Attachment A - KETS Network Products and Services Rebid RFP 758 2700000070.pdf

ATTACHMENT A

Commonwealth of Kentucky Request for Proposal (RFP)

For KETS Network Products and Services Rebid

RFP 758 2700000070

Release Date: August 28, 2026 CLOSING DATE AND TIME September 28, 2026, at 3:30pm ET

Issued by

The Finance and Administration Cabinet On behalf of the Kentucky Department of Education (KDE)

Office of Education Technology (OET)

Commonwealth Buyer:

Dianne Lee NIGP-CPP, CPPB, KCPM

Statewide Procurement Analyst II

COMMONWEALTH OF KENTUCKY

FINANCE AND ADMINISTRATION CABINET

Office of Procurement Services 200 Mero Street, 5th Floor

Frankfort, KY 40622

(502) 782-0799

Dianne.Lee@ky.gov

TABLE OF CONTENTS

Proposal Submission Checklist Section 1 – Summary Section 2 – Introduction Section 3 – Scope of Work Section 4 – Commonwealth Office of Technology Requirements Section 5 – Procurement Requirements and Instructions Section 6 – Proposal Submission Section 7 – Proposal Evaluation Section 8 – Negotiations Section 9 – Contract Requirements Section 10 – Standard Terms and Conditions Section 11 – Attachments

PROPOSAL SUBMISSION CHECKLIST

The vendor MUST include the following with the proposal submission.

If the items highlighted below are not submitted with the proposal submission, the Commonwealth MUST deem the proposal non-responsive and SHALL NOT consider for award.

All other items MUST be submitted prior to award.

• *PROPOSED TECHNICAL SOLUTION

• *PROPOSED COST SOLUTION

• TRANSMITTAL LETTER [see Section 6.7(A)]

• REVENUE FORM 10A100 KENTUCKY TAX REGISTRATION APPLICATION IF

APPLICABLE [see Section 6.7 (C)],

• CERTIFICATE OF AUTHORITY- REGISTRATION WITH SECRETARY OF

STATE BY A FOREIGN ENTITY IF APPLICABLE [see Section 6.7 (D)]

• REQUIRED ANNUAL AFFIDAVIT AND OTHER AFFIDAVIT(S)

https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%2 0Offerors%20and%20Contractors.pdf

• ATTACHMENT E – MANDATORY REQUIREMENTS CHECKLIST

https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf https://finance.ky.gov/office-of-the-secretary/FinanceForms/Annual%20Required%20Affidavit%20for%20Bidders%20Offerors%20and%20Contractors.pdf

SECTION 1 - RFP SUMMARY

1.1 Estimated Schedule of RFP Activities

The following table presents the anticipated schedule for major activities associated with the RFP distribution, proposal submission, proposal evaluation process, and contract award. The Commonwealth reserves the right at its sole discretion to change the Schedule of Activities, including the associated dates and times.

Anticipated Schedule of Activities

Release of RFP

August 28, 2026

Vendors’ Conference will be conducted through video conferencing by the Commonwealth.

Location: Via MS Teams Time: 8:00 AM ET – 10:00 AM ET

Attendance is highly encouraged, as this will be the only opportunity to ask oral questions. The Commonwealth shall not be bound by oral answers to the questions presented at the Vendors’ Conference or oral statements made at any other time by any member of the Commonwealth’s staff. Salient questions asked at the Vendors’ Conference and the responses will be reduced to writing and issued in an Addendum that shall be posted to the E-Procurement Page.

September 3, Vendors MUST email Dianne.Lee@ky.gov by 8:00am ET with their company name, contact name and email address to confirm attendance for the Vendor Conference in order to receive an email invitation for MS TEAMS.

September 2, Vendors’ Written Questions due by 9:00 AM ET

(SUBMIT QUESTIONS ON ATTACHMENT D-VENDORS’

QUESTION FORM)

September 4, Commonwealth’s Response to Vendors’ Written Questions September 11, Proposals due by 3:30 PM ET September 28, The Vendors’ Conference will be held as cited in this RFP. Attendance is highly encouraged as this will be the only opportunity to ask oral questions. The Commonwealth shall not be bound by oral answers to the questions presented at the Conference or oral statements made at any other time by any member of the Commonwealth’s staff. Salient questions asked at the Vendors’ Conference and the responses will be reduced to writing and issued in an Addendum that shall be posted to the E-Procurement Page.

mailto:Dianne.Lee@ky.gov

Vendors shall provide the following information via email by 8:00 am ET, September 2, 2026:

Vendor/Company Name Vendor/Company Contact Vendor/Company email address This shall be sent to Dianne.Lee@ky.gov . This will confirm attendance for the Vendor Conference in order to receive an email invitation for MS TEAMS.

1.2 Issuing Office

The Commonwealth of Kentucky, Finance and Administration Cabinet, Office of Procurement Services, is issuing this RFP on behalf of the Kentucky Department of Education (KDE), which includes Kentucky K-12 Public School Districts, KSB, KSD, and KDE, the agency. The Finance and Administration Cabinet is the only office authorized to change, modify, amend, alter, or clarify the specifications, terms and conditions of this RFP.

