72-PTJH26087 Web Application Firewall (WAF).pdf

STATE OF NORTH CAROLINA

University of North Carolina at Wilmington

Request for Proposal #: 72-PJTH26087

Web Application Firewall (WAF)

Date of Issue: June 15, 2026

Proposal Opening Date: July 15, 2026

At 2:00 PM ET

Direct all inquiries concerning this RFP to:

Justin Hewett

Purchasing Specialist

Email: hewettj@uncw.edu

Phone: 910-962-7058

Ver: 11/2025

Request for Proposal #

72-PJTH26087

For internal State agency processing, including tabulation of proposals, provide your company’s eVP (Electronic Vendor Portal) Number. Pursuant to G.S. 132-1.10(b) this identification number shall not be released to the public.

This page will be removed and shredded, or otherwise kept confidential, before the procurement file is made available for public inspection.

This page shall be filled out and returned with your proposal.

Failure to do so may subject your proposal to rejection.

Vendor Name

Vendor eVP#

Note: For a contract to be awarded to you, your company (you) must be a North Carolina registered Vendor in good standing. You must enter the Vendor number assigned through eVP (Electronic Vendor Portal). If you do not have a Vendor number, register athttps://evp.nc.gov/SignIn

Electronic responses ONLY will be accepted for this solicitation.

https://evp.nc.gov/SignIn

Proposal Number: 72-PJTH26087 Vendor: __________________________________________

Ver: 11/2024

Refer ALL Inquiries regarding this RFP to:

Justin Hewett, UNCW Purchasing Services, hewettj@uncw.edu

Request for Proposal #: 72-PJTH26087 Proposals will be publicly opened: July 15, 2026 at 2:00 PM ET

Using Agency: UNC - Wilmington Commodity No. and Description: 43233205 – Firewall Software

EXECUTION

In compliance with this Request for Proposals (RFP), and subject to all the conditions herein, the undersigned Vendor offers and agrees to furnish and deliver any or all items upon which prices are bid, at the prices set opposite each item within the time specified herein.

By executing this proposal, the undersigned Vendor understands that false certification is a Class I felony and certifies that:

this proposal is submitted competitively and without collusion (G.S. 143-54), none of its officers, directors, or owners of an unincorporated business entity has been convicted of any violations of Chapter 78A of the General Statutes, the Securities Act of 1933, or the Securities Exchange Act of 1934 (G.S. 143-59.2), and it is not an ineligible Vendor as set forth in G.S. 143-59.1.

Furthermore, by executing this proposal, the undersigned certifies to the best of Vendor’s knowledge and belief, that:

it and its principals are not presently debarred, suspended, proposed for debarment, declared ineligible or voluntarily excluded from covered transactions by any Federal or State department or agency.

As required by G.S. 143-48.5, the undersigned Vendor certifies that it, and each of its sub-Contractors for any Contract awarded as a result of this RFP, complies with the requirements of Article 2 of Chapter 64 of the NC General Statutes, including the requirement for each employer with more than 25 employees in North Carolina to verify the work authorization of its employees through the federal E-Verify system.

As required by Executive Order 24 (2017), the undersigned vendor certifies will comply with all Federal and State requirements concerning fair employment and that it does not and will not discriminate, harass, or retaliate against any employee in connection with performance of any Contract arising from this solicitation.

G.S. 133-32 and Executive Order 24 (2009) prohibit the offer to, or acceptance by, any State Employee associated with the preparing plans, specifications, estimates for public contracts; or awarding or administering public contracts; or inspecting or supervising delivery of the public contract of any gift from anyone with a contract with the State, or from any person seeking to do business with the State. By execution of this response to the RFP, the undersigned certifies, for Vendor’s entire organization and its employees or agents, that Vendor is not aware that any such gift has been offered, accepted, or promised by any employees of your organization.

By executing this proposal, Vendor certifies that it has read and agreed to the INSTRUCTION TO VENDORS and the NORTH CAROLINA GENERAL TERMS AND CONDITIONS incorporated herein. These documents can be accessed from the ATTACHMENTS page within this document.

Failure to execute/sign proposal prior to submittal may render proposal invalid and it MAY BE REJECTED. Late proposals shall not be accepted.

University of North Carolina at Wilmington

Ver: 11/2025 2

COMPLETE/FORMAL NAME OF VENDOR:

STREET ADDRESS: P.O. BOX: ZIP:

CITY & STATE & ZIP: TELEPHONE

NUMBER:

TOLL FREE TEL. NO:

PRINCIPAL PLACE OF BUSINESS ADDRESS IF DIFFERENT FROM ABOVE (SEE INSTRUCTIONS TO VENDORS ITEM #21):

PRINT NAME & TITLE OF PERSON SIGNING ON BEHALF OF VENDOR:

VENDOR’S AUTHORIZED SIGNATURE*: DATE: EMAIL:

VALIDITY PERIOD

Offer shall be valid for at least one hundred twenty (120) days from date of bid opening, unless otherwise stated here: ______ days, or if extended by mutual agreement of the parties in writing. Any withdrawal of this offer shall be made in writing, effective upon receipt by the agency issuing this RFP.

ACCEPTANCE OF PROPOSAL

If your proposal is accepted, all provisions of this RFP, along with the written results of any negotiations, shall constitute the written agreement between the parties (“Contract”). The NORTH CAROLINA GENERAL TERMS AND CONDITIONS are incorporated herein and shall apply. Depending upon the Goods or Services being offered, other terms and conditions may apply, as mutually agreed.

