Services for Network Penetration and Compromise Assessment RFP 25-26-47PI-MB.pdf

Board of Cooperative Educational Services Second Supervisory District of Suffolk County

507 Deer Park Road Huntington Station, New York 11746

SPECIFICATIONS & RFP FORM

FOR

SERVICES FOR NETWORK PENETRATION AND COMPROMISE

ASSESSMENT

RFP #25/26-47PI-MB

NAME OF PROPOSER: ___________________________________

BUSINESS ADDRESS: ___________________________________

CITY: ____________________STATE: ______________ZIP: _____

TELEPHONE: ___________________FAX: ______________________

E-MAIL ADDRESS: __________________________________________

PERSON WHO PREPARED RFP: _____________________________

TITLE: ____________________________

An advertisement of RFP was published in Newsday on September 24, 2025.

Request for Proposal is due October 15, 2025

Submit RFP with all pages intact.

Please be sure to complete last page.

To: Proposers From: Lorraine Hein, NIGP-CPP, CPPB, Director of Business Re: RFP #25/26-47PI-MB: SERVICES FOR NETWORK PENETRATION AND

COMPROMISE ASSESSMENT

We would be pleased to receive your RFP in accordance with the instructions set forth. In order to receive consideration, RFPs must be submitted to the Purchasing Office at the above address no later than 3:00 P.M. on OCTOBER 15, 2025.

Attachments

Document

Must Be Returned/Signed and/or Initialed with RFP

Response to be Considered for Award

Pages

► Notice to Proposers No 1 ► General Conditions Yes 9 ► Specifications Yes 21

Vendor Information and Acknowledgement /Cost Summary Pages Yes 2

► Insurance Certification Yes 3 ► Reference Form Yes 3

Certification Pursuant to GML 103-g Iranian Energy Sector Divestment

Yes

► Certification of Sexual Harassment Prevention Yes 1 ► Disclosure Form (% portion must be filled out) Yes 1 ► Hold Harmless & Indemnification Agreement Yes 1 ► Affidavit of Compliance Yes 1 ► NYS Education Department (SED) Yes 1 ► Additional Terms & Conditions for FEMA Contracts No 9 ► Certification Regarding Lobbying Yes 1 ► W-9 Form Yes 1 ► ACH Form If applicable 1 ► Statement of “No Bid” Form If applicable 1 ► Proposal Certification Yes 1 ► Addenda (as required) Yes -

Important Notice – RFP Distribution: Western Suffolk BOCES officially distributes RFP documents from the Purchasing Office or through the Bid Notification System. Copies of RFP documents obtained from any other source are not considered official copies. Only those vendors who obtain RFP documents from either the BOCES Purchasing Office or the Empire State Bid Notification System at:

https://www.bidnetdirect.com/new-york are guaranteed to receive addendum information, if such information is issued.

If you have obtained this document from a source other than the Western Suffolk BOCES Purchasing Office or the Long Island Bid Notification System, BOCES will not guarantee the integrity of the document. It is recommended that you obtain an official copy from the BOCES Purchasing Office or through the above referenced Bid Notification System.

Note: The proposal of each proposer shall contain the certification to non-collusive bidding as set forth in section 103-d of the General Municipal Law included in the specifications. The vendor must be in strict compliance with this requirement. Filing of Affidavit of Disclosure is mandatory when submitting your bid for this project.

The undersigned reserves the right to reject any and all proposals and to accept any proposal or proposals as submitted, or as modified, which in the opinion of the undersigned will be in the best interests of the Western Suffolk BOCES.

The following Notice to Proposers is being published in the official newspapers of BOCES on SEPTEMBER 24, 2025:

Notice to Proposers

The Board of Cooperative Educational Services, Second Supervisory District of Suffolk County (in accordance with Section 103 of Article 5A of the General Municipal Law) hereby invites the submission of sealed proposals for the following:

RFP #25/26-47PI-MB: SERVICES FOR NETWORK PENETRATION AND

COMPROMISE ASSESSMENT

Proposals will be received until 3:00 P.M., OCTOBER 15, 2025 at the Office of the Board of Cooperative Educational Services, Second Supervisory District of Suffolk County, Mailing Address: 507 Deer Park Road, P.O. Box 8007, Huntington Station, NY 11746, Physical Address: 507 Deer Park Ave, Dix Hills, NY 11746, Proposal packages and addenda (as applicable) may be obtained at the same office daily from 8:45 A.M. to 4:30 P.M., except Saturdays, Sundays, and Holidays or may be retrieved at https://www.bidnetdirect.com/newyork

The Board of Cooperative Educational Services, Second Supervisory District of Suffolk County, reserves the right to reject any or all proposals, or to accept part of any proposal.

By: Lorraine Hein, NIGP-CPP, CPPB Director of Business

Understood and Agreed Proposer’s Initials

General Conditions - Page 1 of 9

General Conditions

All invitations to submit proposals issued by the above will bind all vendors to the conditions and requirements set forth in these general conditions, and such conditions shall form an integral part of each contract awarded by the Board of Cooperative Educational Services, Second Supervisory District of Suffolk County.

