RFP 23-074 VENDOR TO PROVIDE INCIDENT RESPONSE, FORENSIC INVESTIGATION AND OTHER CYBER SECURITY SERVICES ON AN AS NEEDED BASIS 23-076 ICN OSP Project # 77220605 Polk Co - West Des Moines, Iowa National Guard. ITB 23-075 VENDOR TO PROVIDE ELECTRICAL SERVICES FOR SAC CITY ELEMENTARY SCHOOL PROJECT

NOTICE TO VENDORS

REQUEST FOR PROPOSAL

The Iowa Telecommunications and Technology Commission operating the Iowa Communications Network (ICN) will be receiving sealed Bid Proposals for the following RFP until 3:00 p.m. central time, January 4, 2024:

RFP 23-074

VENDOR TO PROVIDE INCIDENT RESPONSE, FORENSIC INVESTIGATION AND OTHER CYBER SECURITY SERVICES ON AN AS NEEDED BASIS

Issuing Officer - Brian Clayton

Iowa Communications Network

Grimes State Office Building

400 East 14th Street

Des Moines, IA 50319

Telephone 515-725-4616

FAX 515-725-4774

Brian.clayton@iowa.gov

Vendors must comply with all affirmative action/equal employment opportunity provisions of State and Federal laws.

THIS REQUEST FOR PROPOSAL CONSISTS OF FOUR CHAPTERS AND FOUR ATTACHMENTS:

CHAPTER TITLE

1 Administrative Issues

2 Contractual Terms

3 Technical Specifications

4 Evaluation Criteria

Attachment 1 Contract Terms and Conditions (Sample Agreement)

Attachment 2 Bid Proposal Compliance Form

Attachment 3 Authorization To Release Information

Attachment 4 Bid Proposal Submittal Form

CHAPTER 1

ADMINISTRATIVE ISSUES

1.1 Purpose. The State of Iowa, Iowa Telecommunications and Technology Commission, operating the Iowa Communications Network (collectively ICN) is seeking Bid Proposals from Vendors who are able to Incident Response, Forensic Investigation and cyber security services on an as needed basis upon request by the Iowa Communications Network.

1.2 Schedule and Submission of Bid Proposal.

1.2.1 Questions and Answers. Vendors are invited to submit written questions and/or requests for interpretation/consideration/acceptance concerning this RFP on or before 4:00 p.m. central time December 15, 2023. Vendors with questions concerning this RFP may submit their questions in writing by mail or hand delivery to Brian Clayton at the address below, facsimile at (515) 725-4774 or electronic mail at brian.clayton@icn.state.ia.us. Oral questions will not be accepted, and verbal communications shall not override written communications. Only written communications are binding on ICN. ICN will prepare a written response to all pertinent questions submitted by Vendors. These questions and responses will be posted on the ICN webpage ( www.icn.iowa.gov ) and transmitted via e-mail to all Vendors to whom the RFP has been sent, prior to close of business on December 19, 2023.

1.2.2 Changes and Amendments. In the event it becomes necessary for ICN to amend, add to or delete any part of this RFP, the amendment will be provided to all Vendors to whom the RFP has been sent. Vendor’s Bid Proposal must include acknowledgment of all addenda issued by ICN.

1.2.3 Receipt of Bid Proposals. Bid Proposals must be received at ICN’s office no later than 3:00 p.m. central time January 4, 2024. This requirement is a mandatory requirement and is not a minor deficiency subject to waiver by the ICN. No Bid Proposals will be accepted after the date and time specified. A late Bid Proposal shall be returned unopened to the Vendor. Additionally, no Bid Proposal will be accepted by telephone, electronic mail or facsimile. The Bid Proposals must be mailed (with mailing in sufficient time to arrive on or before this deadline requirement) or be delivered as follows:

Mailing & Delivery Address:

Iowa Communications Network

Attn: Brian Clayton

Grimes State Office Building

400 East 14th Street

Des Moines, IA 50319

If Bid Proposals are delivered by mail service, express courier, delivery service or company, or in person, it shall be the sole responsibility of the Vendor submitting the proposal to insure that such delivery takes place prior to the aforementioned deadline. There shall be no waiving of the deadline due to mis-deliveries on the part of the Vendor, Vendor’s delivery staff or Vendor’s choice of delivery service(s). Deliveries made directly to ICN must be placed with the ICN Contracting Section or with an ICN staff person able to accept such delivery.

1.2.4 Bid Proposal Opening. Bid Proposals will be opened at 3:00 p.m. central time on January 4, 2024. The Bid Proposals and the evaluation documents created by the ICN will remain confidential subject to Iowa Code Section 72.3 until the evaluation committee has evaluated all of the compliant Bid Proposals submitted in response to this RFP and the selection process is complete. The Bid Proposals submitted and the evaluation documents created by the ICN will be available for inspection subject to the exceptions described in Iowa Code Chapter 22 or other applicable law after the selection process is complete.