FOR STATE USE ONLY: Offer accepted and Contract awarded this________ day of __________, 20____, as indicated on

The attached certification, by ____________________________________________________________________.

(Authorized Representative of University of North Carolina at Wilmington)

Ver: 11/2025 3

Contents

1.0 PURPOSE AND BACKGROUND

2.0 GENERAL INFORMATION

2.1 REQUEST FOR PROPOSAL DOCUMENT

2.2 E-PROCUREMENT FEE

2.3 NOTICE TO VENDORS REGARDING RFP TERMS AND CONDITIONS

2.4 RFP SCHEDULE

2.5 PROPOSAL QUESTIONS

2.6 PROPOSAL SUBMITTAL

2.7 PROPOSAL CONTENTS

2.8 ALTERNATE PROPOSALS

3.0 METHOD OF AWARD AND PROPOSAL EVALUATION PROCESS

3.1 METHOD OF AWARD

3.2 CONFIDENTIALITY AND PROHIBITED COMMUNICATIONS DURING EVALUATION

3.3 PROPOSAL EVALUATION PROCESS

3.4 EVALUATION CRITERIA

3.5 PERFORMANCE OUTSIDE THE UNITED STATES

3.6 INTERPRETATION OF TERMS AND PHRASES

4.0 REQUIREMENTS

4.1 FINANCIAL STABILITY

4.2 HUB PARTICIPATION

4.3 VENDOR EXPERIENCE

4.4 BACKGROUND CHECKS

4.5 PERSONNEL

4.6 VENDOR’S REPRESENTATIONS

4.7 QUESTIONS TO VENDORS

4.8 FINANCIAL STABILITY

4.9 AGENCY INSURANCE REQUIREMENTS MODIFICATION

4.10 SECRETARY OF STATE REGISTRATION

5.0 SPECIFICATIONS AND SCOPE OF WORK

6.0 CONTRACT ADMINISTRATION

6.1 CONTRACT MANAGER AND CUSTOMER SERVICE

6.2 INVOICES

Ver: 11/2025 4

6.6 ACCEPTANCE OF WORK

6.9 DISPUTE RESOLUTION

6.10 CONTRACT CHANGES

7.0 ATTACHMENTS

ATTACHMENT A: PRICING

ATTACHMENT B: INSTRUCTIONS TO VENDORS

ATTACHMENT C: NORTH CAROLINA GENERAL TERMS & CONDITIONS

ATTACHMENT D: HUB SUPPLEMENTAL VENDOR INFORMATION

ATTACHMENT E: LOCATION OF WORKERS UTILIZED BY VENDOR

ATTACHMENT F: CERTIFICATION OF FINANCIAL CONDITION

LOBBYING ACTIVITY CERTIFICATION FOR FEDERAL GRANTS

1.0 PURPOSE AND BACKGROUND

The University of North Carolina Wilmington (UNCW) is seeking proposals from qualified vendors to provide a cloud-based Web Application Firewall (WAF) solution and related implementation services. The selected solution will replace UNCW's existing on-premises F5 environment and provide web application security, load balancing, traffic management, and related functionality for university-hosted services.

UNCW currently utilizes an F5 platform to support multiple web applications and services through reverse proxy, load balancing, TLS termination, and web application firewall capabilities. As part of its technology modernization efforts, UNCW intends to migrate these services to a cloud-based platform that enhances security, improves resiliency, and reduces reliance on on-premises infrastructure.

The University seeks a solution that provides robust web application protection, supports both on-premises and cloud-hosted applications, integrates with existing security monitoring tools, and offers a streamlined administrative experience. The selected vendor will be responsible for supporting a proof of concept, implementation, migration planning, testing, training, and transition to production operations.

The intent of this solicitation is to award an Agency Specific Contract.

1.1 CONTRACT TERM

The Contract shall have an initial term of three (3) years, beginning on the date of final Contract execution (the “Effective Date”)

At the end of the Contract’s initial term, the State shall have the option, in its sole discretion, to renew the Contract on the same terms and conditions for up to two (2) additional one-year terms. The State will give the Vendor written notice of its intent to exercise each option no later than thirty (30) days before the end of the Contract’s then-current term. In addition to any optional renewal terms, and with the Vendor’s concurrence, the State reserves the right to extend the Contract after the last active term.

Proposals shall be submitted in accordance with the terms and conditions of this RFP and any addenda issued hereto.

Ver: 11/2025 5

2.0 GENERAL INFORMATION

2.1 REQUEST FOR PROPOSAL DOCUMENT

This RFP is comprised of the base RFP document, any attachments, and any addenda released before Contract award, which are incorporated herein by reference.

2.2 E-PROCUREMENT FEE

ATTENTION: The E-Procurement fee does not apply to this solicitation. See the paragraph entitled ELECTRONIC PROCUREMENT of the North Carolina General Terms and Conditions.

General information on the E-Procurement Services can be found at: http://eprocurement.nc.gov/.

2.3 NOTICE TO VENDORS REGARDING RFP TERMS AND CONDITIONS

It shall be the Vendor’s responsibility to read the Instructions to Vendors, the North Carolina General Terms and Conditions, all relevant exhibits and attachments, and any other components made a part of this RFP and comply with all requirements and specifications herein. Vendors are also responsible for obtaining and complying with all Addenda and other changes that may be issued in connection with this RFP.