A contract, based on this RFP, may or may not be awarded. Any contract award from this RFP is invalid until properly approved and executed by the Finance and Administration Cabinet.

1.3 Agencies to Be Served

This contract shall be for use by the Kentucky Department of Education. No shipments shall be made except upon receipt by vendor of an official delivery order from the using agency.

Extending the Contract Use to Other Agencies The Office of Procurement Services reserves the right, with the consent of the vendor, to offer the Master Agreement resulting from this solicitation to other state agencies requiring the product(s) or service(s).

SECTION 2 - INTRODUCTION

2.1 Purpose

The purpose of this Request for Proposal (RFP) is to solicit proposals for competitive negotiations pursuant to 200 KAR 5:307. The Office of Procurement Services issues this Solicitation on behalf of the Kentucky Department of Education (KDE) to establish up to five (5) Master Agreements for Kentucky Education Technology System (KETS) Network Products & Services. Contracts resulting from this solicitation will provide E-Rate eligible purchasing vehicles for network products and services for KY Department of Education, KY’s Public School Districts, the KY School of the Blind (KSB), and the KY School for the Deaf (KSD) - currently 175 sites in total. This Contract is expected to be effective on the mailto:Dianne.Lee@ky.gov award date so as to be eligible for E-Rate applications covering the purchases of products and services beginning July 1, 2027.

2.2 Background

The Kentucky Department of Education (KDE), Office of Education Technology (OET) is located in Frankfort, Kentucky and provides Education Technology services to the Commonwealth’s public school districts, Area Technology Centers (ATC), the Kentucky School for the Blind (KSB), and the Kentucky School for the Deaf (KSD). Further information about KY public schools can be found at https://openhouse.education.ky.gov.

As mandated by KRS 156.670, a plan related to purchasing, developing and using technology to accomplish specific purposes in Kentucky's public school systems must be developed and must cover at least a five-year period. This plan, known as the KETS Master Plan for Education Technology, was originally adopted by the State Board for Elementary and Secondary Education in May 1992. The Master Plan is updated every six (6) years and identifies (a) things we already do well that we want to continue doing well over the next six (6) years, (b) areas to improve upon, and (c) emerging items likely to occur that need to be accounted for by this Master Plan. The studies, research, standards, governance and technology needs for the state and districts that play a critical role in executing the Master Plan are also identified. The Master Plan for Education Technology is located on the KDE Web site at:

https://www.education.ky.gov/districts/tech/Pages/KETS-2024-2030-KETS- Master-Plan.aspx

This plan for technology is consistent with the underlying tenets of the Kentucky Education Reform Act, which addresses the need to ensure baseline equitable access to and pricing of education technology by establishing standards for the type of technology within each school. This means equity in price and support response for a school no matter how wealthy/poor, big/small or its location (rural/urban).

KETS has established and maintains architectural design and configuration standards to ensure enhancement, maximization and security of the education technology environment in Kentucky. Any technology procured or secured by a district, in a category for which a KETS technology need standard is established, regardless of whether the item is used to reduce the technology need or not, must meet or exceed the KETS standard in compliance with 701 KAR 5:110.

SECTION 3 – SCOPE OF WORK

PROPOSALS THAT DO NOT MEET MANDATORY REQUIREMENTS WILL BE

DEEMED NON-RESPONSIVE AND WILL NOT BE CONSIDERED. REFER TO

ATTACHMENT E – MANDATORY REQUIREMENTS CHECKLIST.

https://openhouse.education.ky.gov/ https://www.education.ky.gov/districts/tech/Pages/KETS-2024-2030-KETS-Master-Plan.aspx https://www.education.ky.gov/districts/tech/Pages/KETS-2024-2030-KETS-Master-Plan.aspx

Mandatory Requirement means a condition set out in the specifications or statement of work that must be met without exception.

Pricing shall only be provided in the Cost Proposal. DO NOT SUBMIT ANY PRICING INFORMATION IN THE TECHNICAL PROPOSAL. Technical Proposals which include any reference to vendor pricing (percentage off MSRP, sample order form showing discount percentage, sample invoice showing discount off MSRP or hourly rate, etc.) will be deemed non-responsive.

3.1 Scope of Work/Technical Requirements

This contract covers the purchasing or leasing of hardware and services for Network Infrastructure. These include management software for ease of operations, management, and monitoring of network performance, functionality, and security; warranties; services of installations; services for maintenance of ongoing programs and technical help. For contractual definitions refer to Attachment F – Contractual Definitions (OEM Held Network Contract).

Managed Internal Broadband Services (MIBS) For the purposes of the E-Rate program, The Federal Communications Commission (FCC), via the Universal Service Administrative Company (USAC), has determined that some of the features of networking equipment and hardware such as monitoring‚ automation‚ analytics‚ and optimization that are built in or native to the networking equipment hardware itself may constitute services which fall under the Managed Internal Broadband Services (MIBS) category of service.

For the purposes of this Request for Proposal (RFP) the Kentucky Department of Education (KDE) has identified the following distinctions: MIBS Functionality and MIBS Services.