Definitions

“Notice to Proposers” a formal statement that, when issued, constitutes an invitation to submit a proposal on the services, materials, supplies, and equipment described in the specifications

“BOCES” Board of Cooperative Educational Services, Second Supervisory District of

Suffolk County

“Proposal” an offer to furnish services, materials, supplies, and equipment in accordance with the Notice to Proposers, these General Conditions, and the Specifications

“Cost Summary” the attachment which the Vendor uses to submit a cost proposal

“Vendor” any entity (e.g., individual, partnership, organization, institution, agency, municipality, government, company, or corporation) submitting a proposal

“Successful Vendor” a Vendor to whom an award is made by BOCES

“Specification” description of services, materials, supplies, and equipment, and the conditions for their provision

Proposal

1. The date and time of the opening will be given in the Notice to Proposers.

2. All proposals must be submitted on and in accordance with forms provided by BOCES.

3. All proposals received after the time stated in the Notice to Proposers will not be considered and will be returned to the Vendor. The Vendor assumes the risk of any delay in the mail or in the handling of the mail by employees of BOCES. Whether sent by mail or by means of personal delivery, the Vendor assumes responsibility for having his/her proposal deposited on time at the place specified.

4. All information required by Notice to Proposers, Specifications, and Proposal Offer, in connection with each item against which a proposal is submitted, must be given to constitute a regular proposal.

5. The submission of a proposal will be construed to mean that the Vendor is fully informed as to the extent and character of the services, supplies, materials or equipment required and a representation that the Vendor can furnish the services, supplies, materials, or equipment satisfactorily in complete compliance with the specifications.

6. No alteration, erasure, or addition is to be made in the typewritten or printed matter. Deviations from the specifications must be set forth in the space provided in the proposal for this purpose.

General Conditions - Page 2 of 9

7. Prices and information required, except signature of Vendor, should be typewritten for legibility.

Illegible or ambiguous proposals may be rejected. All signatures must be hand written. Facsimile, printed, or typewritten signatures are not acceptable.

8. Sales to BOCES are not affected by any fair trade agreements. (General Business Law, Ch. 39, Sec. 369-a, Sub.

3, L.1941).

9. No charge will be allowed for federal, state, or municipal sales and excise taxes since BOCES is exempt from such taxes. The price proposal shall be net and shall not include the amount of any such tax.

10. In all specifications, the words “or equal” are understood after each article giving manufacturer’s name or catalog reference or on any patented article. The decision of Western Suffolk BOCES as to whether an alternate or substitution is in fact “equal” shall be final. If submitting a proposal on items other than those specified, Vendor must in every instance give the trade designation of the article, manufacturer’s name, and detailed specification of item Vendor proposes to furnish. Otherwise, proposal will be construed as submitted on the identical item as specified.

11. Proposals on equipment must be on standard new equipment of latest model, and in current production, unless otherwise specified.

12. All regularly manufactured stock electrical items must bear the label of the Underwriter’s Laboratories, Inc.

13. When proposals are requested on a lump-sum basis, Vendor must submit proposal on each item in the lump-sum group. A Vendor desiring to propose “no charge” on an item in a group must so indicate; otherwise the proposal for the group may be rejected.

The Board of Cooperative Educational Services also reserves the right to award the proposal relating hereto by groups in accordance with unit prices, as a whole at the aggregate price, or at its discretion reject proposals or parts of proposals. We also reserve the right to increase quantities as indicated on the proposal at the time of award or at a future time if it is mutually agreeable.

14. All prices submitted in the proposal must be “per unit” as specified; e.g., do not propose “per case” when “per dozen” is requested; otherwise, proposal may be rejected.

15. Vendor must insert the price per unit and the extensions against each item in the proposal. In the event of a discrepancy between the unit price and the extension, the unit price will govern. Prices shall be extended in decimals, not fractions.

16. Prices shall be net, including transportation and delivery charges fully prepaid by the successful Vendor to the destination indicated in the proposal. If award is made on any other basis, transportation charges must be prepaid by the successful Vendor and added to the invoice as a separate item. In any case, title shall not pass until items have been delivered and accepted.

17. The non-collusive certification must be included with each proposal as required by General Municipal Law, section 103-d. Under penalty of perjury, the Vendor certifies that:

(a) The proposal has been arrived at by the Vendor independently and has been submitted without collusion with any other vendor of services, materials, supplies, or equipment of the type described in the proposal, and

(b) The contents of the proposal have not been communicated by the Vendor, or, to its best knowledge and belief, by any of its employees, or agents, to any person not an employee or agent of the Vendor or its surety on any bond furnished herewith before the official opening of the proposal.

18. All proposals must be sealed. All proposals must be addressed to BOCES, 507 Deer Park Road, General Conditions - Page 3 of 9

Huntington Station, New York 11746. Proposal envelopes must be clearly marked “Proposal”. In addition, the date and time of the proposal opening as indicated on the Notice to Proposers must appear on the envelope.

Proposals must not be attached to or enclosed in package containing proposal samples. Facsimile proposals, telephone proposals or amendments will not be accepted at any time.