1.2.4.1 Failure to comply with or supply any and all information requested to accompany Bid Proposals may be cause for rejection of the proposal as non-compliant.

1.2.4.2 All Bid Proposals shall be firm for a period of 120 days to allow the evaluation committee to fully evaluate all proposals and make an award deemed to be in the best interest of ICN and the State of Iowa.

1.2.4.3 By submitting a Bid Proposal the Vendor agrees to the terms and conditions contained within this RFP.

1.3 Proposal Format.

1.3.1 Bid Proposals shall be printed on 8.5” x 11” paper. One original and one (1) copy must accompany each submission. In addition one copy shall be provided on standard CD or USB drive using Microsoft Word software. The original Bid Proposal must be in a package CLEARLY MARKED RFP 23-074 on the outer envelope or wrapping. This is necessary to insure that the response package is handled properly for verification against the RFP deadline. Lack of notation of RFP number may affect the receipt timing and affect the evaluation process. Vendor should consider this item as a critical factor when submitting a response.

1.3.2 To achieve a uniform review process and the maximum degree of comparability, proposals shall be organized in the following manner:

1.3.2.1 Completed Bid Proposal Compliance Form (Attachment 2).

1.3.2.2 Completed Authorization to Release Information Form (Attachment 3).

1.3.2.3 Completed Bid Proposal Submittal Form (Attachment 4). Vendor shall provide a positive statement of compliance or exception to each requirement listed. Vendor must identify any deviations from the requirements that the Vendor cannot satisfy. Any deviations from the requirements of the RFP or requirements the Vendor cannot satisfy may result in disqualification of the Vendor’s proposal.

1.4 Clarification of Proposals and Obtaining Information. ICN reserves the right to contact a Vendor after submission of Bid Proposals for the purpose of clarifying a Bid Proposal to ensure mutual understanding. This contact may include written questions, interviews, site visits, a review of past performance if the Vendor has provided goods or services to the ICN, or any other political subdivision wherever located or requests for corrective pages in the Vendor’s Bid Proposal. This information may be used to evaluate the Vendor’s Bid Proposal. However, the information received from the Vendor shall not be considered in the evaluation of a Vendor’s Bid Proposal if the information materially alters the content of the Bid Proposal. ICN reserves the right to obtain information concerning any Vendor or any proposal from any source and to consider such information in evaluating the Vendor’s Bid Proposal.

1.4.1 Authorization to Release Information. The Vendor must sign the Authorization to Release Information Form included with this RFP as an attachment. Failure to sign this Authorization may result in the Bid Proposal being rejected outright.

1.5 Waiver of Deficiencies. ICN reserves the right to waive minor deficiencies in a Bid Proposal if, in the judgment of ICN, ICN’s best interest will be served. The decision as to whether a deficiency will be waived or will require the rejection of a Bid Proposal will be solely within the discretion of ICN. There is no guarantee or assurance that any deficiency will be deemed minor and that a deficiency will be waived. Each Vendor is specifically notified that failure to comply with or respond to any part of this RFP requiring a response may result in rejection of the Bid Proposal as not responsive.

1.6 Cost of Bid Proposal. ICN is not responsible for any costs incurred by a Vendor which is related to the preparation or delivery of the Bid Proposal or any other activities carried out by the Vendor as it relates to this RFP.

1.7 Bid Proposal Obligations. The contents of the Bid Proposal and any clarification thereto submitted by the successful Vendor shall become part of the contractual obligation and incorporated by reference into the ensuing Contract.

1.8 Bid Proposals Property of ICN. Except as otherwise stated herein, all Bid Proposals become the property of the ICN and the State of Iowa and shall not be returned to the Vendor unless all Bid Proposals are rejected. In the event all Bid Proposals are rejected, Vendors will be asked to send prepaid shipping instruments to the ICN for return of the Bid Proposals submitted. In the event no shipping instruments are received by the ICN, the Bid Proposals will be destroyed by the ICN. Additionally, the evaluation documents created by the ICN will be destroyed in the event all Bid Proposals are rejected. Otherwise, at the conclusion of the selection process, the contents of all Bid Proposals will be placed in the public domain and be opened to inspection by interested parties subject to the exceptions provided in Iowa Code Chapter 22 or other applicable law.

1.9 Rejection of Bid Proposals.

1.9.1 ICN reserves the right to reject any and all Bid Proposals, in whole and in part, received in response to this RFP at any time prior to the execution of a written Contract covering a particular location. Issuance of this RFP in no way constitutes a commitment by ICN to award a Contract for the products or services included in the RFP. This RFP is designed to provide Vendors with the information necessary for the preparation of competitive Bid Proposals. This RFP process is for ICN’s benefit and is intended to provide ICN with competitive information to assist in the selection of goods and services.

