RFP 9.2425 - District Cybersecurity Assessment.pdf

CHIPPEWA VALLEY SCHOOLS

“Inspiring and empowering learners to achieve a lifetime of success.”

REQUEST FOR PROPOSAL

District Cybersecurity Assessment RFP No. 9.2425

Publish Date: January 6, 2025

Pre-Bid Meeting: January 9, 2025, at 1:00 p.m.

Bid Opening: January 22, 2025, at 2:00 p.m.

Bid Award: March 3, 2025

CHIPPEWA VALLEY SCHOOLS

19120 CASS AVENUE

CLINTON TOWNSHIP, MI 48038

Chippewa Valley Schools District Cybersecurity Assessment 9.2425

Table of Contents

I. Bid Requirements ……………………………………………………………………………………….. 3

II. Bid Award Process ………………………………………………………………………………………. 6

III. Contract Requirements ……………………………………………………………………………….. 7

IV. Work Specifications …………………………………………………………………………………… 10

V. Bid Proposal Form ……………………………………………………………………………………... 13

VI. Affidavits …………………………………………………………………………………………………… 18

VII. Contract ……………………………………………………………………………………………………. 21

I. BID REQUIREMENTS

Introduction/Purpose The intent of this Request for Proposal (herein known as “RFP”) is to source a responsive/responsible Bidder(s) for a full internal network assessment per the requirements and specifications of the Chippewa Valley Schools (herein known as “District”). District shall select the Bidder(s) that offer the best value and expertise for a full network assessment service. Bidders who have experience with performing comprehensive cybersecurity assessments, and who can provide necessary functions and features that will meet the District’s requirements as outlined in this RFP are encouraged to submit proposals. The District may elect to award service to one Bidder, not award at all, or split the award to more than one Bidder at its sole discretion.

General Scope of Work District is seeking proposals for a full network assessment, including vulnerability assessment, internal network security assessment, and internal penetration testing. The proposal shall include the following: a statement of work to include proposed solution; scope; major milestones and phases; timeline; service components, all related costs, and deliverables.

Tentative Timetable The following projected bid timetable shall be used as a working guide for planning purposes. District reserves the right to adjust this timetable as required during the course of the RFP process.

Event Date RFP Issued January 6, 2025 Pre-Bid Meeting January 9, 2025 at 1:00 pm Amendment Issued, if needed January 13, 2025 Bid Opening January 22, 2025 at 2:00 pm Board of Education review/approval March 3, 2025 Contract begins March 4, 2025

Bid Inquiries Direct questions related to this RFP to Lillian Grayson, Purchasing & Risk Management Coordinator, Chippewa Valley Schools, and submit such questions in writing no later than seven (7) days prior to the bid opening date. Include the RFP number, page, section, and paragraph number for each question. Send all questions to Lillian Grayson at purchasing@cvs.k12.mi.us.

Bidders must clearly understand that the only official answer or position of the district will be the one stated in writing by addendum. Do not mail questions as the envelope will be left unopened until the bid opening date and time.

Pre-Bid Meeting A pre-bid meeting will be held providing potential bidders with the opportunity to ask questions. Following the pre-bid meeting, a summary will be sent to all those who have requested bid information.

Join in Person or Virtual: January 9, 2025 at 1:00 pm In Person: CVS Administration Building – 19120 Cass Avenue, Clinton Township, MI 48038

Virtual: https://us02web.zoom.us/j/81967252958?pwd=8ITy2YbNGvr5TNpRq0Qq7N0T2qharN.1 Meeting ID: 819 6725 2958 Passcode: 090106

Ambiguity, Conflict, or Other Errors in the RFP If a Bidder discovers any ambiguity, conflict, discrepancy, omission, or other error in the RFP, it shall immediately notify the Purchasing Department of such an error in writing and request modification or clarification of the document. The Purchasing Department will make modifications by issuing a written revision and will give written notice to all parties who have received this RFP from the District’s Purchasing Department.

mailto:purchasing@cvs.k12.mi.us https://us02web.zoom.us/j/81967252958?pwd=8ITy2YbNGvr5TNpRq0Qq7N0T2qharN.1

Bidder is responsible for clarifying any ambiguity, conflict, discrepancy, omission, or other error in the RFP prior to submitting the proposal or it shall be waived.

Addenda Addenda issued during the time of bidding shall become part of the contract documents and receipt thereof shall be acknowledged on the bid proposal. Addenda will be sent to all who are known by the District to have a set of contract documents. Copies of the addenda will be made available for inspection wherever contract documents are on file for that purpose. Each bidder shall ascertain prior to submitting their bid that they have received all addenda issued.

Acknowledgment of Insurance Requirements By signing its proposal, Bidder acknowledges that it has read, understands and adheres to the insurance requirements for the proposal. Bidder also understands that the evidence of required insurance must be submitted within ten (10) working days following notification of its offer being accepted; otherwise, District may rescind its acceptance of the Bidder’s proposal.

