RFP-21435

WIDE AREA NETWORK (WAN) COMMUNICATION SERVICES

Cleveland Metropolitan School District

1111 Superior Ave E

Cleveland, OH 44114

RELEASE DATE: January 20, 2026

DEADLINE FOR QUESTIONS: February 3, 2026

RESPONSE DEADLINE: February 20, 2026, 1:00 pm

Cleveland Metropolitan School District

REQUEST FOR PROPOSAL

Wide Area Network (WAN) Communication Services

I. Introduction II. Proposal Submission & Format Requirements

III. Proposal Constraints IV. Evaluation Process V. Evaluation Criteria

VI. Award of Contract VII. Contract Term

VIII. Specifications IX. Submittals

Attachments:

A - WAN RFP Appendix A - All CMSD Sites Requiring WAN Services

B - WAN RFP Appendix B - Service Availability Questionnaire

C - WAN RFP Appendix C - SLA Patching and Lifecycle Target Template

D - WAN RFP Appendix D - Definitions and Acronyms

E - CMSD ERate Rider RFP - 122025

Request For Proposal #RFP-21435 Title: Wide Area Network (WAN) Communication Services

1. Introduction

1.1. Summary

The Cleveland Metropolitan School District (hereafter the “District) under RFP-21435 is seeking service providers to provide Wide Area Network (WAN) Communication Services

Cleveland Metropolitan School District (CMSD) seeks proposals from qualified vendors to provide comprehensive Wide Area Network (WAN) communication services. This RFP specifically addresses the communication distribution infrastructure, traditionally referred to as “WAN Services” by CMSD’s

Department of Information Technology.

1.2. Background

To facilitate submission and evaluation of bids, the following provides relevant background information, specifications, and instructions for service providers to submit their bid responses to this ITB. Service providers may submit a bid in response to the specifications below.

The scope of services includes:

• Diverse Access: For the purposes of this RFP, this means that data circuits will be provided via completely diverse service pathways whenever and wherever possible. The diverse pathways shall include the entire path from the carrier’s point of presence to the CMSD facility. They will use completely disparate pathways into and out of each CMSD facility, as required.

• Diverse Carriers: For the purposes of this RFP, will mean that multiple carrier-grade infrastructure providers will be utilized in all geographical areas where multiple carrier infrastructures are present and available at initial service activation, to facilitate the physical circuit(s) into each facility. As it relates to WAN services, two independent, carrier-grade providers will be utilized to deliver the and WAN service to all CMSD facilities, reducing the risk of service outages due to a single carrier’s service/infrastructure failure.

• Carrier Grade Network Infrastructure: Provide services utilizing a carrier-grade fiber network(s), with carrier-grade routing hardware and traffic prioritization to ensure dependable traffic handling that meets advertised SLA levels.

• Origin Point: Fiber aggregation router at the Central Communications Termination Area (currently located on the 14th floor of 1111 Superior Avenue, Cleveland, OH)

• Endpoint: Building-level router at each CMSD site

• Transmission Medium: Fiber infrastructure between origin and endpoint

• Equipment: All routing equipment, optics, and necessary hardware for WAN connectivity

Services explicitly OUT of scope:

• Internet Service Provider (ISP) / Direct Internet Access (DIA) services

• Local Area Network (LAN) equipment or services at individual sites

• End-user devices or desktop support services

• Primary ISP services (OARNet and Zayo) which are managed separately

1.3. Contact Information

Seletha Thompson

Purchasing Analyst

1111 Superior Avenue E, Suite 1800

Cleveland, OH 44114

Email: seletha.thompson@clevelandmetroschools.org

Phone: (216) 838-0418

Department:

Division Of Information Technology

1.4. Timeline

*The dates listed are subject to change at the discretion of the District. Service Providers will be notified of changes to the schedule, as appropriate.

RFP Posted January 20, 2026

Pre-Proposal Meeting (Non-Mandatory) January 27, 2026, 2:00pm

Via Zoom https://clevelandmetroschools-org.zoom.us/j/89475562311

All final questions from service providers to the District

February 3, 2026, 2:00pm

Answers to service providers from the

District and all addenda issued (if necessary)

February 10, 2026, 3:00pm

RFP Responses Due February 20, 2026, 1:00pm

Service Provider(s) selection February 26, 2026

Contract Negotiation February 27, 2026

Contract Start July 1, 2026 mailto:seletha.thompson@clevelandmetroschools.org tel:(216)838-0418 https://clevelandmetroschools-org.zoom.us/j/89475562311

2. Proposal Submission & Format Requirements

2.1. Proposal Submission Requirements

A. In order for the District to evaluate proposals fairly and completely, service providers should follow the format set forth herein and provide all of the information requested. The District discourages costly bids.

B. All proposals shall include all proposal format requirements found below. All information requested in the district-related forms must be submitted via Submittals, or the proposal may be considered non-responsive.

C. Proposals are due at the School District’s e-Procurement Portal on or before 1:00 pm current local time on Friday, February 20, 2026. Proposals must be electronically submitted via School

District’s e-Procurement Portal. Proposals will not be accepted via mail or hand delivery. All materials and proposals submitted should be considered as is.

D. All written questions shall be directed to the School District’s e-Procurement Portal’s Question and Answer feature. Written questions will be accepted until 2:00 pm on Tuesday, February 3, 2026. Under no circumstances should any firm interested in providing the services identified in the RFP, their designees, or anyone affiliated with their firm, contact any other District employee or official during the RFP process, in an attempt to lobby or influence the selection of a service provider pursuant to this RFP.

