accommodate the Bid Questions process, Vendors shall submit any such questions by the “Submit Written Questions” date and time provided in the IFB SCHEDULE above, unless modified by an Addendum.

Questions related to the content of the solicitation, or the procurement process should be directed to the person on the title page of this document via the Sourcing Tool's message board by the date and time specified in the IFB SCHEDULE Section of this IFB. Vendors will enter “Questions Solicitation IFB-41-DIT-1421525913” as the subject of the message. Question submittals should include a reference to the applicable IFB section. This is the only manner in which questions will be received.

Questions or issues related to using the Sourcing Tool itself can be directed to the North Carolina eProcurement Help Desk at 888-211-7440, Option 2. Help Desk representatives are available Monday through Friday from 7:30 AM ET to 5:00 PM ET.

Questions received prior to the submission deadline date, the State’s response, and any additional terms deemed necessary by the State will be posted in the Sourcing Tool in the form of an addendum and shall become an Addendum to this IFB. No information, instruction or advice provided orally or informally by any State personnel, whether made in response to a question or otherwise in connection with this IFB, shall be considered authoritative or binding. Vendors shall rely only on written material contained in the IFB and an addendum to this IFB.

2.2. ADDENDA

The State may issue addenda if Vendor questions are permitted as described below, or if additional terms, specifications, or other changes are necessary for this procurement. All addenda shall become an Addendum to this IFB.

2.3. OFFER SUBMITTAL

Due Date: 2/21/2025

Time: 2:00pmEastern Time

IMPORTANT NOTE: It is the Vendor’s sole responsibility to upload their offer to the Ariba Sourcing Module by the specified time and date of opening. Vendor shall bear the risk for late electronic submission due to unintended or unanticipated delay, including but not limited to internet issues, network issues, local power outages, or application issues. Vendor must include all the pages of this solicitation in their response.

Sealed offers, subject to the conditions made a part hereof, will be received until 2:00 pm Eastern Time on the day of opening and then opened, for furnishing and delivering the commodity as described herein. Offers must be submitted via the Ariba Sourcing Module with the Execution page signed and dated by an official authorized to bind the Vendor’s firm. Failure to return a signed offer shall result in disqualification.

Attempts to submit a proposal via facsimile (FAX) machine, telephone, email, email attachments, or in any hardcopy format in response to this Bid SHALL NOT be accepted and will automatically be deemed Non-Responsive.

a) Submit one (1) signed, original electronic offer through the Ariba Sourcing Module.

b) The Ariba Sourcing Module document number is: 1421525913

c) All File names should start with the Vendor name first, in order to easily determine all the files to be included as part of the Vendor’s response. For example, files should be named as follows:

Vendor Name-your file name.

d) File contents SHALL NOT be password protected, the file formats must be in .PDF, .JPEG, .DOC or .XLS format, and shall be capable of being copied to other sources. Inability by the State to open the Vendor’s files may result in the Vendor’s offer(s) being rejected as Non-Responsive.

e) If the Vendor’s proposal contains any confidential information (as defined in Section 7.0, Paragraph #17), then the Vendor must provide one (1) signed, original electronic offer and one (1) redacted electronic copy.

For Vendor training on how to use the Ariba Sourcing Tool to view solicitations, submit questions, develop responses, upload documents, and submit offers to the State, Vendors should go to the following site: https://eprocurement.nc.gov/training/vendor-training

Questions or issues related to using the Ariba Sourcing Tool itself can be directed to the North Carolina eProcurement Help Desk at 888-211-7440, Option 2. Help Desk representatives are available Monday through Friday from 7:30 AM EST to 5:00 PM EST.

2.4. BASIS FOR REJECTION

Pursuant to 9 NCAC 06B.0401, the State reserves the right to reject any and all offers, in whole or in part; by deeming the offer unsatisfactory as to quality or quantity, delivery, price or service offered;

non-compliance with the specifications or intent of this solicitation; lack of competitiveness; error(s) in specifications or indications that revision would be advantageous to the State; cancellation or other changes in the intended project, or other determination that the proposed requirement is no longer needed; limitation or lack of available funds; circumstances that prevent determination of the best offer; or any other determination that rejection would be in the best interest of the State. Vendor contact regarding this IFB with anyone other than Kelley Fore, Kelley.fore@nc.gov, may be grounds for rejection of said Vendor’s offer.

2.5. LATE OFFERS

Regardless of cause, late offers will not be accepted and will automatically be disqualified from further consideration. It shall be the Vendor’s sole risk to ensure delivery at the designated office by the designated time. Late offers will not be opened and may be returned to the Vendor at the expense of the Vendor or destroyed if requested.

2.6. NON-RESPONSIVE OFFERS

Vendor offers will be deemed non-responsive by the State and will be rejected without further consideration or evaluation if statements such as the following are included:

• “This offer does not constitute a binding offer”,

• “This offer will be valid only if this offer is selected as a finalist or in the competitive range”,

• “Vendor does not commit or bind itself to any terms and conditions by this submission”, https://eprocurement.nc.gov/training/vendor-training

• “This document and all associated documents are non-binding and shall be used for discussion purposes only”,

• “This offer will not be binding on either party until incorporated in a definitive agreement signed by authorized representatives of both parties”, or

• A statement of similar intent.