19. No interpretation of the meaning of the specifications or other contract document will be made to any Vendor orally. Every request for such interpretation should be in writing, addressed to BOCES. Any interpretations issued will be in the form of addenda to the specifications. All addenda so issued shall become a part of the contract documents.

20. If the services, supplies, materials, or equipment are to be delivered over an extended period of time, or if the specifications so state, then the successful Vendor may be required to execute an agreement in relation to the performance of his/her contract, such agreement to be executed by the Vendor within (fifteen) 15 days after notification to execute such contract. If the specifications so state, the successful Vendor also may be required to furnish a performance bond equal to the full amount of the contract to guarantee the faithful performance of such contract. Such performance bond shall be maintained in full force and effect until the contract shall have been fully performed. The surety company furnishing such performance bond shall be authorized to do business in the State of New York and must be satisfactory to BOCES. The successful Vendor shall submit the performance bond at the time of the execution of the contract by the successful Vendor.

21. All specifications are minimum standards; and accepted proposal samples do not supersede specification for quality unless proposal sample is superior, in which case deliveries must be identical to the quality of the accepted proposal sample.

22. BOCES reserves the right to request a representative sample of the item proposed either prior to the award or before shipments are made. If the sample is not in accordance with the requirements of the specification, BOCES may reject the proposal or, if award has been made, cancel the contract with no obligation to the Vendor.

23. Samples, when required, must be submitted strictly in accordance with instructions; otherwise, proposal may not be considered. If samples are requested subsequent to proposal opening, they shall be delivered within ten

(10) days of the request, or as directed, for proposal to have consideration. Samples must be furnished free of charge and must be accompanied by descriptive memorandum invoices indicating if the Vendor desires their return and specifying the address to which they are to be returned provided they have not been used or made useless by tests. Award samples may be held for comparison with deliveries. BOCES will not be responsible for any samples destroyed or mutilated by examination or testing. The Vendor at his/her expense shall remove samples. If the samples can be returned via shipping, the samples will returned at the vendor’s expense, otherwise the vendor is responsible for making arrangements to remove the samples. Samples not removed within fifteen (15) days after written notice to the Vendor will be regarded as abandoned and BOCES shall have the right to dispose of them as its own property.

24. When a specification indicates that an item to be purchased is to be equal to a sample, such sample will be on display at a designated location in the BOCES district. Failure on the part of the Vendor to examine sample shall not entitle the Vendor to any relief from the conditions imposed in the proposals, specifications, etc.

Award

25. Awards will be made to the lowest responsible Vendor, as will best promote the public interest, taking into consideration the reliability of the Vendor, the quality of the materials, the quality of the services, equipment or supplies to be furnished, their conformity with the specifications, the purposes for which they are required, and the terms of delivery.

26. BOCES reserves the right to reject all proposals. Also reserved is the right to reject, for cause, any proposal in whole or in part, to waive technical defects and irregularities if in its judgment the best interests of the BOCES will be served. Also reserved is the right to reject proposals and to purchase items on State contract if the items as specified can be obtained on the same terms and conditions and at a lower price, unless otherwise stated in the specifications.

General Conditions - Page 4 of 9

27. BOCES reserves the right to make awards at any time within sixty (60) days after the date of the proposal opening during which period proposals may not be withdrawn unless the Vendor states in the proposal that acceptance thereof must be made within a shorter specified time.

28. Where a Vendor is requested to submit a proposal on individual items or in the aggregate, BOCES reserves the right to award proposals on individual items or in the aggregate.

29. If two (2) or more Vendors submit identical proposals as to price, the decision of BOCES to award a contract to one (1) of such identical Vendors shall be final. (General Municipal Law, Sec. 103, Sub. 1).

Contract

30. Each proposal will be received with the understanding that the acceptance thereof in writing by BOCES to furnish any or all of the items described therein shall constitute a contract between the successful Vendor and BOCES. If there is any conflict between the general conditions and the specification, the specifications shall control.

Contract shall bind the successful Vendor on the Vendor’s part to furnish and deliver at the prices and in accordance with the conditions of the proposal. Contract shall bind BOCES to pay at the contract prices for all items ordered and delivered.

31. The placing in the mail of a notice of award or purchase order to a successful Vendor, to the address given in the proposal, will be considered sufficient notice of acceptance of contract.

32. If the successful Vendor fails to deliver or provide the services within the time specified, or within reasonable time as interpreted by BOCES, or fails to make replacement of rejected articles when so requested immediately or as directed by BOCES, BOCES may purchase from other sources to take the place of the item rejected or not delivered or services not provided. BOCES reserves the right to authorize immediate purchase from other sources against rejections on any contract when necessary. On all such purchases, the successful Vendor agrees to reimburse BOCES promptly for excess costs occasioned by such purchases. Should the cost be less, the successful Vendor shall have no claim to the difference. Such purchases will be deducted from contract quantity.

33. A contract may be canceled without further obligation to the Vendor upon non-performance of contract.

34. If the successful Vendor fails to deliver as ordered, BOCES reserves the right to cancel the contract and purchase the balance from other sources at the successful Vendor’s expense.

35. Cancellation of contract for any reason may result in removal of the successful Vendor’s name from mailing list for future proposals for an indeterminate period.