E. The District reserves the right to reject any and all proposals, to waive any and all informalities or irregularities, and to disregard all non-conforming responsive conditional proposals. Each

Proposer is liable for all proposal errors or omissions. A proposer shall not be permitted to alter or amend any proposal documents after the Proposal deadline time and date detailed in the RFP unless such is formally requested, in writing, by the District.

F. Proposals must remain open and valid for ninety (90) days from the opening date unless the time for awarding the contract is extended by mutual consent of the District and service provider. Service providers may withdraw their proposals any time before the proposal opening date by clicking on "Unsubmit Proposal" on their Proposal Submission on OpenGov Procurement before the time and date set for the proposal opening.

2.2. Pre-Proposal Meeting

There will be a Pre-Proposal Meeting at 2:00 pm on Tuesday, January 27, 2026. The meeting will be held

Via Zoom. The Zoom link is as follows:

https://clevelandmetroschools-org.zoom.us/j/89475562311

Service providers are encouraged to submit questions prior to the Pre-Proposal Meeting so that they may be addressed.

https://procurement.opengov.com/portal/clevelandmetroschools/projects/225632/document?section=undefined https://procurement.opengov.com/portal/clevelandmetroschools/projects/225632 https://procurement.opengov.com/portal/clevelandmetroschools/projects/225632 https://procurement.opengov.com/portal/clevelandmetroschools/projects/225632

2.3. Proposal Format Requirements

A. The Wide Area Network (WAN) Communication Services specifications for RFP-21435 is described in Specifications Section. Service Providers are required to provide the information below as well as complete the District Related Forms in Submittals section. The narrative part of the proposals must present the following information, be organized with the following headings, and respond to the requested information and questions presented in the RFP scope of work. For evaluation purposes, each heading should be clearly marked in the proposal response.

B. Proposal responses are to be divided into sections as follows:

1. Transmittal Cover Letter: Prepare a letter transmitting the proposal on business letterhead.

The letter should identify the business name, phone number, and business web address along with the name, phone number and email address of the key contact person. The letter must have the signature of a person with authority to obligate the business. The transmittal letter shall also contain a statement that the proposal is a firm offer for a ninety (90) day period.

2. General Information Section

a. Executive Summary: Information about the service provider’s history, structure, organizational metrics, and qualifications for fulfilling the District’s requirements

b. Business Health: information about the service provider’s financial structure and viability, particularly as it relates to fulfilling a multiple-year agreement.

c. Experience: information about the service provider’s current and previous contracts, particularly those with organizations similar to the District.

d. General Narratives about at least three clients using services similar to those being proposed for the District.

e. Management support services: information about staff, project, issue, performance, quality, and risk management methodology.

f. Security: information about the service provider’s policies, practices, and standards for maintaining the confidentiality and integrity of clients’ data, intellectual property, and trade secrets.

g. Risks: service provider’s evaluation of the greatest challenges and risks associated with the particular services and suggestions for mitigating risk.

h. Dispute resolution: information about the service provider’s standard dispute resolution methodologies.

https://procurement.opengov.com/portal/clevelandmetroschools/projects/225632/document?section=2129541 https://procurement.opengov.com/portal/clevelandmetroschools/projects/225632/document?section=undefined

3. Response to Scope of Work Section: The Response to Scope of Work Section of the proposal shall specifically address the manner in which the proposer will meet scope and requirements described in the Scope of Work & Requirements Section of Specifications. The proposal shall provide enough information so that the evaluators will be able to determine the proposer’s ability to meet the scope of work, requirements, and minimum qualifications. Simply paraphrasing the RFP statement of requirements will not be sufficient data for the evaluation and may be considered as a non-responsive proposal response.

4. Cost proposal

5. Completed District Related Forms set forth in Submittals of this RFP.

https://procurement.opengov.com/portal/clevelandmetroschools/projects/225632/document?section=2129541 https://procurement.opengov.com/portal/clevelandmetroschools/projects/225632/document?section=undefined

3. Proposal Constraints

A. The service provider must comply with all laws, rules and regulations dictated by the Board of

Education of the Cleveland Metropolitan School District, City of Cleveland, the State of Ohio and the United States Federal Government.

B. Purchases funded by federal grant funds must adhere to regulations found in Uniform Guidance

“Super Circular”, 2 CFR 200 (UGG), as a condition of receiving funds and to meet annual audit compliance. In an effort to keep policy for all grants consistent, the District implemented the new federal guidelines regarding procurement utilized with federal grants immediately.

C. The District will only accept proposals that cover all of the major components requested in the

RFP.

D. Service provider shall not include Ohio Sales Tax in the price quoted. The District will provide tax exempt certificate to the successful Proposer.

E. Service provider’s personnel and subcontractors on the District site will be required to meet security requirements. Service provider agrees to successfully complete background checks on all of its employees, agents and subcontracts, if necessary, who provide services on site under this scope of work. Each person on site must wear an identification badge that clearly identifies and makes visible the person’s name and company.

F. The successful Service provider and their subcontractor(s), including organizations having personnel, equipment and vehicles on District property, shall provide evidence of insurance as follows:Commercial General LiabilityIncluding limited contractual liability$1,000,000.00 Limit of

Liability(Per occurrence)Automobile LiabilityIncluding non-owned and hired $1,000,000.00 Limit of Liability(Per occurrence)Worker’s CompensationWorker’s compensation and employer’s insurance to full extent required by applicable law

G. This requirement must be fulfilled by the successful service provider providing the District with a current Certificate of Insurance (standard ACORD form), showing the Board of Education of the

Cleveland Municipal School District as an additional insured (Certificate Holder does not constitute being an additional insured), within five(5) days of Notice of Intent to Award

Agreement. The certificates of insurance shall contain a provision that the policy or policies shall not be cancelled without thirty (30) days’ prior written notice to the District.