2.7. NOTICE TO VENDOR(S)

The State objects to and will not be required to evaluate or consider any additional terms and conditions not previously agreed to by the State and submitted with an Offeror’s response.

This applies to any language appearing in or attached to the document as part of the Offeror’s response. By execution and delivery of this IFB and response(s), the Offeror agrees that any additional terms and conditions, whether submitted purposely or inadvertently, shall have no force or effect.

2.8. E-PROCUREMENT SOLICITATION

This is not an E-Procurement solicitation. See Paragraph #31 of Section 7.0

a) General information on the E-Procurement service can be found at http://eprocurement.nc.gov/

b) Within two days after notification of award of a contract, vendor must register in NC E-Procurement @ Your Service at the following web site: https://evp.nc.gov/SignIn?returnUrl=%2F

c) As of the IFB submittal date, the Vendor must be current on all E-Procurement fees. If the Vendor is not current on all E-Procurement fees, the State may disqualify the Vendor from participation in this IFB.

2.9. DISTRIBUTORS AND RESELLERS

“Resellers” as used herein, refers to businesses that routinely sell or distribute Vendor’s Products, and may include “Distributors”, “Value Added Resellers” (VARs), “Original Equipment Manufacturers” (OEMs), Channel Partners, or such other designations. These businesses must be approved by the State prior to placement of any orders. Any contract established will be subject to this solicitation and any resulting Agreement(s), and to the terms and conditions of the State’s competitive bidding process.

The Agency acknowledges that the Reseller has merely purchased the Third-Party Items for resale or license to the Agency, and that the proprietary and intellectual property rights to the Third-Party Items are owned by parties other than the Reseller (“Third Parties”). The Agency further acknowledges that except for the payment to the Reseller for the Third-Party Items, all of its rights and obligations with respect thereto flow from and to the Third Parties. The Reseller shall provide the Agency with copies of all documentation and warranties for the Third-Party Items which are provided to the Reseller. The Reseller shall assign all applicable third-party warranties for Deliverables to the Agency.

2.10. POSSESSION AND REVIEW

During the evaluation period and prior to award, possession of the bids and accompanying information is limited to personnel of the issuing agency, and to the committee responsible for participating in the evaluation. Vendors who attempt to gain this privileged information, or to influence the evaluation process (i.e., assist in evaluation) will be in violation of purchasing rules and their offer will not be further evaluated or considered.

After award of the contract the complete bid file will be available to any interested persons with the exception of trade secrets, test information or similar proprietary information as provided by statute and rule. Any proprietary or confidential information which conforms to exclusions from public records as provided by N.C.G.S. § 132-1.2 must be clearly marked as such in the offer when submitted.

http://eprocurement.nc.gov/ https://evp.nc.gov/SignIn?returnUrl=%2F

2.11. BEST AND FINAL OFFERS (BAFO)

The State may establish a competitive range based upon evaluations of offers, and request BAFOs from the Vendor(s) within this range, e.g., “Finalist Vendor(s)”. If negotiations or subsequent offers are solicited, the Vendor(s) shall provide BAFO(s) in response. Failure to deliver a BAFO when requested shall disqualify the non-responsive Vendor from further consideration. The State will evaluate BAFO(s), oral presentations, and product demonstrations as part of the Vendors’ respective offers to determine the final rankings.

2.12. AWARD

It is the general intent to award this contract to one Vendor. As provided by statute, award will be based on Best Value Analysis, Lowest Price Technically Acceptable Source Selection Method in accordance with 09 NCAC 06B. 0302 Information Technology Procurement.

The State has implemented the electronic Vendor Portal (eVP) that allows the public to retrieve award notices and information on the Internet at https://evp.nc.gov. Results may be found by searching by Solicitation Number or agency name. This information may not be available for several weeks depending upon the complexity of the acquisition and the length of time to complete the evaluation process.

2.13. POINTS OF CONTACT

Contact by the Offeror with the persons shown below for contractual and technical matters related to this IFB is only permitted if expressly agreed to by the purchasing lead named on page 5, or upon award of contract:

Vendor Contractual Point of Contact Vendor Technical Point of Contact

[NAME OF VENDOR]

Street: [STREET ADDRESS]

[CITY, STATE, ZIP]

Attn: Assigned Contract Manager

[NAME OF VENDOR]

Street: [STREET ADDRESS]

[CITY, STATE, ZIP]

Attn: Assigned Technical Lead

3.0 SPECIFICATIONS

3.1. VENDOR STANDARD AGREEMENT(S)

The terms and conditions of Vendor’s standard license, maintenance or other agreement(s) applicable to Software and other Products acquired under this Agreement may apply to the extent such terms and conditions do not materially change the terms and conditions of this Agreement. In the event of any conflict between the terms and conditions of this Agreement and the Vendor’s standard agreement(s), the terms and conditions of this Agreement relating to audit and records, jurisdiction, choice of law, the State’s electronic procurement application of law or administrative rules, the remedy for intellectual property infringement and the exclusive remedies and limitation of liability in the Terms and Conditions herein shall apply in all cases and supersede any provisions contained in Vendor’s relevant standard agreement or any other agreement. The State shall not be obligated under any standard license and/or maintenance or other Vendor agreement(s) to indemnify or hold harmless the Vendor, its licensors, successors or assigns; nor arbitrate any dispute, nor pay late fees, legal fees or other similar costs.