1.9.2 Disqualification. The ICN may reject outright and may not evaluate proposals for any one of the following reasons:

1.9.2.1 The Vendor fails to deliver the Bid Proposal by the due date and time.

1.9.2.2 The Vendor states that a service requirement cannot be met.

1.9.2.3 The Vendor's response materially changes a service requirement.

1.9.2.4 The Vendor’s response limits the rights of the ICN.

1.9.2.5 The Vendor fails to include information necessary to substantiate that it will be able to meet a service requirement.

1.9.2.6 The Vendor fails to respond to the ICN's request for information, documents, or references.

1.9.2.7 The Vendor fails to include a completed, signed Authorization to Release Information Form (See Attachment 3).

1.9.2.8 The Vendor fails to include a completed, signed Bid Proposal Compliance Form (See Attachment 2).

1.9.2.9 The Vendor presents the information requested by this RFP in a format inconsistent with the instructions of the RFP.

1.9.2.10 The Vendor initiates unauthorized contact regarding the RFP with ICN employees.

1.9.2.11 The Vendor’s exceptions to the contract terms and conditions in Attachment 1 materially change the terms and conditions of Attachment 1 or the requirements of this RFP.

1.9.2.12 The Vendor provides misleading or inaccurate responses.

1.9.2.13 The Vendor fails to include a completed Bid Proposal Submittal Form (Attachment 4) and Bid Proposal Submittal Form for Dark Fiber Service (Attachment 4A).

1.9.3 Failure of the Vendor to comply with additional information requests may be cause for rejection of the Bid Proposal as non-compliant.

1.10 Public Records and Requests for Confidentiality.

1.10.1 The release of information by ICN to the public is subject to Iowa Code Chapter 22 and other applicable provisions of law relating to the release of records in the possession of a State agency. Vendors are encouraged to familiarize themselves with these provisions prior to submitting a Bid Proposal. All information submitted by a Vendor may be treated as public information by ICN unless the Vendor properly requests that information be treated as confidential at the time of submitting the proposal. In the event Vendor marks each page of its Bid Proposal as proprietary or confidential without adhering to the requirements of this Section, the ICN may reject the Bid Proposal as noncompliant.

1.10.2 Any requests for confidential treatment of information must be included in a cover letter with the Vendor’s Bid Proposal and must enumerate the specific grounds in Iowa Code Chapter 22 or other legal reasons which support treatment of the material as confidential and must indicate why disclosure is not in the best interests of the public. The request must also include the name, address and telephone number of the person authorized by the Vendor to respond to any inquiries by ICN concerning the confidential status of the materials.

1.10.3 Any documents submitted which contain confidential information must be marked on the outside as containing confidential information, and each page upon which confidential information appears must be marked as containing confidential information. The confidential information must be clearly identifiable to the reader wherever it appears. All copies of the proposal submitted, as well as the original proposal, must be marked in this manner. Vendor’s Submission of a Bid Proposal pursuant to this RFP constitutes Vendor’s agreement that the Vendor’s failure to properly mark information as confidential shall relieve the ICN from any responsibility if the information is viewed by the pubic, a competitor, or is in any way accidentally released.

1.10.4 In addition to marking the material as confidential material where it appears, the Vendor must submit one copy of the Bid Proposal from which the confidential information has been excised. The confidential material must be excised in such a way as to allow the public to determine the general nature of the material removed and to retain as much of the document as possible. These pages must be submitted with the cover letter and will be made available for public inspection.

1.10.5 The Vendor’s failure to request in the Bid Proposal confidential treatment of material pursuant to this Section and the relevant laws and administrative rules will be deemed by ICN as a waiver of any right to confidentiality which the Vendor may have had.

1.11 Restrictions on Gifts and Activities. Iowa Code Chapter 68B contains laws which restrict gifts which may be given or received by State employees and requires certain individuals to disclose information concerning their activities with State government. Vendors are responsible for determining the applicability of this Chapter to their activities and for complying with these requirements. In addition, Iowa Code Chapter 722.1 provides that it is a felony offense to bribe a public official.

1.12 Restriction on Communication. In the event that a Vendor or someone acting on the Vendor’s behalf attempts to discuss this RFP orally or in writing with any Commission member or any employee of ICN other than the ICN Contracting Officer, Vendor may be disqualified. No questions are to be asked of State of Iowa employees regarding this RFP, except for contact with the State Targeted Small Business Office by Vendors certified as Targeted Small Business Entities, without prior notification and approval by the ICN Contracting Officer, except as otherwise permitted by this RFP. All RFP contacts shall be made through the ICN Contracting Officer only.

1.13 Copyrights. By submitting a Bid Proposal the Vendor agrees that ICN may copy the Bid Proposal for purposes of facilitating the evaluation or to respond to requests for public records. The Vendor consents to such copying by submitting a proposal and warrants that such copying will not violate the rights of any third party. ICN will have the right to use ideas or adaptations of ideas which are presented in the proposals. In the event the Vendor copyrights the Bid Proposal, the ICN may reject the proposal as noncompliant.