H. The required insurance must be provided by a company licensed by the State of Ohio, which company must be financially acceptable to the Administration of the Cleveland Municipal School

District

I. In submitting a proposal, service providers agree, unless specifically authorized in writing by an authorized representative of the District on a case-by-case basis, that it shall have no right to use, and shall not use, the name of Cleveland Metropolitan School District, its officials or employees, in any advertising, publicity, promotion, nor to express or imply any endorsement of service provider’s services.

J. The District has a Diversity Business Enterprise and Affirmative Action Program in effect.

Information about this program is set forth at https://bit.ly/3wvVApK.Forms related to this program are set forth in Submittals. Service providers submitting a proposal must complete the appropriate forms and submit same with their proposal.

https://bit.ly/3wvVApK https://procurement.opengov.com/portal/clevelandmetroschools/projects/225632/document?section=undefined

4. Evaluation Process

Evaluations are based on the submitted proposal. Follow-up discussions with the proposer’s best suited to complete the work may be requested. The District reserves the right to interview or to seek additional information related to criteria already specified in the RFP after opening the proposals and prior to entering into a contract, to reject any or all proposals, and to award a contract to one or multiple service providers as the District deems necessary. The District also reserves the right to check references identified by any proposer from any service provider that submitted a proposal. The evaluation process is designed to identify the service provider that is the “best value,” which is the best combination of attributes based upon the evaluation criteria, not necessarily to the service provider with the lowest cost.

4.1. Responsiveness

Proposals will be evaluated, first, as responsive or non-responsive to the RFP’s instructions. A preliminary review will be conducted of all proposals submitted on time to ensure the proposal adheres to the material submission requirements specified in the RFP. Proposals that do not meet the material submission requirements may be deemed non-responsive and rejected. In the event that all proposers do not meet one or more of the submission requirements, the District reserves the right to continue the qualitative evaluation of the proposals and select proposal(s) which most closely meets the scope of work specified in the RFP. Proposal responses must include, or meet, the following submission requirements:

A. Timely Submission

B. Transmittal Cover Letter

C. General Information Section

D. Response to Scope of Work

E. Cost proposal

F. District Related Forms

4.2. Qualitative Evaluation Criteria

The proposals will next be evaluated based on the information presented in the proposal and on additional information obtained during the evaluation process. Responses will be evaluated based on the weighted criteria set forth in Evaluation Criteria.

https://procurement.opengov.com/portal/clevelandmetroschools/projects/225632/document?section=2129535

5. Evaluation Criteria

The proposals will next be evaluated based on the information presented in the proposal and on additional information obtained during the evaluation process. Responses will be evaluated based on the following weighted criteria:

5.1. Phase 1 - Responsiveness Check

No. Evaluation Criteria Scoring Method Weight (Points)

1. Respondent Submittals

Completion of #1 in the Submittals section with all the required information.

Pass / Fail 10 (11.1% of Total)

2. Name & Title of Authorized Signatory

The vendor provided the name and title of the authorized signatory.

Pass / Fail 10 (11.1% of Total)

3. Compliance Declaration and Non-Collusion

Statement Confirmed Pass / Fail 10

(11.1% of Total)

4. Completed Conflict of Interest Form Pass / Fail 10 (11.1% of Total)

5. Completed Proposal Qualification Form Pass / Fail 10 (11.1% of Total)

6. Certification Regarding Debarment, Suspension, and Other Responsibility Matters

Primary Covered Transactions Confirmed

Pass / Fail 10 (11.1% of Total)

7. References Provided Pass / Fail 10 (11.1% of Total)

8. Completed DBE Forms Pass / Fail 10 (11.1% of Total)

9. Completed EOA Contractual Declaration Pass / Fail 10 (11.1% of Total)

5.2. Phase 2 - Proposal Evaluation

No. Evaluation Criteria Scoring Method Weight (Points)

1. Cost

Total Cost of eligible services

Points Based 25 (25% of Total)

2. Technical Solution

Quality and suitability of proposed technical solution

Points Based 20 (20% of Total)

3. Service Level Commitments

Quality of proposed SLAs and vendor's ability to meet them

Points Based 20 (20% of Total)

4. Local Presence & Impact

Ohio/Cleveland presence, local staffing, and use of local subcontractors

Points Based 15 (15% of Total)

5. Implementation Plan

Feasibility and quality of implementation approach

Points Based 10 (10% of Total)

6. Vendor Qualifications

Vendor experience, financial stability, and relevant project history

Points Based 10 (10% of Total)

6. Award of Contract

A. The contents of the RFP, including all appendices and addenda thereto, and the commitments set forth in the proposals shall be considered contractual obligations. Failure to accept these obligations may result in cancellation of the award.

B. The contract award will not be final until the District and the selected Service Provider execute a mutually satisfactory contractual agreement.

