Request for Proposal (RFP)

Wide Area Network (WAN) communication services

Cleveland Metropolitan School District

Version 11.0

1. SCOPE OF SERVICES

1.1 Service Overview

Cleveland Metropolitan School District (CMSD) seeks proposals from qualified vendors to provide comprehensive Wide Area Network (WAN) communication services. This RFP specifically addresses the communication distribution infrastructure, traditionally referred to as “WAN Services” by CMSD’s Department of Information Technology.

1.2 Scope Definition

The scope of services includes:

• Diverse Access: For the purposes of this RFP, this means that data circuits will be provided via completely diverse service pathways whenever and wherever possible. The diverse pathways shall include the entire path from the carrier’s point of presence to the CMSD facility. They will use completely disparate pathways into and out of each CMSD facility, as required.

• Diverse Carriers: For the purposes of this RFP, will mean that multiple carrier-grade infrastructure providers will be utilized in all geographical areas where multiple carrier infrastructures are present and available at initial service activation, to facilitate the physical circuit(s) into each facility. As it relates to WAN services, two independent, carrier-grade providers will be utilized to deliver the and WAN service to all CMSD facilities, reducing the risk of service outages due to a single carrier’s service/infrastructure failure.

• Carrier Grade Network Infrastructure: Provide services utilizing a carrier-grade fiber network(s), with carrier-grade routing hardware and traffic prioritization to ensure dependable traffic handling that meets advertised SLA levels.

• Origin Point: Fiber aggregation router at the Central Communications Termination Area (currently located on the 14th floor of 1111 Superior Avenue, Cleveland, OH)

• Endpoint: Building-level router at each CMSD site

• Transmission Medium: Fiber infrastructure between origin and endpoint

• Equipment: All routing equipment, optics, and necessary hardware for WAN connectivity

Services explicitly OUT of scope:

• Internet Service Provider (ISP) / Direct Internet Access (DIA) services

• Local Area Network (LAN) equipment or services at individual sites

• End-user devices or desktop support services

• Primary ISP services (OARNet and Zayo) which are managed separately

1.3 Service Locations

Central Communications Termination Area

Current Location: 14th Floor, 1111 Superior Avenue, Cleveland, OH 44114

Important: The Central Communications Termination Area will be relocated at some point over the next few years. Vendors must demonstrate flexibility to support either the current location or transition to a new location during the contract period.

Alternative Locations under consideration include:

• H5 Building: 1625 Rockwell Avenue, Cleveland, OH 44114

• Sterling Building: 1255 Euclid Avenue, Cleveland, OH 44115

Requirement: All proposed solutions must accommodate CMSD’s primary ISP, OARNet, being able to provide Direct Internet Access (DIA) circuits at any chosen location. OARNet can cross-connect easily at both the Euclid Avenue and Rockwell Avenue locations.

Building-Level Sites

Vendors will provide WAN services to all CMSD buildings as specified in Appendix A. Each site requires fiber connectivity from the Central Communications Termination Area to the building-level router.

1.4 Current Infrastructure Context

Current Service Provider WAN services are currently provided by ENA/Zayo (note: ENA was acquired by Zayo). The fiber infrastructure is owned and operated by Crown Castle Fiber (CCF), which is subcontracted by Zayo. Crown Castle Fiber has been acquired by Zayo but the entities have not yet merged operationally.

Note: It is acceptable for vendors to subcontract fiber infrastructure services, provided all subcontractors meet the overall Service Level Agreements (SLAs) defined in the master contract.

The primary vendor remains responsible for all service delivery and SLA compliance.

Current Services Include

• Management of fiber aggregation router at Central Communications Termination Area

• Management of building-level routers at each CMSD site

• Dark fiber infrastructure between routers

• Optics and fiber uplink/downlink connections at the district handoff

• Current subscription: Dark Fiber at 1Gbps, burstable to 10Gbps

Current Equipment

• Central Communications Termination Area: Cisco ASR 9002 (owned and managed by current

WAN service provider)

• Building-Level Sites: Cisco ASR 920 (owned and managed by current WAN service provider)

Important: CMSD does not own or manage the routing equipment. All routing equipment is owned and managed by the WAN service provider.

2. MINIMUM TECHNICAL REQUIREMENTS

2.1 Network Topology

CMSD does not mandate a specific network topology. The current implementation uses a hub-and-spoke model with dark fiber, but vendors may propose alternative topologies including:

• Hub-and-spoke configurations

• MPLS mesh networks

• Dual fiber ring topologies

• Other topologies that meet or exceed the technical and performance requirements

All proposed topologies must be clearly documented with network diagrams and justification for the design approach.

2.2 Transmission Medium Requirements

Fiber Requirements

• Primary Medium: Fiber optic connectivity is required to each CMSD site

• Fiber Type: Single-mode fiber

• Current Service: Dark fiber is currently used but is not a requirement for future services

• Alternative Technologies: While vendors may propose technologies other than dark fiber, fiber-based connectivity to each site remains mandatory

Circuit Diversity

• Current fiber infrastructure is not resilient at the site level (single circuit per site)

• CMSD buildings do not currently support diverse service entrances

• CMSD buildings can support diverse circuits entering through the same service entrance

(strongly encouraged)

• Diversity Requirements (if diverse circuits are proposed):

– Circuits may be served from the same utility pole

– Circuits must be truly diverse and not terminate to the same immediate upstream equipment or point of presence (POP)

– Diverse paths should minimize common points of failure wherever technically feasible

2.3 Bandwidth Requirements

• Minimum Bandwidth: 1Gbps per site

• Burstable Capacity: 10Gbps per site (or higher)

• Scalability: Solution must support bandwidth increases without requiring complete infrastructure replacement

2.4 Equipment Requirements

Vendor Equipment Ownership

All routing equipment, including fiber aggregation routers and building-level routers, shall be owned and managed by the vendor. CMSD will not own or be responsible for maintaining this equipment.

