WRA-3224.pdf

MASSACHUSETTS WATER RESOURCES AUTHORITY

Charlestown Navy Yard 100 First Avenue

Boston, Massachusetts 02129

Request for Bids For

Purchase of Firewalls, IPS, and Related Maintenance and Monitoring Services

WRA NO. 3224

BID RELEASE DATE: November 15, 2010

Sealed bids for the specified goods and/or services must be submitted to:

Massachusetts Water Resources Authority (MWRA), Document Distribution, Charlestown Navy Yard, 100 First Avenue, Boston, Massachusetts, 02129

Bids must be received no later than:

11:30 A.M. WEDNESDAY, DECEMBER 8, 2010

FOR QUESTIONS OR INQUIRIES CONTACT:

BUYER _Janice Watts Email: janice.watts@mwra.state.ma.us

TELEPHONE NO. (617) 788-2025

BID RELEASE APPROVAL: BAM

Notice to Bidders:

For any bid or RFP document and any addenda that are received electronically, it is the responsibility of every bidder who receives this bid or RFP and all associated documents to check the Comm-Pass website for any addenda. The Massachusetts Water Resources Authority accepts no liability to provide accommodation to bidders who submit a response based upon information obtained from Comm-Pass, the Authority’s website or any other publication, electronic or hard copy. Bidders may not alter (manually or electronically) the bid language or any bid documents. Unauthorized modifications to the body of the bid, specifications, terms or conditions, which change the intent of this bid or RFP are prohibited and will disqualify a response. Please note that bid proposals must be submitted in hard copy in a sealed envelope. Bids submitted by fax or email will not be accepted.

Notice to Respondents/Bidders Concerning Confidentiality:

Information contained in this procurement document is intended only for the use of the Respondent/Bidder and such other entities as necessary for the preparation of its Statement of Qualifications/Proposal for performance of its services, and this information should be treated accordingly. Respondent/Bidder, and others who are the intended recipients of this information, shall inform all persons or entities to which this information has been or will be disclosed, that the information is provided for preparation of its Statement or Proposal only, and Respondent/Bidder will make the minimum number of copies available to others as is necessary to prepare its Statement or Proposal.

1 General Description

The Massachusetts Water Resources Authority (“MWRA”) seeks to purchase replacement firewalls with high availability, replacement Intrusion Detection/Prevention (“IPS”) sensors, and replacement management appliances to increase the security posture of its computer networks. The purchase includes hardware, software, and related services (i.e., product maintenance, support, and monitoring) for up to four (4) years. The initial Notice to Proceed is for three years, with the option to add up to twelve additional months (i.e. up to one year) at the Authority’s option for a total contract term of four (4) years (i.e. 48 months). The bid shall be awarded to the qualified Vendor with the lowest total cost listed in “RFB Attachment E – Vendor’s Bid Price, Table 1, Part E”. The contract awarded through this RFB process will commence on March 1, 2011, following the end of the MWRA’s current Firewall, IDS, and Related Maintenance and Monitoring Services contract (WRA-2742, PO#1075803 dated 12-21-2007).

2 Schedule, Pre-Bid Conference, and Questions

2.1 Schedule

The following is the tentative schedule, subject to change at the MWRA’s discretion:

RFB issued on or after ................................................................................... Monday, November 15, 2010 Deadline for Submission of Written Questions is NO LATER THAN 2:00 P.M. on ............................................................. Monday, November 29, 2010 MWRA Answers to Questions Mailed by .................................................. Wednesday, December 1, 2010 BIDS DUE NO LATER THAN 11:30 A.M. ON .................................. Wednesday, December 8, 2010

Bids are due in the MWRA’s Procurement Document Distribution Center no later than 11:30 A.M. on the date noted above.

2.2 RFB Questions

All questions specifically regarding this RFB should be directed in writing only, with the subject heading “Questions–Firewall/IDP (WRA 3224) RFB”, addressed to Janice Watts, Buyer (1) by email at:

janice.watts@mwra.state.ma.us; or (2) by mail to her: c/o MWRA, Charlestown Navy Yard, 100 First Avenue, Boston, MA 02129-2043; or (3) by fax to her attention at: 617-788-4899. Email is strongly preferred.

3 Requirements All bidders shall provide the information listed below and shall quote on hardware, software, and services (maintenance, support, and monitoring) as specified. Exception to the Vendor qualifications and reference requirements, manufacturer authorization requirements, technical requirements, and security requirements is not permitted. Four (4) copies of the Bid are required; the Bids must include:

3.1 Vendor Qualifications, including but not limited to financial and operational information, References, and Manufacturer Authorizations, as stipulated in Section 4.

3.2 Quote for Installation activities, and Hardware and Software details, as stipulated in Section 6.

3.3 Quote for Maintenance and Monitoring details, as stipulated in Section 7.

3.4 Security Statement Requirements, as stipulated in Section 11.

3.5 One (1) copy of all Bidder’s service descriptions and blank, standard Form Agreements, which should include, but are not limited to, the following documents:

3.5.1 Firewall co-managed service descriptions and service level agreements (SLAs) at the level required in this RFB

3.5.2 IDP co-managed service descriptions and service level agreements (SLAs) at the level required in this RFB

3.5.3 Non-disclosure policies of Bidder for its employees

3.5.4 Non-disclosure agreements (NDAs) between Bidder and its agents and subcontractors

3.5.5 Non-disclosure agreement (NDA) between Bidder and MWRA

CAUTION: You should only include service descriptions and SLAs for services which are an integral part of the solution presented in response to this RFB. For example, if Bidder offers three (3) levels of service, Bidder should only include the descriptions for the service for which it has included prices on “RFB Attachment E – Vendor’s Bid Price, Table 1”.