C. The contract documents consist of the following:

1. District Contract

2. Response to Scope of Work

3. Cost Proposal

4. All Required District Related Forms in Submittals

5. All applicable addenda

D. The service provider shall perform all work described in the Contract Documents, including without limitation, all terms and conditions of the scope of work and specifications contained herein or otherwise stated in the Contract Documents reasonably inferable there from by the service provider as necessary to produce the results intended therein.

https://procurement.opengov.com/portal/clevelandmetroschools/projects/225632/document?section=undefined

7. Contract Term

The contract period for this RFP will be July 1, 2026 through June 30, 2029 with two (2) renewal options.

The first renewal option is from July 1, 2029 through June 30, 2030. The second renewal option is July 1, 2030 through June 30, 2031. These renewal options will be under the same terms and conditions as the initial contract and the following cost(s).

8. Specifications

8.1. Service Locations

Central Communications Termination Area

Current Location: 14th Floor, 1111 Superior Avenue, Cleveland, OH 44114

Important: The Central Communications Termination Area will be relocated at some point over the next few years. Vendors must demonstrate flexibility to support either the current location or transition to a new location during the contract period.

Alternative Locations under consideration include:

• H5 Building: 1625 Rockwell Avenue, Cleveland, OH 44114

• Sterling Building: 1255 Euclid Avenue, Cleveland, OH 44115

Requirement: All proposed solutions must accommodate CMSD’s primary ISP, OARNet, being able to provide Direct Internet Access (DIA) circuits at any chosen location. OARNet can cross-connect easily at both the Euclid Avenue and Rockwell Avenue locations.

Building-Level Sites

Vendors will provide WAN services to all CMSD buildings as specified in Appendix A. Each site requires fiber connectivity from the Central Communications Termination Area to the building-level router.

8.2. Current Infrastructure Context

Current Service Provider

WAN services are currently provided by ENA/Zayo (note: ENA was acquired by Zayo). The fiber infrastructure is owned and operated by Crown Castle Fiber (CCF), which is subcontracted by Zayo.

Crown Castle Fiber has been acquired by Zayo but the entities have not yet merged operationally.

Note: It is acceptable for vendors to subcontract fiber infrastructure services, provided all subcontractors meet the overall Service Level Agreements (SLAs) defined in the master contract. The primary vendor remains responsible for all service delivery and SLA compliance.

Current Services Include

• Management of fiber aggregation router at Central Communications Termination Area

• Management of building-level routers at each CMSD site

• Dark fiber infrastructure between routers

• Optics and fiber uplink/downlink connections at the district handoff

• Current subscription: Dark Fiber at 1Gbps, burstable to 10Gbps

Current Equipment

• Central Communications Termination Area: Cisco ASR 9002 (owned and managed by current WAN service provider)

• Building-Level Sites: Cisco ASR 920 (owned and managed by current WAN service provider)

Important: CMSD does not own or manage the routing equipment. All routing equipment is owned and managed by the WAN service provider.

8.3. MINIMUM TECHNICAL REQUIREMENTS

Network Topology

CMSD does not mandate a specific network topology. The current implementation uses a hub-and-spoke model with dark fiber, but vendors may propose alternative topologies including:

• Hub-and-spoke configurations

• MPLS mesh networks

• Dual fiber ring topologies

• Other topologies that meet or exceed the technical and performance requirements

All proposed topologies must be clearly documented with network diagrams and justification for the design approach.

Transmission Medium Requirements

Fiber Requirements

• Primary Medium: Fiber optic connectivity is required to each CMSD site

• Fiber Type: Single-mode fiber

• Current Service: Dark fiber is currently used but is not a requirement for future services

• Alternative Technologies: While vendors may propose technologies other than dark fiber, fiber-based connectivity to each site remains mandatory

Circuit Diversity

• Current fiber infrastructure is not resilient at the site level (single circuit per site)

• CMSD buildings do not currently support diverse service entrances

• CMSD buildings can support diverse circuits entering through the same service entrance (strongly encouraged)

• Diversity Requirements (if diverse circuits are proposed):

o Circuits may be served from the same utility pole o Circuits must be truly diverse and not terminate to the same immediate upstream equipment or point of presence (POP) o Diverse paths should minimize common points of failure wherever technically feasible

Bandwidth Requirements

• Minimum Bandwidth: 1Gbps per site

• Burstable Capacity: 10Gbps per site (or higher)

• Scalability: Solution must support bandwidth increases without requiring complete infrastructure replacement

Equipment Requirements

Vendor Equipment Ownership

All routing equipment, including fiber aggregation routers and building-level routers, shall be owned and managed by the vendor. CMSD will not own or be responsible for maintaining this equipment.

Manufacturer Requirements

• Equipment Manufacturer & Models: All routers must be Cisco or equivalent models (cloud-managed or current generation preferred)

• End-of-Life Replacement: The current Cisco ASR 920 routers are past their Last Day of Support

(LDoS) and must be replaced with current-generation equipment

Equipment Lifecycle Management

Vendors must provide a comprehensive equipment lifecycle management plan that addresses:

1. End-of-Sale (EOS) and Last Day of Support (LDoS) Requirements:

• No devices on the CMSD network shall operate past their manufacturer-announced Last Day of

Support (LDoS)

• CMSD does not use third-party support arrangements that allow continued operation of devices after manufacturer support ends

• All devices must be eligible for manufacturer support throughout the contract term

• Vendor must proactively monitor manufacturer EOS/LDoS announcements and notify CMSD according to the timelines committed in Appendix C

2. Device Replacement Timeline:

• When a device model reaches End-of-Sale (EOS) announcement, vendor must develop and present a replacement plan

• All affected devices must be replaced before the Last Day of Support (LDoS) date arrives