1. MIBS Functionality (Integrated Device Capabilities – Included in this RFP)

MIBS Functionality refers to built-in‚ embedded capabilities in network devices for the purposes of management‚ monitoring‚ automation‚ or optimization‚ with such capabilities being effectively out-of-the-box or intrinsic capabilities․ FCC/USAC are the sole authorities responsible for determining MIBS classifications and allocation percentages. KDE does not establish separate MIBS methodologies. All proposed solutions in response to mini-bids, including any user-facing interfaces, dashboards, or management platforms, shall comply with accessibility requirements defined in 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d) and the World Wide Web Consortium’s (W3C) Web Content Accessibility Guidelines (WCAG) 2.0, conformance level Double-A or greater.

Functions such as these include‚ but are not limited to:

a. Performance monitoring and telemetry

b. Automated configuration or optimization features

c. AI-powered insights or anomaly detection

d. Embedded analytics and reporting

Such functionality is considered to exist within the network equipment if

a. It comes pre-installed with the device

b. Does not need the use of third-party management services

c. It does not depend on any separately contracted managed services

For the purpose of Erate eligibility, KDE cannot and “does not” determine whether specific functionality constitutes MIBS. FCC/USAC are responsible for those determinations.

OEM activation licenses, software licenses, and cloud-based management subscriptions may require IC/MIBS allocation percentages depending on USAC guidance.

FCC and USAC are the authorities responsible for determining E-Rate eligibility, service classifications, and any associated allocation percentages. Vendors are responsible for following current FCC and USAC guidance and obtaining clarification directly from USAC when necessary. KDE does not classify networking functionality as Internal Connections or MIBS and will not make product-specific determinations on behalf of Vendors or applicants.

2. MIBS Services (Device-independent Third Party Service – Not included in this

RFP)

MIBS Services are a line of continuing network management services provided by a third-party Vendor․

a. Network monitoring and alerting

b. Configuration management

c. Performance tuning and optimization

d. Incident response and remediation

e. Reporting and operational support

These services:

a. Extend beyond device-level functionality

b. Typically provided as subscription or contractual services

c. Are directly established between a school district and a service provider

This RFP seeks a pricing and purchasing vehicle for E-Rate eligible devices that may or may not have MIBS Functionality. It does not seek MIBS Services. Contract awardees and their selected resellers may offer MIBS Services to districts in response to district requests for quote, however, districts are required to conduct their own full E-Rate competitive bidding process (including filing their own FCC Form 470) in order for these services to be eligible for E-Rate support.

The vendor will follow USAC guidance to determine the appropriate percentage breakout when providing quotes as a response to mini-bid activity for districts, not as a response to this RFP.

Where applicable, in response to school district E-Rate mini-bid requests for quote, Vendors must identify the percentage of functionality deemed by USAC to fall under both the Internal Connections and the Managed Internal Broadband Services categories. In cases in which a product performs both Internal Connections and MIBS functions, but USAC has not determined the percentage “split” between Internal Connections and MIBS, Vendors shall provide a “best estimate” based on the overall functionality of the product when it is operated in a typical school network environment.

FCC/USAC are solely responsible for determining IC/MIBS allocation percentages. Vendors must consult USAC guidance and provide IC/MIBS allocation percentages where applicable. This detail is not to be submitted as part of the RFP response, but as a post contract award activity when providing quotes, etc.

If no predetermined USAC allocation percentage exists, vendors should obtain guidance from USAC and provide a documented allocation percentage consistent with FCC/USAC guidance. This detail is not to be submitted as part of the RFP response, but as a post contract award activity when providing quotes, etc.

IC/MIBS allocation percentages shall be identified at the individual SKU level whenever applicable and included in mini-bid responses, quotations, purchase orders, invoices, and related documentation. This detail is not to be submitted as part of the RFP response, but as a post contract award activity when providing quotes, etc.

The IC/MIBS allocation percentage is intended solely to identify allocation between E-Rate eligible service types and is not intended to distinguish eligible versus ineligible functionality.

Districts may rely on OEM-provided allocation percentages, but USAC retains final authority to validate, modify, reject, or otherwise determine classification and allocation percentages.

KDE does not make independent determinations regarding classification of MIBS functionality, services, warranties, maintenance, licenses, or subscriptions. These classifications are governed by FCC/USAC guidance.

Post contract award, when responding to mini-bids, providing quotes, etc. cloud-based management subscriptions and similar components should be classified and allocated in accordance with FCC and USAC service-type guidance.

District applicants may rely on OEM-provided IC/MIBS allocation percentages when preparing E-Rate funding requests; however, USAC retains final authority to validate, modify, or reject those percentages. This detail is not to be submitted as part of the RFP response, but as a post contract award activity when providing quotes, etc.

The vendor will follow USAC guidance to determine the appropriate percentage breakout when providing quotes as a response to mini-bid activity for districts.

Additionally, Vendors shall identify whether or not the MIBS product functionality is performed by Artificial Intelligence (AI). For purposes of this solicitation, AI refers to machine-based knowledge and functionality. The format of this disclosure may be determined by the Vendor. This disclosure requirement is intended to be consistent with and does not differ from the Commonwealth's Artificial Intelligence requirements contained in Section 10.31 and CIO-126.