Manufacturer Requirements

• Equipment Manufacturer & Models: All routers must be Cisco or close alternative models

(cloud-managed or current generation preferred)

• End-of-Life Replacement: The current Cisco ASR 920 routers are past their Last Day of Support

(LDoS) and must be replaced with current-generation equipment

Equipment Lifecycle Management

Vendors must provide a comprehensive equipment lifecycle management plan that addresses:

1. End-of-Sale (EOS) and Last Day of Support (LDoS) Requirements:

• No devices on the CMSD network shall operate past their manufacturer-announced Last Day of Support (LDoS)

• CMSD does not use third-party support arrangements that allow continued operation of devices after manufacturer support ends

• All devices must be eligible for manufacturer support throughout the contract term

• Vendor must proactively monitor manufacturer EOS/LDoS announcements and notify CMSD according to the timelines committed in Appendix C

2. Device Replacement Timeline:

• When a device model reaches End-of-Sale (EOS) announcement, vendor must develop and present a replacement plan

• All affected devices must be replaced before the Last Day of Support (LDoS) date arrives

• Replacements must occur with adequate time to avoid any service degradation

• Vendor must include projected replacement costs and timelines in the proposal for any equipment approaching EOS

• Vendor must complete Appendix C, Section C.1 (Lifecycle and Replacement Targets), indicating standard timelines for EOS notification and LDoS-based replacement activities

3. Firmware and Software Update Requirements:

CMSD’s target expectations for firmware and software updates are as follows; bidders must indicate in Appendix C, Section C.2 whether they meet, exceed, or propose alternative timelines:

• Feature Updates: Applied on a regular cadence in accordance with manufacturer recommendations and vendor maintenance schedule

• Security Updates - High/Critical CVEs: Target of within 7 calendar days of vendor release

• Security Updates - Medium/Low CVEs: Target of within 21 calendar days of vendor release

• Zero-Day / Actively Exploited Vulnerabilities: Emergency maintenance targeted as soon as a patch or mitigation is available

Vendor must document in Appendix C, Section C.2:

• Standard timelines for each category of update

• Any exceptions or constraints

• Whether emergency change processes are available to meet zero-day targets

4. Lifecycle Management Plan (to be included in proposal):

• Current EOS/LDoS status of all proposed equipment

• Monitoring process for tracking manufacturer announcements

• Notification timeline for informing CMSD of upcoming EOS/LDoS dates

• Standard replacement procedures and timelines

• Financial model for handling mid-contract equipment refreshes

Optics Requirements

• Optics Type: Cisco (preferred) Single-Mode Long Range (LR) SFP & fiber required

• Generic SFPs or DACs: Not acceptable

• Standards Compliance: All optics must meet or exceed industry standards for single-mode fiber transmission

Central Communications Termination Area Equipment

Option A: Direct Uplink to CMSD Communication Core If the vendor solution uplinks directly to CMSD’s communication core infrastructure:

• Uplink Configuration: 40G uplinks (direct or aggregation) to each of CMSD’s High Availability (HA) failover stacks (A & B Stack)

• Location: Central Communications Termination Area

• Resiliency: Uplinks must connect to CMSD’s resilient core switch infrastructure

Option B: Direct Cross-Connect to ISP(s) If the vendor solution cross-connects directly to Internet Service Provider(s):

• CMSD core uplink requirement does not apply

• Vendor must clearly document interconnection architecture

• Cross-connect arrangements must be documented and maintained by vendor

Important: Depending on the solution provided, please comment on the uplink/cross-connect service diversity that is provided for high-availability/failover at the handoff from the proposed service to upstream connectivity.

High Availability and Resiliency Requirements

Fiber Aggregation Router (Central Communications Termination Area):

CMSD strongly prefers resilient designs at the aggregation layer. Rather than prescribing a single model (e.g., mandatory HA pair or cold spare), bidders must clearly describe:

• The high availability / failover capabilities provided for the aggregation router(s)

• Whether design is active/active, active/standby, cold spare on-site, or other (describe)

• Any non-recurring and recurring costs associated with each resiliency option

• Expected failover behavior (automatic vs. manual) and expected failover times

CMSD will evaluate the robustness and cost-effectiveness of proposed HA designs as part of the Technical Solution and SLA scoring. Bidders must document their design in Appendix C, Section C.3.

Building-Level Router (Individual Sites):

• Replacement Timeline: Same business day if replacement determination occurs prior to 12:00 PM noon EST and next business day by 7:00 AM EST otherwise

• High Availability (HA) failover is not required but is not prohibited

• Vendor must maintain adequate spare inventory to meet replacement timeline

• Vendor must document in Appendix C, Section C.3 the standard replacement model, spare strategy, and any optional per-site HA/failover offerings and associated costs

2.5 Cybersecurity Requirements

Vendors must incorporate, where applicable, the following cybersecurity controls into their solution design and operations. Solution should follow Zero Trust Architecture principals as best they can, including but not limited to:

2.5.1 Network Segmentation and Boundary Protection

• Design WAN to define and control network boundaries using firewalls and intrusion detection/prevention systems (IDPS)

• Protect network perimeter and internal segments through physical or logical segmentation

• Implement access control lists (ACLs) and firewall rules to restrict traffic between network segments