• Replacements must occur with adequate time to avoid any service degradation

• Vendor must include projected replacement costs and timelines in the proposal for any equipment approaching EOS

• Vendor must complete Appendix C, Section C.1 (Lifecycle and Replacement Targets), indicating standard timelines for EOS notification and LDoS-based replacement activities

3. Firmware and Software Update Requirements:

CMSD’s target expectations for firmware and software updates are as follows; bidders must indicate in

Appendix C, Section C.2 whether they meet, exceed, or propose alternative timelines:

• Feature Updates: Applied on a regular cadence in accordance with manufacturer recommendations and vendor maintenance schedule

• Security Updates - High/Critical CVEs: Target of within 7 calendar days of vendor release

• Security Updates - Medium/Low CVEs: Target of within 21 calendar days of vendor release

• Zero-Day / Actively Exploited Vulnerabilities: Emergency maintenance targeted as soon as a patch or mitigation is available

Vendor must document in Appendix C, Section C.2:

• Standard timelines for each category of update

• Any exceptions or constraints

• Whether emergency change processes are available to meet zero-day targets

4. Lifecycle Management Plan (to be included in proposal):

• Current EOS/LDoS status of all proposed equipment

• Monitoring process for tracking manufacturer announcements

• Notification timeline for informing CMSD of upcoming EOS/LDoS dates

• Standard replacement procedures and timelines

• Financial model for handling mid-contract equipment refreshes

Optics Requirements

• Optics Type: Cisco (preferred) or equivalent Single-Mode Long Range (LR) SFP & fiber required

• Generic SFPs or DACs: Not acceptable

• Standards Compliance: All optics must meet or exceed industry standards for single-mode fiber transmission

Central Communications Termination Area Equipment

Option A: Direct Uplink to CMSD Communication Core If the vendor solution uplinks directly to CMSD’s communication core infrastructure:

• Uplink Configuration: 40G uplinks (direct or aggregation) to each of CMSD’s High Availability (HA) failover stacks (A & B Stack)

• Location: Central Communications Termination Area

• Resiliency: Uplinks must connect to CMSD’s resilient core switch infrastructure

Option B: Direct Cross-Connect to ISP(s) If the vendor solution cross-connects directly to Internet

Service Provider(s):

• CMSD core uplink requirement does not apply

• Vendor must clearly document interconnection architecture

• Cross-connect arrangements must be documented and maintained by vendor

Important: Depending on the solution provided, please comment on the uplink/cross-connect service diversity that is provided for high-availability/failover at the handoff from the proposed service to upstream connectivity.

High Availability and Resiliency Requirements

Fiber Aggregation Router (Central Communications Termination Area):

CMSD strongly prefers resilient designs at the aggregation layer. Rather than prescribing a single model

(e.g., mandatory HA pair or cold spare), bidders must clearly describe:

• The high availability / failover capabilities provided for the aggregation router(s)

• Whether design is active/active, active/standby, cold spare on-site, or other (describe)

• Any non-recurring and recurring costs associated with each resiliency option

• Expected failover behavior (automatic vs. manual) and expected failover times

CMSD will evaluate the robustness and cost-effectiveness of proposed HA designs as part of the

Technical Solution and SLA scoring. Bidders must document their design in Appendix C, Section C.3.

Building-Level Router (Individual Sites):

• Replacement Timeline: Same business day if replacement determination occurs prior to 12:00 PM noon EST and next business day by 7:00 AM EST otherwise

• High Availability (HA) failover is not required but is not prohibited

• Vendor must maintain adequate spare inventory to meet replacement timeline

• Vendor must document in Appendix C, Section C.3 the standard replacement model, spare strategy, and any optional per-site HA/failover offerings and associated costs

Cybersecurity Requirements

Vendors must incorporate, where applicable, the following cybersecurity controls into their solution design and operations. Solution should follow Zero Trust Architecture principals as best they can, including but not limited to:

Network Segmentation and Boundary Protection

• Design WAN to define and control network boundaries using firewalls and intrusion detection/prevention systems (IDPS)

• Protect network perimeter and internal segments through physical or logical segmentation

• Implement access control lists (ACLs) and firewall rules to restrict traffic between network segments

• Support isolation of management, user, and application traffic

• Implement device access controls based on CMSD-specified policies

• Provide network diagram showing all segmentation zones and boundary protection mechanisms

Administrative Access Security and Identity Management

• Multi-Factor Authentication (MFA): All remote and privileged access to WAN management systems must require MFA

• Endpoint Protection Requirements: Vendor must document and enforce security controls required on systems accessing WAN management interfaces:

o Current endpoint protection/antivirus software o Operating system and security patches current o Device authentication mechanisms (Windows/macOS domain authentication, MDM enrollment) o Firewall enabled on management workstations o Disk encryption where applicable

• Separation of Duties: Vendor must ensure no single person can authorize and implement a network change without independent review and approval

• Session Controls: Establish and enforce policies for:

o Session establishment (authentication, MFA) o Session duration limits o Concurrent session limits o Session termination procedures o Automatic logout on inactivity

Data Transmission Security and Cryptographic Protection

• Encryption Standards: Use strong encryption protocols (minimum TLS 1.2, preferred TLS 1.3) for all management traffic

• VPN Support: Ensure WAN infrastructure supports CMSD’s existing VPN solutions (IPsec, SSL VPN) without performance degradation

• End-to-End Encryption: Support end-to-end encryption for sensitive applications and data where required