Documentation Requirements Bidder must utilize the format specified in the proposal documents. Proposals must be in strict compliance with this RFP. Failure to comply with all provisions of the RFP may result in disqualification. The District will not permit changes to the submissions after the proposals are received and opened except as authorized by law.

Submission of a proposal shall constitute Bidder’s representation that neither Bidder nor an officer, agent or employee of Bidder, or the spouse, parent or child of an officer, agent, or employee of Bidder, is involved in the ownership, operation or management of any subcontractor claiming status as a business for purposes of this Contract.

Furthermore, submission of a proposal shall constitute Bidder’s representation that every subcontractor claiming status as a Business for purposes of this Contract has been doing business under its current name and ownership for at least three years prior to proposal date in the trade in which it will be employed by Contractor in the performance of Contract work.

Bidder must certify that no official or employee of the Chippewa Valley Schools is peculiarly interested in this proposal or in the contract which the bidder offers to execute or in expected profits to arise there from, and that this bid is made in good faith without fraud or collusion or connection with any other person submitting a proposal.

Delivery of Proposals Sealed bids clearly labeled “District Cybersecurity Assessment RFP 9.2425”, and Bidder’s business name will be received by Chippewa Valley Schools until January 22, 2025, at 2:00 p.m., local time, at which time all bids will be publicly opened and read.

The District will not accept any proposals received after 2:00 p.m. local time and shall return such late proposals to the Bidder. District will not accept faxed or emailed proposals. It is the sole responsibility of the bidder to ensure their bid has been delivered before the due date and hour as indicated. Proposals will be considered firm for a period of 60 days from the bid opening date until the time of award.

Bidders must submit one (1) original, and two (2) copies of the Bid Proposal Form, Cost Proposal, Affidavits, and all other required documentation. A copy of this RFP is not required to be submitted.

Proposals are to be delivered to the attention of:

Chippewa Valley Schools Attn: Lillian Grayson, Purchasing & Risk Management Coordinator 19120 Cass Avenue Clinton Township, MI 48038

Bid Opening A public bid opening will promptly begin on January 22, 2025, at 2:00 p.m. local time.

In Person: CVS Administration Building – 19120 Cass Avenue, Clinton Township, MI 48038 Virtual: https://us02web.zoom.us/j/89487455080?pwd=TPb2Asa5dMOZRw2bERTlpRsJ6HlGjz.1 Meeting ID: 894 8745 5080 Passcode: 385471

Proposals and Presentation Costs The District will not be liable in any way for any costs incurred by any Bidder in the preparation of its proposal in response to this RFP, nor for the presentation of its proposal and/or participation in any discussions or negotiations.

Validity of Proposals

All proposals shall be valid for ninety (90) days from the opening date of the RFP, until the time of award.

Sole Bidder It is the District’s intent that this RFP permits competition. It shall be the Bidder’s responsibility to advise the District in writing if any language, requirements, scope specifications, etc., or any combinations thereof, inadvertently restricts or limits the requirements stated in this RFP to a sole source. District shall receive such notification no later than eight (8) days prior to the date set for acceptance of bids.

If only one bid is received in response to the RFP, a detailed cost proposal will be requested of the single Bidder, upon request by the District. A cost/price analysis and evaluation and/or audit shall be performed with the cost proposal in order to determine if the price is fair and reasonable.

Contents of Proposal Bidder shall include in its proposal, at a minimum, the information outlined in this section in a manner which demonstrates Bidder’s competence and qualifications for the satisfactory performance of services identified in this

RFP.

Bidder shall include separate exhibits, clearly labeled, to a cover letter, including the following:

• Company overviews, including experience with similar projects, Proposal Exhibit A

• Detailed methodology for conducting the assessment and testing, Proposal Exhibit B

• Timeline for project completion, Proposal Exhibit C

• References from at least three previous clients, Proposal Exhibit D

• Cost proposal with a detailed breakdown of fees, Proposal Exhibit E

• Certifications and Statement of Qualifications of the assessment team, Proposal Exhibit F

• Affidavits o School Safety o Familial Disclosure o Iran Sanctions

• Certificate of Liability Insurance https://us02web.zoom.us/j/89487455080?pwd=TPb2Asa5dMOZRw2bERTlpRsJ6HlGjz.1

II. BID AWARD PROCESS

Evaluation of Proposals Bidders shall exercise particular care in reviewing the specifications required for this RFP. Submission of a proposal to the District’s Purchasing Department offers no rights upon the Bidder nor obligations to District in any manner. The District’s Purchasing Department reserves the right to withdraw this RFP at any time and for any reason and to issue such clarifications, modifications, and/or amendments as it may deem appropriate.

The District reserves the right to waive any irregularities in proposals, provided that such action is in the best interest of the District. Any such waiver shall not modify any remaining RFP requirements or excuse the Bidder from full compliance with the RFP specifications and other contract requirements if the Bidder is awarded the Contract.