4 Vendor Qualifications, References, and Manufacturer Authorizations

Bidder shall include a section in its bid package tabbed and entitled, “BID Section 1 – Vendor Qualifications, References, and Manufacturer Authorizations”, including all of the following items, referencing the relevant section of the RFB listed below. Failure to include or to meet any of the stated Vendor Qualifications, failure to include the required References or Manufacturer Authorizations, may, at the Authority’s sole option, result in disqualification of the bid.

4.1 Statement of Business Longevity

Bidder shall state that it has been performing the type of services outlined in this RFB as its primary source of business for a minimum of three (3) years. Bidder shall label the statement under a heading marked “BID Section 1, 4.1 Statement of Business Longevity”.

4.2 References

Bidder shall provide three (3) references, preferably from both government agencies and private sector companies which are comparable in network size and have needs similar to MWRA’s, for which Bidder has done work similar to that outlined in this RFB for at least three (3) years. Each reference must include valid contact name(s) and recently verified telephone number(s). Bidder shall label references under a heading marked “BID Section 1, 4.2 References”.

4.3 Statement of Security Operations Centers

Bidder shall state that it has at least two (2) fully operational, fully redundant Security Operations Centers located in at least two (2) different geographic regions, in order to provide 24x7x365 monitoring services, and further shall state that each Security Operations Center is staffed with a minimum of six (6) engineers per seat. Statement must include the postal address (including postal code) and main telephone number for each Security Operations Center. Bidder shall label statement under a heading marked “BID Section 1, 4.3 Statement of Security Operations Centers.”

4.4 Statement of Support Office Location and Certification of Support Office Staff

4.4.1 Statement of Support Office Location

Bidder shall state that it has a support office within a response radius not exceeding a three-hour drive from MWRA’s Computer Center at 2 Griffin Way, Chelsea, Massachusetts 02150-3334.

Bidder must also list the postal address (including postal code) and contact information (including valid telephone number) of said support office. Bidder shall include such information under a heading marked “BID Section 1, 4.4 Statement of Support Office Location and Certification of Support Office Staff”.

Definition MWRA defines “support office” for the purposes of this contract as a location or set of locations at which a minimum of one (1) engineer-level certified staff member is available 24x7x365 for on-site assistance, including hardware failures or malfunctions, per the operating procedures mutually agreed upon by MWRA and the winning Bidder.

4.4.2 Certification of Support Office Staff

Bidder shall further state “that the total complement of staff members at the support office is certified at the appropriate level to provide the required support for all of the products related to this RFB”. (Upon further request from the MWRA, the Bidder must provide copies of Certifications.) Bidder shall include its Certification regarding Support Office Staff under the heading marked “BID Section 1, 4.4 Statement of Support Office Location and Certification of Support Office Staff”.

Example For example, if there is only one staff member in the support office, he or she must have engineer-level certification in MWRA’s currently running version of Check Point and IBM products. Continuing the example, if there are two (2) staff members, then one staff member might have the relevant Check Point certifications and the other might have the relevant IBM certifications. MWRA expects that in the latter scenario, both staff members will be available to respond to an urgent support call, if required.

4.5 Audited Financial Statements

Bidder must provide, as an attachment to its bid, an audited financial statement for its immediately preceding two (2) fiscal years; or, if an audited financial statement was not completed, provide unaudited statements. Bidder shall include such information under a heading marked “BID Section 1,

4.5 Audited Financial Statements”.

4.6 Bankruptcy Statement

Bidder must state whether it has filed for the protection of a U.S. Bankruptcy Court in the last seven (7) years. If this statement is in the affirmative, the Bidder must describe the circumstances that led to the filing, the ultimate disposition of the matter (e.g., reorganization with a payment plan to creditors), the current financial situation, and substantial, detailed evidence of the firm’s financial ability to complete this project if selected as the winning Vendor. Bidder shall include such statement and information under a heading marked “BID Section 1, 4.6 Bankruptcy Statement”.

4.7 Statement and Proof of Insurance

Bidder must state that it “will provide and maintain the required MWRA insurance as outlined in ‘RFB Attachment F – Insurance Requirements’”. The winning Vendor will be required to submit proof that it has obtained all of the required insurance within five (5) business days of notification that it is the winning Vendor. Bidder shall include such statement under a heading marked “BID Section 1, 4.7 Statement and Proof of Insurance”.

4.8 Manufacturer Authorizations

Bidder shall provide written authorization from each of the manufacturers of all hardware, software, maintenance and monitoring products contained within this RFB, and all replacements, substitutions, etc., stating that the Bidder is permitted to resell, use, program, work with, and support its products.

Bidder shall include these authorizations in a section labeled “BID Section 1, 4.7 Manufacturer Authorizations”.

4.9 Subcontractors

For each subcontractor it uses, Bidder must include all documentation required by Sections 4.1 through

4.8 (appropriately attached and labeled), which provide the subcontractors’ qualifications and authorizations to perform the work specified in this RFB. This information must be included as an attachment to its bid, inserted into the section of its response tabbed and entitled “BID Section 2 – Subcontractor Qualifications, References, and Manufacturer Authorizations”.

4.10 Joint Ventures

If Bidder is a Joint Venture, for each party of the Joint Venture, Bidder must include all documentation required by Sections 4.1 through 4.8 (appropriately attached and labeled), which provide the parties’ qualifications and authorizations to perform the work specified in this RFB. Bidder must also include a copy of the (proposed or executed) joint venture agreement as an attachment to its bid, inserted into the section of its response tabbed and entitled “BID Section 2 – Joint Venture Parties’ Qualifications, References, and Manufacturer Authorizations”.