• Denial-of-Service Protection: Incorporate protections against DDoS and service availability attacks:

o Rate limiting on WAN circuits o Traffic scrubbing or filtering capabilities o Coordination with ISP DDoS mitigation services o SLA guarantees for DDoS incident response

Security Monitoring, Logging, and Threat Intelligence

• Configuration Baselines: Establish and maintain secure configuration baseline for all WAN devices:

o Document approved configurations o Disable unnecessary services and ports o Enforce password complexity and account lockout policies o Restrict SNMP read/write community strings o Disable default accounts and credentials

• Audit Logging: All WAN devices must generate comprehensive audit logs of security-relevant events:

o Administrative access (login attempts, successful logins, logouts) o Configuration changes with before/after values o User actions and authentication events o Unauthorized access attempts o Security policy violations o Logs retained for minimum 90 days, preferred 1 year

• SIEM Integration: Vendor should utilize centralized Security Information and Event Management

(SIEM) tools to:

o Aggregate logs from all WAN devices o Normalize and parse log data o Generate alerts for suspicious activity o Enable correlation analysis across devices o Provide long-term log storage and analysis

• Intrusion Detection/Prevention: Vendor must deploy network intrusion detection/prevention systems (IDS/IPS) at WAN entry and exit points at the public edge:

o Detect known attack signatures o Block malicious traffic patterns o Alert on anomalous behavior o Provide forensic analysis capabilities

• Threat Intelligence Integration: Vendor must incorporate real-time threat monitoring tools to:

o Monitor threat feeds for emerging vulnerabilities o Identify indicators of compromise o Respond to active threats o Provide threat assessments and recommendations

Secure Device Configuration and Hardening

• Least Functionality: Restrict WAN devices and systems to only essential functions necessary to perform their duties:

o Disable unnecessary services and protocols o Remove default or unused credentials o Restrict network access through firewall rules

• Secure Boot: Configure secure boot mechanisms where available to prevent unauthorized firmware modifications

• Device Authentication: Implement device authentication mechanisms where supported:

o Cryptographic certificates for device identity o Mutual authentication between devices o Certificate pinning where applicable

• Configuration Backup and Recovery: Maintain regular backups of WAN device configurations with:

o Encrypted backup storage o Version control and change tracking o Rapid restoration capabilities o Testing of restoration procedures

Disaster Recovery and Business Continuity

• Resilience: Design WAN for high availability and quick recovery from attacks or outages

• Failover Mechanisms: Implement diverse circuits and uplinks and automatic failover mechanisms:

o Sub-second failover where technically feasible o Monitoring of failover mechanisms o Testing of failover procedures

• Incident Response Planning: Provide documented incident response procedures:

o Security breach response plan o DDoS response procedures o Configuration compromise response o Forensic preservation procedures o Incident communication plan

• Business Continuity Testing: Conduct and document regular testing of:

o Failover and recovery procedures o Backup restoration o Incident response procedures o Disaster recovery scenarios

Barebones Services for Closed or Vacant Buildings

For closed or vacant CMSD buildings, the Department of IT must continue to provide internet connectivity at significantly reduced capacity sufficient to support building systems, including (at minimum) HVAC controls, surveillance, and Emergency Communications Systems.

CMSD currently uses Spectrum Business-class asymmetrical internet services (nominally 1 Gbps downstream / 30 Mbps upstream) for this purpose. Offerors whose proposed WAN solution can cost-effectively scale down to provide similar low-capacity connectivity for closed or vacant sites shall clearly describe this capability in their proposal, including:

• Technical architecture and access method (e.g., fiber, coax, or other).

• Nominal downstream and upstream speeds and any usage limitations.

• Service limitations compared to full-production instructional sites (e.g., lack of resiliency options, reduced SLA targets, or fewer reporting features).

• Pricing model (per-site MRC and NRC) and how such barebones services would be ordered, modified, and disconnected over time as CMSD closes, repurposes, or reopens buildings.

8.4. MAINTENANCE AND CHANGE MANAGEMENT

Maintenance Windows

District-Wide Maintenance Window

For work that may impact multiple sites or district-wide services:

• Scheduled Window: Friday 6:00 PM through Sunday 11:59 PM

• Frequency: As needed, with advance notice to CMSD

• Notification: Minimum 7 calendar days advance notice for routine maintenance; 72 hours for urgent maintenance

Single-Site Maintenance Window

For work impacting only a single site:

• Scheduled Window: Daily, outside of instructional hours (generally 4:00 PM - 7:00 AM on school days)

• Coordination: Must be coordinated with the building principal

• Notification: Minimum 48 hours advance notice

Change Control Requirements

All work performed during maintenance windows must adhere to the following change control procedures:

• Change Documentation: All planned changes must be documented in writing and submitted to

CMSD for approval

• Rollback Plan: Every change must include an adequate rollback plan

• Testing Plan: Pre-maintenance testing procedures must be documented

• Rollback Timeline: Rollback procedures must be executable within the maintenance window

• Emergency Changes: Process for emergency changes outside maintenance windows must be documented

Building Access Coordination

For work requiring physical access to CMSD buildings:

• Coordination: Must be coordinated with CMSD Facilities and Custodial staff

• After-Hours Access: If custodial staff can provide after-hours building access, vendor personnel are expected to proceed with work

• Access Restrictions: If building access is unavailable until business hours, vendor repair crew must be able to be present when custodial staff confirms availability

• Security Requirements: All vendor personnel requiring building access must complete CMSD background check and security requirements

8.5. SERVICE LEVEL AGREEMENTS (SLAs)

Service Criticality Classification

Critical Service Classification

All fiber outages are classified as CRITICAL incidents:

• Fiber outages result in loss of phone services (digital voice over IP)

• Loss of phone services means emergency 911 services are unavailable

• Loss of emergency services may require school cancellation

• Loss of internet connectivity for digital learning environments may require school cancellation

• All fiber outages receive highest priority response

Uptime Requirements

CMSD’s suggested target for site-level availability is:

• Minimum Target – Site Availability: 99.99% uptime per site, per month.