• Support isolation of management, user, and application traffic

• Implement device access controls based on CMSD-specified policies

• Provide network diagram showing all segmentation zones and boundary protection mechanisms

2.5.2 Administrative Access Security and Identity Management

• Multi-Factor Authentication (MFA): All remote and privileged access to WAN management systems must require MFA

• Endpoint Protection Requirements: Vendor must document and enforce security controls required on systems accessing WAN management interfaces:

– Current endpoint protection/antivirus software

– Operating system and security patches current

– Device authentication mechanisms (Windows/macOS domain authentication, MDM enrollment)

– Firewall enabled on management workstations

– Disk encryption where applicable

• Separation of Duties: Vendor must ensure no single person can authorize and implement a network change without independent review and approval

• Session Controls: Establish and enforce policies for:

– Session establishment (authentication, MFA)

– Session duration limits

– Concurrent session limits

– Session termination procedures

– Automatic logout on inactivity

2.5.3 Data Transmission Security and Cryptographic Protection

• Encryption Standards: Use strong encryption protocols (minimum TLS 1.2, preferred TLS 1.3) for all management traffic

• VPN Support: Ensure WAN infrastructure supports CMSD’s existing VPN solutions (IPsec, SSL

VPN) without performance degradation

• End-to-End Encryption: Support end-to-end encryption for sensitive applications and data where required

• Denial-of-Service Protection: Incorporate protections against DDoS and service availability attacks:

– Rate limiting on WAN circuits

– Traffic scrubbing or filtering capabilities

– Coordination with ISP DDoS mitigation services

– SLA guarantees for DDoS incident response

2.5.4 Security Monitoring, Logging, and Threat Intelligence

• Configuration Baselines: Establish and maintain secure configuration baseline for all WAN devices:

– Document approved configurations

– Disable unnecessary services and ports

– Enforce password complexity and account lockout policies

– Restrict SNMP read/write community strings

– Disable default accounts and credentials

• Audit Logging: All WAN devices must generate comprehensive audit logs of security-relevant events:

– Administrative access (login attempts, successful logins, logouts)

– Configuration changes with before/after values

– User actions and authentication events

– Unauthorized access attempts

– Security policy violations

– Logs retained for minimum 90 days, preferred 1 year

• SIEM Integration: Vendor should utilize centralized Security Information and Event Management (SIEM) tools to:

– Aggregate logs from all WAN devices

– Normalize and parse log data

– Generate alerts for suspicious activity

– Enable correlation analysis across devices

– Provide long-term log storage and analysis

• Intrusion Detection/Prevention: Vendor must deploy network intrusion detection/prevention systems (IDS/IPS) at WAN entry and exit points at the public edge:

– Detect known attack signatures

– Block malicious traffic patterns

– Alert on anomalous behavior

– Provide forensic analysis capabilities

• Threat Intelligence Integration: Vendor must incorporate real-time threat monitoring tools to:

– Monitor threat feeds for emerging vulnerabilities

– Identify indicators of compromise

– Respond to active threats

– Provide threat assessments and recommendations

2.5.5 Secure Device Configuration and Hardening

• Least Functionality: Restrict WAN devices and systems to only essential functions necessary to perform their duties:

– Disable unnecessary services and protocols

– Remove default or unused credentials

– Restrict network access through firewall rules

• Secure Boot: Configure secure boot mechanisms where available to prevent unauthorized firmware modifications

• Device Authentication: Implement device authentication mechanisms where supported:

– Cryptographic certificates for device identity

– Mutual authentication between devices

– Certificate pinning where applicable

• Configuration Backup and Recovery: Maintain regular backups of WAN device configurations with:

– Encrypted backup storage

– Version control and change tracking

– Rapid restoration capabilities

– Testing of restoration procedures

2.5.6 Disaster Recovery and Business Continuity

• Resilience: Design WAN for high availability and quick recovery from attacks or outages

• Failover Mechanisms: Implement diverse circuits and uplinks and automatic failover mechanisms:

– Sub-second failover where technically feasible

– Monitoring of failover mechanisms

– Testing of failover procedures

• Incident Response Planning: Provide documented incident response procedures:

– Security breach response plan

– DDoS response procedures

– Configuration compromise response

– Forensic preservation procedures

– Incident communication plan

• Business Continuity Testing: Conduct and document regular testing of:

– Failover and recovery procedures

– Backup restoration

– Incident response procedures

– Disaster recovery scenarios

2.6 Barebones Services for Closed or Vacant Buildings

For closed or vacant CMSD buildings, the Department of IT must continue to provide internet connectivity at significantly reduced capacity sufficient to support building systems, including (at minimum) HVAC controls, surveillance, and Emergency Communications Systems.

CMSD currently uses Spectrum Business-class asymmetrical internet services (nominally 1 Gbps downstream / 30 Mbps upstream) for this purpose. Offerors whose proposed WAN solution can cost-effectively scale down to provide similar low-capacity connectivity for closed or vacant sites shall clearly describe this capability in their proposal, including:

• Technical architecture and access method (e.g., fiber, coax, or other).

• Nominal downstream and upstream speeds and any usage limitations.

• Service limitations compared to full-production instructional sites (e.g., lack of resiliency options, reduced SLA targets, or fewer reporting features).

• Pricing model (per-site MRC and NRC) and how such barebones services would be ordered, modified, and disconnected over time as CMSD closes, repurposes, or reopens buildings.