36. When materials, equipment, or supplies, are rejected, they must be removed by the successful Vendor from the premises of BOCES within five (5) days of notification. Rejected items left longer than five (5) days will be regarded as abandoned, and BOCES shall have the right to dispose of them as its own property.

37. No items are to be shipped or delivered until receipt of an authorized purchase order from BOCES.

38. It is mutually understood and agreed that the successful Vendor shall not assign, transfer, convey, sublet, or otherwise dispose of the contract or his/her right, title or interest therein, or his/her power to execute such contract, to any other person, company or corporation, without the previous written consent of BOCES.

All Vendors shall notify BOCES, in advance of an award recommendation, of any prospective subcontracting arrangements. Upon notification to BOCES, BOCES reserves the right to review said subcontracting arrangements. BOCES reserves the right to investigate the subcontractor(s) prior to making an award recommendation.

Installation of Equipment

39. The successful Vendor shall clean up and remove all debris and rubbish resulting from his/her work from time to time as required or directed. Upon completion of the work, the premises shall be left in a neat, unobstructed condition, the buildings broom cleaned and everything in good repair and working order. Materials left by the vendor are the property of the successful Vendor unless otherwise specified.

40. Equipment, supplies, and materials shall be stored at the site only with the prior approval of BOCES and at the

General Conditions - Page 5 of 9 successful Vendor’s risk. In general, such on-site storage should be avoided to prevent possible damage or loss of the material.

41. Work shall progress so as to cause the least inconvenience to BOCES and with proper consideration for the rights of other successful Vendors or workers. The successful Vendor shall perform Vendor’s work promptly with due regard for coordination requirements, if any.

42. Vendors shall acquaint themselves with conditions at the site and shall assume all responsibility for placing and installing the equipment in the designated locations.

43. Equipment for trade-in shall be dismantled by the successful Vendor and removed at his/her expense. The condition of the trade-in equipment at the time it is turned over to the successful Vendor shall be as described in the specifications, except as affected by normal wear and tear from use up to the time of trade-in. All such equipment is represented simply “as is.” Equipment is available for inspection only at the delivery point listed for new equipment, unless otherwise specified.

44. The successful Vendor guarantees:

(a) Vendor’s products against defective material or workmanship and to repair or replace any items damaged or marred in transit;

(b) to furnish adequate liability insurance for protection from damage for all work and to repair damages of any kind for which Vendor or Vendor’s workers are responsible, to the building or equipment, to Vendor’s own work, or to the work of other successful Vendors’;

(c) to carry adequate insurance to protect Western Suffolk BOCES from loss in case of accident, fire, theft, etc.; (d) that all deliveries will be equal to the accepted proposal sample;

(e) that the equipment or furniture offered is standard, new, latest model or regular stock product or as required by the specifications with parts regularly used for the type of equipment or furniture offered; also that no attachment or part has been substituted or applied contrary to manufacturer’s recommendations and standard practice. Every unit delivered must be guaranteed against faulty material and workmanship for a period of at least one (1) year from date of delivery, irrespective of the manufacturer’s warranty. If during this period such faults develop, the successful Vendor agrees to replace the unit or the part affected without cost to BOCES.

The successful Vendor, free of charge, with the specific understanding that all replacements shall carry the same guarantee as the original equipment, shall replace any merchandise provided under the contract that is or becomes defective during the guarantee period. The successful Vendor shall make any such replacement immediately upon receiving notice from BOCES.

Delivery

45. Delivery must be made as ordered and in accordance with the proposal and specifications. If delivery instructions do not appear on order, it will be interpreted to mean prompt delivery (not to exceed thirty (30) days).

The decision of BOCES as to reasonable compliance with delivery terms shall be final. Burden of proof of delay in receipt of order shall rest with the successful Vendor. Failure to deliver for any reason may result in cancellation of the contract by BOCES.

46. BOCES will not schedule any deliveries for Saturdays, Sundays, or legal holidays, except commodities required for daily consumption or where the delivery is an emergency, a replacement or is overdue, in which event the convenience of BOCES shall govern. All deliveries will be made between the hours of 8:30 a.m. and 2:30 p.m.

47. Items shall be securely and properly packed for shipment, storage, and stocking in new shipping containers and according to accepted commercial practice, without extra charge for packing cases, baling or sacks.

48. The successful Vendor shall be responsible for delivery of items in good condition at point of destination.

Vendor shall file with the carrier all claims for breakage, imperfections, and other losses, which will be deducted from

General Conditions - Page 6 of 9 invoices. BOCES will note for the benefit of successful Vendor when packages are not received in good condition.

49. Unless otherwise stated in the specifications, all items must be delivered into and placed at a point within the building as directed by the shipping instructions or the agent of BOCES. The successful Vendor will be required to furnish proof of delivery in every instance.

50. Unloading and placing of the equipment and furniture is the responsibility of the successful Vendor, and BOCES accepts no responsibility for unloading and placing of equipment. Any costs incurred due to the failure of the successful Vendor to comply with this requirement will be charged to the Vendor. No help for unloading will be provided by BOCES and suppliers should notify their truckers accordingly.