• Measurement Period: Calendar month

• Exclusions: Planned maintenance during approved maintenance windows (with proper notice) is excluded from availability calculations.

Uptime Calculation:

Uptime % = ((Total Minutes in Month - Unplanned Downtime Minutes) / Total Minutes in Month) × 100

Bidders must indicate their committed monthly availability target in Appendix C.4.1, and state whether their commitment meets or exceeds CMSD’s suggested 99.99% target.

Response, Restore, and Repair Time Requirements

To clarify expectations, CMSD distinguishes between:

• Restore: Service restored to a functional state that meets SLA performance targets (latency, loss, jitter), even if a workaround is in place.

• Repair: Underlying fault fully corrected, temporary workarounds removed, documentation updated, and environment returned to steady state “hands-off” condition.

CMSD views the following as suggested target values for incident response, restore, and repair times.

Bidders must document their proposed SLAs in Appendix C.4.2 and indicate where they meet or exceed these suggested targets.

Critical Incidents (Fiber Outages, Complete Site Down)

• Initial Response (Target): 30 minutes or less from incident detection or notification

• On-Site Response (Target): 2 hours or less (if physical access is available)

• Time to Restore Service (Target): 4 hours or less

• Time to Repair / Cleanup (Target): 8 hours or less, or next maintenance window if mutually agreed

• In-Progress Updates: Every 30 minutes or less

• Work Schedule: 24/7/365 response and repair, with the following exception:

o If building access is required and custodial staff cannot provide immediate access, repair crew must be present when building access becomes available

High Priority Incidents (Degraded Performance, Partial Outage)

• Initial Response (Target): 1 hour or less

• On-Site Response (Target): 4 hours or less (if required)

• Time to Restore Service (Target): 8 business hours or less

• Time to Repair / Cleanup (Target): 24 business hours or less

• In-Progress Updates: Every 2 hours or less

Medium Priority Incidents (Non-Service Affecting Issues)

• Initial Response (Target): 4 business hours or less

• Time to Restore / Repair (Target): 24 business hours or less

Low Priority Incidents (Informational, Minor Issues)

• Initial Response (Target): 8 business hours or less

• Time to Restore / Repair (Target): 5 business days or less

Bidders must provide their own response, restore, and repair targets by priority and indicate alignment with these suggested values in Appendix C.4.2.

Mean Time to Restore (MTTR) and Mean Time to Repair

CMSD’s MTTR expectations are also treated as suggested targets. Bidders must document their commitments in Appendix C.4.1.

• Mean Time to Restore (MTTR-restore) - Critical Incidents: Target of 4 hours or less (averaged quarterly)

• Mean Time to Repair (MTTR-repair) - Critical Incidents: Target of 8 hours or less (averaged quarterly)

• MTTR-restore - High Priority Incidents: Target of 8 business hours or less (averaged quarterly)

• MTTR-repair - High Priority Incidents: Target of 24 business hours or less (averaged quarterly)

Performance Requirements

CMSD considers the following as suggested performance thresholds for WAN services. Bidders must state their standard performance SLAs and indicate alignment in Appendix C.4.3.

• Latency: Average round-trip latency between any site and Central Communications Termination Area shall not exceed 20ms under normal operating conditions

• Packet Loss: Packet loss shall not exceed 0.1% measured monthly

• Jitter: Jitter shall not exceed 5ms measured monthly

Proposals with weaker performance standards must provide justification and risk mitigation; this will be considered under the Service Level Commitments evaluation criterion.

8.6. SERVICE CREDITS AND REMEDIES

Service Credit Framework

CMSD expects a performance-based service credit framework tied to SLA outcomes. The specific percentages and thresholds below are CMSD’s suggested values and are also presented for bidder completion in Appendix C.5 and C.6.

Service levels will be measured monthly and reported regarding compliance of meeting each respective SLA as listed in sections 5.2, 5.3, 5.4 and 5.5.

Credit to CMSD will be calculated when SLAs are not met for the respective month.

The awarded vendor, for meeting monthly SLA performance, will receive a ‘reward’ of equal percentage for each SLA to be applied against SLA credits, if they occur during the fiscal year.

Any amounts at-risk (the difference between credits and rebates) will be subject to a “True Up” referring to the process of reconciling and adjusting payments based on actual performance data each June before the close of the fiscal year and June invoice is submitted to CMSD. Any ‘rewards’ remaining at the end of the fiscal year will be forgone.

Key principles:

• Service credits are calculated as a percentage of the monthly recurring charges (MRC) for affected services or sites.

• Vendor is expected to proactively calculate and present credits due based on SLA performance (see

Section 5.6).

• Final credit structure will be established based on the selected bidder’s responses in Appendix C and subsequent contract negotiations.