3.1.1 Technical Requirements

A. Qualified Vendor:

A Qualified Vendor is an original equipment manufacturer (OEM) of enterprise level network solutions that meet or exceed all technical specifications outlined in this solicitation. A manufacturer must bid direct and may not bid through a manufacturer-authorized reseller. Each (OEM) will be allowed to submit one (1) bid only. Qualified OEM Vendors must respond to this RFP online using their registered Kentucky Vendor Customer account.

After the award, the manufacturer may propose the use of up to three (3) agents/resellers. The Kentucky Department of Education reserves the right to review and give final approval to the proposed agents/resellers and/or any change in agents/resellers after the initial contract award. The manufacturer is still responsible for ALL aspects of the contract requirements regardless of the usage of an agent(s)/reseller(s). A manufacturer SHALL NOT be allowed to have more than three (3) agents/resellers.

Agent/resellers selected by contract holders shall agree to submit a signed ATTACHMENT G KETS Network Products and Services Reseller Agreement form signifying agreement and compliance with the terms and conditions of the contract, including, but not limited to:

a. Eligibility and good standing to provide services under the federal E-Rate program

b. Meeting or exceeding the minimum discount off MSRP established by the

OEM under contract

c. Obtaining OEM sign-off on all responses to E-Rate mini-bid requests for quote from KY school districts

d. Naming and assigning specific personnel to support roles (E-Rate, technical, sales, warranty, etc.) and

e. Quotes must indicate the length of time for which they are valid

f. Providing sales and activity data to the OEM contract holder at a minimum on a quarterly basis and as directed by Office of Education Technology

(OET)

The vendor shall provide the KETS Network Products and Services Reseller Agreement to KDE for review at the initiation and at the renewal of contracts as needed based on input and feedback.

Changes to the assignment of resellers by contract holders will be limited to April 1 through September 30 of each calendar year, thereby ensuring continuity of providers during the typical E-Rate “application season”.

Exceptions to this must be pre-approved by OET.

For this solicitation and resulting contract(s), an agent/reseller is defined as a company or individual that represents the manufacturer in quotes for products and/or services, purchase order review, delivery and/or warranty and support services of the manufacturer’s product(s). Quotes for products and/or service shall be on the letterhead of the entity presenting the quote. All financial documentation including quotes and invoices shall be issued by the OEM or agent/reseller responsible for delivering products and/or services.

Contract holders shall provide a link to an active list of KETS and E-Rate eligible products and services available under resulting contract(s) which includes current MSRP. This link will be referenced and made available on the appropriate page of the KDE Website where these contracts and product standards are identified.

The Commonwealth will not evaluate or score MSRP values, MSRP publication dates, or MSRP snapshots. This detail is not to be submitted as part of the RFP response, but as a post contract award activity when providing quotes, etc.

PRICING INFORMATION IN THE TECHNICAL PROPOSAL. Technical Proposals which include any reference to vendor pricing (percentage off MSRP, sample order form showing discount percentage, sample invoice showing discount off MSRP or hourly rate, etc) will be deemed non-responsive.

The requirement to provide a link to an active MSRP price list applies only to awarded contract holders and is not a proposal submission requirement.

Vendors shall not include MSRP links, product catalog links, or other hyperlinks in their Technical Proposal or Cost Proposal. Following contract award, contract holders shall provide and maintain the required MSRP link for publication and contract administration purposes.

B. Categories:

Vendor and all those working on behalf of the Vendor who holds the contract must comply with all requirements established under the E-Rate program, and the Vendor shall maintain and provide a link to an updated price list that clearly identifies KETS and E-Rate eligible products and services which includes current MSRP. Vendor shall clearly distinguish between E-rate eligible and non E-Rate eligible components. This contract is the mechanism by which Kentucky public school districts and the Kentucky Department of Education purchase (or lease) and maintain network products and associated services. These products and services may be hardware or software-based and ensure effective delivery of network traffic across the customers’ Network Infrastructure (Local Area Network (LAN) and Wide Area Network (WAN). These offerings may be a combination of products and services that are on customer premises or provider/cloud hosted. These offerings might also include subscription-based services.

The type of products may include (but are not necessarily limited to):

1. E-Rate Eligible Basic Services:

a. Switches (Wired L2 and L3)

b. Routers

c. Wireless Access Points

d. Wireless Controllers (physical or virtual)

e. Cables/Accessories (including related components used for internal broadband connections)

f. Basic Firewalls

g. SD-WAN (hardware with MIBS functionality, services are excluded)

h. Software Licenses (right-to-use, client access)

i. Installation/Initial Configuration

j. Training (On-site in conjunction with installation/initial configuration)

k. Basic Maintenance Support for Hardware and/or Software

2. Non-E-Rate Eligible Basic Services

l. Network Access Control

m. Network Software (Management, Security and/or Analytics)

n. Network Professional Services

o. Network Accessories

p. Wireless – Configuration Software

q. Technician/System Admin Training (off-site, advanced)

r. Advanced Firewall

s. LAN/WAN Edge Devices (3rd party)

t. Security-related enhancements

u. Network Monitoring

v. Traffic Logging, Reporting and/or Analysis.

C. Single Point of Contact:

It is crucial to have a dedicated account team with which to form a partnership.