51. All deliveries shall be accompanied by delivery tickets or packing slips. Tickets shall contain the following information for each item delivered:

• Purchase Order Number

• Name of Article

• Item Number

• Quantity

• Name of Successful Vendor

Cartons shall be labeled with purchase order or contract number, successful Vendor’s name and general statement of contents. Failure to comply with this condition shall be considered sufficient reason for refusal to accept the materials.

Payments

52. Payment for the used portion of an inferior delivery will be made by BOCES on an adjusted price basis.

53. Payments will be made only after correct presentation of invoices as required by Western Suffolk BOCES.

54. Payments of any claim shall not preclude BOCES from making claim for adjustments on any item found not to have been in accordance with general conditions and specifications.

55. A discount for prompt payment, as specified by Vendor, will be considered as part of the proposal price.

Discounts will be taken on payments made for partial as well as complete deliveries. The discount period will be the period between delivery and payment.

Public Works Contracts

56. Contractors shall comply with all provisions of the Labor Law (including minimum wages as set forth by the New York State Labor Department) and any other applicable statutes of the State of New York.

Toxic Substances

57. Each vendor furnishing a toxic substance as defined by Section 875 of New York State Labor Law to BOCES shall provide not less than two (2) copies of a material safety data sheet, which shall include for each such substance the information outlined in Section 876 of New York State Labor Law. For your information, Chapter 551 of the Laws of New York, 1980, Article 28 (toxic substances) can be found on pages TS-1 and TS-2.

Savings Clause

58. The successful Vendor shall not be held responsible for any losses resulting if the fulfillment of the terms of the contract shall be delayed or prevented by wars, acts of public enemies, strikes, fires, floods, acts of God, or for any other acts not within the control of the successful Vendor and which, by the exercise of reasonable diligence, the Vendor is unable to prevent.

Vendor Application

59. To receive an award from a proposal, a BOCES vendor application must be on file in the Purchasing Office.

Non-Collusive Certification

60. Non-collusive certification must be submitted with each proposal. The enclosed form, “Proposal Certification,”

General Conditions - Page 7 of 9 meets this requirement.

Disclosure Form

61. The enclosed “Disclosure Form” must be submitted with each proposal.

STANDARD CLAUSES FOR WSBOCES CONTRACTS

The parties to the attached contract, license, lease, amendment or other agreement of any kind (hereinafter, "the contract" or "this contract") agree to be bound by the following clauses which are hereby made a part of the contract (the word "Contractor" herein refers to any party other than Western Suffolk BOCES, whether a contractor, licenser, licensee, lessor, lessee or any other party):

Non-Assignment Clause

62. This contract may not be assigned by the Contractor or its right, title or interest therein assigned, transferred, conveyed, sublet or otherwise disposed of without the WSBOCES’s previous written consent, and attempts to do so are null and void. WSBOCES retains its right to approve an assignment and to require that any Contractor demonstrate its responsibility to do business with WSBOCES.

Workers' Compensation Benefits

63. In accordance with Section 142 of the State Finance Law, this contract shall be void and of no force and effect unless the Contractor shall provide and maintain coverage during the life of this contract for the benefit of such employees as are required to be covered by the provisions of the Workers' Compensation Law.

Non-Discrimination Requirements

64. To the extent required by Article 15 of the Executive Law (also known as the Human Rights Law) and all other State and Federal statutory and constitutional non-discrimination provisions, the Contractor will not discriminate against any employee or applicant for employment because of race, creed, color, sex, national origin, sexual orientation, age, disability, genetic predisposition or carrier status, or marital status. Furthermore, in accordance with Section 220-e of the Labor Law, if this is a contract for the construction, alteration or repair of any public building or public work or for the manufacture, sale or distribution of materials, equipment or supplies, and to the extent that this contract shall be performed within the State of New York, Contractor agrees that neither it nor its subcontractors shall, by reason of race, creed, color, disability, sex, or national origin: (a) discriminate in hiring against any New York State citizen who is qualified and available to perform the work; or (b) discriminate against or intimidate any employee hired for the performance of work under this contract. If this is a building service contract as defined in Section 230 of the Labor Law, then, in accordance with Section 239 thereof, Contractor agrees that neither it nor its subcontractors shall by reason of race, creed, color, national origin, age, sex or disability: (a) discriminate in hiring against any New York State citizen who is qualified and available to perform the work; or (b) discriminate against or intimidate any employee hired for the performance of work under this contract. Contractor is subject to fines of $50.00 per person per day for any violation of Section 220-e or Section 239 as well as possible termination of this contract and forfeiture of all moneys due hereunder for a second or subsequent violation.

Wage and Hours Provisions

65. If this is a public work contract covered by Article 8 of the Labor Law or a building service contract covered by Article 9 thereof, neither Contractor's employees nor the employees of its subcontractors may be required or permitted to work more than the number of hours or days stated in said statutes, except as otherwise provided in the Labor Law and as set forth in prevailing wage and supplement schedules issued by the State Labor Department.