3. MAINTENANCE AND CHANGE MANAGEMENT

3.1 Maintenance Windows

District-Wide Maintenance Window

For work that may impact multiple sites or district-wide services:

• Scheduled Window: Friday 6:00 PM through Sunday 11:59 PM

• Frequency: As needed, with advance notice to CMSD

• Notification: Minimum 7 calendar days advance notice for routine maintenance; 72 hours for urgent maintenance

Single-Site Maintenance Window

For work impacting only a single site:

• Scheduled Window: Daily, outside of instructional hours (generally 4:00 PM - 7:00 AM on school days)

• Coordination: Must be coordinated with the building principal

• Notification: Minimum 48 hours advance notice

3.2 Change Control Requirements

All work performed during maintenance windows must adhere to the following change control procedures:

• Change Documentation: All planned changes must be documented in writing and submitted to CMSD for approval

• Rollback Plan: Every change must include an adequate rollback plan

• Testing Plan: Pre-maintenance testing procedures must be documented

• Rollback Timeline: Rollback procedures must be executable within the maintenance window

• Emergency Changes: Process for emergency changes outside maintenance windows must be documented

3.3 Building Access Coordination

For work requiring physical access to CMSD buildings:

• Coordination: Must be coordinated with CMSD Facilities and Custodial staff

• After-Hours Access: If custodial staff can provide after-hours building access, vendor personnel are expected to proceed with work

• Access Restrictions: If building access is unavailable until business hours, vendor repair crew must be able to be present when custodial staff confirms availability

• Security Requirements: All vendor personnel requiring building access must complete CMSD background check and security requirements

4. SERVICE LEVEL AGREEMENTS (SLAs)

4.1 Service Criticality Classification

Critical Service Classification

All fiber outages are classified as CRITICAL incidents:

• Fiber outages result in loss of phone services (digital voice over IP)

• Loss of phone services means emergency 911 services are unavailable

• Loss of emergency services may require school cancellation

• Loss of internet connectivity for digital learning environments may require school cancellation

• All fiber outages receive highest priority response

4.2 Uptime Requirements

CMSD’s suggested target for site-level availability is:

• Minimum Target – Site Availability: 99.99% uptime per site, per month.

• Measurement Period: Calendar month

• Exclusions: Planned maintenance during approved maintenance windows (with proper notice) is excluded from availability calculations.

Uptime Calculation:

Uptime % = ((Total Minutes in Month - Unplanned Downtime Minutes) / Total Min utes in Month) × 100

Bidders must indicate their committed monthly availability target in Appendix C.4.1, and state whether their commitment meets or exceeds CMSD’s suggested 99.99% target.

4.3 Response, Restore, and Repair Time Requirements

To clarify expectations, CMSD distinguishes between:

• Restore: Service restored to a functional state that meets SLA performance targets (latency, loss, jitter), even if a workaround is in place.

• Repair: Underlying fault fully corrected, temporary workarounds removed, documentation updated, and environment returned to steady state “hands-off” condition.

CMSD views the following as suggested target values for incident response, restore, and repair times. Bidders must document their proposed SLAs in Appendix C.4.2 and indicate where they meet or exceed these suggested targets.

Critical Incidents (Fiber Outages, Complete Site Down)

• Initial Response (Target): 30 minutes or less from incident detection or notification

• On-Site Response (Target): 2 hours or less (if physical access is available)

• Time to Restore Service (Target): 4 hours or less

• Time to Repair / Cleanup (Target): 8 hours or less, or next maintenance window if mutually agreed

• In-Progress Updates: Every 30 minutes or less

• Work Schedule: 24/7/365 response and repair, with the following exception:

– If building access is required and custodial staff cannot provide immediate access, repair crew must be present when building access becomes available

High Priority Incidents (Degraded Performance, Partial Outage)

• Initial Response (Target): 1 hour or less

• On-Site Response (Target): 4 hours or less (if required)

• Time to Restore Service (Target): 8 business hours or less

• Time to Repair / Cleanup (Target): 24 business hours or less

• In-Progress Updates: Every 2 hours or less

Medium Priority Incidents (Non-Service Affecting Issues)

• Initial Response (Target): 4 business hours or less

• Time to Restore / Repair (Target): 24 business hours or less

Low Priority Incidents (Informational, Minor Issues)

• Initial Response (Target): 8 business hours or less

• Time to Restore / Repair (Target): 5 business days or less

Bidders must provide their own response, restore, and repair targets by priority and indicate alignment with these suggested values in Appendix C.4.2.

4.4 Mean Time to Restore (MTTR) and Mean Time to Repair

CMSD’s MTTR expectations are also treated as suggested targets. Bidders must document their commitments in Appendix C.4.1.

• Mean Time to Restore (MTTR-restore) - Critical Incidents: Target of 4 hours or less (averaged quarterly)

• Mean Time to Repair (MTTR-repair) - Critical Incidents: Target of 8 hours or less (averaged quarterly)

• MTTR-restore - High Priority Incidents: Target of 8 business hours or less (averaged quarterly)

• MTTR-repair - High Priority Incidents: Target of 24 business hours or less (averaged quarterly)

4.5 Performance Requirements

CMSD considers the following as suggested performance thresholds for WAN services. Bidders must state their standard performance SLAs and indicate alignment in Appendix C.4.3.

• Latency: Average round-trip latency between any site and Central Communications Termination Area shall not exceed 20ms under normal operating conditions

• Packet Loss: Packet loss shall not exceed 0.1% measured monthly

• Jitter: Jitter shall not exceed 5ms measured monthly

Proposals with weaker performance standards must provide justification and risk mitigation; this will be considered under the Service Level Commitments evaluation criterion.