A license agreement for Cloudflare Terms and Conditions of User and associated agreements are currently in the process of being finalized by and between Cloudflare, Inc. and NC Department of Information Technology, and will be applicable to this IFB. A fully executed copy of the https://evp.nc.gov/ updated license agreement will be incorporated by reference in the contract via a Best and Final Offer

(BAFO).

3.2. VENDOR UTILIZATION OF WORKERS OUTSIDE U.S.

In accordance with N.C.G.S. § 143B-1361(b), Vendor must detail in the IFB response, the manner in which it intends to utilize resources or workers located outside the U.S. The State of North Carolina will evaluate the additional risks, costs, and other factors associated with such utilization prior to making an award for any such Vendor’s offer. The Vendor shall provide the following for any offer or actual utilization or contract performance:

a) The location of work performed under a state contract by the Vendor, any subcontractors, employees, or other persons performing the contract and whether any of this work will be performed outside the United States.

b) The corporate structure and location of corporate employees and activities of the Vendors, its affiliates or any other subcontractors.

c) Notice of the relocation of the Vendor, employees of the Vendor, subcontractors of the Vendor, or other persons performing Services under a state contract outside of the United States.

d) Any Vendor or subcontractor providing call or contact center Services to the State of North Carolina shall disclose to inbound callers the location from which the call or contact center Services are being provided.

Will any work under this contract be performed outside the United States? YES NO

If Vendor answered “YES” above, list the location(s) outside the United States where work under this contract will be performed by Vendor, any sub-contractors, employees, or other persons performing work under the contract.

3.3. E-VERIFY

Pursuant to N.C.G.S. § 143B-1350(k), the State shall not enter into a contract unless the awarded Vendor and each of its subcontractors comply with the E-Verify requirements of N.C.G.S. Chapter 64, Article 2. Vendors are directed to review the foregoing laws. Any awarded Vendor must submit a certification of compliance with E-Verify to the awarding agency, and on a periodic basis thereafter as may be required by the State.

3.4 BRAND SPECIFIC PRODUCT

Manufacturer(s) name and product descriptions used in this solicitation are product specific. The items offered in response to this solicitation must be the manufacturer and type specified. Failure to comply with this requirement will result in rejection of offer.

3.5. SECURITY SPECIFICATIONS

3.5.1 SOLUTIONS HOSTED ON STATE INFRASTRUCTURE – RESERVED

3.5.2 SOLUTIONS NOT HOSTED ON STATE INFRASTRUCTURE

To comply with the State’s Security Standards and Policies, State agencies are required to perform annual security/risk assessments on their information systems using NIST 800-53 controls. This requirement additionally applies to all Vendor-provided, agency-managed Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) solutions which will handle data classified as Medium Risk (Restricted) or High Risk (Highly Restricted) data.

(a) Vendors shall provide a completed Vendor Readiness Assessment Report Non-State Hosted Solutions (“VRAR”) at offer submission. This report is located at the following website:

https://it.nc.gov/documents/vendor-readiness-assessment-report

(b) Upon request, Vendors shall provide a current independent 3rd party assessment report in accordance with the following subparagraphs (i)-(iii) prior to contract award. However, Vendors are encouraged to provide a current independent 3rd party assessment report in accordance with subparagraphs (i)-(iii) at the time of offer submission.

(i) Federal Risk and Authorization Management Program (FedRAMP) certification, SOC 2 Type 2, ISO 27001, or HITRUST are the preferred assessment reports for any Vendor solutions which will handle data classified as Medium Risk (Restricted) or High Risk (Highly Restricted).

(ii) A Vendor that cannot provide a preferred independent 3rd party assessment report as described above may submit an alternative assessment, such as a SOC 2 Type 1 assessment report. The Vendor shall provide an explanation for submitting the alternative assessment report. If awarded this contract, a Vendor who submits an alternative assessment report shall submit one of the preferred assessment reports no later than 365 days of the Effective Date of the contract. Timely submission of this preferred assessment report shall be a material requirement of the contract.

(iii) An IaaS vendor cannot provide a certification or assessment report for a SaaS provider UNLESS permitted by the terms of a written agreement between the two vendors and the scope of the IaaS certification or assessment report clearly includes the SaaS solution.

(c) Additional Security Documentation. Prior to contract award, the State may in its discretion require the Vendor to provide additional security documentation, including but not limited to vulnerability assessment reports and penetration test reports. The awarded Vendor shall provide such additional security documentation upon request by the State during the term of the contract.