5 Scope of Activities The scope of activities to be performed by the winning Bidder is listed in Sections 5 and 7 herein; in these sections, the winning Bidder is called the “Vendor.”

5.1 Activity Categories

The activities within the scope of the contract shall be divided into the following categories:

Check Point-Related Tasks (See Section 5.4) IBM Security Solutions-Related Tasks (See Section 5.5) Miscellaneous Tasks (See Section 5.6)

Details for each of the tasks in each of the categories are provided in the corresponding Section.

5.2 Project Management Requirements

5.2.1 Project Plan

Submit a project plan for all Firewall Tasks in Section 5.4, all IDP Tasks in Section 5.5, and all Miscellaneous Tasks in Section 5.6, including scope and schedule within one (1) week of bid award. MWRA will review, negotiate amendments to plan as necessary, and approve plan within three (3) business days of receipt. A project plan must be approved by MWRA prior to initiating any work.

5.2.2 Suggested Configuration

Recommend the optimal, suggested configuration for all purchased devices, based on industry best practices and MWRA-identified guidelines. Deliver two (2) copies of all recommended configuration documentation to MWRA.

5.2.3 Knowledge Transfer

Provide knowledge transfer equivalent to on-the-job training to up to four (4) MWRA staff during implementation and configuration of all purchased devices, completing this work within the time frames described in the schedule of the approved project plan.

5.2.4 Actual Configuration

Document the finalized, actual configuration of all purchased devices, the placement of the devices within MWRA’s network(s), and all data and network traffic flows, completing this work within the time frames described in the schedule of the approved project plan. Deliver two

(2) copies of all documentation to MWRA.

5.2.5 Operational Procedures

Identify and document the operational procedures for all of the required actions and activities for both Vendor and MWRA. The areas that need specific operational procedures documented include, but are not limited to, the following:

Data handling and flow

Authentication, authorization, and access control

Integrity of the hardware and software

Configuration management

Backups and restores

Monitoring and auditing

Risk management

Incident management

Complete the work within the time frames described in the schedule of the approved Project Plan. Deliver two (2) copies of all documentation to MWRA.

5.3 Current MWRA Network Security Topology

5.3.1 Perimeter at Chelsea

MWRA’s “primary” perimeter (point of demarcation is located within MWRA Computer Center at Chelsea, Massachusetts) consists of the following components:

Four (4) T1 connections to the Internet

A border router (managed by MWRA’s Internet Service Provider)

An ISS Proventia G400 network-based IPS sensor

Two (2) Check Point NGX (R65) firewalls on Nokia IP390s in high availability, with four (4) defined DMZ subnets

IPSEC VPN concentrator (owned and managed by MWRA)

SSL VPN solution (owned and managed by MWRA)

Email firewalls in high availability (owned and managed by MWRA)

One (1) CDI Port Authority 88 switch and one (1) CDI Port Authority 44 switch, with remote console capabilities via dial-up, and corresponding Power Control Modules for connected devices

5.3.2 Perimeter at Deer Island

MWRA’s “secondary” perimeter (point of demarcation is located within MWRA Computer Center at Deer Island, Winthrop, Massachusetts) consists of the following components:

One (1) T1 connection to the Internet

A border router (managed by MWRA’s Internet Service Provider)

An ISS Proventia G100 network-based IPS sensor

Two (2) Check Point NGX (R65) firewalls on Nokia IP350s in high availability, with two

(2) defined DMZ subnets

25 licenses for Check Point Network Extender SSL VPN solution on the IP350s

Email firewall (owned and managed by MWRA)

One (1) CDI Port Authority 88 switch, with remote console capabilities via dial-up, and corresponding Power Control Modules for connected devices

5.3.3 Perimeter for Telog Services

MWRA’s “additional” perimeter (point of demarcation is located in MWRA Operations Control Center in Chelsea, Massachusetts) consists of the following components:

One (1) DSL connection to the Internet

One (1) SonicWALL TZ 170 firewall with Comprehensive Gateway Services

5.3.4 Security Management Subnets

MWRA’s security management subnets (one in Chelsea and one at Deer Island) house all devices that contain the software necessary to manage and monitor all aspects of MWRA’s information security program, including the firewalls and IPS components. This software includes, but is not limited to, the following items:

Two (2) Check Point SmartCenters, running on Nokia IP350s, in high availability (one in Chelsea, and one at Deer Island)

ISS SiteProtector (in Chelsea)

Security Information and Event Management (SIEM) solution (in Chelsea, owned and managed by MWRA)

Vulnerability scanning solution (in Chelsea, owned and managed by MWRA)

Additionally, the security management subnets might include later-approved hardware and software that are not listed above.

5.3.5 Additional Network-based IPS Sensors

MWRA has four (4) ISS Proventia G100 network-based IPS sensors deployed inside its “perimeter(s)” at three (3) different locations. The locations are Chelsea, Massachusetts; Deer Island, Winthrop, Massachusetts; and Marlborough, Massachusetts.

5.3.6 Diagrams of MWRA Network and Security Topology

Diagrams of MWRA’s network and security topology are considered “Security Most Sensitive”, within its own data classification structure. That specific level of security requires that only those who have an imminent “need to know” are granted access to them. Therefore, MWRA will only make these diagrams available to the winning Vendor, and only after delivery of a signed Non-Disclosure Agreement. (See “Attachment I– Non-Disclosure Agreement.”)