Rejection of Proposals The District reserves the right to accept or reject in whole or in part any or all proposals submitted. The District shall reject the proposal of any Bidder that is determined to be non-responsive. The failure of a Bidder to promptly supply information in connection with respect to responsibility may be grounds for a determination of non-responsibility.

Requests for Clarification of Proposals The District reserves the right to request qualification information from any Bidder or other sources before issuing documents, receiving bids or awarding a contract. The District may, at its sole discretion, accept or reject Bidders as qualified. The right to waive any informalities in qualification materials is reserved by the District. The Bidder, in submitting his/her bid, agrees to accept the decision of the District as final.

Source Selection Method An award, if made, will be made to the responsible and responsive Bidder(s) whose proposal is most advantageous to the District, taking into consideration price and the other factors set forth in this RFP. The District may, as it deems necessary, conduct discussions with those Bidders for the purpose of clarification to assure full understanding of, and responsiveness to solicitation requirements. The District may exercise their right to conduct discussions with none, one, some, or all of the Bidders without penalty.

Evaluation Criteria The District may consider the following factors in evaluating the bid responses, in no order of importance:

1. Adherence to all bid requirements and submittal documents.

2. Pricing and payment terms.

3. Capability and skill–technical qualifications, certifications, and training

4. Experience and Equipment–familiarity with our buildings, response time to work requests, warranties, and types of products and equipment used to meet RFP specifications.

5. Responsiveness and supportability to perform installations and service projects on schedule and within budget. Ability to service a large district. Evidence of your firm’s administrative support.

6. The Bidder’s past relationship with the District, if applicable.

7. Feedback from references.

8. Any new factor discovered during the bid evaluation process, whether or not specifically listed in the RFP document.

9. Any other relevant factor specifically listed in the bid.

Deliverables Upon completion of the project, awarded Bidder will provide the following deliverables:

• Detailed report of identified vulnerabilities, risks, and their respective criticality levels

• Executive summary with high-level findings and recommendations

• Technical documentation outlining remediation steps for each identified issue

• Debrief meeting with District Technology Services staff to review report

• A presentation to key stakeholders summarizing assessment results and action plans. Key stakeholders may include District Administrators and/or the Chippewa Valley Schools Board of Education

III. CONTRACT REQUIREMENTS

General Description of Required Performance Outcomes Where not more specifically described in any of the various sections of these specifications, services shall conform to all of the methods and operations of best standards and accepted practices of the profession involved and shall include all work “turnkey” required for completion of the services.

Schedule of Work Work will begin following a kick-off and planning meetings after award of bid. Completion of project and final billing must be completed by June 30, 2025.

Schedule of work will be coordinated with District Technology Staff at the outset of the project.

Terms and Conditions of Contract for Services The Contractor will not be permitted to either assign or underlet the contract, nor assign either legally or equitably any monies hereunder, or its claim thereto without the previous written consent of the District’s Purchasing & Risk Management Coordinator. If such written consent is granted by the District, all terms and conditions, including pricing, shall remain in force for the duration of the Contract.

The Contractor declares that the only parties interested in this proposal as principals are named herein; that this proposal is made without collusion with any other person, firm or corporation; that no officer or agent of the District is directly or indirectly interested in this bid; and he proposes and agrees that if this proposal is accepted he will contract with the District in accordance with the specifications, also the terms and conditions as spelled out in this bid form.

No person, including but not limited to corporations, partnerships, limited partnerships or limited liability corporations, shall be eligible to receive a contract under this RFP if that person has been convicted of any felony offense involving the distribution of controlled substances and, for contracts to be performed for on-site services to the District, if that person or any person to be employed by that person in the performance of such on-site services has been convicted of a "sex offense” as defined in MCL 380.1535a(1).

Contract Period Dates to start work will be determined at the project kick-off meeting with District anticipating March commencement.

Completion of project, including final invoicing, will be no later than June 30, 2025.

Contract Cancellations and Suspensions The Contract will be monitored for acceptable services rendered throughout the contract period. The District reserves the right to cancel and terminate any Contract(s), in part or in whole, for any reason or for no reason, without penalty, upon notice to the Contractor. District will have the option to cancel the contract for any reason with thirty (30) days’ notice. District reserves the right to cancel the Contract immediately for due cause.

Contractor shall not be entitled to lost profits or any further compensation not earned prior to the time of cancellation.

In the event that performance on the part of any party hereto shall be delayed or suspended as a result of circumstances beyond reasonable control and without the fault and negligence of said party, none of the parties shall incur any liability to the other parties as a result of such delay or suspension. Circumstances deemed to be beyond the control of the parties hereunder shall include, but not be limited to, acts of God or of the public enemy; insurrection; acts of the Federal Government or any unit of State or Local Government in either sovereign or contractual capacity; fires, floods; epidemics; quarantine restrictions; strikes, freight embargoes or delays in transportation, to the extent that they are not caused by the party’s willful or negligent acts or omissions, and to the extent that they are beyond the party’s reasonable control.