This working partnership affords the Vendor (OEM) insight into how KDE and K-12 public school districts operate. Vendor shall provide an account team that includes, but is not limited to, a sales account representative that is also the Single Point of Contact (SPOC), pre-sales engineer, and a post-sales support level staff to serve the needs of the K-12 customers. Vendor shall name the assigned person that will be the single point of contact (SPOC) for contract issues. Vendor shall ensure that this person and all salespersons of their product will be knowledgeable in:

a. All the details of the KETS contract including the mini-bid process.

b. The KY public school, district office, and KDE customer base

c. The most current KETS Master Plan on our KDE web site and year round current events in KETS

d. Federal E-Rate program and provide assistance to KDE or K-12 public school districts in completing their annual E-Rate filing.

The SPOC must be proactive in sharing information or presenting a point of view with the selling staff and the manufacturer(s) of the KETS products.

Each reseller shall provide an account team that includes, but is not limited to, a sales account representative that is also the Single Point of Contact (SPOC), pre-sales engineer, and a post-sales support level staff to serve the needs of the K-12 customers. In addition, each Reseller shall provide a single email address for all E-Rate related correspondence, including but not limited to mini-bid requests, BEAR form assistance, bulk up load assistance, etc This mailbox should be monitored by multiple people connected to the Reseller.

KETS customers shall notify the OET Vendor Manager when Vendors fail to meet the requirements of the contract. The OET Vendor Manager will work directly with the SPOC to remedy the issue and work with KDE staff and Vendor escalation points of contact to escalate issues as needed.

Upon contract award, Vendor shall provide a description of a copy of procedures for requesting escalation, complaint resolution and identify the staff available for installations, billing problems, etc. Vendor shall provide updated information annually at a minimum.

D. Deliverables:

All deliveries of equipment shall be provided within thirty (30) calendar days of the Vendor’s receipt of the purchase order from the customer, unless otherwise requested by the purchasing agency in writing. Delivery is defined as the receipt of goods and completion of installation, if required.

Customers purchasing from contracts resulting from this solicitation shall have thirty (30) calendar days from the date the customer receives a complete order to notify the Vendor of any issues with the order (i.e. missing or damaged parts).

Vendor may consider the order accepted by the customer after the close of the thirty (30) calendar day window.

E. Leasing

Leasing should be made available as an option to KETS customers. Leasing agreements shall meet all legal requirements for the Commonwealth and KDE.

Vendor shall quote hardware warranty coverage for the duration of the lease period. If the lease exceeds threshold of $100,000 then the lease must be approved by KDE before the lease can be approved.

Any leasing agreement must comply with Kentucky procurement requirements.

Local district requirements still apply. Any E-rate eligible leasing or billing must be in compliance with USAC E-rate requirements.

Below is a link to the guidelines and regulations regarding leases;

https://www.education.ky.gov/districts/tech/Pages/District%20Lease.aspx

F. Warranty:

Vendor shall agree to include one (1) year of Primary Service Coverage Timeframe (PSCT) for maintenance/warranty in the initial purchase cost. After the initial one (1) year period, if hardware maintenance is desired, it will be the responsibility of the customer to procure from either this contract or other approved sources.

1. Primary Service Coverage Timeframe maintenance/warranty shall meet the following criteria:

a. The KETS customer’s PSCT falls between the hours of 7:30 am and

5:00 pm customer’s local time, Monday - Friday, excluding state observed holidays;

b. The Vendor shall be available to provide warranty service during the

PSCT.

c. Vendor shall respond within four (4) business hours to begin the diagnostics/fault determination. Vendor should perform all fault determination.

d. Next business day onsite response. Onsite is defined that the Vendor goes to the location of the equipment purchased, e.g. a school district office, state agency, etc. Vendor shall come on-site to install any replacement https://www.education.ky.gov/districts/tech/Pages/District%20Lease.aspx parts or perform repair work, so the network equipment is operational three

(3) business days of the initial call.

e. All technicians shall be properly certified and or licensed to service network hardware;

f. Perform diagnostics and repair remotely if applicable versus onsite response with the customer’s prior approval.

g. Replacement parts shall be new or reconditioned, and of equal or better quality than original parts;

h. There shall be no charge for any shipping and handling of parts or labor charges for troubles or issues with the equipment;

i. Vendor shall ensure any optional -- year two and beyond PSCT coverage, or the Extended Service Coverage Timeframe – maintenance/warranty cost is the same throughout the state.

j. Vendor shall perform a backup on all devices that have backup capability prior to making hardware or software changes;

k. Vendor shall be provided access to the customer’s building where the network equipment is located as required to fulfill customer service requests.

2. Optional Extended Service Coverage Timeframe (ESCT) coverage up to 24 x 7 shall be available if purchased;

a. Vendor shall provide a pricing option for Extended Service Coverage Timeframe (ESCT) to be added to the PSCT one (1) year maintenance/warranty included with the initial purchase of the hardware.

b. Vendor shall ensure any optional ESCT maintenance/warranty cost is the same throughout the state.

c. Vendor shall call and/or email customer back within one clock (1) hour of customer placing call to begin the diagnostics/fault determination and provide applicable information including ticket number;

d. Vendor goes onsite to the location of the equipment purchased, e.g. a school district office, state agency, etc. Vendor shall come on-site to install any replacement parts or perform repair work so the network equipment is operational within twenty-four (24) clock hours (one (1) business day) of the initial call.

