RFP_26L-0724_Specifications.pdf

RFP 26L-0724

Scope of Work Specifications

REQUEST FOR PROPOSAL 26L-0724

Network Firewall: Consulting, Management, Upgrade, and Testing

SPECIFICATIONS

Purpose of specifications: Specifications are designed to enable offeror to satisfy a requirement for a product, material, process, or service. A specification may be expressed as a standard, part of a standard, or independent of a standard. No specification is intended to limit competition by eliminating items capable of satisfactorily meeting the requirements of the procurement. If offeror believes a specification is unnecessarily restrictive, offeror must notify Mohave prior to specified proposal due date and time.

Partial proposals: Mohave may consider partial proposals for award of a contract.

Use of brand names: Brand names, trade names, model numbers, and/or catalog numbers may be used to describe the standard of quality, performance, and other characteristics needed to meet member requirements. Use of the name of a manufacturer, brand, make, or catalog number is not intended to limit or restrict competition, nor does it restrict offeror from the submission of brand equivalent offers. However, Mohave reserves the right to decide whether alternatives are equivalent to the materials and/or equipment described in the solicitation. Mohave shall be the sole judge of equivalent quality, and Mohave’s decision shall be final.

Compliance with specifications: Offerors shall offer products, materials, processes, or services they believe meet the specifications. The fact that a manufacturer, supplier, or offeror chooses not to produce or provide product, material, process, or services to meet the specifications shall not be considered sufficient cause to adjudge the specifications as restrictive.

Additional references and definitions used for specifications: (acronyms used in the solicitation are noted in bold font below):

ANSI (ANSI): www.ansi.org

Center for Internet Security (CIS): https://www.cisecurity.org/controls

Federal Communications Commission (FCC): www.fcc.gov

IEEE (IEEE): www.ieee.org

ISO (ISO): www.iso.org

ITU (ITU): www.itu.int

Internet Engineering Task Force (IETF): www.ietf.org

National Electrical Code (NEC): https://www.nfpa.org/NEC

National Institute of Standards and Technology (NIST): https://www.nist.gov

Telecommunications Industry Association (TIA): www.tiaonline.org

UL Solutions (UL): www.ul.com http://www.ansi.org/ https://www.cisecurity.org/controls http://www.fcc.gov/ http://www.ieee.org/ http://www.iso.org/ http://www.itu.int/ http://www.ietf.org/ https://www.nfpa.org/NEC https://www.nist.gov/ http://www.tiaonline.org/ http://www.ul.com/

SPECIFICATION INSTRUCTIONS

Exceptions/Deviations from specifications: Offerors will respond to each numbered specification by checking the appropriate “Comply” or “Exception/Deviation*” box. “No Bid” items shall be marked as such in the appropriate “Exception/Deviation*” box. Your exceptions/deviations must be clearly explained.

Reference the specification that you are taking exceptions/deviations to detail any proposed substitute language, and clearly explain how the exceptions/deviations meet or exceed specifications. Unacceptable exceptions/deviations shall remove your proposal from consideration for award. Mohave shall be the sole judge on the acceptance of exceptions and Mohave’s decision shall be final. Details for exceptions/deviations shall be listed by specification number on the Scope of Work and Specifications Acceptance Form.

Specifications

Comply Exception/

Deviation*

1.1 General Specifications

1.1.01 Contract vendor shall provide network firewall services to include, but not be limited to: consulting, firewall management, firewall upgrade, and firewall testing.

1.1.02 Network firewalls shall work at the Internet, intranet, department, and workgroup level, depending on member’s requirements.

1.1.03 Network firewalls shall provide the following capabilities to include but not be limited to: stateful and deep packet inspection; network address translation; application identification and control; encrypted traffic inspection; integrated intrusion detection and prevention; anti-malware and threat prevention; URL/web filtering; DNS security;

geo-IP filtering; VPN support (site-to-site and remote access);

centralized management; and comprehensive event logging with export to member-designated SIEM or log management platforms.

1.1.04 Additional network firewall capabilities may include, but not be limited to: sandboxing or detonation of suspicious files; data loss prevention (DLP); zero-trust network access (ZTNA) integration; SD- WAN functionality; and cloud-delivered or hybrid deployment options.

1.1.05 Contract vendor shall not offer non-firewall related equipment, services, or software to include, but not be limited to: computers, software, network server hardware, appliances, or peripheral equipment.