Minimum Availability Service Credits

CMSD’s suggested availability credit structure is:

Monthly Uptime Achieved CMSD Minimum Service Credit on Affected Site(s) MRC

99.99% or higher 0% (SLA met, no credit)

99.90% to 99.989% 5% of monthly charges for affected site(s)

99.00% to 99.899% 10% of monthly charges for affected site(s)

96.00% to 98.999% 25% of monthly charges for affected site(s)

Below 96.00% 50% of monthly charges for affected site(s)

Bidders must provide their proposed availability credit percentages for each uptime band in Appendix

C.5.1 and indicate whether they meet or exceed these suggested values.

Minimum Response and Restore Time Service Credits

Critical Incident Response Failures

CMSD suggests the following credits when Critical incident targets are missed:

Response Metric CMSD Minimum Target CMSD Minimum Service Credit (per affected site)

Initial Response ≤ 30 minutes 5% of monthly charges for affected site(s)

On-Site

Response

≤ 2 hours 10% of monthly charges for affected site(s)

Time to Restore ≤ 4 hours 15% of monthly charges for affected site(s)

High Priority Incident Response Failures

Response Metric CMSD Minimum Target CMSD Minimum Service Credit (per affected site)

Initial Response ≤ 1 hour 3% of monthly charges for affected site(s)

Time to Restore ≤ 8 business hours 10% of monthly charges for affected site(s)

Bidders must specify their proposed credits for each metric in Appendix C.5.2 (Critical) and C.5.3 (High) and clarify any deviations from CMSD’s suggested values.

Minimum Performance Service Credits

CMSD suggests credits when performance thresholds in Section 4.5 are breached in a given month:

Performance

Metric Breach Condition (Monthly) CMSD Minimum Service Credit (per affected site)

Packet Loss Exceeds 0.1% average 5% of monthly charges for affected site(s)

Latency Exceeds 20ms average 5% of monthly charges for affected site(s)

Jitter Exceeds 5ms average 5% of monthly charges for affected site(s)

Bidders must propose their own performance credit structure in Appendix C.5.4, indicating whether they meet or exceed CMSD’s suggested values.

Patch Compliance Credits (All Patching Activities)

CMSD expects patching commitments to align with the timelines described in Section 2.4 and Appendix

C.2. The credit model below is a suggested structure for missed patch SLAs across all WAN equipment patching (OS, firmware, security, feature updates).

Patch Category CMSD Minimum Timeline Target CMSD Minimum Service Credit

(District-Wide)

Critical/High impact patches

(CVE)

Within 7 calendar days 10% of total monthly charges district-wide

Medium/Low impact patches (CVE)

Within 21 calendar days 5% of total monthly charges district-wide

Zero-day / Actively exploited issues As soon as fix/mitigation is available 25% of total monthly charges district-wide

Bidders must provide their proposed credit percentages for each patch category in Appendix C.5.5 and describe any conditions or exclusions.

Service Credit Caps and Procedures

Credit Caps

CMSD’s position on maximum credits is:

• Per-Site Monthly Credit Cap: 100% of that site’s monthly recurring charges.

• District-Wide Monthly Credit Cap: 100% of total district monthly recurring charges.

Bidders must confirm acceptance or propose alternatives in Appendix C.6.1.

Credit Identification and Request Process

CMSD expects the vendor to:

• Proactively monitor SLA performance and identify any breaches that trigger service credits.

• Reflect all SLA failures and corresponding credits due in monthly reports and within the portal, without requiring CMSD to initiate each request.

• Support CMSD’s right to audit SLA metrics, calculations, and credits at any time.

• Provide retroactive credits if CMSD identifies an unreported SLA breach that should have incurred a credit (CMSD suggests up to 12 months lookback).

Bidders should describe any differences from this process in Appendix C.6.1 Notes/Comments.

Chronic Service Failure Handling

CMSD’s suggested definition and remedy for chronic service failure:

• Trigger Condition: Any site experiences SLA failures that result in credits in three (3) separate months within any rolling six (6) month period.

• Remedy: CMSD may, at its sole discretion, designate such failures as chronic and terminate services for cause for the affected site(s) and/or the entire contract, without requiring an intermediate corrective action plan period.

Bidders must indicate in Appendix C.6.2 whether they accept this suggested chronic failure definition and remedy or propose an alternative approach.

8.7. IMPLEMENTATION PLANNING

Implementation Timeline Requirements

Vendors must provide a detailed implementation timeline including:

Phase 1: Pre-Implementation Planning (Estimated Duration: 60-90 days)

• Contract execution and kickoff meeting

• Detailed site surveys of all CMSD locations

• Network design documentation and approval

• Equipment procurement and staging

• OARNet coordination and cross-connect arrangements

• Building access coordination and scheduling

• Staff training plan development

Phase 2: Pilot Implementation (Estimated Duration: 30-45 days)

• Implementation at designated pilot sites (3-5 sites)

• Testing and validation of services

• Performance baseline establishment

• Issue identification and resolution

• Documentation refinement

• Staff Training (as-needed)

• Cutover to new services

• Decommission old services

Phase 3: Full Rollout (Estimated Duration: 90-180 days)

• Phased implementation across all CMSD sites

• Weekly rollout schedule with defined site groupings

• Testing and acceptance for each site being rolled out

• Parallel operation period (if applicable)

• Cutover procedures for each site

• Old equipment decommissioning

Phase 4: Project Closeout (Estimated Duration: 30 days)

• Final testing and acceptance

• As-built documentation delivery

• Staff training completion

• Warranty period commencement

• Transition to ongoing operations

Implementation Deliverables

Vendors must provide the following deliverables as part of Phase 1 and maintained throughout implementation:

Planning Deliverables:

• Detailed project plan with milestones and dependencies

• Risk assessment and mitigation plan

•…