1.14 Conflict Between Terms. ICN reserves the right to accept or reject any exception taken by the Vendor to the terms and conditions of this RFP. Substantial variations between the Vendor’s terms and conditions and those contained in this RFP may be grounds for rejection of the Vendor’s Bid Proposal as non-responsive and non-compliant.

1.15 Release of Claims. With the submission of a Bid Proposal, Vendor agrees that it will not bring any claim or have any cause of action against ICN or the State of Iowa based on any misunderstanding concerning the information provided herein or concerning ICN’s failure, negligent or otherwise to provide the Vendor with pertinent information as intended by this RFP.

1.16 Construction of RFP with Laws and Rules. This RFP is to be construed in accordance with the laws of the State of Iowa, including Iowa Code Chapter 8D and Iowa Administrative Code Chapter 751. Changes in applicable laws and rules may affect the award process or the resulting Contract. Vendors are responsible for ascertaining pertinent legal requirements and restrictions. Vendors are encouraged to visit a web site containing references to the Iowa Code and the Iowa Administrative Code for information. A suggested address is http://www.legis.state.ia.us or http://www.icn.state.ia.us.

1.17 Soft Copy. Soft copies of the RFP will be available by request to brian.clayton@iowa.gov .

1.18 Downloading RFP from the Internet. All amendments will be posted on the ICN’s website at www.icn.iowa.gov under Bidding Opportunities. Vendors are advised to check the ICN’s website periodically for amendments to this RFP, particularly if the Vendor downloaded the RFP from the Internet because the Vendor may not automatically receive amendments if it did not contact the ICN for a copy of the RFP. If the Vendor received this RFP as a result of a written request to the ICN, the Vendor will receive amendments.

1.19 Definition of Contract. The full execution of a written contract shall constitute the making of a contract for services and no Vendor shall acquire any legal or equitable rights relative to the contract services until the Contract has been fully executed by the successful Vendor and the ICN.

1.20 Award Notice and Acceptance Period. The ICN will send the Notice of Intent to Award the Contract to all Vendors submitting a timely Bid Proposal. Negotiation and acceptance of the contracts shall be completed with the successful Vendors no later than sixty (60) days after Notice of Intent issuance date if there are no appeals filed. If an apparent successful Vendor fails to negotiate and deliver the executed contract by that date, the ICN may, in its sole discretion, cancel the award and award the contract for that site to the next highest ranked Vendor offering services for that end point location. The ICN reserves the right to continue negotiations after sixty days if, in ICN’s sole discretion, ICN deems it to be in the best interests of ICN to do so.

CHAPTER 2

CONTRACTUAL TERMS

2.1 Contractual Terms Generally.

2.1.1 The Contract the ICN expects to award as a result of this Request For Proposal will be based upon the Bid Proposal submitted by the successful Vendor (Vendor awarded the Contract) and this solicitation. The Contract between the ICN and the Vendor shall be a combination of the specifications, terms and conditions of the Request For Proposal, including the terms contained in the Contract Terms and Conditions Sample Agreement identified as Attachment 1, the offer of the Vendor contained in its Bid Proposal, written clarifications or changes made in accordance with the provisions herein, and any other terms deemed necessary by the ICN.

2.1.2 The Contract terms contained in Attachment 1 are not intended to be a complete listing of all Contract terms but are provided only to enable Vendors to better evaluate the costs associated with the RFP and the potential resulting Contract. Vendors should plan on such terms being included in any Contract awarded as a result of this RFP. All costs associated with complying with these requirements should be included in any pricing quoted by the Vendor.

2.1.3 By submitting a Bid Proposal, each Vendor acknowledges its acceptance of these specifications, terms and conditions without change except as otherwise expressly stated in the appropriate section of the Bid Proposal Compliance Form (Attachment 2). If a Vendor takes exception to a provision, it must state the reason for the exception and set forth in Attachment 2 of its Bid Proposal the specific Contract language it proposes to include in place of the provision. Exceptions that materially change these terms or the requirements of the RFP may be deemed non-responsive by the ICN, in its sole discretion, resulting in possible disqualification of the Bid Proposal. The ICN reserves the right to either award a Contract without further negotiation with the successful Vendor or to negotiate Contract terms with the selected Vendor if the best interests of the ICN would be served.

2.2 Additional Cost Items Not In Contract. ICN is unaware of any additional Contract terms that would add cost. Notwithstanding, should any Contract items arise that would cost additional monies; those costs shall be borne by the Vendor.