If Vendors have questions or issues regarding any component of this RFP, those must be submitted as questions in accordance with the instructions in the PROPOSAL QUESTIONS Section. If the State determines that any changes will be made as a result of the questions asked, then such decisions will be communicated in the form of an RFP addendum.

The State may also elect to leave open the possibility for later negotiation of specific provisions of the Contract that have been addressed during the question-and-answer period, prior to contract award.

Other than through the process of negotiation under 01 NCAC 05B.0503, the State rejects and will not be required to evaluate or consider any additional or modified terms and conditions submitted with Vendor’s proposal or otherwise.

This applies to any language appearing in or attached to the document as part of the Vendor’s proposal that purports to vary any terms and conditions or Vendors’ instructions herein or to render the proposal non-binding or subject to further negotiation. Vendor’s proposal shall constitute a firm offer that shall be held open for the period required herein (“Validity Period” above).

The State may exercise its discretion to consider Vendor proposed modifications. By execution and delivery of this RFP Response, the Vendor agrees that any additional or modified terms and conditions, whether submitted purposely or inadvertently, shall have no force or effect, and will be disregarded unless expressly agreed upon through negotiation and incorporated by way of a Best and Final Offer (BAFO). Noncompliance with, or any attempt to alter or delete, this paragraph shall constitute sufficient grounds to reject Vendor’s proposal as nonresponsive.

2.4 RFP SCHEDULE

The table below shows the intended schedule for this RFP. The State will make every effort to adhere to this schedule.

Event Responsibility Date and Time Issue RFP State June 15, 2026

Submit Written Questions Vendor June 29, 2026 – No Later Than 12:00 PM ET

Provide Response to Questions State July 1, 2026

Submit Proposals Vendor July 15, 2026 – No Later Than 2:00 PM ET

Contract Award State August 17, 2026 http://eprocurement.nc.gov/

Ver: 11/2025 6

2.5 PROPOSAL QUESTIONS

Upon review of the RFP documents, Vendors may have questions to clarify or interpret the RFP in order to submit the best proposal possible. To accommodate the Proposal Questions process, Vendors shall submit any such questions by the “Submit Written Questions” date and time provided in the RFP SCHEDULE Section above, unless modified by Addendum.

Written questions shall be emailed to hewettj@uncw.edu by the date and time specified above. Vendors should enter “RFP # 72-PJTH26087: Questions” as the subject for the email. Question submittals should include a reference to the applicable RFP section and be submitted in the format shown below:

Reference Vendor Question

RFP Section, Page Number Vendor question …?

Questions received prior to the submission deadline date, the State’s response, and any additional terms deemed necessary by the State will be posted in the form of an addendum to the electronic Vendor Portal (eVP), https://evp.nc.gov, and shall become an Addendum to this RFP. No information, instruction or advice provided orally or informally by any State personnel, whether made in response to a question or otherwise in connection with this RFP, shall be considered authoritative or binding. Vendors shall rely only on written material contained in the RFP and an addendum to this RFP.

2.6 PROPOSAL SUBMITTAL

IMPORTANT NOTE: This is an absolute requirement. Late bids, regardless of cause, will not be opened or considered, and will be automatically disqualified from further consideration. Vendor shall bear the sole risk of late submission due to unintended or unanticipated delay. It is the Vendor’s sole responsibility to ensure its proposal has been received as described in this RFP by the specified time and date of opening. The time and date of receipt will be marked on each proposal when received. Any proposal or portion thereof received after the proposal deadline will be rejected.

All proposal responses shall be submitted electronically via the electronic Vendor Portal (eVP). Additional information can be found at the eVP updates for Vendors link: https://eprocurement.nc.gov/news-events/evp-updates-vendors.

If confidential and proprietary information is included in the proposal, also submit one (1) signed, REDACTED copy of the proposal. Such information may include trade secrets defined by N.C. Gen. Stat. § 66-152 and other information exempted from the Public Records Act pursuant to N.C. Gen. Stat. §132- 1.2. Vendor may designate information, Products, Services or appropriate portions of its response as confidential, consistent with and to the extent permitted under the statutes and rules set forth above. By so redacting any page, or portion of a page, the Vendor warrants that it has formed a good faith opinion, having received such necessary or proper review by counsel and other knowledgeable advisors, that the portions determined to be confidential and proprietary and redacted as such, meet the requirements of the Rules and Statutes set forth above. However, under no circumstances shall price information be designated as confidential.

If the Vendor does not provide a redacted version of the proposal with its proposal submission, the Department may release an unredacted version if a record request is received.

Failure to submit a proposal in strict accordance with these instructions shall constitute sufficient cause to reject a Vendor’s proposal(s). Vendors are strongly encouraged to allow sufficient time to upload proposals.

Critical updated information may be included in Addenda to this RFP. It is important that all Vendors responding to this RFP periodically check the State’s eVP website for any Addenda that may be issued prior to the bid opening date. All Vendors shall be deemed to have read and understood all information in this RFP and all Addenda thereto.

mailto:hewettj@uncw.edu https://evp.nc.gov/

Ver: 11/2025 7

2.7 PROPOSAL CONTENTS

Vendors shall populate all attachments of this RFP that require the Vendor to provide information and include an authorized signature where requested. Failure to provide all required items, or Vendor’s submission of incomplete items, may result in the State rejecting Vendor’s proposal, in the State’s sole discretion.