As a result of such delay, the District reserves the right to suspend work wholly or in part if deemed necessary for the best interest of the District. This suspension will be without compensation to the Contractor, other than to adjust the contract completion requirements.

Pricing and Invoicing Procedure All prices shall be F.O.B. Destination, if applicable, and shall include all charges that may be imposed in fulfilling the terms of this contract. Bidder shall provide a breakdown cost per hour for services performed during normal working hours (straight) and holidays/weekends (overtime) on the Cost Proposal Form. Prices shall remain firm for a minimum period of one (1) year.

Labor rates shall include all such direct and indirect overhead costs such as transportation, general and administrative costs, etc. Labor rates will be paid on the basis of time at the site. The District will not pay for travel time to or from District property, and such fees will not be included by the Contractor in hours charged for work performed. Charges begin when the Contractor arrives at the District building and end when the crew leaves the building. Time records will be verified by District video camera and/or office sign in sheets.

The Contractor shall submit invoices upon the completion of any work resulting from this Contract using agreed upon contracted pricing. The invoice shall be in a format acceptable to the District. The invoice must be accompanied by one copy of each signed Service Ticket. District shall be responsible to pay invoice upon satisfactory completion of work within 30 days of receipt of invoice. Contractor is encouraged to provide a discount for early payment.

At a minimum, each invoice shall include:

• Name and phone number of person who requested work

• Date of work request

• Detailed background information about the request (who, what, where, when, why)

• Name of person who performed work

• Date of work performed

• Detailed information about all work done (who, what, where, when, why)

• If work could not be performed, list the reason(s) why.

• Itemized invoice showing Service Ticket #, Quantities, Description, Unit price, Unit of measure, and extended costs.

The Contractor is prohibited from using this contract in billing for any commodity or service that is not covered specifically under this contract nor approved by the District. Costs for services shall not include additional fees for delays or return trips due to Contractor’s unfamiliarity with District’s infrastructure or errors.

Hold Harmless and Indemnify Guarantee The Contractor, to the fullest extent permitted by law, agrees to defend, pay on behalf of, indemnify, and hold harmless Chippewa Valley Schools, its elected and appointed officials, employees and volunteers, and others working on behalf of Chippewa Valley Schools, against any and all claims, demands, suits, or loss, including all costs connected therewith, and for any damages which may be asserted, claimed, or recovered against or from the Contractor by reason of personal injury, including bodily injury or death and / or property damage, including loss of use thereof, which arises out of or is in any way connected or associated with this Contract.

Insurance Requirements A sample Certificate of Insurance shall be included with Bidder’s proposal. In addition, prior to commencement of any work, a Certificate of Insurance executed by Contractor’s insurance agent or carrier showing required insurance coverage shall be submitted, specifically naming Chippewa Valley Schools. Each insurance policy to be furnished by successful Contractor shall include, by endorsement to the policy, a statement that a notice shall be given to Chippewa Valley Schools by certified mail thirty (30) days prior to cancellation or upon any materials change in coverage. All coverage shall be with insurance companies licensed and admitted to do business in the State of Michigan.

Contractor shall provide Certificates of Insurance evidencing the above-required insurance, prior to commencement of this contract and thereafter with certificates evidencing renewals or replacements of said policies of insurance at least fifteen (15) days prior to the expiration or cancellation of any such policies. Said Notices and Certificates of Insurance shall be provided to the Purchasing Department.

As a condition of performing work for the District as a Contractor, the Contractor must provide District with satisfactory evidence of their insurance coverage as follows:

Commercial General Insurance: $1,000,000 Per Occurrence, $2,000,000 General Aggregate coverage for Contractual Liability, Premise/Operations, Independent Contractors, Broad Form Property Damage, Products/Completed Operations and Personal Injury.

Business (Commercial) Automobile Liability Insurance: $1,000,000 Per Occurrence, Combined Single Limit for bodily injury and property damage. Coverage shall include all owned, non-owned and hired vehicles.

Worker’s Compensation, including Employers’ Liability Insurance: covering your statutory obligations in the state (Michigan) in which your work for the District is to be performed. Employer’s Umbrella Liability coverage for $2,000,000 per accident.

Insurance Terms and Conditions:

1. Products-completed operations liability must be maintained for not less than one year after acceptance of completion of your work.

2. Each insurance carrier shall have a Best’s rating at B+ VII or better, and acceptable to the District.

3. The words “endeavor to” and “but failure to mail such notice shall impose no obligation or liability of any kind upon the company, its agents or representatives” do not apply or have been removed.

4. The District shall be named as an additional insured by endorsement on the Contractor’s policy. This coverage shall contain no special limitations on the scope of protection afforded to the District.

5. The Contractor’s insurance coverage shall be primary insurance as respects to the District. Any insurance or self-insurance maintained by the District shall be excess of the Contractor’s insurance and shall not contribute with it.

6. Any and all deletions/exclusions/restrictions from this coverage require the prior written consent of

Chippewa Valley Schools.