CHAPTER 3

TECHNICAL SPECIFICATIONS

3.1 BACKGROUND INFORMATION. The Iowa Communications Network (ICN) requires Incident Response and Forensic Investigation and related cyber security services. Incident Response is defined as managing the aftermath of a security breach or attack (also known as an event or incident) in order to limit damage and reduce recovery time and costs. Forensic Investigation is defined as the recovery and investigation of material found in digital devices. The ICN is particularly interested in Forensic Investigation capabilities relating to network traffic and network equipment. Additional related cyber security services are also being requested for use on a case by case basis.

3.2 SCOPE. ICN will be accepting Bid Proposals from Vendors who are able to provide Incident Response, Forensic Investigation and cyber security services on an as needed basis upon request by the Iowa Communications Network. When called upon Vendor shall assist the ICN to detect and respond to incidents, taking appropriate measures to prevent a reoccurrence. Vendor to use whatever technology and evidence sources ICN has, in addition to Vendor tools and licensed commercial products it utilizes to quickly gain visibility, rapidly identify, contain a compromise and restore operations. If there are security gaps, Vendor shall assist the ICN in deciding which solutions will be most effective for future security efforts.

3.3 INSTRUCTIONS. Vendor shall provide a positive statement of compliance to each section within 3.4, 3.5, 3.6, and provide a descriptive, detailed response how its product and or service meets each requirement or functionality. Vendor shall also complete the Bid Proposal Submittal Form (Attachment 4).

3.4 REQUIREMENTS. The Incident Response and Forensic Investigation Services offered by the Vendor must meet or exceed the requirements of Section 3.4. The minimum requirements for services are:

3.4.1 Initial response time: Vendor shall provide remote collaboration with the ICN within hours (e.g. 4 hours) of notification. The Vendor will have the ability to have a certified incident handler onsite within days (e.g. 2 days) of notification.

3.4.2 Vendor shall have the ability to support both network and host based analysis to include:

3.4.2.1 Data and Database forensics (audit, access, destructive queries).

3.4.2.2 Guarantee chain of custody and evidence in a manner that will be legally upstanding.

3.4.2.3 Live memory data recovery.

3.4.2.4 Packet analysis.

3.4.2.5 Capability to work across multiple operating systems – (Windows, OS X, Linux, Unix, Android, iOS, etc.).

3.4.2.6 Capability to work across multiple active network and network security equipment – (Cisco, Juniper, Brocade, Ciena, CheckPoint, Fortinet, Palo Alto, etc.)

3.4.2.7 Capability to work across multiple security information and security event monitoring platforms – (LogRhythm, Elastic, Splunk, Event Manager, NetWitness, etc.)

3.4.3 Vendor shall have team members certified in network and system forensic tools (e.g., Encase, FTK, Wireshark, etc.).

3.4.4 Vendor shall have the ability to staff a forensics investigation team with Certified Forensic Examiners.

3.4.5 Vendor shall have the ability to staff an incident response team with Certified Incident Handlers.

3.4.6 Vendor shall confirm it will provide collaboration throughout the incident with the Iowa Communications Network Security Bureau.

3.4.7 Vendor shall have the ability to perform immediate remediation actions and develop long term remediation plans, based upon the vulnerabilities identified in the Incident Response and Forensic Investigation performed by the Vendor.

3.5 INCIDENT RESPONSE AND FORENSIC INVESTIGATION COSTS.

3.5.1 The ICN does not wish to enter into a retainer basis for use of forensic investigation services or remediation services. ICN shall consider “per hour” pricing. Vendor may provide one hourly rate or may provide a set of tiered hourly rates as they would be applied to different classifications of personnel that may be used during the service response.

3.5.1.1 Vendor shall identify if there is a minimum number of hours ICN would need to commit to when using the services on a per incident basis.

3.5.1.2 If Vendor provides these services on a contingency basis, ICN will consider the following rate structures:

3.5.1.2.1 A flat rate service for a specific amount of hours or a definitive SOW, (which must be provided), then an hourly rate for additional hours needed beyond the flat rate quoted.

3.5.1.2.2 Hourly rate per personnel classification position. Example: programmer I @ $50.00 per hour, Programmer II @ $60.00 per hour, Programmer III @ $70.00 per hour.

3.5.1.3 Vendor shall provide a “loaded” hourly or flat rate, which will include all administrative fees, software tools, licenses, etc. needed for the vendor personnel to perform the service.

3.5.1.4 Vendor shall confirm the rates quoted shall be fixed for the first year of any resulting contract. Vendor shall also detail any potential escalator for subsequent contract renewal periods.

3.5.1.5 The State has established rules for limitations on reimbursement expenses. For any expenses, Vendor is unable to include in the “loaded“ hourly or flat rate and for which the Vendor seeks reimbursement, Vendor shall reference Department of Administrative Services - State Accounting Enterprise Procedure 210-245 (accessible on the internet) for limits on travel expenses.