3. Optional Post-PSCT Maintenance/Warranty (Year Two and Beyond)

a. Vendors may offer optional maintenance and warranty support services for periods beyond the PSCT one (1) year maintenance/warranty.

b. If optional post– PSCT maintenance/warranty is purchased, the Vendor shall provide separate, itemized pricing for post-PSCT warranty support:

i. Identify pricing per device, per system, or per site, as applicable

ii. Ensure pricing is clearly distinguishable from eligible equipment costs

iii. Post-PSCT maintenance/warranty service levels shall:

a. At minimum, match PSCT service levels

b. Allow customers to select alternative service levels (e.g., Extended Service Coverage Timeframe)

c. Customers may:

i. Renew annually

ii. Upgrade/change service level

iii. Decline continued maintenance/warranty

4. Optional Multi-Year Maintenance/Warranty

Vendors may provide optional multi-year maintenance/warranty pricing

(e.g.,3-year or 5-year terms), provided:

a. Such options are not bundled into base equipment cost

b. All pricing is separately identified

c. Selection is at the customer’s discretion

d. At a minimum matches PSCT service levels

G. Sales Reporting:

Vendor shall maintain accurate records indicating sales from the KETS contract. Quarterly sales and warranty data shall be reported as directed by KETS Contract Management and shall contain, at a minimum, the following fields: date of invoice, PO #, customer name, item manufacturing part number, Item serial number, item description (must include model name and number), type of product, unit list price, quantity, total list price, total discounted price, discount off MSRP (percentage), and applicable reseller name if resellers are utilized for the contract.

Vendor shall prepare and submit electronically this information no later than ten

(10) business days after the end of each quarter to the KETS Contract Management at ketscontractmgmt@education.ky.gov. The Vendor SPOC shall submit quarterly sales reports. The vendor shall not rely on KDE for reminders mailto:ketscontractmgmt@education.ky.gov to submit reports. It is the responsibility of OET to report any failure to submit and/or late submissions of sales reports on the annual contract review.

H. Services Requirements:

The Vendor shall provide a comprehensive list of Services offered under this

RFP.

Pricing shall only be provided in the Cost Proposal. DO NOT SUBMIT ANY PRICING INFORMATION IN THE TECHNICAL PROPOSAL. Technical Proposals which include any reference to vendor pricing (percentage off MSRP, sample order form showing discount percentage, sample invoice showing discount off MSRP or hourly rate, etc) will be deemed non-responsive.

Engagement Requirements: Any services engagement initiated under this contract shall require mutual written acceptance between the Vendor and the Agency/District including agreement on:

1. The detailed scope of work

2. Required resources and/or materials

3. Estimated timeframe for completion

4. Final deliverables

No work shall commence until both parties have approved the engagement in writing.

3.2 Value Added Services

Value-added services may be added to the contract with the prior approval by the Commonwealth Office of Technology and the Office of Procurement Services Buyer of Record. Upon approval, a formal modification will be made to add the service(s). No work shall begin until a contract modification is completed and notice provided by the OPS Buyer that work may begin.

SECTION 4 – COMMONWEALTH OFFICE OF TECHNOLOGY (COT)

REQUIREMENTS

4.1 Commonwealth Information Technology Policies and Standards

A. The Vendor and any subcontractors shall be required to adhere to applicable Commonwealth policies and standards.

B. The Commonwealth posts changes to COT Standards and Policies on its Commonwealth Office of Technology - Home - Commonwealth Office of Technology (Kentucky) website. Vendors and subcontractors shall ensure their solution(s) shall work in concert with all posted changes. Vendors or subcontractors that cannot comply with changes must, within thirty (30) days of the posted change, request written relief with the justification for such relief. The https://technology.ky.gov/Pages/index.aspx https://technology.ky.gov/Pages/index.aspx

Commonwealth may: 1) deny the request, 2) approve an exception to the policy/standard, or 3) consider scope changes to the contract to accommodate required changes. Vendors or subcontractors that do not provide the response within the thirty (30) day period shall be required to comply within ninety (90) days of the change.

C. Vendor shall comply with Section 10.31 regarding Artificial Intelligence

4.2 Compliance with Industry Accepted Reporting Standards Based on Trust Service Principles and Criteria The Vendor must employ comprehensive risk and threat management controls based on defined industry standards for service organizations such as AICPA TSP section 100, Trust Services Principles and Criteria. The Vendor must annually assert compliance and engage a third party to examine such assertions and, controls to provide a Report, such as AT101 SOC 2 type 2, on Controls at a Service Organization Relevant to Security, Availability, Processing, Integrity, Confidentiality, and Privacy, which contains an opinion on whether the operating controls effectively support the assertions. All such reports, including publicly available reports (i.e. AT 101 SOC 3) shall be made available to the Commonwealth for review.