Vendor RFP responses shall include the following items and attachments, which shall be arranged in the following order:

a) Cover Letter, which must contain the following: (i) a statement that confirms that the proposer has read the RFP in its entirety, including all links, and all Addenda released in conjunction with the RFP, (ii) a statement that the Vendor agrees to perform in accordance with the scope of work, requirements, and specifications contained herein; and (iii) Vendor’s agreement to comply with all instructions, terms and conditions, and attachments.

b) Title Page: Include the company name, address, phone number and authorized representative along with the Proposal Number.

c) Completed and signed version of all EXECUTION PAGES, along with the body of the RFP.

d) Signed receipt pages of any addenda released in conjunction with this RFP, if required to be returned.

e) Vendor’s Proposal addressing all Specifications of this RFP: 4.8 QUESTIONS TO VENDORS, 5.0 SPECIFICATIONS AND

SCOPE OF WORK

f) Completed version of ATTACHMENT A: PRICING

g) Completed version of ATTACHMENT D: HUB SUPPLEMENTAL VENDOR INFORMATION

h) Completed version of ATTACHMENT E: LOCATION OF WORKERS UTILIZED BY VENDOR

i) Completed and signed version of ATTACHMENT F: CERTIFICATION OF FINANCIAL CONDITION

j) Completed and signed version of CERTIFICATION FOR CONTRACTS, GRANTS, LOANS, AND COOPERATIVE AGREEMENTS and OMB STANDARD FORM LLL

2.8 ALTERNATE PROPOSALS

Unless provided otherwise in this RFP, Vendor may submit alternate proposals for comparable Goods, various methods or levels of Service(s), or that propose different options. Alternate proposals must specifically identify the RFP requirements and advantage(s) addressed by the alternate proposal. Any alternate proposal, in addition to the marking described above, must be clearly marked with the legend: “Alternate Proposal #___ [for ‘name of Vendor’]”. Each proposal must be for a specific set of Goods and Services and must include specific pricing. If a Vendor chooses to respond with various offerings, each must be offered with a separate price and be contained in a separate proposal document. Each proposal must be complete and independent of other proposals offered.

3.0 METHOD OF AWARD AND PROPOSAL EVALUATION PROCESS

3.1 METHOD OF AWARD

North Carolina G.S. 143-52 provides a general list of criteria the State shall use to award contracts, as supplemented by the additional criteria herein. The Goods or Services being procured shall dictate the application and order of criteria; however, all award decisions shall be in the State’s best interest. All qualified proposals will be evaluated, and awards will be made to the Vendor(s) meeting the specific RFP Specifications and achieving the highest and best final evaluation, based on the criteria described below.

Ver: 11/2025 8

While the intent of this RFP is to award a Contract(s) to a single vendor, the State reserves the right to make separate awards to different Vendors for one or more line items, to not award one or more line items or to cancel this RFP in its entirety without awarding a Contract, if it is considered to be most advantageous to the State to do so.

The State reserves the right to waive any minor informality or technicality in proposals received.

3.2 CONFIDENTIALITY AND PROHIBITED COMMUNICATIONS DURING EVALUATION

While this RFP is under evaluation, the responding Vendor, including any subcontractors and suppliers, is prohibited from engaging in conversations intended to influence the outcome of the evaluation. See Paragraph 29 of the Instructions to Vendors entitled COMMUNICTIONS BY VENDORS.

Each Vendor submitting a proposal to this RFP, including its employees, agents, subcontractors, suppliers, subsidiaries and affiliates, is prohibited from having any communications with any person inside or outside the using agency; issuing agency; other government agency office or body (including the procurement lead named above, any department secretary, agency head, members of the General Assembly and Governor’s office); or private entity, if the communication refers to the content of Vendor’s proposal or qualifications, the content of another Vendor’s proposal, another Vendor’s qualifications or ability to perform a resulting contract, and/or the transmittal of any other communication of information that could be reasonably considered to have the effect of directly or indirectly influencing the evaluation of proposals, the award of a contract, or both.

Any Vendor not in compliance with this provision shall be disqualified from evaluation and award. A Vendor’s proposal may be disqualified if its subcontractor and/or supplier engage in any of the foregoing communications during the time that the procurement is active (i.e., the issuance date of the procurement until the date of contract award or cancellation of the procurement). Only those discussions, communications or transmittals of information authorized or initiated by the issuing agency for this RFP or inquiries directed to the procurement lead named in this RFP regarding requirements of the RFP (prior to proposal submission) or the status of the award (after submission) are excepted from this provision.

3.3 PROPOSAL EVALUATION PROCESS

Only responsive submissions will be evaluated.

The State will conduct a One-Step evaluation of Proposals:

Proposals will be received according to the method stated in the Proposal Submittal Section above.

All proposals must be received by the issuing agency not later than the date and time specified in the RFP SCHEDULE Section above, unless modified by Addendum. Vendors are cautioned that this is a request for offers, not an offer or request to contract, and the State reserves the unqualified right to reject any and all offers at any time if such rejection is deemed to be in the best interest of the State.

At the date and time provided in the RFP SCHEDULE Section above, unless modified by Addendum, the proposal from each responding Vendor will be opened publicly and all offers (except those that have been previously withdrawn, or voided bids) will be tabulated. The tabulation shall be made public at the time it is created. When negotiations after receipt of bids are authorized pursuant to G.S. 143-49 and 01 NCAC 05B.0503, only the names of offerors and the Goods and Services offered shall be tabulated at the time of opening. If negotiation is anticipated, cost and price shall become available for public inspection at the time of the award. Interested parties are cautioned that these costs and their components are subject to further evaluation for completeness and correctness and therefore may not be an exact indicator of a Vendor’s pricing position.