5. SERVICE CREDITS AND REMEDIES

5.1 Service Credit Framework

CMSD expects a performance-based service credit framework tied to SLA outcomes. The specific percentages and thresholds below are CMSD’s suggested values and are also presented for bidder completion in Appendix C.5 and C.6.

Service levels will be measured monthly and reported regarding compliance of meeting each respective SLA as listed in sections 5.2, 5.3, 5.4 and 5.5.

Credit to CMSD will be calculated when SLAs are not met for the respective month.

The awarded vendor, for meeting monthly SLA performance, will receive a ‘reward’ of equal percentage for each SLA to be applied against SLA credits, if they occur during the fiscal year.

Any amounts at-risk (the difference between credits and rebates) will be subject to a “True Up” referring to the process of reconciling and adjusting payments based on actual performance data each June before the close of the fiscal year and June invoice is submitted to CMSD. Any ‘rewards’ remaining at the end of the fiscal year will be forgone.

Key principles:

• Service credits are calculated as a percentage of the monthly recurring charges (MRC) for affected services or sites.

• Vendor is expected to proactively calculate and present credits due based on SLA performance (see Section 5.6).

• Final credit structure will be established based on the selected bidder’s responses in Appendix C and subsequent contract negotiations.

5.2 Minimum Availability Service Credits

CMSD’s suggested availability credit structure is:

Monthly Uptime Achieved CMSD Minimum Service Credit on Affected Site(s) MRC 99.99% or higher 0% (SLA met, no credit) 99.90% to 99.989% 5% of monthly charges for affected site(s) 99.00% to 99.899% 10% of monthly charges for affected site(s) 96.00% to 98.999% 25% of monthly charges for affected site(s) Below 96.00% 50% of monthly charges for affected site(s)

Bidders must provide their proposed availability credit percentages for each uptime band in Appendix C.5.1 and indicate whether they meet or exceed these suggested values.

5.3 Minimum Response and Restore Time Service Credits

Critical Incident Response Failures

CMSD suggests the following credits when Critical incident targets are missed:

Response Metric CMSD Minimum Target CMSD Minimum Service Credit (per affected site) Initial Response ≤ 30 minutes 5% of monthly charges for affected site(s) On-Site Response

≤ 2 hours 10% of monthly charges for affected site(s)

Time to Restore ≤ 4 hours 15% of monthly charges for affected site(s)

High Priority Incident Response Failures Response Metric CMSD Minimum Target CMSD Minimum Service Credit (per affected site) Initial Response ≤ 1 hour 3% of monthly charges for affected site(s) Time to Restore ≤ 8 business hours 10% of monthly charges for affected site(s)

Bidders must specify their proposed credits for each metric in Appendix C.5.2 (Critical) and C.5.3 (High) and clarify any deviations from CMSD’s suggested values.

5.4 Minimum Performance Service Credits

CMSD suggests credits when performance thresholds in Section 4.5 are breached in a given month:

Performance Metric Breach Condition (Monthly)

CMSD Minimum Service Credit (per affected site)

Packet Loss Exceeds 0.1% average 5% of monthly charges for affected site(s) Latency Exceeds 20ms average 5% of monthly charges for affected site(s) Jitter Exceeds 5ms average 5% of monthly charges for affected site(s)

Bidders must propose their own performance credit structure in Appendix C.5.4, indicating whether they meet or exceed CMSD’s suggested values.

5.5 Patch Compliance Credits (All Patching Activities)

CMSD expects patching commitments to align with the timelines described in Section 2.4 and Appendix C.2. The credit model below is a suggested structure for missed patch SLAs across all WAN equipment patching (OS, firmware, security, feature updates).

Patch Category CMSD Minimum Timeline Target CMSD Minimum Service Credit (District‑Wide)

Critical/High impact patches (CVE)

Within 7 calendar days 10% of total monthly charges district‑wide

Medium/Low impact patches (CVE)

Within 21 calendar days 5% of total monthly charges district‑wide

Zero‑day / Actively exploited issues

As soon as fix/mitigation is available

25% of total monthly charges district‑wide

Bidders must provide their proposed credit percentages for each patch category in Appendix C.5.5 and describe any conditions or exclusions.

5.6 Service Credit Caps and Procedures

Credit Caps

CMSD’s position on maximum credits is:

• Per-Site Monthly Credit Cap: 100% of that site’s monthly recurring charges.

• District-Wide Monthly Credit Cap: 100% of total district monthly recurring charges.

Bidders must confirm acceptance or propose alternatives in Appendix C.6.1.

Credit Identification and Request Process

CMSD expects the vendor to:

• Proactively monitor SLA performance and identify any breaches that trigger service credits.

• Reflect all SLA failures and corresponding credits due in monthly reports and within the portal, without requiring CMSD to initiate each request.

• Support CMSD’s right to audit SLA metrics, calculations, and credits at any time.

• Provide retroactive credits if CMSD identifies an unreported SLA breach that should have incurred a credit (CMSD suggests up to 12 months lookback).

Bidders should describe any differences from this process in Appendix C.6.1 Notes/Comments.

Chronic Service Failure Handling

CMSD’s suggested definition and remedy for chronic service failure:

• Trigger Condition: Any site experiences SLA failures that result in credits in three (3) separate months within any rolling six (6) month period.

• Remedy: CMSD may, at its sole discretion, designate such failures as chronic and terminate services for cause for the affected site(s) and/or the entire contract, without requiring an intermediate corrective action plan period.

Bidders must indicate in Appendix C.6.2 whether they accept this suggested chronic failure definition and remedy or propose an alternative approach.