Furthermore, Contractor and its subcontractors must pay at least the prevailing wage rate and pay or provide the prevailing supplements, including the premium rates for overtime pay, as determined by the State Labor Department in accordance with the Labor Law. Additionally, effective April 28, 2008, if this is a public work contract covered by Article 8 of the Labor Law, the Contractor understands and agrees that the filing of payrolls in a manner consistent with Subdivision 3-a of Section 220 of the Labor Law shall be a condition precedent to payment by Western Suffolk BOCES of any Western Suffolk BOCES approved sums due and owing for work done upon the project.

Non-Collusive Bidding Certification

66. In accordance with Section 139-d of the State Finance Law, if this contract was awarded based upon the submission of bids, Contractor affirms, under penalty of perjury, that its bid was arrived at independently and without collusion aimed at restricting competition. Contractor further affirms that, at the time Contractor submitted its bid, an authorized and responsible person executed and delivered to Western Suffolk BOCES a non-collusive bidding

General Conditions - Page 8 of 9 certification on Contractor's behalf.

Iran Divestment Act

67. By entering into this Agreement, Contractor certifies in accordance with State Finance Law §165-a that it is not on the “Entities Determined to be Non-Responsive Bidders/Offerers pursuant to the New York State Iran Divestment Act of 2012” (“Prohibited Entities List”) posted at: http://www.ogs.ny.gov/about/regs/docs/ListofEntities.pdf

Contractor further certifies that it will not utilize on this Contract any subcontractor that is identified on the Prohibited Entities List. Contractor agrees that should it seek to renew or extend this Contract, it must provide the same certification at the time the Contract is renewed or extended. Contractor also agrees that any proposed Assignee of this Contract will be required to certify that it is not on the Prohibited Entities List before the contract assignment will be approved by Western Suffolk BOCES. During the term of the Contract, should the Western Suffolk BOCES receive information that a person (as defined in State Finance Law §165-a) is in violation of the above-referenced certifications, the Western Suffolk BOCES will review such information and offer the person an opportunity to respond. If the person fails to demonstrate that it has ceased its engagement in the investment activity which is in violation of the Act within 90 days after the determination of such violation, then Western Suffolk BOCES shall take such action as may be appropriate and provided for by law, rule, or contract, including, but not limited to, imposing sanctions, seeking compliance, recovering damages, or declaring the Contractor in default.

Western Suffolk BOCES reserves the right to reject any bid, request for assignment, renewal or extension for an entity that appears on the Prohibited Entities List prior to the award, assignment, renewal or extension of a contract, and to pursue a responsibility review with respect to any entity that is awarded a contract and appears on the Prohibited Entities list after contract award.

Compliance with New York State Education Law §2-D Unauthorized Release of Personally Identifiable Information

68. Contractor shall comply with the provisions of the New York State Education Law §2-d Unauthorized Release of Personally Identifiable Information. (General Business Law Section 899-aa; State Technology Law Section 208).

Compliance with New York State Information Security Breach and Notification Act

69. Contractor shall comply with the provisions of the New York State Information Security Breach and Notification Act (General Business Law Section 899-aa; State Technology Law Section 208).

Set-off Rights

70. WSBOCES shall have all of its common law, equitable and statutory rights of set-off. These rights shall include, but not be limited to, the WSBOCES's option to withhold for the purposes of set-off any moneys due to the Contractor under this contract up to any amounts due and owing to WSBOCES with regard to this contract, or any other contract with WSBOCES.

Payment

71. WSBOCES agrees to pay properly submitted invoices within thirty (30) days of receipt by WSBOCES.

Records

72. The Contractor shall establish and maintain complete and accurate books, records, documents, accounts and other evidence directly pertinent to performance under this contract (hereinafter, collectively, "the Records"). The Records must be kept for the balance of the calendar year in which they were made and for six (6) additional years thereafter. The State Comptroller, State Education Department, the Attorney General and any other person or entity authorized to conduct an examination, as well as the agency or agencies involved in this contract, shall have access to the Records during normal business hours at an office of the Contractor within the State of New York or, if no such office is available, at a mutually agreeable and reasonable venue within the State, for the term specified above for the purposes of inspection, auditing and copying. WSBOCES shall take reasonable steps to protect from public disclosure any of the Records which are exempt from disclosure under Section 87 of the Public Officers Law (the "Statute") provided that: (i) the Contractor shall timely inform an appropriate Western Suffolk BOCES official, in writing, that said records should not be disclosed; and (ii) said records shall be sufficiently identified; and (iii) designation of said records as exempt under the Statute is reasonable. Nothing contained herein shall diminish, or in any way adversely affect, WSBOCES’s right to discovery in any pending or future litigation.