5.4 Details of Check Point-Related Tasks

5.4.1 Replace Check Point SmartCenters in High Availability with Smart-1 Appliances Vendor shall replace the two (2) Check Point SmartCenter servers running in high availability on MWRA-owned Nokia IP350s, located at Deer Island, Winthrop, Massachusetts, and Chelsea, Massachusetts, to Check Point Smart-1 management appliances in high availability. Success for this task will include demonstrating that the failover capabilities of the new Smart-1 appliances work as required; pushing policies successfully from each Smart-1 appliance; proving that the appliances are functioning within proper configuration and normal operating parameters; and demonstrating that alerts are being successfully generated and transmitted back to Vendor’s operations centers.

5.4.2 Replace Firewalls in High Availability between MWRA General Network (Chelsea) and Internet Replace the current MWRA firewalls (Check Point NGX [R65], running on Nokia IP390s in high availability) with the new Check Point R71 on Check Point Power-1 devices, configured in high availability. Vendor will migrate or recreate all rules, settings, and configurations from the current firewalls to the new ones, and ensure new firewalls are registered successfully with the new Check Point Smart-1 management solutions. Success for this task will include testing that the failover capabilities of the new firewalls work as required for all network segments; pushing policies successfully from both Smart-1 devices; proving that the firewalls are functioning within proper configuration and normal operating parameters (including blocking and not blocking correctly specified traffic); and demonstrating that alerts are being successfully generated and transmitted back to Vendor’s operations centers.

5.4.3 Replace Firewalls in High Availability between MWRA General Network (Deer Island) and Internet Replace the current MWRA firewalls (Check Point NGX [R65], on Nokia IP350s, in high availability) with the new Check Point R71 on Check Point UTM-1 devices, configured in high availability. Vendor will migrate or recreate all rules and configurations from the current firewalls to the new ones, and ensure new firewalls are registered successfully with the Check Point Smart-1 management solutions. Success for this task will include testing that the failover capabilities of the new firewalls work as required for all network segments; pushing policies successfully from both Smart-1 devices; proving that the firewalls are functioning within proper configuration and normal operating parameters (including blocking and not blocking correctly specified traffic); and demonstrating that alerts are being successfully generated and transmitted back to Vendor’s operations centers.

5.4.4 Implement Check Point Software Blades

Install and configure all purchased Check Point software blades (including Monitoring, SmartEvent Intro, and Mobile Access) on the newly installed UTM-1 devices, located at Deer Island, Winthrop, Massachusetts, and Power-1 devices, located at Chelsea, Massachusetts.

Configuration of blades will include translation of current policies and practices along with recommendations for additional modifications that align with current industry standards and commonly adopted “best” practices. Success for this task will include demonstrating the ability to push the same policies to the appropriate newly implemented blades; proving that the new Smart-1 devices can display respective log entries from each of the blades; and demonstrating that alerts are being successfully generated and transmitted back to Vendor’s operations centers.

5.5 Details of IBM Security Solutions-Related Tasks

5.5.1 Replace SiteProtector Server with SiteProtector Appliance Replace the current SiteProtector server running on MWRA-owned HP hardware, located at Chelsea, Massachusetts, to the newly purchased SiteProtector management appliance. Success for this task will include migrating all policies and configurations on the current server to the new appliance; pushing policies successfully from the new appliance to the sensors; proving that the appliance is functioning within proper configuration and normal operating parameters; and demonstrating that alerts are being successfully generated and transmitted back to Vendor’s operations centers.

5.5.2 Remove Network-based IPS Sensor (G400) and Implement

Replacement Network-based IPS Sensor (GX5008) Remove existing ISS Proventia G400 network-based IPS sensor from outside the firewalls in Chelsea, Massachusetts, and install and configure replacement GX5008 network-based IPS sensor with intelligent bypass unit (copper). Plan and design exact network location of the GX5008 sensor with MWRA security and network engineers. Migrate (and update) all policies and configurations from G400 to GX5008. Success for this task will include validly de-registering the G400 sensor and registering the GX5008 sensor with MWRA’s new SiteProtector appliance; proving that policy changes can be effected from SiteProtector; demonstrating that the sensor is functioning within proper configuration and normal operating parameters (including blocking and not blocking correctly specified traffic); and demonstrating that alerts are being successfully generated and transmitted back to Vendor’s operations centers.

5.5.3 Replace Network-based IPS Sensors (G100) with New Network-based IPS Sensors (GX4004) in 4 Locations Replace four (4) existing ISS Proventia G100 network-based IPS sensors with four (4) GX4004 network-based IPS sensors in Chelsea, Massachusetts (2 locations); Deer Island, Winthrop, Massachusetts; and Marlborough, Massachusetts. Migrate all policies and configurations from the current G100 sensors to the new GX4004 sensors. Success for this task will include validly de-registering the G100 sensors and registering the GX4004 sensors with MWRA’s new SiteProtector appliance; proving that policy changes can be effected from SiteProtector;

demonstrating that the sensors are functioning within proper configuration and normal operating parameters (including blocking and not blocking correctly specified traffic); and demonstrating that alerts are being successfully generated and transmitted back to Vendor’s operations centers.

5.5.4 Install, Upgrade, or Patch Existing, Licensed Host-based IPS Sensors Install, upgrade, or patch all existing, licensed IBM Proventia Server Sensors (host-based IPS for Windows Server 2003 and Linux). Success for this task will include validly re-registering the Server Sensors with MWRA’s new SiteProtector appliance; proving that policy changes and software updates can be effected from the new SiteProtector appliance; demonstrating that the sensors are functioning within proper configuration and normal operating parameters (including blocking and not blocking correctly specified traffic); and demonstrating that alerts are being successfully generated and transmitted back to Vendor’s operations centers.