Ver: 11/2025 9

At their option, the evaluators may request oral presentations or discussions with any or all Vendors for clarification or to amplify the materials presented in any part of the proposal. Vendors are cautioned, however, that the evaluators are not required to request presentations or other clarification—and often do not. Therefore, all proposals should be complete and reflect the most favorable terms available from the Vendor.

Upon completion of the evaluation process, the State will make award(s) based on the evaluation and post the award(s) to the State’s eVP website under the RFP number for this solicitation. Award of a Contract to one Vendor does not mean that the other proposals lacked merit, but that, all factors considered, the selected proposal was deemed most advantageous and represented the best value to the State.

The State reserves the right to negotiate with one or more vendors, or to reject all original offers and negotiate with one or more sources of supply that may be capable of satisfying the requirement, and in either case to require Vendor to submit a Best and Final Offer (BAFO) based on discussions and negotiations with the State.

3.4 EVALUATION CRITERIA

In addition to the general criteria in G.S. 143-52 which may or may not be relevant to this RFP, all qualified proposals will be evaluated, and award made based on considering the following criteria, to result in an award most advantageous to the State:

1. Cost (30%)

2. Vendor Product & Experience (40%)

3. Project Approach & Timeline (30%)

3.5 PERFORMANCE OUTSIDE THE UNITED STATES

Vendor shall complete ATTACHMENT F: LOCATION OF WORKERS UTILIZED BY VENDOR. In addition to any other evaluation criteria identified in this RFP, the State may also consider, for purposes of evaluating proposed or actual contract performance outside of the United States, how that performance may affect the following factors to ensure that any award will be in the best interest of the State:

a) Total cost to the State

b) Level of quality provided by the Vendor

c) Process and performance capability across multiple jurisdictions

d) Protection of the State’s information and intellectual property

e) Availability of pertinent skills

f) Ability to understand the State’s business requirements and internal operational culture

g) Particular risk factors such as the security of the State’s information technology

h) Relations with citizens and employees

i) Contract enforcement jurisdictional issues

3.6 INTERPRETATION OF TERMS AND PHRASES

This RFP serves two functions: (1) to advise potential Vendors of the parameters of the solution being sought by the State; and (2) to provide (together with other specified documents) the terms of the Contract resulting from this procurement. The use of phrases such as “shall,” “must,” and “requirements” are intended to create enforceable contract conditions. In determining whether proposals should be evaluated or rejected, the State will take into consideration the degree to which Vendors have proposed or failed to propose solutions that will satisfy the State’s needs as described in the RFP. Except as specifically stated in the RFP, no one requirement shall automatically

Ver: 11/2025 10 disqualify a Vendor from consideration. However, failure to comply with any single requirement may result in the State exercising its discretion to reject a proposal in its entirety.

4.0 REQUIREMENTS

This Section lists the requirements related to this RFP. By submitting a proposal, the Vendor agrees to meet all stated requirements in this Section as well as any other specifications, requirements, and terms and conditions stated in this RFP. If a Vendor is unclear about a requirement or specification, or believes a change to a requirement would allow for the State to receive a better proposal, the Vendor is urged to submit these items in the form of a question during the question-and-answer period in accordance with the Proposal Questions Section above.

Proposal price shall constitute the total cost to the State for complete performance in accordance with the requirements and specifications herein, including all applicable charges for handling, transportation, administrative and other similar fees. Complete ATTACHMENT A: PRICING FORM and include in Vendor’s proposal. The pricing provided in ATTACHMENT A, or resulting from any negotiations, is incorporated herein and shall become part of any resulting Contract.

INVOICES MAY NOT BE PAID UNTIL AN INSPECTION HAS OCCURRED AND THE GOODS OR SERVICES ACCEPTED.

4.1 FINANCIAL STABILITY

As a condition of contract award, the Vendor must certify that it has the financial capacity to perform and to continue to perform its obligations under the Contract; that Vendor has no constructive or actual knowledge of an actual or potential legal proceeding being brought against Vendor that could materially adversely affect performance of this Contract; and that entering into this Contract is not prohibited by any contract, or order by any court of competent jurisdiction.

Each Vendor shall certify it is financially stable by completing ATTACHMENT G: CERTIFICATION OF FINANCIAL CONDITION. The State is requiring this certification to minimize potential issues from contracting with a Vendor that is financially unstable. From the date of the Certification to the expiration of the Contract, the Vendor shall notify the State within thirty (30) days of any occurrence or condition that materially alters the truth of any statement made in this Certification. The Contract Manager may require annual recertification of the Vendor’s financial stability.

4.2 HUB PARTICIPATION

Pursuant to North Carolina General Statute G.S. 143-48, it is State policy to encourage and promote the use of small, minority, physically handicapped, and women contractors in purchasing Goods and Services. As such, this RFP will serve to identify those Vendors that are minority owned or have a strategic plan to support the State’s Historically Underutilized Business program by meeting or exceeding the goal of 10% utilization of diverse firms as 1st or 2nd tier subcontractors. Vendor shall complete ATTACHMENT D: HUB SUPPLEMENTAL VENDOR INFORMATION.