The Zero Trust Network Access Project will be required to receive and securely manage data that is classified as High, Program Critical. Refer to the North Carolina Statewide Data Classification and

Handling policy for more information regarding this data classification. The policy is located at the following website: https://it.nc.gov/document/statewide-data-classification-and-handling-policy

To comply with the State’s Security Standards and Policies, State agencies are required to perform annual security/risk assessments on their information systems using NIST 800-53 controls.

3.6 ENTERPRISE ARCHITECTURE SPECIFICATIONS – RESERVED

ENTERPRISE, SERVICES, AND STANDARDS

Agencies and vendors should refer to the Vendor Resources Page for information on NCDIT regarding architecture, security, strategy, data, digital, identity and access management and other general information on doing business with state Information Technology (IT) process.

The Vendor Resources Page can be found at the following link: https://it.nc.gov/vendor-engagement-resources. This site provides vendors with statewide information and links referenced throughout the IFB document. Agencies may request additional information.

3.7. DELIVERY

Successful Vendor will complete supply of software within 10 consecutive calendar days after receipt of purchase order electronically.

If circumstances beyond the control of the contractor result in a late delivery [or installation], it is the responsibility and obligation of the contractor to notify the Purchasing Agent listed on the purchase order, in writing, immediately upon determining delay of shipment. The written notification should indicate the anticipated delivery date.

https://it.nc.gov/documents/vendor-readiness-assessment-report https://it.nc.gov/document/statewide-data-classification-and-handling-policy https://it.nc.gov/vendor-engagement-resources https://it.nc.gov/vendor-engagement-resources

3.8. CONTRACT TERM

A contract awarded pursuant to this IFB shall have an effective date as provided in the Notice of Award. The term shall be three (3) years and will expire upon the anniversary date of the effective date unless otherwise stated in the Notice of Award, or unless terminated earlier. The State retains the option to extend this contract for two (2) additional one (1) year periods at its sole discretion.

4.0 FURNISH AND DELIVER

Contract Period Year 1

QTY SKU MFG PART # DESCRIPTION

UNIT

PRICE

EXTENDED

PRICE

(ANNUAL)

5500 6638449 ZTE-USER

CLOUDFLARE ENTERPRISE

– ATTRIBUTE PART -Zero Trust Enterprise – User

5500 7104597 DLP

CLOUDFLARE ENTERPRISE

– ATTRIBUTE PART- Data Loss Prevention (DLP) per Seat

1 6669725 MAGIC-WAN

CLOUDFLARE ENTERPRISE

– ATTRIBUTE PART -Magic

WAN

6153 6669726 MAGIC-WAN

CLOUDFLARE ENTERPRISE

– ATTRIBUTE PART – Magic

WAN Bandwidth NA

84 6685098 GDE-IP

CLOUDFLARE ENTERPRISE

– ATTRIBUTE PART

1 7222274

CLOUDFLARE-

GS

CLOUDFLARE FOR

GOVERNMENT SERVICE

(FedRAMP)

1 7965175 CFR-MS-L

CLOUDFLARE ENTERPRISE

– ATTRIBUTE PART –

MIGRATION SERVICES –

12M

Total Offer Cost Year 1: $___________________

Contract Period Year 2

QTY SKU MFG PART # DESCRIPTION

UNIT

PRICE

EXTENDED

PRICE

(ANNUAL)

11500 6638449 ZTE-USER

CLOUDFLARE ENTERPRISE

– ATTRIBUTE PART -Zero Trust Enterprise – User

11500 7104597 DLP

CLOUDFLARE ENTERPRISE

– ATTRIBUTE PART- Data Loss Prevention (DLP) per Seat

1 6669725 MAGIC-WAN

CLOUDFLARE ENTERPRISE

– ATTRIBUTE PART -Magic

WAN

6153 6669726 MAGIC-WAN

CLOUDFLARE ENTERPRISE

– ATTRIBUTE PART – Magic

WAN Bandwidth NA

84 6685098 GDE-IP

CLOUDFLARE ENTERPRISE

– ATTRIBUTE PART

1 7222274

CLOUDFLARE-

GS

CLOUDFLARE FOR

GOVERNMENT SERVICE

(FedRAMP)

Total Offer Cost Year 2: $___________________

Optional Migration Services Year 2

QTY SKU MFG PART # DESCRIPTION

UNIT

PRICE

EXTENDED

PRICE

(ANNUAL)

1 7965175 CFR-MS-L

CLOUDFLARE

ENTERPRISE –

ATTRIBUTE PART –

Migration Services -12M

Optional Migration Services Cost Year 2: $___________________

Total Offer Cost Year 2 with Optional Migration Services: $_________________________

Contract Period Year 3

QTY SKU MFG PART # DESCIPTION UNIT

PRICE

EXTENDED

PRICE

(ANNUAL)