7. Any deductibles or self-insured retentions must be declared to and approved by the District. Contractor shall be liable for the payment of any deductible over $1,000 applicable to any coverage.

8. General Liability and Auto Liability limits may be attained by individual policies or by a combination of underlying policies with umbrella and/or excess liability policies.

9. If Contractor, for any reason, fails to provide and maintain insurance coverage which is required pursuant to this Agreement, the same shall be deemed a material breach of contract. The District, at its sole option, may terminate this Agreement and obtain damages from the Contractor resulting from said breach.

IV. WORK SPECIFICATIONS

GENERAL WORK REQUIREMENTS

The information furnished in this RFP is not intended in any way to describe or guarantee either the maximum or minimum amount or type of work to be done. Information in this RFP is to be used for illustrative purposes and there is no guarantee to be complete or accurate. The Contractor will be required to furnish and complete all services as needed by the District during the period of the contract.

District reserves the right to purchase additional similar items/services that are not listed in the RFP. Contractor is to make these similar items/services available to the District through this Contract at the same awarded unit pricing.

Contractor shall provide a complete, workmanlike, well executed work in accordance with these specifications and all applicable national, state and local codes. All services shall be executed by licensed personnel, as required by law, as well as factory trained and authorized/certified. In cases of conflict between requirements, that requirement which is in compliance with all applicable codes, and which is also, in the opinion of Chippewa Valley Schools, more advantageous to the District, shall govern.

All work under this Contract shall be done according to all applicable state and federal laws. All Contractors providing services under this contract are to be in good standing and licensed as required by law. A current copy of the Bidder’s license must be submitted with the bid. Bidders shall submit, with their bid, a copy of the current license for any and all business that will be performing subcontracting work for the District under this Contract.

Copies of the Contractor's and subcontractor's licenses will be retained in the contract file.

All workmen shall be thoroughly experienced in the particular class of work in which they are employed. District reserves the right to demand immediate removal of any member of the Contractor’s staff that, in the District’s opinion, impedes the progress of the work or violates any laws or District policies.

Protect equipment at all times to prevent theft, damage, soiling, and misalignment. Coordinate with the District for secure storage of equipment and materials. The District is not required to provide a secure storage area. Clean up of all work areas daily is required. The Contractor shall provide all power and safety grounding, according to the manufacturer’s recommendations on all newly installed equipment.

Contractor shall be responsible for familiarity with District’s building wiring infrastructure. The District shall not be responsible for training Contractor in locations of where District’s closets or work areas exist. District will, however, provide as much information as possible to ensure speedy and accurate work. In cases where delays are clearly not due to the Contractor’s performance or lack of performance, the Contractor is responsible for notifying the appropriate District contact person for explanation and recommended procedures. The Contractor must investigate and report on any complaints that arise in connection with the use of his/her materials, equipment and supplies.

SPECIFIC WORK REQUIREMENTS

District is seeking proposals for a full network assessment, which includes minimum requirements outlined in Section A. If funding permits, District will also commission an external assessment as outlined in Section B.

Bidders will provide separate pricing for Sections A and B to allow District to make a decision.

Bidders can offer additional services that are pertinent to the project as Voluntary Alternates.

Minimum Requirements Section A – Internal Network Assessment Vulnerability Assessment

a. Identify vulnerabilities across internal systems, applications, and infrastructure

b. Prioritize vulnerabilities based on severity and business impact

Internal Network Security Assessment

a. Assess the security of internal network architecture and protocols, and potential attack paths

b. Identify risks related to access control, misconfigurations, and outdated technologies

Internal Penetration Testing

a. Simulate attacks on internal systems to identify exploitable vulnerabilities

b. Assess the effectiveness of internal detection and response systems

c. Document exploitation paths and potential impacts of successful attacks

Section B – External Network Assessment

1. External Penetration Testing

2. Simulate attacks from external adversaries to uncover exploitable vulnerabilities

3. Test for vulnerabilities such as misconfigured systems, exposed services, and application flaws

4. Document potential exploitation paths that external attackers could use to breach the network

5. Reporting and Recommendations

a. Provide a standalone external assessment report with prioritized risks and remediation steps

Coordination of Services The Contractor shall appoint a full-time employee as Project Manager to oversee the fulfillment of this Contract.

This Project Manager shall be the one main contact for the District’s Technology Department and shall be accessible to the District via mobile numbers. Project Manager must be available to be onsite within 2 hours. The Project Manager shall be knowledgeable of the District’s buildings and operations, respond quickly to phone calls, and be responsible for the successful servicing of this Contract.

District requires very minimal disruption of service during normal business hours. Any system downtime must be coordinated in advance with the District. Contractor will work exclusively with the Technology Department for work orders. Service(s) ordered by other than the District’s Technology Department is not authorized and therefore payment of these services is not guaranteed.

The Project Manager shall coordinate and expedite all phases of the work. The Project Manager shall cooperate fully with other contractors and subcontractors on District property.