1.1.06 Contract vendor shall not offer under an awarded contract the following E-rate eligible Category 2 management services: Basic Management of Internal Connections or Managed Internal Broadband.

1.2 Consulting Services Specifications

1.2.01 Contract vendor shall provide network firewall consulting services to include, but not be limited to: firewall hardware and software analysis; firewall architecture and design; network security assessment; gap analysis; optimization and cleanup; network segmentation design; cloud and hybrid network security architecture;

disaster recovery and business continuity analysis; local area network (LAN) analysis; and wide area network (WAN) security analysis.

1.2.02 Contract vendor shall provide recommendations or solutions to strengthen firewall from current configuration for compliance with current industry standards and regulations.

1.2.03 Contract vendor shall provide evaluation report(s) containing the following elements including, but not limited to: objective and scope of the project; summary of methodologies used in the evaluation;

summary of the results; specific findings with adequate descriptions of the strengths and weaknesses identified; appropriate and reasonable recommendations for future action; or any criteria requested by the member.

Exception/

Deviation*

1.3 Firewall Management Specifications

1.3.01 Contract vendor shall provide network firewall management to include, but not be limited to: automation, policy control, firewall configuration, rule management, change management, compliance, monitoring, performance optimization, event logging and archiving, and baseline and trend development.

1.3.02 Network firewall monitoring management and support services shall include troubleshooting and solution development to ensure firewall complies with current industry standards and regulations.

1.3.03 Contract vendor may offer root cause analysis to assist member in determining the cause of the problem and identifying potential solutions.

1.3.04 Contract vendor shall provide on-site and/or remote network firewall management services. Remote network firewall support shall be provided through the contract vendor or qualified third-party provider.

1.3.05 Contract vendor may offer remote network firewall management and support services through direct connection to member’s network through secure network connection.

1.3.06 Incident and problem management shall consist of routine and emergency services to repair, strengthen, and restore member’s network firewall.

1.3.07 Help desk service availability shall be during a member-defined time frame (e.g., normal business hours or 24 hours a day 7 days a week).

Provide descriptions and pricing in Product and Services tab of the Pricing Workbook.

1.3.08 Contract vendor shall provide member specific procedures that outline help desk operation, work order flow, problem escalations, and notifications that describe actions taken from point of problem discovery to resolution.

1.4 Firewall Upgrade Specifications

1.4.01 Contract vendor may provide firewall hardware and software licenses, maintenance, repair, replacement, or upgrade.

1.4.02 Contract vendor upgrades to member network shall provide for system firewall enhancement or improvement, bring the existing firewall into conformance with current industry standards or the manufacturer minimum recommended standards.

1.4.03 All hardware shall be in accordance with the following current applicable codes and standards: ANSI, CIS, FCC, IEEE, IETF, ISO, NEC, NIST, and UL.

1.4.04 Firewall software integrated security capabilities shall include, but not be limited to: intrusion detection and prevention, anti-malware protection, URL and content filtering, application identification and control, event logging, and management.

1.4.05 Firewall software solutions may include optional integrated security capabilities that extend or complement the firewall's core functions, including but not limited to: cloud-delivered threat intelligence subscriptions; integrated sandboxing or file detonation services; DLP;

secure web gateway (SWG) functionality; cloud access security broker (CASB) integration; ZTNA; and secure access service edge (SASE) or security service edge (SSE) platforms that incorporate firewall functionality.

1.4.06 Optional capabilities shall be directly integrated with or operationally dependent upon the firewall services provided under this contract.

Standalone security products not integrated with the firewall are subject to the limitations in 1.1.05.

Exception/

Deviation*

1.5 Firewall Testing Specifications

1.5.01 Contract vendor shall assist member in developing, implementing, and maintaining network security plans that address firewall testing, scope, and criteria.

1.5.02 Contract vendor shall perform firewall testing using member established criteria prior to testing. Criteria shall be documented in the written testing plan or statement of work that defines testing frequency, scope, and methodology.

1.5.03 Contract vendor shall perform firewall testing as directed by member or as prescribed by established network security plans. Testing shall include, but not be limited to: vulnerability assessment, penetration testing, and compliance audits.