1700 6638449 ZTE-USER CLOUDFLARE

ENTERPRISE -

ATTRIBUTE PART - Zero

Trust Enterprise - User

1700 7104597 DLP CLOUDFLARE

ENTERPRISE -

ATTRIBUTE PART- Data Loss Prevention (DLP) Per Seat

1 6669725 MAGIC-WAN CLOUDFLARE

ATTRIBUTE PART -

MAGIC WAN

6153 6669726 MAGIC-WAN CLOUDFLARE

ATTRIBUTE PART -

MAGIC Wan Bandwidth

NA

84 6685098 GDE-IP CLOUDFLARE

ATTRIBUTE PART

1 7222274 CLOUDFLARE-

GS

CLOUDFLARE FOR

GOVERNMENT

SERVICE (FedRAMP)

Total Offer Cost Year 3: $______________________

Total Offer Cost Year 1-3: $_____________________

Total Offer Cost Year 1-3 with Year 2 optional migration services: $______________________________

Optional Contract Period Renewal 1 (Year 4)

QTY SKU MFG PART # DESCRIPTION

UNIT

PRICE

EXTENDED

PRICE

(ANNUAL)

17000 6638449 ZTE-USER

CLOUDFLARE ENTERPRISE

– ATTRIBUTE PART -Zero Trust Enterprise – User

17000 7104597 DLP

CLOUDFLARE ENTERPRISE

– ATTRIBUTE PART- Data Loss Prevention (DLP) per Seat

1 6669725 MAGIC-WAN

CLOUDFLARE ENTERPRISE

– ATTRIBUTE PART -Magic

WAN

6153 6669726 MAGIC-WAN

CLOUDFLARE ENTERPRISE

– ATTRIBUTE PART – Magic

WAN Bandwidth NA

84 6685098 GDE-IP

CLOUDFLARE ENTERPRISE

– ATTRIBUTE PART

1 7222274

CLOUDFLARE-

GS

CLOUDFLARE FOR

GOVERNMENT SERVICE

(FedRAMP)

Total Offer Cost Year 4: $_____________________

Optional Contract Period Renewal 2 (Year 5)

QTY SKU MFG PART # DESCRIPTION

UNIT

PRICE

EXTENDED

PRICE

(ANNUAL)

17000 6638449 ZTE-USER

CLOUDFLARE ENTERPRISE

– ATTRIBUTE PART -Zero Trust Enterprise – User

17000 7104597 DLP

CLOUDFLARE ENTERPRISE

– ATTRIBUTE PART- Data Loss Prevention (DLP) per Seat

1 6669725 MAGIC-WAN

CLOUDFLARE ENTERPRISE

– ATTRIBUTE PART -Magic

WAN

6153 6669726 MAGIC-WAN

CLOUDFLARE ENTERPRISE

– ATTRIBUTE PART – Magic WAN Bandwidth NA

84 6685098 GDE-IP

CLOUDFLARE ENTERPRISE

– ATTRIBUTE PART

1 7222274

CLOUDFLARE-

GS

CLOUDFLARE FOR

GOVERNMENT SERVICE

(FedRAMP)

Total Offer Cost Year 5: $________________________

2.0 HISTORICALLY UNDERUTILIZED BUSINESSES

“Historically Underutilized Businesses (HUBs) consist of minority, women and disabled business firms that are at least fifty-one percent owned and operated by an individual(s) of the aforementioned categories.

Also included in this category are disabled business enterprises and non-profit work centers for the blind and severely disabled.” http://ncadmin.nc.gov/businesses/hub

Pursuant to N.C.G.S. §§1 43B-1361(a), 143-48 and 143-128.4, the State invites and encourages participation in this procurement process by businesses owned by minorities, women, disabled, disabled business enterprises and non-profit work centers for the blind and severely disabled. This includes utilizing subcontractors to perform the required functions in this IFB.

Is Vendor a Historically Underutilized Business? YES NO If “YES”, specify classification.

http://ncadmin.nc.gov/businesses/hub

6.0 NC DEPARTMENT OF INFORMATION TECHNOLOGY INSTRUCTIONS TO VENDORS

1) READ, REVIEW AND COMPLY: It shall be the Vendor’s responsibility to read this entire document, review all enclosures and attachments, and comply with all requirements specified herein.

2) DEFINITIONS:

• NCDIT: The North Carolina Department of Information Technology

• NCDIT CONVENIENCE CONTRACT: A contract that is used for the procurement of IT goods or Services. These contracts are in place for the convenience of the state and use of them is optional.

• OPEN MARKET CONTRACT: A contract for the purchase of goods or Services not covered by a term, technical, or convenience contract.

• TERM CONTRACT: A contract in which a source of supply is established for a specified period of time for specified Services or supplies; usually characterized by an estimated or definite minimum quantity, with the possibility of additional requirements beyond the minimum, all at a predetermined unit price

• THE STATE: Is the state of North Carolina and its agencies.

• VENDOR: Company, firm, corporation, partnership, individual, etc., submitting a response to a solicitation.

3) PROMPT PAYMENT DISCOUNTS: Vendors are urged to compute all discounts into the price offered.

If a prompt payment discount is offered, it will not be considered in the award of the contract except as a factor to aid in resolving cases of identical prices.

4) CLARIFICATIONS/INTERPRETATIONS: Any and all questions regarding this document must be addressed to the purchaser named on the cover sheet of this document. Do not contact the user directly. Any and all revisions to this document shall be made only by written addendum from NCDIT.