Scheduling of Services Work delays will not be tolerated. Prompt arrival at the work site as scheduled with the District is very important.

Contractor shall schedule their work in such a way to minimize the number of service calls and travel between buildings. Contractor shall allocate sufficient resources, equipment, and personnel to all projects to ensure it is completed on time and is consistent with the intent of these specifications.

Approval of Services District reserves the option of deciding what type of solution is best suited for the desired application, and what type of equipment, parts or accessories will be provided and installed by the Contractor. Any equipment, part or accessory not meeting the District’s requirements will be removed and the proper equipment, part or system shall be installed at the Contractor’s expense.

The District’s Technology Director will determine acceptability of all work and/or services performed. The District reserves the right to make unannounced periodic inspections of the work in progress. All work must be coordinated around school operations to ensure the safety of students and staff. Permits, licenses, and taxes shall be the responsibility of the Contractor at no additional cost to the District. If the work and/or services are not acceptable, the Contractor will be called in to review and correct all problem areas without additional cost to the District within 90 days’ notice. Upon notification by the District, the Contractor will complete repairs to deficient work and/or services in accordance with a schedule jointly agreed upon. Contractor shall be solely responsible for submitting reports to any official as required by law.

Billable Parts All parts required for the service are to be listed separately in the invoice. Itemized pricing will be available through the end of project if District chooses to add any additional equipment or services to original project. A price list for parts and equipment will be provided to the District’s Purchasing & Risk Management Coordinator prior to any contract extension. District encourages Contractor to provide price decreases and volume discounts.

Manufacturer rebates shall be forwarded onto the District.

Maintenance and Record Keeping It shall be the responsibility of the Contractor to determine any and all maintenance or service required and appropriate for each system, and to maintain the necessary record keeping as required by law.

Warranty The Contractor shall deliver to the District upon completion of all work for any projects resulting from this Contract, his/her written guarantee, made out to the District and in a form satisfactory to the District, guaranteeing (and he/she does hereby guarantee) all of the work under the Contract to be free from faulty materials, free from improper workmanship, and against injury from proper and usual wear, and agreeing (and he/she does hereby guarantee) to replace or to re-execute, without cost to the District, such work as may be found improper, and to repair all damage caused to the other work or the other work and/or materials, due to such required replacement or re-execution.

This service guarantee shall be a period of 90 days from the date of completion of any work resulting from this Contract, as evidenced by the District’s final certificate of payment and completion, or for a longer period of time where so stipulated in the Contract documents.

Contractor shall coordinate all equipment and parts warranty guarantees on behalf of the District’s interest without additional charges. All warranty work will be coordinated by awarded Bidder with no additional charge for services or hardware. Awarded Bidder will coordinate all warranty / replacement work. Contractor shall make use of all product warranties available to the District at all times.

When defective workmanship and/or materials are discovered requiring repairs to be made under this warranty, all such repair work shall be done by the Contractor at his own expense within five (5) days after notice of such defect has been given to him by the District. The Contractor shall be responsible for disconnecting, packing, shipping, repairing and reconnecting the equipment or wired infrastructure to proper operating condition at no cost to the District.

Should the Contractor fail to repair or correct such defective workmanship and/or materials within five (5) days after being notified, the District may make the necessary repairs and charge the Contractor with the actual cost of all labor and material required.

V. BID PROPOSAL FORM

BID PACKAGE: District Cybersecurity Assessment RFP 9.2425

DUE DATE: January 22, 2025, 2:00 p.m., local time.

TO: Chippewa Valley Schools Attn: Lillian Grayson, Purchasing & Risk Management Coordinator 19120 Cass Avenue Clinton Township, MI 48038

INSTRUCTIONS FOR SUBMITTING BID – Bidder is required to submit one (1) original and two (2) copies of Bid Proposal. Submit this Bid Proposal Form and the following with your bid. Chippewa Valley Schools requires Bidders to submit information on Forms provided through this RFP unless otherwise specified.

Failure to submit the forms/information listed above may be cause for disqualification of bid.

AGREEMENTS

The undersigned understands that the District reserves the right to accept or reject any or all Bids in whole or in part, or to waive any informality therein. If in the District’s opinion, it is in their best interest, the contract may be awarded to other than the lowest bidder, for quality of the supplies and services, delivery time, fill rate, etc.

District also reserves the right to hold bids for a period of 90 days from bid opening date.

If award is made to us under this proposal, we agree to enter into an Agreement with Chippewa Valley Schools to furnish services, in strict accordance with this proposal, bid documents and all pertinent portions of specifications.

I also understand that this project is being funded through the federal State and Local Cybersecurity Grant and as such, I must meet relevant federal contract guidelines.

My signature certifies that the proposal as submitted complies with all Terms and Conditions as set forth in this RFP. My signature also certifies that the accompanying proposal is not the result of, or affected by, any unlawful act of collusion with another person or company engaged in the same line of business or commerce, or any act of fraud. Furthermore, I understand that fraud and unlawful collusion are crimes under Federal Law, and can result in fines, prison sentences, and civil damage awards.