6. IMPLEMENTATION PLANNING

6.1 Implementation Timeline Requirements

Vendors must provide a detailed implementation timeline including:

Phase 1: Pre-Implementation Planning (Estimated Duration: 60-90 days)

• Contract execution and kickoff meeting

• Detailed site surveys of all CMSD locations

• Network design documentation and approval

• Equipment procurement and staging

• OARNet coordination and cross-connect arrangements

• Building access coordination and scheduling

• Staff training plan development

Phase 2: Pilot Implementation (Estimated Duration: 30-45 days)

• Implementation at designated pilot sites (3-5 sites)

• Testing and validation of services

• Performance baseline establishment

• Issue identification and resolution

• Documentation refinement

• Staff Training (as-needed)

• Cutover to new services

• Decommission old services

Phase 3: Full Rollout (Estimated Duration: 90-180 days)

• Phased implementation across all CMSD sites

• Weekly rollout schedule with defined site groupings

• Testing and acceptance for each site being rolled out

• Parallel operation period (if applicable)

• Cutover procedures for each site

• Old equipment decommissioning

Phase 4: Project Closeout (Estimated Duration: 30 days)

• Final testing and acceptance

• As-built documentation delivery

• Staff training completion

• Warranty period commencement

• Transition to ongoing operations

6.2 Implementation Deliverables

Vendors must provide the following deliverables as part of Phase 1 and maintained throughout implementation:

Planning Deliverables:

• Detailed project plan with milestones and dependencies

• Risk assessment and mitigation plan

• Communication plan and escalation procedures

• Site-by-site implementation schedule

• Network architecture diagrams (logical and physical)

Technical Deliverables:

• Complete site survey reports

• Equipment lists with serial numbers and locations

• Fiber infrastructure maps and documentation

• Configuration documentation for all equipment

• IP addressing and VLAN schemes (if applicable)

• As-built documentation upon completion

Testing and Acceptance:

• Test plans for pilot and production rollout

• Performance baseline measurements

• User Acceptance Testing (UAT) procedures

• Cutover runbooks for each site

• Rollback procedures

Training and Knowledge Transfer:

• Use of the vendor’s web-based portal to:

– View real-time and historical performance metrics.

– Open, track, and escalate incidents and service requests.

– Initiate and track approved changes.

– Access documentation and topology diagrams.

– Review SLA performance and credits.

• CMSD administrative onboarding for portal user management and roles.

• High-level overview of WAN architecture sufficient for CMSD to interpret health and performance data.

6.3 Implementation Constraints and Considerations

School Calendar Constraints:

• Minimize disruption during instructional hours

• Coordinate major implementations during school breaks when possible

• Summer break (June-August) preferred for intensive implementation activities

• Avoid implementation during state testing windows

Existing Service Continuity:

• Current services must remain operational until new services are fully tested and accepted

• Parallel operation period required before final cutover

• Rollback capability required for each site implementation

• Maximum acceptable downtime per site during cutover: 4 hours

• All site-specific work while school is in session must accommodate school being back up by

6:30 AM the next day

• For each site (and the Central Communications Termination Area), vendor must assess and document space, power, and cooling requirements needed to support concurrent operation of legacy and new services during phased cutover.

Central Communications Termination Area:

• Implementation must accommodate existing equipment and space constraints at 1111 Superior

• Vendor must assess space, power, and cooling requirements

• Coordination with building management required

• Solution must be designed with future relocation in mind

Coordination Requirements:

• Weekly implementation status meetings with CMSD Department of Information Technology

• 48-hour notification before site-specific work

• Building principal notification and approval for each site

• Coordination with CMSD Facilities and Custodial staff

• OARNet coordination for cross-connect activities

6.4 Acceptance Criteria

CMSD will consider the implementation complete when:

• All sites are operational with new WAN services

• 30-day burn-in period completed for each site without Critical incidents

• All SLAs are being met consistently

• All documentation has been delivered and approved

• Staff training has been completed

• Existing equipment has been properly decommissioned after burn-in period

• Final project report has been delivered and accepted

7. ONGOING OPERATIONS

7.1 Service Delivery Model

Network Operations Center (NOC)

Vendor must maintain a 24/7/365 Network Operations Center with:

• Continuous monitoring of all CMSD WAN infrastructure

• Proactive alerting and incident response

• Direct contact information provided to CMSD IT staff

• Escalation procedures for Critical incidents

• U.S.-based NOC staff (primary contact)

Security Operations Center (SOC)

In addition to the NOC, vendor must provide Security Operations Center (SOC) capabilities (either as an internal function or via a qualified partner) responsible for:

• 24/7/365 security monitoring of WAN-related devices, logs, and alerts.

• Correlation of security events across WAN infrastructure and relevant systems.

• Triage, escalation, and coordination of security incidents affecting WAN services.

• Integration with CMSD’s Information Security and SIEM platforms, where applicable.

• Participation in security incident response, including root cause analysis and remediation recommendations.

Vendor must describe whether NOC and SOC functions are combined or separate and how responsibilities are divided and coordinated.

Technical Support Structure

Vendor must provide:

• Tier 1 Support: Initial incident response, triage, and basic troubleshooting

• Tier 2 Support: Advanced troubleshooting and resolution

• Tier 3 Support: Engineering-level support and complex issue resolution

• Escalation Path: Clear escalation procedures with defined timeframes

• Emergency Contacts: 24/7 emergency contact numbers for Critical incidents

Service Desk

Vendor must provide:

• Toll-free phone number for CMSD staff to report issues.

• A web-based portal that is available 24/7/365 to:

– Submit and track incidents, service requests, and change requests.