The Vendor is cautioned that the requirements of this IFB can be altered only by written addendum and that verbal communications from whatever source are of no effect.

5) ACCEPTANCE AND REJECTION: The State reserves the right to reject any and all offers, to waive any informality in offers and, unless otherwise specified by the Vendor, to accept any item in the offer.

If either a unit price or an extended price is obviously in error and the other is obviously correct, the incorrect price will be disregarded.

6) AWARD OF CONTRACT: Responsive offers will be evaluated and acceptance may be made in accordance with Best Value procurement practices as defined by N.C.G.S. § 143-135.9. Unless otherwise specified by the State or the Vendor, the State reserves the right to accept any item or group of items on a multi-item offer. In addition, on agency specific or term contracts, NCDIT reserves the right to make partial, progressive or multiple awards: where it is advantageous to award separately by items; or where more than one supplier is needed to provide the contemplated requirements as to quantity, quality, delivery, service, geographical areas; other factors deemed by NCDIT to be pertinent or peculiar to the purchase in question.

7) MISCELLANEOUS: Masculine pronouns shall be read to include feminine pronouns and the singular of any word or phrase shall be read to include the plural and vice versa.

8) PROTEST PROCEDURES: When an offeror wants to protest a contract awarded pursuant to this solicitation that is over $25,000 they must submit a written request to the issuing agency at the address given in this document. This request must be received in this office within fifteen (15) calendar days from the date of the contract award and must contain specific sound reasons and any supporting documentation for the protest. Note: Contract award notices are sent only to those actually awarded contracts, and not to every person or firm responding to this solicitation. IFB status and Award notices are posted on the Internet at https://evp.nc.gov. All protests will be governed by NCAC Title 9, Department of Information Technology (formerly Office of Information Technology Services), Subchapter 06B Sections .1101 - .1121.

9) VENDOR REGISTRATION AND SOLICITATION NOTIFICATION SYSTEM The electronic Vendor Portal (eVP) allows Vendors to electronically register with the State to receive electronic notification of current procurement opportunities for goods and services available on the eVP at the following web site: https://evp.nc.gov.

10) DIGITAL IMAGING: The State will digitize the Vendor’s response if not received electronically, and any awarded contract together with associated contract documents. This electronic copy shall be a preservation record and serve as the official record of this solicitation with the same force and effect as the original written documents comprising such record. Any printout or other output readable by sight shown to reflect such record accurately is an “original.”

7.0 NC Department of Information Technology Terms and Conditions

1) DEFINITIONS:

a) “Data” includes means information, formulae, algorithms, or other content that the State, the State’s employees, agents and end users upload, create or modify using the Services pursuant to this Agreement. Data also includes user identification information and metadata which may contain Data or from which the State’s Data may be ascertainable.

b) “Deliverable/Product” Warranties shall mean and include the warranties provided for products or deliverables licensed to the State as included in Paragraph 7) c) of these Terms and Conditions unless superseded by a Vendor’s Warranties pursuant to Vendor’s License or Support Agreements.

c) “Services” shall mean the duties and tasks undertaken by the Vendor to fulfill the requirements and specifications of this solicitation, including, without limitation, providing web browser access by authorized users to certain Vendor online software applications identified herein, and to related services, such as Vendor hosted Computer storage, databases, Support, documentation, and other functionalities, all as a Software as a Service (“SaaS”) solution.

d) “State” shall mean the State of North Carolina, the Department of Information Technology as an agency, or the agency identified in this solicitation as the Purchasing Agency and Award Authority.

e) “Support” includes provision of ongoing updates and maintenance for the Vendor online software applications, and as may be specified herein, consulting, training and other support Services as provided by the Vendor for SaaS tenants receiving similar SaaS Services.

2) ACCESS AND USE OF SAAS SERVICES:

a) Vendor grants the State a personal non-transferable and non-exclusive right to use and access, all

Services and other functionalities or services provided, furnished or accessible under this Agreement. The State may utilize the Services as agreed herein and in accordance with any mutually agreed Acceptable Use Policy. The State is authorized to access State Data and any Vendor-provided data as specified herein and to transmit revisions, updates, deletions, enhancements, or modifications to the State Data. This shall include the right of the State to, and access to, Support without the Vendor requiring a separate maintenance or support agreement. Subject to an agreed limitation on the number of users, the State may use the Services with any computer, computer system, server, or desktop workstation owned or utilized by the State or other authorized users. User access to the Services shall be routinely provided by the Vendor and may be subject to a more specific Service Level Agreement (SLA) agreed to in writing by the parties. The State shall notify the Vendor of any unauthorized use of any password or account, or any other known or suspected breach of security access. The State also agrees to refrain from taking any steps, such as reverse engineering, reverse assembly or reverse compilation to derive a source code equivalent to the Services or any portion thereof. Use of the Services to perform services for commercial third parties (so- called “service bureau” uses) is not permitted, but the State may utilize the Services to perform its governmental functions. If the Services fees are based upon the number of Users and/or hosted instances, the number of Users/hosted instances available may be adjusted at any time (subject to the restrictions on the maximum number of Users specified in the Furnish and Deliver Table herein above) by mutual agreement and State Procurement approval. All Services and information designated as “confidential” or “proprietary” shall be kept in confidence except as may be required by the North Carolina Public Records Act: N.C.G.S. § 132-1, et. seq.