5.6 Details of Miscellaneous Tasks

5.6.1 Change All Existing Administrator and System Passwords

All existing administrator- and system-level passwords must be changed to new passwords that meet Vendor’s standard operating procedures, industry standards, and commonly adopted “best” practices. All new passwords must be documented and provided to MWRA Project Manager immediately upon their change.

5.6.2 Test Remote Out-of-Band Console Capabilities

Vendor shall adopt the current MWRA-owned Port Authority remote communications and console switches (manufactured by Communication Devices, Inc., or CDI) and modify current configurations to incorporate all new firewall and IPS devices. Success for this task will include demonstrating Vendor’s ability to cycle power to the firewalls and IPS network-based sensors remotely through a dial-up connection to the Port Authority switches.

6 Hardware and Software Details

6.1 Itemized Solution List

The security solution that MWRA seeks includes the following items, as specified also on “RFB Attachment E Vendor Bid Price Table 1, Part A”:

Two (2) Check Point Power-1 5075 appliances, configured in high availability

Two (2) Check Point Monitoring blades (software)

Two (2) Check Point SmartEvent Intro blades (software)

Two (2) Check Point Smart-1 Security Management appliances, licensed for up to five (5) gateways with up to four (4) software blades per gateway, configured for high availability

Two (2) Check Point UTM-1 3076 Total Security Appliances, configured in high availability (2nd appliance with “Secondary” license)

Two (2) Check Point Mobile Access blades (software), licensed for up to 50 concurrent connections

Four (4) IBM ISS Proventia GX4004-V2 network-based sensors

One (1) IBM ISS Proventia GX5008-V2 network-based sensor

One (1) IBM ISS Proventia GX5008-V2 Intelligent Bypass Unit (Copper)

One (1) IBM ISS SiteProtector Appliance

6.2 Current Versions

Bidder must list and price the most current version of each item on “RFB Attachment E – Vendor’s Bid Price, Table 1, Part A”, as of the date the bid is submitted (See Section 15.3).

6.3 Pricing Required

Bidder must provide a price for each line of each Part of “RFB Attachment E – Vendor’s Bid Price, Table 1”, in order for the Bidder’s submission to be valid.

6.4 No Substitutions Accepted

MWRA will not accept any substitutions for any of the items listed on “RFB Attachment E– Vendor’s Bid Price, Table 1, Part A”, unless said substitution is merely a more recent, supported version of the same item, and such items shall still be subject to MWRA’s approval; Bidder must state any proposed substitute of an item in an attachment to its submitted Bid Price form. Notwithstanding the prior sentence, the Authority expressly reserves the right to require the product version stated in Part A, at the price stated therein. Bids that contain substitutions in “RFB Attachment E – Vendor’s Bid Price, Table 1, Part A” not approved by MWRA will result in disqualification of the bid.

7 Maintenance and Monitoring Details

7.1 Solution List

Vendor shall be responsible for maintaining, monitoring, and managing, with proper prior MWRA authorization, all purchased components (i.e., hardware, software, and operating systems) listed in Section 6.1, and the currently MWRA-owned IBM ISS Proventia host-based IPS sensor software, including, but not limited to, the application of patches, updates, and upgrades for said components.

7.2 Co-Management of Configurations

Share, jointly with MWRA, the management of the rules and configurations for the firewalls and IPS solutions. In so doing, notify MWRA of and receive required MWRA authorization for any Vendor-initiated changes, per configuration management procedures that will be defined and mutually agreed upon as part of the awarded contract.

7.3 Single Point of Contact

Vendor shall be the single point of contact for all maintenance, monitoring, and support services for all devices listed in Section 6.1.

7.4 Start Date for Services

Maintenance, monitoring, and support services shall start on the commencement date of this contract.

7.5 Notification of Patches, Updates, and Upgrades

Vendor shall notify MWRA, in writing, of the availability of all patches, updates, and upgrades (including firmware) for MWRA devices monitored by Vendor. The written notification to MWRA shall be received within two (2) business days of their availability, and shall include the following items regarding said patches, updates, and upgrades:

7.5.1 The level of urgency for their application

7.5.2 The risk associated with not applying them

7.5.3 A recommendation regarding their application

7.5.4 A proposed schedule for their implementation

7.6 Limits for Scheduled Downtime

Bidder shall limit the scheduled downtime for all devices that directly impact MWRA’s Internet services (including, but not limited to, firewalls and inline IPS network sensors) to the following timeframes, unless otherwise excepted with explicit permission by MWRA:

7.6.1 Monday-Friday 7:00 A.M. – 6:00 P.M. < 15 minutes

7.6.2 Monday-Friday 6:00 P.M. – 7:00 A.M. < 1 hour

7.6.3 Saturday-Sunday all day < 4 hours

7.7 Emergency Response Details

7.7.1 Emergency Response Requirements

Vendor shall assist MWRA to contain intrusion/firewall damage, return systems to normal operation, preserve forensic evidence, perform forensic analysis, and recommend improvement actions as appropriate. Vendor shall not involve local, national, and/or international law enforcement with respect to any such invasion or damages without written permission from MWRA’s MIS Director or Managing Director.

7.7.2 Changes During Emergency

In the event of an “emergency” (also to be defined and mutually agreed upon as part of the awarded contract), MWRA reserves the right to make any changes that it deems necessary to any device that is subject to the terms of this contract in order to protect the integrity of MWRA, the health of the public, and the National Infrastructure without the knowledge or permission of, or prior notification to the Bidder.