4.3 System Vulnerability and Security Assessments

The Commonwealth reserves the right to conduct, in collaboration with the Vendor, non-invasive vulnerability and security assessments of the software and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of these assessments, the Commonwealth will communicate any findings to the Vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the Vendor. Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the Vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls that will reduce risk to an acceptable and agreed upon level. An accredited third party source may be selected by the Vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

4.4 Privacy Assessments

The Commonwealth reserves the right to conduct Privacy assessments of the collection, use, maintenance and sharing of Commonwealth data by any Vendor services, software, and infrastructure used to provide services prior to implementation and periodically thereafter. Upon completion of this assessment, the Commonwealth will communicate any findings to the Vendor for action. Any cost relating to the alleviation of the findings will be the responsibility of the Vendor.

Mitigations will be subject to re-evaluation after completion. In cases where direct mitigation cannot be achieved, the Vendor shall communicate this and work closely with the Commonwealth to identify acceptable compensating controls or privacy practices that will reduce risk to an acceptable and agreed upon level. An accredited third party source may be selected by the Vendor to address findings, provided they will acknowledge all cost and provide valid documentation of mitigation strategies in an agreed upon timeframe.

4.5 Privacy, Confidentiality and Ownership of Information

The Commonwealth is the designated owner of all Commonwealth data and shall approve all access to that data. The Vendor shall not have ownership of Commonwealth data at any time. The Vendor shall not profit from or share Commonwealth data. The Vendor shall be in compliance with privacy policies established by governmental agencies or by state or federal law. Privacy notice statements may be developed and amended from time to time by the Commonwealth and will be appropriately displayed on the Commonwealth portal (Ky.gov). The Vendor should provide sufficient security to protect the Commonwealth and COT data in network transit, storage, and cache. All Commonwealth data, including backups and archives, must be maintained at all times within the contiguous United States. All Commonwealth data, classified as sensitive or higher, as defined in Enterprise Standards, must be encrypted in-transit and at rest.

4.6 EU GDPR Compliance

The Commonwealth of Kentucky requires all Vendor contracts to comply with the European Union’s General Data Privacy Regulation [Regulation (EU) 2016/679] (the “GDPR”) when the Commonwealth is a “controller” or “processor” of “personal data” from an individual “data subject” located in the European Union, as those terms are defined in the GDPR. The Contractor acknowledges and agrees that it is acting as a “processor” of “personal data” for the Commonwealth under this Agreement and that all applicable requirements of the GDPR are incorporated by reference as material terms of this Agreement. The Contractor represents and warrants that (1) it is aware of and understands its compliance obligations as a “processor” under GDPR; (2) it has adopted a GDPR compliance policy/program, a copy of which has been provided to the Commonwealth; (3) it will process “personal data” only in accordance with the Commonwealth’s instructions; and (4) with regard to its obligations under this Agreement, it shall comply with all applicable requirements of the GDPR to the same extent as adopted by the Commonwealth. Additionally, the Contractor shall indemnify and hold harmless the Commonwealth, and its employees from and against any claims, demands, suits, damages, penalties, fines, or costs arising from any violation of GDPR by the Contractor.

4.7 Data Quality

The vendor shall provide proposed levels of data quality per the following dimensions.

Data Quality is the degree to which data is valid, accurate, complete, unique, timely, consistent with all requirements and business rules, and relevant for a given use. The vendor shall provide data quality definitions and metrics for any data elements. Data has to be of the appropriate quality to address the needs of the Commonwealth of Kentucky. The following dimensions can be used to assess data quality:

• Validity – The data values are in an acceptable format.

• Accuracy – The data attribute is accurate.

• Completeness – There are no null values in a data field.

• Uniqueness – There are no duplicate values in a data field.

• Timeliness – The data attribute represents information that is not out-of-date.

• Consistency – The data attribute is consistent with a business rule that may be based on that attribute itself, or on multiple attributes.

• Adherence to business rules – The data attribute or a combination of data attributes adheres to specified business rules.

4.8 License Agreements

Any proposed software agreements, i.e. license agreement, subscription agreement, end-user license agreement, etc. shall include the following language, or similar, and must be submitted to the Commonwealth Office of Technology (COT) for review and approval prior to the award of the contract:

“Governing Law shall be the Commonwealth of Kentucky, Franklin County. All terms of the vendor/subvendor agreement/EULA shall be read as applicable only to the extent permitted by Kentucky law and no term in violation of the Kentucky law, inclusive of Kentucky Procurement Law, shall be given effect.”

Any third-party software licenses and cloud resources necessary for the proposed solution may be procured via the Commonwealth’s existing contracts.

4.9 Software Version Requirements

All commercially supported and Commonwealth approved software components such as operating system (OS), Database software, Application software, Web Server software, Middle Tier software, and other ancillary software must be kept current. In the event that a patch interferes with the solution, the Vendor must present a plan for compliance to the Commonwealth outlining the constraints and an appropriate plan of action to bring the solution into compliance to allow this patch to be applied in the shortest timeframe possible, not to exceed three months, unless otherwise negotiated with the Commonwealth.

4.10 No Surreptitious Code Warranty

The contractor represents and warrants that no copy of licensed Software provided to the Commonwealth contains or will contain any Self-Help Code or any Unauthorized Code as defined below. This warranty is referred to in this contract as the "No Surreptitious Code Warranty”. As used in this contract, "Self-Help Code" means any back door, time bomb, drop-dead device, or other software routine designed to disable a computer program automatically with the passage of time or under the positive control of a person other than the license of the software. Self- Help Code does not include Software routines in a computer program, if any, designed to permit an owner of the computer program (or other person acting by authority of the owner) to obtain access to a licensee's computer system(s) (e.g.

remote access) for purposes of maintenance or technical support. As used in this contract, "Unauthorized Code" means any virus, Trojan horse, spyware, worm or other Software routines or components designed to permit unauthorized access to disable, erase, or otherwise harm software, equipment, or data; or to perform any other such actions. The term Unauthorized Code does not include Self-Help Code.