b) The State’s access license for the Services and its associated services neither transfers, vests, nor infers any title or other ownership right in any intellectual property rights of the Vendor or any third party, nor does this license transfer, vest, or infer any title or other ownership right in any source code associated with the Services unless otherwise agreed to by the parties. The provisions of this paragraph will not be construed as a sale of any ownership rights in the Services. Any Services or technical and business information owned by Vendor or its suppliers or licensors made accessible or furnished to the State shall be and remain the property of the Vendor or such other party, respectively. Vendor has a limited, non-exclusive license to access and use the State Data as provided to Vendor, but solely for performing its obligations under this Agreement and in confidence as provided herein.

c) Vendor or its suppliers shall at minimum, and except as otherwise agreed, provide telephone assistance to the State for all Services procured hereunder during the State’s normal business hours (unless different hours are specified herein). Vendor warrants that its Support and customer service and assistance will be performed in accordance with generally accepted industry standards. The

IFB Number 41-DIT-1421525913 CLOUDFLARE ZTNA LICENSES IFB

Page 18 of 29 May 13, 2024

State has the right to receive the benefit of upgrades, updates, maintenance releases or other enhancements or modifications made generally available to Vendor’s SaaS tenants for similar Services. Vendor’s right to a new use agreement for new version releases of the Services shall not be abridged by the foregoing. Vendor may, at no additional charge, modify the Services to improve operation and reliability or to meet legal requirements.

d) Vendor will provide to the State the same Services for updating, maintaining and continuing optimal performance for the Services as provided to other similarly situated users or tenants of the Services, but minimally as provided for and specified herein. Unless otherwise agreed in writing, Support will also be provided for any other (e.g., third-party) software provided by the Vendor in connection with the Vendor’s solution herein. The technical and professional activities required for establishing, managing, and maintaining the Services environment are the responsibilities of the Vendor. Any training specified herein will be provided by the Vendor to certain State users for the fees or costs as set forth herein or in an SLA.

e) Services provided pursuant to this Solicitation may, in some circumstances, be accompanied by a user clickwrap agreement. The term clickwrap agreement refers to an agreement that requires the end user to manifest his or her assent to terms and conditions by clicking an “ok” or “agree” button on a dialog box or pop-up window as part of the process of access to the Services. All terms and conditions of any clickwrap agreement provided with any Services solicited herein shall have no force and effect and shall be non-binding on the State, its employees, agents, and other authorized users of the Services.

f) The Vendor may utilize partners and/or subcontractors to assist in the provision of the Services, so long as the State Data is not removed from the United States unless the terms of storage of the State Data are clearly disclosed, the security provisions referenced herein can still be complied with, and such removal is done with the prior express written permission of the State. The Vendor shall identify all of its strategic business partners related to Services provided under this contract, including but not limited to, all subcontractors or other entities or individuals who may be a party to a joint venture or similar agreement with the Vendor, who will be involved in any application development and/or operations.

g) Vendor warrants that all Services will be performed with professional care and skill, in a workmanlike manner and in accordance with the Services documentation and this Agreement.

h) An SLA or other agreed writing shall contain provisions for scalability of Services and any variation in fees or costs as a result of any such scaling.

i) Professional services provided by the Vendor at the request by the State in writing in addition to agreed Services shall be at the then-existing Vendor hourly rates when provided, unless otherwise agreed in writing by the parties.

3) WARRANTY OF NON-INFRINGEMENT; REMEDIES.

a) Vendor warrants to the best of its knowledge that:

i) The Services do not infringe any intellectual property rights of any third party; and

ii) There are no actual or threatened actions arising from, or alleged under, any intellectual property rights of any third party;

b) Should any Services supplied by Vendor become the subject of a claim of infringement of a patent, copyright, Trademark or a trade secret in the United States, the Vendor, shall at its option and expense, either procure for the State the right to continue using the Services, or replace or modify the same to become noninfringing. If neither of these options can reasonably be taken in Vendor’s judgment, or if further use shall be prevented by injunction, the Vendor agrees to cease provision of any affected Services, and refund any sums the State has paid Vendor and make every reasonable effort to assist the State in procuring substitute Services. If, in the sole opinion of the State, the cessation of use by the State of any such Services due to infringement issues makes the retention of other items acquired from the Vendor under this Agreement impractical, the State shall then have the option of terminating the Agreement, or applicable portions thereof, without penalty or termination charge; and Vendor agrees to refund any sums the State paid for unused Services.

c) The Vendor, at its own expense, shall defend any action brought against the State to the extent that such action is based upon a claim that the Services supplied by the Vendor, their use or operation, Page 19 of 29 May 13, 2024 infringes on a patent, copyright, trademark or violates a trade secret in the United States. The Vendor shall pay those costs and damages finally awarded or agreed in a settlement against the State in any such action. Such defense and payment shall be conditioned on the following:

i) That the Vendor shall be notified within a reasonable time in writing by the State of any such claim;

and,

ii) That the Vendor shall have the sole control of the defense of any action on such claim and all negotiations for its settlement or compromise provided, however, that the State shall have the option to participate in such action at its own expense.

d) Vendor will not be required to defend or indemnify the State if any claim by a third party against the State for infringement or misappropriation results from the State’s material alteration of any Vendor-branded Services, or from the continued use of the good(s) or Services after receiving notice they infringe on a trade secret of a third party.