7.8 Chain of Escalation

Vendor shall work with MWRA to develop a chain of escalation; Bidder shall adhere to the MWRA-approved chain of escalation for notification of intrusions, problems, service interruptions, and other suspicious activities in the monitored areas of MWRA’s network(s).

7.9 Service Level Agreements (SLAs)

Vendor shall meet the following Service Level Agreements (SLAs), including the following:

7.9.1 99.9% or higher uptime

7.9.2 24x7x365 monitoring of all firewall and IDP solution components

7.9.3 24x7x365 support for all related hardware devices and software

7.9.4 Notification to MWRA of HIGH alerts within 30 minutes

7.9.5 Notification to MWRA of MEDIUM alerts within 1 hour

7.9.6 Implementation of requested configuration changes, by priority, as follows:

HIGH 1 hour MEDIUM 24-48 hours LOW mutually agreed upon target

7.9.7 Quarterly configuration reviews and improvement suggestions for all firewall and IPS devices: provide Quarterly Configuration Reviews/Improvement Suggestion reports by the tenth day of the first month of each quarter, except that the first such quarter shall be only sixty days’ in length. (i.e., January 10, April 10, July 10, October 10).

7.9.8 Capability for out-of-band monitoring

7.9.9 Maintain a toll-free number with an immediate human response Monday-Friday during normal business hours (i.e., 9:00 A.M. to 5:00 P.M. EST) and a 15-minute callback after hours.

7.9.10 Provide monthly aggregate service reports by the fifth day of each month, and Quarterly Aggregate Service reports by the tenth day of the first month of each quarter (i.e., January 10, April 10, July 10, October 10).

7.10 MWRA Review of Security Events and Logs

Provide the real-time analysis and false-positive data reduction in a cost-effective manner for all firewalls and IPS solutions. MWRA retains the right and requires the access and authorization to review manually, analyze, aggregate, correlate, prioritize, and data-mine the security events and logs internally, in addition to the Vendor’s required operations under this contract.

7.11 Online Access to Service Data and Metrics

Provide a secure Web-based tool for intelligence gathering, research, and reporting. Vendor shall provide both real-time and historical log access, based on an archival plan mutually agreed upon by both MWRA and the Vendor. Reporting mechanisms provided by Vendor shall include a variety of reporting options, covering the breadth of all services rendered and suitable for multiple audiences (executive, IT management, and engineer).

8 Payment Terms The Total Contract Price for all goods and services under this Contract is an amount Not To Exceed $_______________________________________, and is comprised of the elements described in “RFB Attachment E – Vendor‘s Bid Price, Table 1”.

8.1 Hardware and Software Goods

8.1.1 Total Price

The Total Price for the purchase of all hardware and software goods is $__________________________ (the amount shown on Line 12, Part A, of “RFB Attachment E– Vendor’s Bid Price, Table 1”).

8.1.2 Terms

Payment shall be in one lump sum, and shall be due thirty (30) days after delivery of satisfactory goods, and receipt of a properly completed invoice with all applicable licenses, documentation, and warranties for same attached.

8.2 Annual Maintenance and Support

8.2.1 Total Price

The Total Price for maintenance and support of all specified hardware and software goods over the three (3) years plus the optional Year 4 of the contract is $__________________________ (the amount stated on Line 21, Part B, of “RFB Attachment E – Vendor’s Bid Price, Table 1”).

8.2.1.1 The Year 1 amount is $______________________.

8.2.1.2 The Year 2 amount is $______________________.

8.2.1.3 The Year 3 amount is $______________________.

8.2.1.4 The optional Year 4 amount is $______________________.

8.2.2 Terms

Payment shall be made annually at the commencement of the maintenance period, and shall be due within thirty (30) days after receipt of a properly completed invoice.

8.3 Monitoring Services

8.3.1 Total Price

The Total Price for monitoring services over the three (3) years plus the optional Year 4 of the contract is $__________________________ (the amount stated on Line 22, Part C, of “RFB Attachment E – Vendor’s Bid Price, Table 1”).

8.3.1.1 The Year 1 amount is $______________________.

8.3.1.2 The Year 2 amount is $______________________.

8.3.1.3 The Year 3 amount is $______________________.

8.3.1.4 The optional Year 4 amount is $______________________.

8.3.2 Terms

In each contract year (i.e., Year 1, Year 2, Year 3, and, if approved, Year 4), eighty percent (80%) of the annual monitoring fee shall be due and paid annually within thirty (30) days of receipt of a properly completed invoice. Twenty percent (20%) of the annual monitoring fee shall be withheld as annual retainage, and shall be paid at the end of the year upon satisfactory work and upon receipt of an invoice for said retainage balance. In each contract year, the annual retainage for that contract year shall be paid within thirty (30) days after receipt of a duplicate of the original invoice for that contract year, which shall have been submitted in the beginning of that same contract year; provided, however, that the annual retainage shall not be due if, in any contract year (i.e., Year 1, Year 2, Year 3, or Year 4), Vendor has failed to meet the Maintenance and Monitoring requirements in the Agreement as stated in Section 7 of this contract.

8.4 Installation & Configuration, Training, and Additional Consulting Services

8.4.1 Installation & Configuration (Allowance of up to 15 Days)

8.4.1.1 Total Price

The Total Price for the installation and configuration of all specified hardware and software goods is an amount not to exceed $__________________________ (the amount stated on Line 23, Part D, of “RFB Attachment E – Vendor’s Bid Price, Table 1”) for up to 15 days of installation and configuration..