3.6 CYBER SECURITY SERVICES. Vendor shall provide a response to each sub-section of 3.6, detailing how its company provides the test, review or assessment. Each Vendor service description should entail a generic scope of work, identifying the methods Vendor uses for the service, approximate hours the service will take if limited by number of devices, number of users, time/duration, performed remotely or on site or other qualifiers including cost components (flat rate or hourly rate) for the service offered. After each test, review or assessment Vendor shall provide a report which identities critical vulnerabilities, serious vulnerabilities, and low to moderate vulnerabilities. The ICN intends to perform some type of Vulnerability Assessment or Penetration Testing annually.

3.6.1 Penetration Testing:

3.6.1.1 External Network Vulnerability Assessment and Penetration Testing

3.6.1.2 Internal Network Vulnerability Assessment and Penetration Testing

3.6.1.3 Wireless Network Assessment and Penetration Testing

3.6.1.4 Web Application Penetration Testing

3.6.1.5 Any other assessments offered by vendor relating to technical risk posture

3.6.2 Describe which network and system forensic tools (e.g., Encase, FTK, Wireshark, etc.) are used by team members performing the testing, reviews and assessments. Vendor shall provide supporting documentation.

3.6.3 Vendor shall detail security certifications that is employees or subcontractors hold, such as; Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CIS), Certified Ethical Hacker (CEH), GIAC Security Expert (GSE), EnCase Certified Examiner (EnCE), Certified Computer Examiner (CCE), GIAC Certified Forensic Examiner (GCFE), etc.

3.6.4 Describe how Vendor will be sharing data with the ICN while finding and working collaboratively on resolutions.

3.6.5 Service Level Agreements: Provide a copy of your standard Service Level Agreement(s) (SLA) which has been established and identify appropriate remediation’s in the event there is a lapse in service levels.

3.6.5.1 Provide your SLA for each of the following services you provide.

3.6.5.1.1 Environment Assessment

3.6.5.1.2 Investigation & Scoping

3.6.5.1.3 Containment

3.6.5.1.4 Remediation & Recovery

3.6.5.1.5 Malware – threat analysis

3.6.5.1.6 Forensics

3.6.5.1.7 Compromise Assessment

3.6.5.1.8 Other security services identified in this document.

3.6.6 Describe your employee workforce and if you hire employees specifically to support one-off incident engagements. Will the Vendor assign specific employees to the ICN account, utilize available personnel at the time of incident and or if necessary hire sub-contractors to fulfil the engagement?

3.6.6.1 Vendor shall detail the background checks it’s employee(s) and or subcontractor(s) must pass before they are hired or allowed to provide services to customers.

3.6.7 Describe how data will be protected if there is a need to remove data from ICN locations. Vendor shall also describe how it detects unauthorized access to ICN data held on your systems.

3.6.8 Describe how and where any sensitive data, including authentication information, is stored on clients, servers, and participating external devices while on ICN property, in transit, and while off ICN property. Is it cryptographically protected? If so, provide details.

3.6.9 Provide your process to inform the ICN of a Security Incident if ICN data is compromised while in your possession.

3.6.10 Describe if you currently have any Internet Service Provider (ISP) or broadband carrier customers utilizing your services.

3.6.11 Vendor shall provide 3 references to customers where you have provided the services requested within this RFP. Vendor shall provide company name, contact person, phone and e-mail address of the person ICN may contact.

3.6.12 Vendor shall confirm it is willing to provide a free consultation, demonstration of its skills prior to a contract award.

3.6.13 Vendor shall confirm its understanding that ICN reserves the right to award a contract to more than one Vendor, however ICN will not award duplicate contracts for the same security services identified within this chapter.

3.6.14 Vendor shall confirm its understanding that Vendor may also be used for cyber security assessments and evaluations of ICN and our authorized users physical and virtual network systems.

3.6.15 Vendor shall confirm its understanding that ICN may, at its sole discretion, entertain limited negotiation prior to contract signing and, as a result, revise the attached contract terms and conditions or performance requirements in the State’s best interests, provided that such revision of terms and conditions or performance requirements shall not materially affect the basis of response evaluations or negatively impact the competitive nature of the RFP and contractor selection process.

3.6.16 Vendor shall Identify what office and personnel footprint the company maintains in the State of Iowa.

CHAPTER 4

EVALUATION CRITERIA

4.1 Award Process.

4.1.1 An evaluation committee assigned by personnel within the ICN will review the Bid Proposals. The evaluation committee will consider all information provided when making its recommendation and may consider relevant information from other sources. By virtue of statutory authority, a preference will be given to products and provisions grown and coal produced within the State of Iowa.

4.1.2 The evaluation committee will make a recommendation to the Executive Director of the ICN indicating the committee’s recommendations for which Vendor(s) it believes the ICN should select to receive Contract. The Executive Director will select the Vendor to receive the award. The Executive Director is not bound by the committee’s recommendation. All Vendors submitting Bid Proposals will receive notification of the award.