My signature also certifies that this firm has no business or personal relationships with any other companies or persons that could be considered as a conflict of interest or potential conflict of interest to Chippewa Valley

Tab No.

Description Exhibit Included

Company Overview A

Statement of Work B

Timeline for Project Completion C

References D

Cost Proposal E

Certifications and Statement of Qualifications F

Affidavits (3)

Certificate of Liability Insurance

Contract

Schools, and that there are no principals, officers, agents, employees, or representatives of this firm that have any business or personal relationships with any other companies or persons that could be considered as a conflict of interest or a potential conflict of interest to Chippewa Valley Schools, pertaining to any and all work or services to be performed as a result of this request and any resulting contract.

I hereby certify that I am authorized to sign as a Representative for the Firm:

NAME OF BIDDER

Company Name: _____________________________________________________________________________

Address: ______________________________ City_________________________ State________ Zip ________

Name of Contact Person:____________________________________________Title:_______________________

Phone: __________________________________ Cell: ______________________________________________

Email:__________________________________ Website Address:______________________________________

Name, title, and signature of individual duly authorized to execute contracts:

Name:_________________________________________________ Title: ________________________________

Signature:___________________________________________________________________________________

LEGAL STATUS OF BIDDER

A Company organized and existing under the laws of the State of ______________________________________

Federal Tax Identification Number _______________________________________________________________

ADDENDA

The undersigned acknowledges receipt of the following addenda:

Addendum # _______dated_______________ Addendum #_______dated_______________

Addendum # _______dated_______________ Addendum #_______dated_______________

COMPANY BACKGROUND

Number of years that company has been in operation providing security services including cybersecurity assessments and services similar to the scope of services described in this RFP. ______________ Years

Office Locations ________________________________________________________________________________

Number of total office locations ___________________________________________________________________

Location of Corporate Headquarters ________________________________________________________________

Location of office from which service will be provided to District _________________________________________

Number of current full-time regular employees company wide __________________________________________

Number of employees in office providing services to District ____________________________________________

Total number of clients __________________________________________________________________________

Phone Number _________________________________________________________________________________

EXHIBIT D

REFERENCES

List a minimum of three references, preferably school districts other than Chippewa Valley Schools, for which Bidder has provided comparable systems and professional services during the past five years. References may or may not be reviewed or contacted at the discretion of District. District reserves the right to contact references other than, and/or in addition to, those provided by Bidder. District shall not provide information received from references to Bidders.

Reference 1

School District Name/Company: __________________________________________________________________

Department Name: _____________________________________________________________________________

Address: ______________________________________________________________________________________

Contact Person: ____________________________________________ Title: ______________________________

Phone: __________________________________ Email: ______________________________________________

General Description of Services Performed: _________________________________________________________

Dates for Performance (Project duration in months): _________________________________________________

Reference 2

Department Name: _____________________________________________________________________________

Address: ______________________________________________________________________________________

Contact Person: ____________________________________________ Title: ______________________________

Phone: __________________________________ Email: ______________________________________________

General Description of Services Performed: _________________________________________________________

Dates for Performance (Project duration in months): _________________________________________________

Reference 3

Department Name: _____________________________________________________________________________

Address: ______________________________________________________________________________________

Contact Person: ____________________________________________ Title: ______________________________

Phone: __________________________________ Email: _______________________________________________

General Description of Services Performed: _________________________________________________________

Dates for Performance (Project duration in months): _________________________________________________

EXCEPTIONS: Bidder must detail any exceptions or deviations from bid requirements or any terms and conditions below:

EXHIBIT E

COST PROPOSAL

List the total proposed cost for each section below and attach a detailed breakdown of fees.

Company Name:_________________________________________________________________

SECTION A – Internal Network Assessment

SECTION B – External Network Assessment If funding permits, District may also choose to perform an external network assessment.

VOLUNTARY ALTERNATES – Additional Services

AFFIDAVIT OF BIDDER

(COMPLIANCE WITH SCHOOL SAFETY INITIATIVE LEGISLATION)

The undersigned, the District or authorized officer of (the "Bidder"), certifies to Chippewa Valley Schools (the "School District"), that any and all persons who will work directly or indirectly for the Bidder, including, but not limited to, Bidder's employees, agents, vendors, subcontractors or consultants, and who will work at or on any School District property, shall at all times be in compliance with MCL 380.1230, 380.1230a, 380.1230c, 380.1230d, and 380.1230g and have not been convicted of any "listed offenses".l The Bidder further warrants and represents that all persons who will work directly or indirectly for the Bidder, including, but not limited to, Bidder's employees, agents, vendors, subcontractors or consultants, and who will work at or on any School District property, shall at all times be in compliance with MCL 380.1230, 380.1230a, 380.1230c, 380.1230d and 380.1230g.