1.5.04 Contract vendor shall perform vulnerability assessments to identify security weaknesses in firewall hardware, firewall software, firewall configuration, and firewall rule base. Assessment shall be performed through automated scanning and manual review. Vulnerability scanning tools and signature databases shall be current at the time of assessment.

1.5.05 Contract vendor shall provide a report of the vulnerability assessment results to member, which includes, but is not limited to: inventory of assets assessed; list of identified vulnerabilities with Common Vulnerabilities and Exposures (CVE) identifiers where applicable;

severity rating for each finding using a recognized scoring system (e.g., Common Vulnerability Scoring System (CVSS)); and prioritized remediation recommendations.

1.5.06 Contract vendor shall perform penetration testing that simulates real-world attacks against the network firewall and adjacent network components. Penetration testing shall identify exploitable weaknesses that may not be detected by automated vulnerability scanning.

1.5.07 Contract vendor shall conduct penetration testing written rules-of-engagement document approved by member that defines scope, permitted techniques, timing, escalation procedures, and authorization.

1.5.08 Penetration testing shall be performed by personnel holding recognized industry certifications (e.g., OSCP, GPEN, GXPN, CEH, or equivalent). Provide evidence of certification in Vendor Response 5.3

1.5.09 Contract vendor shall provide a report of the penetration testing results to member, which includes, but is not limited to: an executive summary; technical findings documenting each exploited weakness with reproduction steps; evidence of exploitation (e.g., screenshots, logs); a risk rating for each finding using a recognized scoring system (e.g., CVSS); and prioritized remediation recommendations.

1.5.10 Contract vendor shall perform compliance audits to assess the firewall configuration, rule base, change management practices, and operational procedures against applicable industry standards, regulatory requirements, and member-specified frameworks.

1.5.11 Prior to compliance audits, contract vendor shall provide a recognized professional certification to member when required by a framework (e.g., PCI Qualified Security Assessor (QSA) for PCI-DSS audits).

Compliance audits shall be performed by appropriately certified personnel.

Exception/

Deviation*

1.5 Firewall Testing Specifications (Cont’d)

1.5.12 Contract vendor shall provide a report of compliance audit results to member, which includes, but is not limited to: identification of findings; a control-by-control mapping to the applicable framework;

documented evidence supporting each finding; a risk rating for each finding using a recognized scoring system (e.g., NIST Cyber Risk Scoring (CRS)); and prioritized, actionable remediation recommendations.

1.5.13 Contract vendor shall perform network firewall assessment, audit and testing activities, as applicable to the member's environment and agreed scope, which may include, but not be limited to: network infrastructure (including firewalls, switches, routers, and wireless access points); servers and endpoints reachable through the firewall;

web applications and APIs; mobile applications; cloud and virtual environments; remote access and VPN infrastructure; and physical security controls protecting network equipment.

1.5.14 Contract vendor shall provide all assessment, audit, and testing reports in a secure manner. Contract vendor shall provide all testing artifacts (raw scan data, exploit evidence, working papers) to member. Member will destroy all artifacts in accordance with the current applicable data retention requirements. All assessment, audit, and testing findings shall be treated as confidential and shall not be disclosed to any party other than member without member's written authorization.

*Exceptions/deviations must be listed on the Scope of Work and Specifications Acceptance Form. List the specification number for each exception/deviation.

Scope of Work and Specifications Acceptance Form

Signature on the Offer and Acceptance Form certifies complete acceptance of the Scope of Work and Specifications in this solicitation, except as noted below (additional pages may be attached, if necessary).

Check one of the following responses to the Scope of Work and Specifications:

We take no exceptions/deviations to the Scope of Work and Specifications.

(Note: If nothing is listed below, it is understood that no exceptions/deviations are taken.)

We take the following exceptions/deviations to the Scope of Work and Specifications.

All exceptions/deviations shall be clearly explained. Reference the corresponding

Scope of Work or Specifications that you are taking exceptions/deviations to. Provide details on your exceptions/deviations below:

(Note: All requested exceptions/deviations must be clearly explained. Reference the specific language that you are taking exceptions/deviations to detail any proposed substitute language, and clearly explain how the exceptions/deviations meet or exceed Scope of Work and Specifications. Unacceptable exceptions/deviations may remove your proposal from consideration for award. Mohave shall be the sole judge on the acceptance of exceptions/deviations and Mohave’s decision shall be final.)