4.1.3 All applicable contracting requirements imposed by this RFP and Iowa law shall be met by the Vendor. The successful Vendor(s) must, in a timely manner, enter into Contract with the ICN to implement the services contemplated by this RFP. Failure of a successful Vendor(s) to agree to the terms of a Contract within a timely manner may be grounds for the ICN to award to the next compliant Vendor for that site.

4.2 Evaluation Criteria. The bid proposals will be evaluated using a scoring system which will be made available at the time of the Bid Opening. Evaluation of bid proposals will be based on, but not limited to, the general criteria, included in the Vendor response to Chapter 3. It shall be Vendor’s responsibility to insure that the proposal offered fully iterates the Vendor ability to perform the RFP requirements, and to clearly show how the Vendor would perform the requested services. The ICN shall not necessarily award the contract to the Vendor offering the lowest cost to the State. The ICN may award a contract to the most responsible Vendor meeting the requirements of this RFP and which in the determination of ICN provides the best value to the State after considering price and compliance with the provisions of this request

ATTACHMENT 1

CONTRACT TERMS AND CONDITIONS

RFP 23-074

SECTION 1. IDENTITY OF THE PARTIES.

1.1 The Iowa Communications Network (ICN) is authorized by the Iowa Code Chapter 8D to operate a communications network in the State of Iowa. The ICN’s address is Grimes State Office Building, 400 East 14th Street, Des Moines, IA 50319.

1.2 Vendor is a corporation qualified to provide (list the service) and is authorized to conduct business in the State of Iowa. Vendor address is (awarded vendor will be listed).

SECTION 2. PURPOSE. The parties have entered into this Agreement for the purpose of XXXXXXXXXXXXXXXXXXXXXXXXXXX. ICN is entering into this Agreement pursuant to Iowa Code Chapter 8D.

SECTION 3. TERM. This Agreement is effective upon signature of both Parties and shall continue for (identify term & renewals). The Agreement may be renewed upon mutual written agreement of the Parties.

SECTION 4. DOCUMENTS INCORPORATED BY REFERENCE.

4.1 Incorporation of Bid Proposal Documents. The Request for Bid Proposal and the Vendor’s bid proposal in response to this RFP, together with any clarifications, attachments, appendices, amendments or other writings of the ICN or the Vendor (collectively bid proposal) are incorporated into this Agreement by this reference as if fully set forth in this Agreement.

4.2 Contractual Obligations of Vendor. The terms and conditions of the bid proposal and of the RFP are made contractual obligations of the Vendor.

4.3 Contents of Agreement. The parties acknowledge that this Agreement consists of this document as well as the RFP and the bid proposal and that the parties are obligated to perform as set forth in the RFP and the bid proposal to the same extent that they are obligated to perform the specific duties set forth in this document.

4.3.1 Order of Preference. In the case of any inconsistency or conflict between the specific provisions of this document, the RFP or the bid proposal, any inconsistency or conflict shall be resolved as follows:

4.3.2 First by giving preference to the specific provisions of this Agreement.

4.3.3 Second, by giving preference to the specific provisions of the RFP.

4.3.4 Third, by giving preference to the specific provisions of the bid proposal.

4.4 Intent of References to Bid Documents. The references to the parties' obligations, which are contained in this document, are intended to change, supplement or clarify the obligations as stated in the RFP and the bid proposal. The failure of the parties to make reference to the terms of the RFP or bid proposal in this document shall not be construed as creating a conflict and will not relieve the Vendor of the contractual obligations imposed by the terms of the RFP and the bid proposal. Terms offered in the bid proposal, which exceed the requirements of the RFP, shall not be construed as creating an inconsistency or conflict with the RFP or this document. The contractual obligations of the ICN cannot be implied from the bid proposal.

SECTION 5. DEFINITIONS. The following words shall have the meanings set forth below. Words in the singular shall be held to include the plural and vice versa, and words of gender shall be held to include the other gender as the context requires. For the purposes of this Contract, the following terms and all other terms defined in this Contract shall have the meanings so defined unless the context clearly indicates otherwise.

5.1 “State” shall mean the State of Iowa and all of its departments, boards, and commissions, including the ICN.

5.2 “ICN” shall mean the Iowa Telecommunications and Technology Commission operating the Iowa Communications Network.

5.3 “Vendor” shall mean [Vendor will be listed].

5.4 “Agreement” or “Contract” shall mean this document and any amendments to this document or any other documents incorporated by reference.

5.5 The Contract shall be available to all State of Iowa institutions, universities, schools, and political subdivisions.

SECTION 6. SCOPE OF WORK.

6.1 Scope of Services.

6.1.1. The services to be performed pursuant to and as a result of this Agreement by the Vendor are described on Schedule A attached hereto and made a part hereof by this reference.