8.4.1.2 Terms (Allowance)

This Total Price amount shall become an Allowance, and may only be spent by an executed Task Order(s) signed by the MWRA Project Manager approving the number of days, the rate(s), Other Direct Costs, and the Not To Exceed amount of the Task Order. Use of the Allowance amount listed on Line 23, Part D, of "RFB Attachment E

– Vendor’s Bid Price, Table 1” is not guaranteed. Vendor shall submit a properly completed invoice referencing the Task Order to MWRA upon satisfactory completion of the installation and configuration services provided to MWRA. Payment will be made within thirty (30) days of receipt of invoice.

8.4.2 Training (Allowance: $25,000)

Vendor shall arrange to obtain/provide certified training for MWRA staff, in Massachusetts, if/as requested by Task Order. An Allowance is provided for this task in Line 24, Part D, of “RFB Attachment E – Vendor’s Bid Price, Table 1”.

8.4.2.1 Total Price

An Allowance has been allocated on the total amount not to exceed $ 25,000. The Vendor shall not be automatically entitled to these Allowance monies, as described below.

8.4.2.2 Terms

This Total Price amount shall be an Allowance, and may only be spent by an executed Task Order(s) signed by the MWRA Project Manager approving the expenditure on a lump sums basis for said Training for up to three people. Use of the Allowance amount listed on Line E 24, Part D, of "RFB Attachment E – Vendor’s Bid Price, Table 1” is not guaranteed. Vendor shall submit a properly completed invoice referencing the Task Order to MWRA upon satisfactory completion of the Training services. Payment will be made within thirty (30) days of receipt of invoice.

8.4.3 Additional Consulting (Allowance: $40,000)

8.4.3.1 Total Price

An Allowance has been allocated on the total amount not to exceed $40,000. The Vendor shall not be automatically entitled to these Allowance monies as described below.

8.4.3.2 Terms

The Allowance monies may only be spent after execution of a Task Order(s), attached as “RFB Attachment G – Blank Task Order Form”, specifying the scope of work, the number of hours of work to be performed, at the approved rate(s), plus Other Direct Costs if any, and the Not To Exceed price for such work. Payment for T&M in Task Orders shall be made at the Single Hourly Rates (“CHRs”) identified as allowable on Page 2 in the notes of “RFB Attachment E – Vendor’s Bid Price, Table 1, Part D”, up to a Not To Exceed Maximum Price. A Task Order may be amended by another Task Order.

8.4.3.3 Other Direct Costs

The CHRs shall include all associated costs (direct, indirect, and profit) and no additional compensation shall be allowed except for allowable ordinary and extraordinary Other Direct Costs authorized in advance by MWRA which are listed in the Task Order and which conform to MWRA’s applicable rules and procedures. A list of ordinary expenses that may be considered reimbursable is attached as “RFB Attachment H – Allowable Ordinary and Extraordinary Other Direct Costs”. Vendor understands and agrees that all materials (Other Direct Costs) included in a Task Order shall be provided at the lesser of: (1) cost, with no markup, or (2) at the best discounted price for government entities.

9 Termination MWRA reserves the right to terminate the contract in writing for convenience within 30 days of the annual renewal or immediately for cause. Notwithstanding any other provision herein, or any other definition of “cause” otherwise provided in law, cause may include, but is not limited to, the following:

9.1 Breach of contract such as confidentiality, integrity, and/or availability;

9.2 MWRA’s concern regarding Vendor’s viability concerns such as financial difficulty and/or significant staffing reductions/changes that may impact service delivery; and

9.3 Press releases or other public communications that may, in the sole judgment of MWRA, negatively impact MWRA or MWRA’s public image.

10 Insurance and Indemnification

10.1 Insurance

Bidder shall meet the insurance requirements listed in “RFB Attachment F – Insurance Requirements” throughout the term of the Agreement.

10.2 Indemnification

Bidder shall fully indemnify and be fully liable for any and all damages sustained by MWRA arising out of, or in any way connected to, the Bidder’s failure to comply with the provisions of this contract.

11 Security Requirements

11.1 Terms

The Bidder must agree that, if awarded the bid, it will be bound over the term of the Agreement, without any qualifications or limitations, by the provisions of both “RFB Attachment A – MWRA SP-SS Confidentiality/Limited Use Terms” and “RFB Attachment B – MWRA MIS Security Requirements Terms”, which are attached hereto.

11.2 Security Certification Form

The Bidder must complete (signed by a person authorized to bind the Bidder) and attach as part of its bid the form attached as “RFB Attachment C– Vendor’s Security Certification”, indicating its assent to the terms stated in Section 11.1. Submission of the signed forms constitutes assent over the term of the Agreement.

11.3 Security Signatories List

The Bidder must list the person(s) who will be authorized to sign confidentiality agreements in connection with the contract. The Bidder must complete (signed by a person authorized to bind the Bidder) and attach to its bid the form attached as “RFB Attachment D – Vendor’s Security Signatories”, indicating its assent to this Section 11.3.

12 Order of Precedence A copy of this RFB and the successful Vendor’s response shall be attached to the Purchase Order form awarded to the Vendor. The terms listed in this RFB, to the degree that they may conflict with any term(s) or condition(s) listed on the MWRA Purchase Order form to which they are to be attached, shall supersede such MWRA Purchase Order form term(s) or condition(s).

13 Bid Submission Indicates Assent to Terms Submission of a bid for the work identified in this RFB constitutes the Vendor’s express agreement to all performance and payment terms listed in this RFB, including all of its attachments, without qualification or limitation.