– View current status of all circuits and equipment.

– Display near real-time performance metrics (latency, loss, jitter, utilization).

– Visualize historical performance and SLA compliance.

– Access documentation, diagrams, and inventories.

– View planned maintenance and change calendars.

• Email support for non-urgent issues.

• Automated ticket updates and notifications.

• Mobile-friendly access (via responsive web or app) is preferred.

7.2 Routine Monitoring and Reporting

Real-Time Monitoring

Vendor must monitor the following metrics in real-time:

• Circuit availability and status

• Bandwidth utilization per site

• Latency, jitter, and packet loss

• Router CPU and memory utilization

• Interface errors and discards

• Environmental alarms (temperature, power)

These metrics must be continuously monitored by the vendor for SLA compliance and performance, and must also be exposed to CMSD in near real-time via the web portal, with the ability to drill down by site, circuit, and time period, and to export both current and historical data (minutes, hourly, daily, weekly, monthly) for independent analysis.

Monthly Reporting Requirements

Vendor must provide monthly service reports including:

• Executive Summary: High-level service overview and key metrics

• Availability Report: Uptime statistics per site and district-wide

• Performance Metrics: Latency, packet loss, jitter measurements

• Incident Summary: All incidents, root causes, and resolutions

• SLA Compliance: Demonstration of SLA achievement or credits owed

• Bandwidth Utilization: Peak and average utilization per site

• Maintenance Activities: Summary of planned and emergency maintenance

• Security Updates: Firmware/software updates applied during the period

• Cybersecurity Posture: Summary of security events, vulnerabilities, and remediation

• Infrastructure Status: Equipment health, capacity status, upcoming maintenance

Report Delivery:

• Due at scheduled monthly Operational Status meeting or within 10 business days of month end

• Delivered via web portal and email

• Available in PDF and raw data formats (CSV/Excel)

• May be available as standard reports within the web portal for ease of access.

Quarterly Business Reviews (QBRs) & Strategic Planning

Vendor must participate in quarterly business review meetings with CMSD:

• Review of service performance and trends

• Discussion of incidents and improvement opportunities

• Capacity planning and forecasting

• Technology roadmap updates

• Contract and financial review

• Upcoming projects and initiatives

7.3 Proactive Maintenance and Optimization

Preventive Maintenance

Vendor must perform routine preventive maintenance including:

• Firmware and software updates per defined schedules

• Configuration backups and audits

• Capacity trend analysis and planning

• Equipment health checks

• Optical power level monitoring and adjustments

Performance Optimization

Vendor should continuously optimize network performance:

• QoS tuning and adjustments

• Routing optimization

• Traffic engineering (if applicable)

• Bandwidth recommendation based on utilization trends

Capacity Planning

Vendor must provide annual capacity planning assessments:

• Current utilization trends

• Projected growth based on historical data

• Recommendations for bandwidth increases

• Timeline and costs for recommended upgrades

Capacity planning inputs and historical trend data should be available and exportable through the web portal.

7.4 Security Monitoring and Compliance

Security Monitoring

Vendor must monitor for and respond to:

• Unusual traffic patterns or potential DDoS attacks

• Unauthorized access attempts

• Configuration changes (authorized and unauthorized)

• Security vulnerabilities in equipment and software

• Alerts from intrusion detection/prevention systems

Vulnerability Management

• Continuous monitoring of vendor security bulletins and CVE databases

• Assessment of vulnerabilities affecting CMSD infrastructure

• Patch management per defined timelines (Section 2.4 and Appendix C)

• Coordination with CMSD Information Security team

• Incident response for actively exploited vulnerabilities

Compliance Reporting

Vendor must provide documentation supporting CMSD’s compliance obligations:

• FERPA (Family Educational Rights and Privacy Act) compliance

• Ohio Department of Education technology requirements

• Audit trail and evidence for compliance audits

• Regular security posture assessments

7.5 Documentation Maintenance

Vendor must maintain current documentation including:

• Network diagrams (logical and physical)

• Equipment inventory with locations and serial numbers

• Configuration documentation

• Change history and logs

• Standard operating procedures

• Contact lists and escalation matrices

• Security configuration baseline documentation

Update Requirements:

• Documentation should be updated as part of any changes

• Annual comprehensive documentation review and update

• Access provided to CMSD via secure web portal

• Version control maintained

• Access to current documentation must be available through the vendor web portal.

• Historical versions and revision history should be retained and accessible for audit and troubleshooting purposes (for example, the last 12-24 months).

8. VENDOR MANAGEMENT AND ITSM INTEGRATION

8.1 Contract Management

Primary Contacts

Vendor must designate:

• Account Manager: Primary business relationship owner

• Technical Account Manager (TAM): Primary technical contact

• Project Manager: Dedicated resource for implementation phase

• NOC Manager: Point of contact for operational issues

Contact Requirements:

• Contact information within 5 business days of contract execution

• Changes to contacts communicated 30 days in advance, where possible

• Backup contacts designated for each role

Regular Meeting Cadence (Post Implementation)

• Quarterly Business Reviews: Strategic review of service delivery and planning

• Monthly Operations Meetings: Review open issues, upcoming maintenance, performance

• (Bi)Weekly Meetings: Cover work progress and emerging issues during implementation

• Ad-Hoc Meetings: As needed for projects or urgent matters

8.2 Performance Management

Key Performance Indicators (KPIs)

CMSD will track vendor performance using:

• Network availability percentage (per site and district-wide)

• Mean Time to Respond (MTTR) for all incident priorities

• Mean Time to Restore and Repair by priority

• SLA compliance rate

• Incident volume and trends

• Customer satisfaction (measured through CMSD surveys)

• Security patch compliance

• Change success rate

• Documentation accuracy and currency

Vendor must:

• Provide KPI dashboards and underlying data through the portal.