General Conditions - Page 9 of 9

Insurance

73. Unless different terms apply in the Contract between Contractor and WSBOCES, the Contractor shall at its own cost and expense procure and maintain or cause to be procured and maintained general liability insurance for the services provided by Contractor under the terms of this Agreement in amounts of no less than $1,000,000 per claim/$2,000,000 million aggregate. Such coverage shall remain in full force and effect covering the actions of the Contractor and shall cover all occurrences including those claims made during and after the term of this Agreement arising from any acts or occurrences during the term of this agreement. Prior to the start of the services to be provided by Contractor, the Contractor shall present evidence of the aforementioned coverage and such coverage shall also provide that it may not be canceled or materially changed without 30 days prior written notice to

WSBOCES

Indemnification and Hold Harmless

74. The Contractor agrees indemnify, and save harmless, WSBOCES, and their respective officers, directors, contractors, agents and employees, from and against any and all liability (statutory or otherwise), claims, suits, demands, damages, judgments, costs, interest and expenses (including, but not limited to, counsel fees and disbursements incurred in the defense of any action or proceeding), to which they may be subject or which they may suffer by reason of, or by reason of any claim for, any injury to, or death of, any person or persons or damage to property (including any loss of use thereof) or otherwise arising from or in connection with this agreement due to or resulting from any default by Contractor in the performance of Contractor’s obligations under this agreement or from any act, omission or negligence of Contractor or any of Contractor’s officers, directors, agents, contractors, servants, employees, subtenants, licensees or invitees.

Conflicting Terms

75. In the event of a conflict between the terms of the contract (including any and all attachments thereto and amendments thereof) and the terms of this Appendix A, the terms of this Appendix A shall control.

Governing Law

76. This contract shall be governed by the laws of the State of New York except where the Federal supremacy clause requires otherwise.

No Arbitration

77. Disputes involving this contract, including the breach or alleged breach thereof, may not be submitted to binding arbitration (except where statutorily authorized), but must, instead, be heard in a court of competent jurisdiction of the State of New York, County of Suffolk.

Amendment/Modification

78. No amendment or modification of the contract between the Contractor or WSBOCES shall be valid unless in writing and signed by all parties to the contract.

Service of Process

79. In addition to the methods of service allowed by the State Civil Practice Law & Rules ("CPLR"), Contractor hereby consents to service of process upon it by registered or certified mail, return receipt requested. Service hereunder shall be complete upon Contractor's actual receipt of process or upon WSBOCES's receipt of the return thereof by the United States Postal Service as refused or undeliverable. Contractor must promptly notify WSBOCES, in writing, of each and every change of address to which service of process can be made. Service by WSBOCES to the last known address shall be sufficient. Contractor will have thirty (30) calendar days after service hereunder is complete in which to respond.

____Understood and Agreed

Specifications - Page 1 of 21

SPECIFICATIONS

SERVICES FOR NETWORK PENETRATION AND COMPROMISE ASSESSMENT

RFP #25/26-47PI-MB

To be received by 3:00 p.m., OCTOBER 15, 2025

The Board of Cooperative Educational Services, Second Supervisory District of Suffolk County, hereinafter referred to as BOCES, invites sealed proposals from qualified organizations and/or individuals, hereinafter referred to as vendor, to conduct a network penetration and compromise assessment for our IT infrastructure.

The contract will be awarded to the vendor best meeting the needs of BOCES as determined by BOCES in its sole discretion. Note that the lowest-cost vendor may not be the best suited to meet the needs of the BOCES.

In accordance with §104b of General Municipal Law, goods and services such as contracts for professional services, requiring special skill or training, are not required by law to be procured through competitive bidding, but must be procured in a manner so as to assure the prudent and economical use of public monies.

1. Purpose BOCES requests proposals from qualified organizations and/or individuals, hereinafter referred to as vendor, to conduct a network penetration and compromise assessment for our IT infrastructure.

2. Definitions

The following definitions are used throughout this RFP:

RFP - Request for Proposal: Refers to each and every requirement stated in this document and all attachments hereto and any additional instructions that are developed and incorporated subsequent to the distribution of this document;

BOCES: The requestor, Western Suffolk BOCES, whose principal place of business is located at 507 Deer Park Avenue, Huntington Station, NY 11746;

Agreement and Contract: The final executed business arrangement between BOCES and the applicable vendor/consultant, together with the terms and conditions of that relationship (purchase order, formal contract, etc.);

Vendor, Proposer, You, Your Firm, Consultant: Refer to the entities that will be submitting a response(s) to this RFP;

Proposal and response: Refer to the complete product, service and price proposal submitted by the proposer as a result of the RFP;

SAVE: Schools Against Violence in Education;

NYSED: New York State Education Department.

Proposer’s Initials Specifications - Page 2 of 21

3. Requests for Clarification/Additional Information All requests for clarification or additional information related to this RFP must be submitted in writing by mail, fax, or e-mail on or before October 8, 2025 to:

Ms. Lorraine Hein, NIGP-CPP, CPPB Director of Business Board of Cooperative Educational Services

Second Supervisory District of Suffolk County 507 Deer Park Road

Huntington Station, NY 11746 E-Mail: purchasing@wsboces.org Voice: (631) 549-4900 Fax: (631) 623-4923

In the event BOCES provides clarification or supplemental information to this RFP, all recipients of this RFP will receive the information via an addendum to this RFP. BOCES assumes no responsibility for vendor’s/consultant’s failing to receive all addenda issued.

4. Contract Term The contract shall be in effect from date of award through contract completion, at the discretion of the BOCES, not to exceed the prices indicated in the vendor’s/consultant’s RFP submission, and upon mutual agreement.

5. Award To be considered for an award, proposers must complete all items on the Proposal Form and return the attached W-9 form with the proposal submission. The BOCES will issue purchase orders for items/services awarded prior to commencement of work and vendor(s) must accept same. Vendors will not perform any work without an authorized purchase order.