In this regard, Bidder agrees, without limitation, to report within three (3) business days to the School District when any such person is charged with a crime listed in Section 1535a(1) of the Revised School Code2 or a substantially similar law, and to immediately report to the School District if that person is subsequently convicted, plead guilty or plead no contest to that crime.

BIDDER: ________________________________

By: _____

Its: __________________________

STATE OF __________ )

COUNTY OF _______________________)

This instrument was acknowledged before me on the ________ day of ___________________, 2025, by

, Notary Public

__________________ County, ____________

My Commission Expires:__________________

Acting in the County of : __________________

1The term listed offenses means those defined in section 2 of the Sex Offenders Registration Act (SORA), MCL 28.722 2MCL 380.1535a(1).

AFFIDAVIT OF BIDDER

FAMILIAL DISCLOSURE

Pursuant to MCL 380.1267, a sworn and notarized statement disclosing any familial relationship that exists between the owner or any employee of the bidder and any member of the Chippewa Valley Schools Board or the Chippewa Valley Schools Superintendent shall be accompanied with the Proposal.

Bids and Proposals without this disclosure statement will not be accepted.

The members of the Chippewa Valley Schools Board of Education are: Mr. Kenneth Pearl, Ms. Denise Aquino, Mr. Christopher Gura, Mr. Don Kuntz, Ms. Talitha Mahome, Ms. Monica Radyko, and Mr. Robert Wojtowicz. The Chippewa Valley Schools Superintendent is Mr. Ronald Roberts.

□ The following are the familial relationship(s):

Owner/Employee Name Related to Relationship

1. _______________________ _____________________ _______________________

2. _______________________ _____________________ _______________________

3. _______________________ ______________________ _______________________

Attach additional pages if necessary to disclose all familial relationships.

□ There is no familial relationship that exists between the owner, officer, director or administrator of Bidder, or any employee of Bidder who is involved in this procurement and contracting process, and any board member, administrator or employee of Chippewa Valley Schools, or any family member of any board member, administrator, or employee of Chippewa Valley Schools.

The undersigned, the owner or authorized representative of Bidder _____________________________ Name of Company does hereby represent and warrant that the disclosure statements herein contained are true.

Signature of Bidder Representative Print Name Title

STATE OF __________ )

) ss

COUNTY OF _______________________)

This instrument was acknowledged before me on the _________ day of _______________, 2025, by

, Notary Public

_________________County, _____________

My Commission Expires:_____________________

Acting in the County of: _____________________

AFFIDAVIT OF COMPLIANCE

IRAN ECONOMIC SANCTIONS ACT

Michigan Public Act No. 517 of 2012

The undersigned, the owner or authorized officer of _____________________ (the “Contractor”), pursuant to the compliance certification requirement provided in the Chippewa Valley Schools’ (the “School District”) Request For Proposals, hereby certifies, represents and warrants that the Contractor (including its officers, directors and employees) is not an “Iran linked business” within the meaning of the Iran Economic Sanctions Act, Michigan Public Act No. 517 of 2012 (the “Act”), and that in the event Contractor is awarded a contract as a result of the aforementioned Request For Proposal, the Contractor will not become an “Iran linked business” at any time during the course of performing the Work or any services under the contract.

The Contractor further acknowledges that any person who is found to have submitted a false certification is responsible for a civil penalty of not more than $250,000.00 or 2 times the amount of the contract or proposed contract for which the false certification was made, whichever is greater, the cost of the School District’s investigation, and reasonable attorney fees, in addition to the fine.

Moreover, any person who submitted a false certification shall be ineligible to bid on a Request for Proposal for three (3) years from the date that it is determined that the person has submitted the false certification.

Bidder: __________________________________________ Print Name

By: _________________________________

Its: _________________________________

STATE OF __________ )

) ss

COUNTY OF _______________________)

This instrument was acknowledged before me on the _________ day of ___________________, 2025, by __________________________.

, Notary Public

__________________ County, ____________

My Commission Expires: ______________

Acting in the County of: _______________

CONTRACT AGREEMENT

DISTRICT CYBERSECURITY ASSESSMENT RFP 9.2425

CONTRACT PERIOD: March 4, 2025 through June 30, 2025

SECTION I. Conditioned upon Vendor being awarded by the Chippewa Valley School Board of Education, or award being made administratively, the bid requirements set out in RFP 9.2425, and upon order of the Township of Clinton, Michigan, Vendor does hereby agree to provide above services to Chippewa Valley Schools in accordance with the terms of Vendor's submitted Bid Proposal and the Specifications in above referenced RFP, the services listed in the RFP as awarded to Bidder in the Board of Education resolution awarding such bid to Vendor. Execution of said Resolution shall evidence Chippewa Valley Schools’ acceptance of this contract.

SECTION II. Chippewa Valley Schools agrees to pay Vendor at the prices listed in the Bid Proposal within 30 days and Specifications with payment being subject to any discount terms stated upon the Bid Page and Specifications, and subject to any payment terms contained elsewhere within this contract and its attachments.

SECTION III. Vendor agrees to maintain the following minimum insurance limits…