4.3 VENDOR EXPERIENCE

In its Proposal, Vendor shall demonstrate experience with public and/or private sector clients with similar or greater size and complexity to the State. Vendor shall provide information as to the qualifications and experience of all executive, managerial, legal, and professional personnel to be assigned to this project, including resumes citing experience with similar projects and the responsibilities to be assigned to each person.

4.4 BACKGROUND CHECKS

Any personnel or agent of Vendor performing Services under any Contract arising from this RFP may be required to undergo a background check at the expense of the Vendor, if so requested by the State.

Ver: 11/2025 11

4.5 PERSONNEL

Vendor warrants that qualified personnel shall provide Services under this Contract in a professional manner.

“Professional manner” means that the personnel performing the Services will possess the skill and competence consistent with the prevailing business standards in the industry. Vendor will serve as the prime contractor under this Contract and shall be responsible for the performance and payment of all subcontractor(s) that may be approved by the State. Names of any third-party Vendors or subcontractors of Vendor may appear for purposes of convenience in Contract documents; and shall not limit Vendor’s obligations hereunder. Vendor will retain executive representation for functional and technical expertise as needed in order to incorporate any work by third party subcontractor(s).

Should the Vendor’s proposal result in an award, the Vendor shall be required to agree that it will not substitute key personnel assigned to the performance of the Contract without prior written approval by the Contract Lead. Vendor shall further agree that it will notify the Contract Lead of any desired substitution, including the name(s) and references of Vendor’s recommended substitute personnel. The State will approve or disapprove the requested substitution in a timely manner. The State may, in its sole discretion, terminate the Services of any person providing Services under this Contract. Upon such termination, the State may request acceptable substitute personnel or terminate the contract Services provided by such personnel.

4.6 VENDOR’S REPRESENTATIONS

If Vendor’s Proposal results in an award, Vendor agrees that it will not enter any agreement with a third party that may abridge any rights of the State under the Contract. If any Services, deliverables, functions, or responsibilities not specifically described in this solicitation are required for Vendor’s proper performance, provision and delivery of the Service and deliverables under a resulting Contract, or are an inherent part of or necessary sub-task included within such Service, they will be deemed to be implied by and included within the scope of the Contract to the same extent and in the same manner as if specifically described in the Contract. Unless otherwise expressly provided herein, Vendor will furnish all of its own necessary management, supervision, labor, facilities, furniture, computer and telecom-munications equipment, software, supplies and materials necessary for the Vendor to provide and deliver the Services and/or other Deliverables.

4.7 QUESTIONS TO VENDORS

Vendor shall respond to each of the following questions. Vendors are requested to keep responses concise and relevant and should not include generic marketing materials. Responses will be reviewed as part of the evaluation process.

Vendor Product and Experience (40%)

1. Provide references from at least three (3) of the company’s customers from the past eight (8) years for services that are similar in scope, size, and complexity to the services described in this RFP, preferably that of Higher Education, but certainly at an enterprise level. Provide the following information for each customer and include how long your organization has been established:

a. Organization Name and Address;

b. Contact name with email address and phone number;

c. Time period in which work was performed; and

d. Short description of work performed.

2. Describe your pricing and cost model for the proposed cloud-based WAF service. Include the licensing metrics used (e.g., per protected application/service, domain/FQDN, policy, requests, bandwidth, or other), what is included in the base subscription (WAF, bot/DDoS protections, load

Ver: 11/2025 12 balancing, certificate management, SIEM integration, API access, etc.), any overage or usage-based charges, required minimums, and all one-time costs (implementation, migration, training).

3. Describe your experience with moving away from a physical on prem F5 LTM/AWAF/ASM environment.

4. Describe the experience of the team that will be assigned to this project.

5. Describe how intuitive and easy-to-use the administrative interface is for day-to-day operations (e.g., onboarding an application, reviewing/triaging events, tuning false positives, creating exceptions, and deploying changes).

6. Describe the process required to deploy the WAF and onboard new applications, including support for protecting applications hosted on-premises and in multiple cloud environments.

7. Describe how the solution detects and mitigates common web application attacks, as well as automated attacks such as bots, credential stuffing, and Layer 7 denial-of-service attempts. Where does mitigation happen(edge, centralized)? How is bot activity detected and what happens during mitigation?

What is the end user experience, and is mitigation automatic or user driven? Are there any usage-based charges for mitigation activity?

8. When a false positive is detected or an exception needs to be made, what is that process and how long would it take for the triggering end user’s connection to no longer be blocked. Additionally, what is the typical or expected false positive rate for your solution?

9. Describe how often the platform's managed rulesets are updated and the level of customer administrative effort required to implement those updates.

10. Describe the effectiveness of your solution using your managed rulesets, in detecting and mitigating known and emerging attacks.

11. Describe your approach to certificate management and integration with ACME-based certification management solutions, including whether certificates are automatically renewed and deployed or require customer intervention.

12. What does technical support for the product look like? Is it only for break fix situations, or can you call for support with onboarding a new application and get configuration assistance? Will technical support assist with rule tuning, false positive management, and incident response?

Project Approach & Timeline (30%)

13. Explain your approach to meeting the requirements listed in Section X

14. Provide a detailed project plan that includes, at a minimum, the following:

a. Project timeline

b. The project stages and milestones

c. Resources required from both parties

d. Responsibilities of each resource

e. Communication processes for reporting project progress

f. Project scope change management processes.

g. Pricing for the project management configuration

Ver: 11/2025 13

15. Describe the company’s migration process. Is there tooling to convert iRules? Is this vendor led manual configuration? Do iRules typically move over directly or is there typically redesign of how applications work when migrating?