6. Board Policies and Regulations The following shall be the responsibility of the vendor, at no additional cost to Western Suffolk

BOCES:

The vendor is obligated to abide by all applicable BOCES Board policies and regulations.

Refer to the web link below for the BOCES Board policies and regulations:

http://www.wsboces.org/wp-content/uploads/Western-Suffolk-BOCES-Policies.pdf

The vendor shall be solely responsible for complying with all applicable laws, regulations, etc. The cost of such compliance shall be borne entirely by vendor, who shall hold the BOCES harmless from any claims, demands or penalties arising from vendor’s failure to comply with the above. BOCES will be held harmless from these and any decisions that pertain to the vendor’s work.

7. Reservation of Rights BOCES reserves and may exercise, at any time, any of the following rights and options with respect to the RFP.

BOCES reserves the right to reject all proposals without incurring any cost. Also reserved is the right to reject for cause, any proposal, in whole or in part; and to waive non-material defects, irregularities, and omissions, if, in its judgment, the best interests of the BOCES will be served.

Proposer’s Initials Specifications - Page 3 of 21

BOCES reserves the right to seek additional proposals, to enter into negotiations with and subsequently contract with more than one proposer/vendor, and/or to award one or more contract(s) on the basis of criteria other than price.

BOCES reserves the right to negotiate the terms of the contract, including the award amount, with the selected vendor(s) prior to entering into a contract.

BOCES reserves the right to retain all proposals submitted and to use any ideas in a proposal regardless of whether that proposal is selected.

BOCES reserves the right to reject incomplete submissions. BOCES also reserves the right to reject any or all responses to this RFP, request additional data or material at any time, or to cancel this RFP in whole or in part. All material submitted in response to this RFP will become the property of BOCES upon the opening of this RFP.

BOCES reserves the right to reject any proposal where investigation and evaluation of the vendor's qualifications indicate that the vendor may not promptly and efficiently complete the work as per the specifications.

BOCES reserves the right to reject proposals that impose conditions that would modify the terms and conditions of the specification, or limit the vendor’s liability to BOCES on the contract awarded on the basis of such proposal.

BOCES reserves the right to cancel or withdraw this RFP with or without substitution, to alter the terms or conditions of the RFP and/or to alter, within reason, the proposed implementation schedule.

If the awarded vendor(s)/consultant(s) fails to deliver or provide the services within the time specified, or fails to abide by any of the provisions of this Contract, including but not limited to, untimely performance, inadequate adherence to the schedule, or other unsatisfactory performance, such failure shall constitute a breach of Contract. Upon such breach, BOCES shall provide written notice of intention to terminate to the contract with the Successful Vendor setting forth the reasons for such termination and if the Successful Vendor does not cure such breach within a ten (10) day period of such notice, BOCES reserves the right to terminate said Contract for default, immediately and in order to protect the continuity of the operations, the required services may be procured from the apparent responsible second low bidder or other sources. In the event default action is carried out, the delinquent Successful Vendor agrees to reimburse BOCES promptly for excess costs occasioned by such expenditures from revenue owed to the delinquent Successful Vendor or from the Performance Bond (if applicable). However, should the delinquent Successful Vendor cure such breach and perform its obligations during such ten (10) day notice period, the Contract shall continue in full force and effect.

Each proposal will be received with the understanding that the acceptance thereof, in writing, by BOCES to furnish any or all of the Items/services described therein shall constitute a Contract between the Successful Vendor and BOCES (“Contract”). The Contract shall bind the Successful Vendor to furnish and deliver at the prices and in accordance with the conditions of this RFP. BOCES reserves the right to increase or decrease the quantities ordered.

Proposer’s Initials Specifications - Page 4 of 21

At the sole discretion of BOCES, a proposal may be rejected and the Contract not awarded, to a Vendor whose performance on a previous Contract with BOCES has been determined to be unsatisfactory.

BOCES further reserves the right to reject any proposal if the vendor fails to satisfy BOCES that they are properly qualified to carry out the obligations of the contract.

BOCES reserves the right to use outside vendors on an “as needed” basis, as determined by

BOCES.

The contract, if awarded, in part or in whole, will be to the bidder(s) who meet(s) all the terms and conditions of the specifications. BOCES guarantees no minimum or maximum purchases or contracts as a result of award of this RFP. Additionally, the BOCES reserves the right to purchase any goods or services included as a part of this RFP from any means legally available to it at any time.

8. Scope of Work

BOCES is seeking proposals from qualified vendors to conduct services for the network penetration and a comprehensive compromise assessment for our IT infrastructure. This assessment will identify potential vulnerabilities, security gaps, and any evidence of existing compromise across our network.

Scope of services for a network penetration and vulnerability assessment:

1. Provide security penetration test to 10 external facing servers.

2. Provide security penetration test to 150 internal networked devices.

3. Provide security penetration test up to 5 wireless access devices.

4. Provide a comprehensive compromise assessment for our IT infrastructure. This assessment will identify potential vulnerabilities, security gaps, and any evidence of existing compromise across our network.

Vulnerability…