In addition, contractor will use up-to-date commercial virus detection software to detect and remove any viruses from any software prior to delivering it to the Commonwealth. The Vendor shall defend the Commonwealth against any claim, and indemnify the Commonwealth against any loss or expense arising out of any breach of the No Surreptitious Code Warranty.

4.11 Network Connection Requirements

A. Vendor shall work with KDE and/or all Kentucky public schools to establish any network connections. If a secure site-to-site connection is required, the Vendor shall employ a secure site-to-site connection procured by KDE.

B. Vendor shall notify KDE and/or all Kentucky public schools of network bandwidth requirements and if caching is required for implementation Vendor shall resolve caching requirements, in coordination with KDE.

C. Vendor shall, at KDE’s discretion, provide appropriate access to enable the Commonwealth to perform additional security measures, such as decryption of the network traffic if required for inspection. If the proposed solution does not have the ability to meet this requirement, the Vendor must provide an alternative such as audit reporting of this function.

D. Vendor shall provide notifications to the KDE Customer Service Center and/or applicable local school district service for unplanned outages within 5 minutes.

E. Vendor shall notify KDE Change Management and/or applicable local school district, through the KDE Customer Service Center and/or applicable local school district, a minimum of two (2) business days prior to any planned outage.

4.12 Applicable Security Control Framework Compliance

The Vendor must have an awareness and understanding of the NIST Special Publication 800-53 Security Control Framework and employ safeguards that meet or exceed the moderate level controls as defined within the standard. The respondent must provide sufficient safeguards to provide reasonable protections around the Commonwealth’s data to ensure that the confidentiality, integrity, and availability is maintained at an appropriate level. These include but are not limited to:

• Access Control The Vendor must employ policy and process that provide for stringent control to limit physical and logical access to systems that house Commonwealth data, on a need to know basis, provide clear separation of duties, and adheres to least privilege principles.

• Awareness and Training The Vendor must provide the appropriate role specific training for staff to ensure that there is awareness and understanding of roles and responsibilities as they relate to the protections around the Commonwealth’s data.

• Audit and Accountability There must be sufficient auditing capability to ensure that actions are tracked and there is individual accountability for all actions taken by Vendor staff.

• Configuration Management The Vendor must work within established baselines that provide minimal functionality needed to ensure service delivery without exposing unnecessary risk. The Vendor must also employ structured change control processes that provide a level of coordination with the client agreed upon in a Service Level Agreement (SLA).

• Contingency Planning The Vendor must employ contingent planning policy and procedures that ensure service delivery based on agreed SLA levels while maintaining all Commonwealth data within the continental Unites States.

• Identification and Authorization The Vendor must employ appropriate identity and access management policies and procedures to ensure that access is appropriately authorized and managed at a level to ensure that access is provisioned and de-provisioned in a timely and efficient manner.

• Incident Response The Vendor must employ policy and procedures to ensure that an appropriate response to all identified security incidents are addressed in a timely manner and are reported to the appropriate parties in an agreed upon SLA timeframe. The Vendor must also ensure that all staff are sufficient trained to ensure that they can identify situations that are classified as security incidents.

• Maintenance The Vendor must employ policy and procedures that ensure that all maintenance activities are conducted only by authorized maintenance staff leveraging only authorized maintenance tools.

• Media Protection The Vendor must employ policy and procedure to ensure that sufficient protections exist to protect Commonwealth data on all storage media throughout the media lifecycle and maintain documentation from media creation through destruction.

• Physical and Environmental Controls

The Vendor must employ physical and environmental policies and procedures that ensure that the service and delivery infrastructure are located in a physically secure and environmentally protected environment to ensure the confidentiality, integrity, and availability of Commonwealth data.

• Personnel Security The Vendor must employ policies and procedures to ensure that all staff that have access to systems that house, transmit, or process Commonwealth data have been appropriately vetted and have been through a background check at the time of hire and periodically thereafter.

• System and Communications Protections The Vendor must employ physical and logical protection that protect system communications and communication media from unauthorized access and to ensure adequate physical protections from damage.

4.13 IRS Publication 1075 -Exhibit 7 Safeguarding Contract Language

Publication 1075 (Rev. 11-2021) (irs.gov)

I. PERFORMANCE

In performance of this contract, the Contractor agrees to comply with and assume responsibility for compliance by officers or employees with the following requirements:

(1) All work will be performed under the supervision of the contractor.

(2) The contractor and contractor’s officers or employees to be authorized access to FTI must meet background check requirements defined in IRS Publication 1075.

The contractor will maintain a list of officers or employees authorized access to FTI. Such list will be provided to the agency and, upon request, to the IRS.

(3) FTI in hardcopy or electronic format shall be used only for the purpose of carrying out the provisions of this contract.