9-Appendix A Technical Environment Summary.docx

Appendix A – Technical Environment and Staffing (Based on October 2025 Inventory) Buffalo Public Schools (BPS) operates a modern, highly available enterprise network and data-center infrastructure engineered for continuous service delivery, automated recovery, and secure connectivity across approximately 75 district facilities. The awarded Managed Network Services vendor will be expected to maintain, monitor, and enhance the following core environment components.

The following items are considered “in scope” meaning direct access to managing the systems with highest level of systems administrator access.

1. Network Architecture (in scope)

· Dark-Fiber Ring: Private metropolitan-area network connecting all BPS sites via redundant 40 Gbps links using IEEE 802.1aq Shortest Path Bridging (SPB) for sub-second failover.

· Edge and Core Switching: Extreme 7720, VSP7254 building core and 4950, 5420 edge switches configured with Split Multi-Link Trunking (SMLT) for link and chassis redundancy (Approximately 1,800 total switches)

· UPS: 400 Vertiv UPS in all wiring closets for network switches

· Wireless Infrastructure: 5,000 Aruba Wi-Fi 6/6E access points managed through Aruba Central with redundant Aruba 9240 controllers.

· Network Access Control: Aruba ClearPass (6-node cluster) and Extreme Control NAC for wired and wireless authentication.

· Perimeter and Internal Firewalls: Fortinet FortiGate 901G next-generation firewalls configured in active/passive HA clusters with SD-WAN, IPS, and VPN services.

· Internet Connectivity: Two diverse 10 Gbps Internet circuits terminating in separate data centers; automatic SD-WAN failover for path resiliency.

2. Compute and Virtualization, Storage and Data Protection (in scope)

· VMware vSphere 8.5 Stretched Cluster: Six Dell R6625 servers (96 cores / 1.5 TB RAM each) providing active-active virtualization across both data centers.

· High Availability: Automated failover and restarts using vSphere HA; RTO ≈ 5 minutes for critical VMs.

· Management Tools: vCenter for cluster administration and VM lifecycle management.

· Pure Storage C50 ActiveCluster: Synchronous replication between sites for RPO = 0 and instantaneous failover; Cloud Mediator prevents split-brain events.

· iSCSI over 25 Gb Ethernet with MPIO: Redundant paths from servers to storage arrays for non-disruptive access.

· Backup Platforms: HPE StoreOnce and HPE Cloud Storage repositories with Druva data-protection software.

3. Endpoints and MS Licensing (approximate counts) (in scope)

· Windows: 25,000

· iPads: 25,000

· Macintosh: 500

· Chromebooks: currently investigating placements

· Interactive Touch Panels: 3,000 total, with 3,000 android/smartboard OS built in and 3,000 integrated windows units

· Cloud applications: MS365 Education A5 licensing suite for all staff with Student entitlement, MS Entra/AD on-prem for all users, MS Outlook.

4. Security Architecture (in scope)

· Defense-in-Depth: Dual FortiGate clusters for perimeter and internal segmentation; granular policy enforcement via Virtual Domains (VDOMs).

· Endpoint Protection: Microsoft Defender for Endpoint deployed across all managed devices.

· XDR Protection: Microsoft Defender Suite (ie. Defender for Identity, etc.) enabled and Microsoft Sentinel SIEM deployed

· Monitoring and Analytics: Zabbix and Intermapper for network and system monitoring, integrated with Team Dynamix ITSM for ticket management.

· SOC Integration: Contracted MDR and 24×7 Security Operations Center services and District vCISO partnership for threat detection and incident response.

5. Disaster Recovery and Resilience (in scope)

· Dual Active-Active Data Centers: Sites 94 and 97 operate as a single logical environment with independent power, cooling, and connectivity.

· Automated Recovery Validation: Quarterly failover testing confirms self-healing capabilities; critical services recover within five minutes or less.

· Target Availability: 99.9999 % (excluding scheduled maintenance).

6. Management and Support Systems (in scope)

· ITSM Platform: Use of Team Dynamix for ticketing and change control.

· Asset Management: Use of Incident IQ, FileMaker Server database (legacy system), and JAMF/Intune for device inventory and deployment.

· Authentication and Identity: Active Directory / Azure AD hybrid environment with multi-factor authentication capabilities.

7. BPS IT Administrative Team (Administrative reporting structure)

· CTO:

· Director of IT Instructional Services:

· Director of IT Infrastructure: WAN Project Manager, Manager of Systems Operations (devops), Help Desk Manager.

The following areas are considered “partner scope” meaning other BPS IT departments and/or BPS Divisions or contractors are responsible for the hands-on administration of devices and systems, however the IT augmented staff will interface, interoperate, integrate, and help other staffing to support connectivity of these systems.

1. BPS IT Help Desk Team (partner scope for endpoints and all user tickets)

· ITSM Platform: Team Dynamix hosted environment

· BPS User: Primary interface, triage, and ticket resolution

· Printers/copiers: 1,000 units with managed print services

· E-mail and Archival: MS Outlook for all users

· Staffing: 7 BPS positions plus 1 supervisor, located at city hall

· Contracted Service Providers: Toshiba for managed printer services, Erie 1 BOCES for E-mail support and archival.

2. BPS IT Network Team (partner scope for network systems)

· VoIP System: 6,000+ handsets with managed hosted Alcatel system

· Structured Wiring Closets: 75 Main Distribution Frame (MDF, one per building), approximately 350 Intermediate Distribution Frame (IDF, AKA wiring closets) supporting approximately 60,000 cat 5e cable drops.

· Digital Signage: 150 units

· Time clocks: 100 units

· HUDL systems: 20 units

· Staffing: 4 BPS field technician positions plus 1 manager, based out of PS 28, travel to all locations

· Contracted Service Providers: Advance2000 (A2K) for Hosted VoIP services. Working Knowledge and Structured WNY for network cabling and AP placement.

3. BPS IT Contracted Endpoint Deployment Team (partner scope)

· Endpoints: physical deployment, distribution, repair, collection of all staff, student and administrator Windows, iPads, and Macintosh systems

· Asset Management: Key interoperation/users of Incident IQ system

· Staffing: 0 BPS staff, oversight by BPS directors

· Contracted Service Providers: Alternative Information Systems (AIS), 13 field technician positions plus 1 supervisor, based out of PS 28, travel to all locations

4. BPS IT Contracted Security Services (partner scope for security systems)

· VCISO and Vulnerability Management consultation: provided by DeepSeas

· MDR, XDR, SOC services: provided by BlueVoyant (integrated MS Sentinel Parent Tenant with BPS MS Sentinel Instance

· Staffing: 0 BPS staff, oversight by BPS directors

5. BPS Plant Facilities Division (partner scope, approximate counts)

· Security Cameras and Video: 5,000

· PA System: 75 head end units, integrated with VoIP phone system.

· Building Access Controls: 500 door units and controllers, badging for district staff

· HVAC and Building Environment Controllers: 500 modules

· Endpoints: approximately 250 Windows co-managed workstations

· Staffing: 2 endpoint field technicians plus 1 supervisor, plus IT services subcontractors for the above systems.

6. Miscellaneous Systems (partner scope, various departments)

· Application/Directory Integration: Internal data transfer and directory integration as needed (IT DevOps team)

· Transportation systems: sensitive operation center (Transportation department)

· Instructional systems: help deploy instructional software as requested.

This technical environment represents the current operational baseline for Buffalo Public Schools. The selected Managed Services provider must demonstrate the expertise and certifications required to maintain, optimize, and evolve this infrastructure throughout the contract term.