4) ACCESS AVAILABILITY; REMEDIES:

a) The Vendor warrants that the Services will be in good working order, and operating in conformance with Vendor’s standard specifications and functions as well as any other specifications agreed to by the parties in writing, and shall remain accessible 24/7, with the exception of scheduled outages for maintenance and of other service level provisions agreed in writing, e.g., in an SLA. Vendor does not warrant that the operation of the Services will be completely uninterrupted or error free, or that the Services functions will meet all the State’s requirements, unless developed as Customized Services. The State shall notify the Vendor if the Services are not in good working order or inaccessible during the term of the Agreement. Vendor shall, at its option, either repair, replace or reperform any Services reported or discovered as not being in good working order and accessible during the applicable contract term without cost to the State.

If the Services monthly availability averages less than 99.9% (excluding agreed-upon maintenance downtime), the State shall be entitled to receive automatic credits as indicated immediately below, or the State may use other contractual remedies such as recovery of damages, as set forth herein in writing, e.g., in Specifications, Special Terms or in an SLA, and as such other contractual damages are limited by N.C.G.S. §143B-1350(h1) and the Limitation of Liability paragraph below. If not otherwise provided, the automatic remedies for nonavailability of the Subscription Services during a month are:

1. A 10% service credit applied against future fees if Vendor does not reach 99.9% availability.

2. A 25% service credit applied against future fees if Vendor does not reach 99% availability.

3. A 50% service credit applied against future fees or eligibility for early termination of the Agreement if Vendor does not reach 95% availability.

If, however, Services meet the 99.9% service availability level for a month, but are not available for a consecutive120 minutes during that month, the Vendor shall grant to the State a credit of a pro-rated one-day of the monthly subscription Services fee against future Services charges. Such credit(s) shall be applied to the bill immediately following the month in which Vendor failed to meet the performance requirements or other service levels, and the credit will continue to be deducted from the monthly invoice for each prior month that Vendor fails to meet the support response times for the remainder of the duration of the Agreement. If Services monthly availability averages less than 99.9% (excluding agreed-upon maintenance downtime), for three (3) or more months in a rolling twelve-month period, the State may also terminate the contract for material breach in accordance with the Default provisions hereinbelow.

b) Support Services. If Vendor fails to meet Support Service response times as set forth herein or in an SLA for a period of three consecutive months, a 10% service credit will be deducted from the invoice in the month immediately following the third month, and the 10% service credit will continue to be deducted from the monthly invoice for each month that Vendor fails to meet the support response times for the remainder of the duration of the Agreement.

5) EXCLUSIONS:

a) Except as stated above in Paragraphs 3 and 4, Vendor and its parent, subsidiaries and affiliates, subcontractors and suppliers make no warranties, express or implied, as to the Services.

b) The warranties provided in Paragraphs 3 and 4 above do not cover repair for damages, malfunctions

Page 20 of 29 May 13, 2024 or service failures substantially caused by:

i) Actions of non-Vendor personnel;

ii) Failure to follow Vendor’s written instructions relating to the Services provided to the State; or

iii) Force Majeure conditions set forth hereinbelow.

iv) The State’s sole misuse of, or its own inability to use, the Services.

6) PERFORMANCE REVIEW AND ACCOUNTABILITY. N.C.G.S. § 143B-1340(f) and 09 NCAC 06B.1207 require provisions for performance review and accountability in State IT contracts. For this procurement, these shall include the holding a retainage of 10% of the contract value and withholding the final payment contingent on final acceptance by the State as provided in 09 NCAC 06B.1207(3) and (4), unless waived or otherwise agreed, in writing. The Services herein will be provided consistent with and under these Services performance review and accountability guarantees.

7) LIMITATION OF LIABILITY: Limitation of Vendor’s Contract Damages Liability:

a) Where Services are under the State’s exclusive management and control, the Vendor shall not be liable for direct damages caused by the State’s failure to fulfill any State responsibilities of assuring the proper use, management and supervision of the Services and programs, audit controls, operating methods, office procedures, or for establishing all proper checkpoints necessary for the State’s intended use of the Services.

b) The Vendor’s liability for damages to the State arising under the contract shall be limited to two times the value of the Contract.

c) The foregoing limitation of liability shall not apply to claims covered by other specific provisions including but not limited to Service Level Agreement or Deliverable/Product Warranty compliance, or to claims for injury to persons or damage to tangible personal property, gross negligence or willful or wanton conduct. This limitation of liability does not apply to contributions among joint tortfeasors under N.C.G.S.