6.1.2 The Vendor shall prepare and deliver specifications to the ICN which will detail the design, technical and functional capabilities, look and feel, and other attributes related to the project, all as more fully described in Schedule A.

6.2 Amendments to Scope of Services and Specifications. The parties agree that Schedule A, Scope of Services, and the specifications, may be revised, replaced, amended or deleted at any time during the term of this Agreement to reflect changes in service or performance standards upon the mutual written consent of the parties.

6.3 Brand Name or Equal Items. Unless otherwise provided in the invitation for bid, the name of a certain brand, make or manufacturer does not restrict bidders to the specific brand, make or manufacturer named; it conveys the general style, type, character, and quality of the article desired, and any article which the County in its sole discretion determines to be the equal of that specified, considering quality, workmanship, economy of operation, and suitability for the purpose intended, shall be accepted.

6.4 Formal Specifications. When a solicitation contains a specification which states no substitutes, no deviation therefrom will be permitted and the bidder will be required to furnish articles in conformity with that specification. The bidder shall abide by and comply with the true intent of the specifications and not take advantage of any unintentional error or omission, but shall fully complete every part as the true intent and meaning of the specifications and drawings. Whenever the mention is made of any articles, material, or workmanship to be in accordance with laws, ordinances, building codes, underwriter's codes, A.S.T.M. regulations or similar expressions, the requirements of these laws, ordinances, etc., shall be construed as to the minimum requirements of these specifications.

6.5 Industry Standards. Services rendered pursuant to this Agreement shall be performed in a professional and workmanlike manner in accordance with the terms of this Contract and with generally acceptable industry standards of performance for similar tasks and projects. In the absence of a detailed specification for the performance of any portion of this Agreement the parties agree that the applicable specification shall be the generally accepted industry standard. As long as the ICN notifies Vendor promptly of any services performed in violation of this standard, Vendor will re-perform the services, at no cost to ICN, such that the services are rendered in the above-specified manner.

6.6 Non-Exclusive Rights. This Agreement is not exclusive. The ICN reserves the right to select other Vendors to provide services similar or identical to the Scope of Services described in this Agreement during the term of this Agreement.

6.7 Staffing. The ICN reserves the right to disapprove any employee of Vendor who is assigned to provide services pursuant to this Agreement or to request Vendor to remove an employee from providing services pursuant to this Agreement at any time during the Agreement’s duration if the employee fails to perform as required by Vendor and/or ICN, which includes adherence to State of Iowa work rules and policies including background checks and training requirements.

SECTION 7. COMPENSATION.

7.1 Payment Terms. The Vendor shall identify services rendered and submit itemized invoices for amounts owed on a monthly basis. ICN shall pay all approved invoices in arrears and in conformance with Iowa Code. ICN may pay invoices in less than 60 days as provided in Iowa Code; however, an election to pay in less than sixty (60) days shall not act as an implied waiver of Iowa Code. Any sums owed to ICN by the Vendor shall be itemized and deducted from the Vendor’s invoice prior to submission. Notwithstanding anything herein to the contrary, ICN shall have the right to dispute any invoice submitted for payment and withhold payment of any disputed amount if ICN believes the invoice is inaccurate or incorrect in any way. Invoices shall be submitted to ICN Finance – Accounts Payable, Grimes State Office Building, 400 East 14th Street, Des Moines, IA 50319.

7.2 Pricing. The pricing matrix is described in Schedule A. The parties agree that the pricing may be revised, replaced, amended or deleted at any time during the term of this Agreement upon the mutual written consent of the parties.

7.2.1 If Vendor fails to submit an invoice within 60 days after shipment of the goods or provision of the service pursuant to this Contract, the ICN shall be excused from any liability owing to the Vendor and shall not pay invoices submitted after the 60th day. Additionally, ICN must receive all fiscal year invoices no later than July 15. ICN shall be excused from any liability owing to the Vendor and shall not pay invoices submitted after July 15.

7.3 Reimbursable Expenses. There shall be no reimbursable expenses associated with this Agreement separate from the compensation referred to in this section. Vendor shall be solely responsible for all costs and expenses, including, but not limited to, travel, mileage, meals, lodging, equipment, supplies, personnel, training, salaries, benefits, insurance, conferences, long distance telephone, and all other costs and expenses of Vendor.

7.4 Freight. The ICN requests that all shipments be quoted and delivered F.O.B. Point of Destination, Freight paid by Vendor. Vendor bears all risk of loss during shipment of goods. The Vendor shall properly package goods. The State will not accept noticeably damaged goods. The State reserves the right to inspect the goods at a reasonable time subsequent to delivery in the event the State is unable to perform an adequate inspection of the goods at the time of delivery. If the State discovers damaged or defective goods not readily apparent at the time of delivery, the State shall have the right to return goods at no cost to the State, regardless of when the damage or defect is discovered.

...