16. Describe the company’s cutover approach, including the cutover steps, how cutover success will be validated, and the rollback plan.

17. Describe the company’s approach to support including before, during, and in the days following cutovers. The response should address readiness activities, real-time cutover support, escalation procedures, and post-cutover stabilization.

4.8 FINANCIAL STABILITY

As a condition of contract award, the Vendor must certify that it has the financial capacity to perform and to continue to perform its obligations under the Contract; that Vendor has no constructive or actual knowledge of an actual or potential legal proceeding being brought against Vendor that could materially adversely affect performance of this Contract; and that entering into this Contract is not prohibited by any contract, or order by any court of competent jurisdiction

Each Vendor shall certify it is financially stable by completing the ATTACHMENT G: CERTIFICATION OF FINANCIAL CONDITION. The State is requiring this certification to minimize potential performance issues from Contracting with a Vendor that is financially unstable. This Certification shall be deemed continuing, and from the date of the Certification to the expiration of the Contract, the Vendor shall notify the State within thirty (30) days of any occurrence or condition that materially alters the truth of any statement made in this Certification.

4.9 AGENCY INSURANCE REQUIREMENTS MODIFICATION

A. Default Insurance Coverage from the General Terms and Conditions applicable to this Solicitation:

☐ Small Purchases

☒ Contract value in excess of the Small Purchase threshold, but up to $1,000,000.00

☐ Contract value in excess of $1,000,000.00

4.10 SECRETARY OF STATE REGISTRATION

A contract award under the above-referenced solicitation, and the resulting purchase orders, will produce repeated orders and transactions in North Carolina and will constitute “transacting business” in the State, which requires a certificate of authority from the North Carolina Secretary of State as provided in G.S. §55-15-01 (corporations) or §57D- 7-01 (LLCs). Please go to: https://www.sosnc.gov/ to register.

Vendor registered with the North Carolina Secretary of State: Yes☐ No ☐

5.0 SPECIFICATIONS AND SCOPE OF WORK

Project Deadlines

The overall project must be completed by December 1, 2026.

The project should begin no later than September 1, 2026.

UNCW expects the proof of concept environment to be established and all proof of concept testing to be completed within a total period of three (3) weeks. Vendors must incorporate this timeframe into their project schedule.

https://www.sosnc.gov/

Ver: 11/2025 14

Award Conditions:

Any resulting award shall be contingent upon the vendor successfully completing a proof of concept and demonstrating that the proposed solution meets UNCW’s required specifications.

Current Environment

We have between 11 and 14 services where an on premise F5 big IP (2 appliances in HA) serves as a reverse proxy to the backend servers. The F5 appliance performs a combination of load balancing, Layer 7 WAF (Web Application Firewall) functionality, as well as TLS termination. Some more niche functionality Is performed by the irule scripting language provided by the F5. Examples of this niche functionality include modifying/inserting headers as well as making forwarding decisions based on the header content.

Technical Specifications:

• The system should support SSL automation for the client connectivity. Automated cert replacement for back-end servers is a plus.

Solution Must:

• Be a streamlined, user-friendly solution with an intuitive interface and minimal configuration requirements. Highly complex or feature-heavy systems that exceed the stated functional needs are not preferred.

• Must be capable of protecting workloads in various cloud environments (OCI, AWS, Azure, etc) as well as our on-prem datacenters.

• Be cloud only – no on prem equipment, software, or VMs in the environment.

• Have a highly available geographically diverse infrastructure which can tolerate loss of regional services.

• Provide 24/7 technical support.

• Support a migration from the existing on-premises F5 LTM/AWAF/ASM environment.

• Must allow backend applications to enforce Microsoft Entra Conditional Access for WAF-protected applications and provide audit/logging of authentication and access decisions with forwarding to Splunk and/or Rapid7 InsightIDR.

• Must perform layer 7 inspection of web traffic, decrypting traffic for analysis, blocking malicious requests, and re-encrypting traffic before forwarding to backend servers. Traffic must remain encrypted while in transit.

• Must provide support for HTTP 1.0, HTTP 1.1, HTTP 2.0 and HTTP/3, along with IPv4 and IPv6.

• The capability to perform the aforementioned decryption while ensuring the end user connects to the service in the form of "<identifier>.uncw.edu" without certificate issues/security warnings from the client application.

• The aforementioned cryptography must be in line with TLS 1.3 and PCQ. If not currently quantum resistant, this will need to be on the roadmap.

• Provide WAF protection for a minimum of 18 web applications/services, including load balancing for 5 services with a minimum of two backend servers each, and allow for scalable expansion as additional services are added.

• Automatically apply updates for threat signatures without manual intervention. The platform must also allow administrators to create exceptions or disable specific signatures to mitigate false positives that block legitimate traffic.

• Be capable of whitelisting particular public IP ranges and blocking all traffic from other public IP space for traffic incoming to the WAF service.

• Be capable of whitelisting particular URL paths with and without wildcards for added protection (for example allow or block all traffic to /path/*).

Ver: 11/2025 15

• For the two aforementioned whitelisting mechanisms, the WAF service needs to be able to use AND/OR logic to grant and deny access. Below is an example:

If the source address is 1.1.1.1 AND the path is /admin/management -> ALLOW access to /admin/management elseif path is /admin/management -> BLOCK all access to path /admin/management.

else -> ALLOW access to all other paths

• Must support independent WAF policies for each protected application or service behind the WAF.