14 Summary of Required Documents for Valid Bid Bidder shall submit the following documents for its Bid, labeling and separating its Bid into “Sections”, including the following:

14.1 BID Section 1 – Vendor Qualifications, References, and Manufacturer Authorizations

(Responding to RFB Section 4 With Attachments, including, but not limited to, Manufacturer Authorizations and such other attachments as may be required to respond to RFB Section 4)

14.2 BID Section 2 – Vendor’s Bid Price (Submit completed forms provided as “RFB Attachment E

– Vendor’s Bid Price, Table 1”):

14.2.1 Table 1, Part A, Hardware and Software (Responding to Requirements listed in RFB Section 6)

14.2.2 Table 1, Part B, Maintenance and Support (Responding to Requirements listed in RFB Section 7)

14.2.3 Table 1, Part C, Monitoring Services (Responding to Requirements listed in RFB Section 7)

14.2.4 Table 1, Part D, Installation & Configuration, Training, and Additional Consulting Services (Responding to Requirements listed in RFB Section 5)

14.2.5 Table 1, Part E, GRAND TOTAL (Sum of Parts A, B, C and D)

14.3 BID Section 3 – Vendor’s Security Certification (Submit signed, completed form provided as RFB Attachment C, attached hereto.)

14.4 BID Section 4 – Vendor’s Security Signatories List (Submit signed, completed form provided as RFB Attachment D, attached hereto.)

14.5 BID Section 5 – Vendor’s Service Descriptions and Non-Disclosure Agreements (List, paginate, and attach 1 copy of each of Vendor’s service descriptions and blank, standard Form Agreements, including, but not limited to, those documents identified in Section 3.5.)

15 Bid Submission

15.1 Four (4) copies of the Bid are required. Except where this document contains express instructions to the contrary, all requested information must be included in the bid package.

15.2 If the Bid is submitted by a joint venture, it must be signed by all parties to the joint venture.

15.3 Bids (four copies) must be received in MWRA’s Procurement Document Distribution Center at the following address, no later than 11:30 A.M. on the date noted above in the Schedule in Section 2:

Michele Gillen, Deputy Director of Administration and Finance Massachusetts Water Resources Authority Procurement Dept. Document Distribution Center 100 First Avenue, Bldg. 39-1, First Floor Charlestown Navy Yard Boston, MA 02129-2043

Packages should be marked:

“Firewalls, IPS, and Related Maintenance and Monitoring Services (WRA 3224)”

Bids or any parts thereof received in the Document Distribution Center after the required date and time will not be accepted and will be rejected as non-responsive to the Request for Bids. Delivery of Bids to any office, function, advisor, or location other than the Document Distribution Center will not constitute receipt by MWRA. The transmission of Bids by FAX is not permitted. It is the sole responsibility of the Bidder to ensure that bids are received at the proper location, prior to the stated deadline. Bidders are further advised that the Procurement Office of MWRA is located in Charlestown, a neighborhood of Boston. Lines of transportation are congested and under construction. Bidders should plan accordingly for timely statement delivery. The 11:30 A.M. deadline is strictly enforced.

Bidders may obtain an electronic copy of the form provided with this RFB entitled “RFB Attachment E – Vendor’s Bid Price, Table 1”. Note that this form must be completed and submitted on paper, as part of the bid package, and may NOT be transmitted or delivered electronically.

15.4 The Authority reserves the right to seek additional information from any and all bidders. The Authority reserves the right to reject any and all bid proposals, to waive any minor informalities in the bid proposals, and to enter into any agreement deemed by the Authority to be in its best interest.

16 RFB Attachments

The following are the Attachments to this RFB:

RFB Attachment A – MWRA SP-SS Confidentiality/Limited Use Terms RFB Attachment B – MWRA MIS Security Requirements RFB Attachment C – Vendor’s Security Certification RFB Attachment D – Vendor’s Security Signatories List RFB Attachment E – Vendor’s Bid Price, Table 1 (Parts A, B, C, D, E) RFB Attachment F – Insurance Requirements RFB Attachment G – Blank Task Order Form RFB Attachment H– Allowable Ordinary and Extraordinary Other Direct Costs RFB Attachment I – External Non-Disclosure Agreement RFB Attachment J - Standard Contract Provisions, including:

“Part A General Provisions” and “Part B Purchase Order Terms and Conditions”

Your interest in working with the Authority is appreciated.

Michele Gillen Deputy Director of Administration and Finance November 15, 2010

This page is intentionally left blank.

RFB ATTACHMENT A – MWRA SP-SS CONFIDENTIALITY/LIMITED USE TERMS*

[Note: As used herein, the term “Consultant” shall mean the “Bidder / Vendor”]

PROFESSIONAL SERVICES AGREEMENTS - SECURITY PROVISIONS

CONFIDENTIALITY: LIMITED USE OF DOCUMENTS AND EMPLOYEE SECURITY ASSESSMENTS

1.1 It is understood and agreed by the Consultant that any documents or information provided to the Consultant by the Authority for the preparation of its proposal or for the performance of its work and preparation of its deliverables, may contain sensitive information as it relates to Authority facilities and operations. Therefore, such documents and information, as well as any deliverables developed therefrom are considered privileged and strictly confidential.

1.2 Except as required for the discharge of its duties to the Authority under this Agreement or as otherwise required by law, the Consultant shall not communicate or release any such deliverable, document, or information in any form to any third party without the prior written consent of the Authority.

1.3 The Consultant shall not use such deliverables, documents, or information other than for the performance of services under this Agreement.