• Document the exact calculation methods used for each KPI.

• Allow CMSD to verify and audit KPI calculations and underlying raw data.

Performance Improvement Plans

If vendor performance falls below expectations:

• CMSD may require a Performance Improvement Plan within 15 business days.

• Plan must include corrective actions, timelines, success metrics, and root cause analyses;

relevant RCA reports that exist should be included where appropriate.

• Continued performance issues may result in contract termination for cause.

8.3 Change Management

Request for Change (RFC) Process

All non-emergency changes must follow CMSD’s change management process:

Change Categories:

• Standard Changes: Pre-approved, low-risk changes

• Normal Changes: Changes requiring review and approval

• Emergency Changes: Urgent changes required to restore service

Change Submission Requirements:

• 7 business days advance notice for Normal Changes

• 72 hours advance notice for emergency maintenance

• 48-hour notification for Standard Changes

• Emergency Changes may proceed immediately with notification

8.4 Incident and Problem Management

Incident Management Process All service-affecting issues must be managed through:

• Incident detection (by vendor monitoring or CMSD report)

• Email or SMS notification to CMSD for Critical incidents

• Assignment to appropriate technical resources

• Troubleshooting and resolution

• Root cause analysis

• Incident closure with documentation

Problem Management Process

For recurring or significant incidents, vendor must implement a formal Problem Management process that includes:

• Problem Identification: Creating a Problem Record for the underlying cause of one or more related incidents.

• Root Cause Analysis (RCA): Investigating incidents to identify the underlying error or root cause.

• Problem Resolution: Developing and implementing a permanent fix for the root cause.

• Workaround Management: Creating and documenting temporary solutions (“workarounds”) that mitigate impact when a permanent fix is not yet available.

• Known Error Management: Documenting problems once the root cause and a workaround are known, and making this information available through the portal.

• Proactive Prevention: Analyzing trends in incident records to proactively prevent future problems from occurring.

Problem records and RCA documentation should be viewable and exportable by CMSD via the portal.

8.5 Contract Modifications and Site Flexibility

• Changes to scope, services, or pricing must be documented through formal change orders

• No contractual changes that have not been approved through a change order may be added to a contract extension

• Sites may be added or removed during the contract term with a minimum of 30 days disconnection notice

• Pricing for any added sites or services must match the bid pricing for services

• Removed sites will cease billing effective the month following service disconnection

• Change orders for site additions/removals require approval by CMSD IT Strategy Execution &

Governance

• No work shall commence on out-of-scope items without an approved change order

9. EVALUATION CRITERIA AND WEIGHTING (100 POINTS TOTAL)

9.1 Evaluation Criteria

Evaluation Category Points Description

Cost 25 Total cost of ownership including implementation and ongoing costs

Technical Solution 20 Quality and suitability of proposed technical solution

Service Level Commitments

20 Quality of proposed SLAs and vendor’s ability to meet them

Local Presence & Impact 15 Ohio/Cleveland presence, local staffing, and use of local subcontractors

Implementation Plan 10 Feasibility and quality of implementation approach

Vendor Qualifications 10 Vendor experience, financial stability, and relevant project history

Total | 100

9.2 Cost (25 points)

Evaluation Sub-Criteria:

• Monthly Recurring Costs (13 points) Competitiveness, transparency, and simplicity of recurring pricing (per-site rates, bandwidth tiers, optional services).

• Implementation Costs (7 points) One-time fees including construction, site surveys, engineering, equipment turn-up, and cutover support.

• Total Cost of Ownership (5 points) 5-year cost projection, predictability (price protections, caps/escalators), and budget stability for CMSD.

9.3 Technical Solution (20 points)

Evaluation Sub-Criteria:

• Network Architecture (8 points) Solution design quality (hub-and-spoke, ring, mesh, etc.), resiliency, scalability, and alignment with CMSD’s redundancy and growth needs.

• Equipment and Technology (5 points) Use of current-generation platforms, lifecycle management (EOS/LDoS handling), high availability options, and conformance with CMSD standards (e.g., Cisco).

• Technical Requirements Compliance (5 points) Degree to which the proposed solution meets or exceeds the minimum requirements in Section 2 (fiber to every site, bandwidth, optics, segmentation, cybersecurity, DR/BCP).

• Security and Value-Added Capabilities (2 points) Strength of integrated security controls (MFA, logging, segmentation, monitoring) and value-added functions (SD-WAN, advanced analytics, richer portal features) that materially improve CMSD’s operational posture.

9.4 Service Level Commitments (20 points)

Evaluation Sub-Criteria:

• SLA Quality (12 points) Robustness of uptime commitments (including four-nines availability), response/restore/repair times across incident priorities, MTTR targets, and performance metrics (latency, packet loss, jitter).

• Service Credit Structure (5 points) Fairness, adequacy, and clarity of the service credit model relative to CMSD’s suggested minimums, including treatment of patching compliance credits and chronic failure conditions.

• SLA Performance Track Record (3 points) Evidence of consistently meeting or exceeding SLAs in similar K-12 or public-sector environments, including documented historical SLA reports and customer feedback.

9.5 Local Presence & Economic Impact (15 points)

Evaluation Sub-Criteria:

• Ohio/Cleveland Presence (5 points) Strength of local footprint: existence and size of offices, number and roles of staff based in Northeast Ohio, and…