• Must support ACME-based certificate management solutions.

• Must support modification and insertion of custom HTTP headers (e.g., X-Forwarded-For) as requests are forwarded to backend systems.

• Must be able to block traffic based on the contents of headers as needed.

• Must prevent clients from discovering the IP addresses of backend servers, ensuring all traffic is routed through the WAF.

• Must identify and mitigate malicious bot activity and DDoS attacks on web services.

• Must distribute traffic across multiple geographically diverse sites, supporting weighted or prioritized load balancing per service.

• Vendor must publish the CIDR ranges from which WAF traffic originates, allowing administrators to whitelist WAF nodes and block other traffic. Updates to these ranges should be communicated in a timely manner to ensure uninterrupted service.

• Must integrate with Splunk and/or Rapid7 Insight IDR for log forwarding, ensuring that WAF events and traffic logs can be ingested in real time. Log fields must include: Full request headers, Geo/IP information, Rule that triggered the block, etc.

• Must support log forwarding for configuration and change tracking.

• Must provide management via web interface and API supporting SSO and MFA, with compatibility for DUO and Microsoft MFA, with role-based access control to enforce read-only and other permission levels for administrators.

• Should offer baseline security policy templates for typical web applications and frameworks, with vendor guidance for policy tuning and false-positive reduction.

• Must provide the ability to define and enforce custom WAF rules.

• Must route traffic via DNS CNAME records configured on customer-managed DNS servers, directing traffic to the WAF provider’s service endpoints.

• Must provide a management API that supports bulk configuration changes across applications and policies.

• Must support mutual TLS (mTLS) passthrough for backend services where end-to-end client certificate authentication is required.

• Must allow exempting specific IP addresses or CIDR ranges from WAF inspection, configurable on a per-service basis.

• Must provide robust reporting, including pre-built reports that show metrics such as the number of blocked requests, detected threats, and other relevant security events.

Training Requirements:

• The vendor or partner must provide initial administrator training sufficient to onboard UNCW staff to deploy, operate, tune, and troubleshoot the WAF service, including hands-on configuration exercises.

• Training should be available in multiple formats, including live instructor-led format and on-demand format, and include role-based tracks (e.g., administrator/operator, security analyst/read-only, and incident response).

• Vendor or partner must provide training materials for reuse (slides, recordings, runbooks, and product documentation) and should keep them updated as features and UI change.

• Vendor or partner must provide a training environment so staff can practice configuration changes without impacting production services.

Ver: 11/2025 16

Implementation & Project Management Requirements:

• Vendor or partner must assign a dedicated project manager (PM) and technical implementation lead for the duration of implementation and cutover.

• Vendor or partner must provide a documented implementation plan and schedule that includes, at minimum: kickoff, discovery, design, configuration, pilot, phased onboarding/migration, production cutover, and post-cutover support.

• The vendor must perform a readiness assessment of our current environment, including a network readiness review and pre-deployment validation, to confirm migration preparedness.

• Vendor or partner must provide project governance including recurring status cadence (at least weekly during implementation), ongoing tracking of project hours, and written status reports.

• Vendor or partner must work with UNCW to develop a phased migration approach for onboarding the 18 services, including recommended grouping/waves, stakeholder coordination, communication plan, and defined criteria for progressing from one wave to the next.

• Vendor or partner must define testing and acceptance criteria for each onboarded service, including validation of application functionality, verification of logging/SIEM integration, and an agreed process for false-positive tuning.

• Vendor or partner must provide a documented backout/rollback plan for each service cutover.

• Vendor or partner must provide a post-cutover support period with defined hours, response targets, and support channels, and conduct a transition/handoff to steady-state operations (including review of monitoring, alerting, and escalation procedures).

• Vendor or partner must assist UNCW in designing and standing up a non-production test environment (or equivalent testing approach) that mirrors production as closely as practical.

• Vendor or partner must provide a written test plan with agreed testing parameters, including at minimum: functional testing (application workflows), security testing (rule coverage and false-positive validation), and performance testing (latency/throughput impacts) for each onboarded service.

• Vendor or partner must define clear acceptance criteria and a sign-off process per service, and provide testing artifacts upon request (e.g., results summaries, configuration snapshots, and evidence of logging/SIEM events) prior to production cutover.

• The vendor or partner must provide documentation aligned with industry best practices (such as NIST, CIS benchmarks, etc.) and support its review and implementation.

6.0 CONTRACT ADMINISTRATION

All Contract Administration requirements are conditioned on an award resulting from this solicitation. This information is provided for the Vendor’s planning purposes.

6.1 CONTRACT MANAGER AND CUSTOMER SERVICE

The Vendor shall be required to designate and make available to the State a contract manager. The contract manager shall be the State’s point of contact for Contract related issues and issues concerning performance, progress review, scheduling, and service.

Contract Manager Point of Contact

Name:

Office Phone #:

Mobile Phone #:

Email:

Ver: 11/2025 17

The Vendor shall be required to designate and make available to the State for customer service. The customer service point of contact shall be the State’s point of contact for customer service-related issues (define roles and responsibilities).

Customer Service Point of Contact

Name:

Office Phone #:

Mobile Phone #:

Email:

6.2 INVOICES

Vendor shall invoice the Procurement Entity. The standard format for invoicing shall be Single…