THE UNIVERSITY OF THE WEST INDIES · a.Supply, configure and deliver a Unified Threat Management...

THE UNIVERSITY OF THE WEST INDIES

OPEN CAMPUS ST. AUGUSTINE, TRINIDAD AND TOBAGO

OFFICE OF THE CHIEF INFORMATION OFFICER The University of the West Indies, St Augustine Campus, Trinidad and Tobago Phone: (868-663-8155); Phone/Fax: (868-645-9741); Email: [email protected]

________________________________________________________________________________________________________

July 31, 2018

Request for Proposal for a Unified Threat Management (UTM) solution

The University of the West Indies (UWI), Open Campus, is seeking the services of qualified vendors experienced in supplying and configuring a Unified Threat Management (UTM) solution for our sites throughout the Caribbean.

You are invited to submit your proposal following the guidelines presented in the attached RFP. We are also kindly asking that you pay particular attention to the Calendar of Events listed on page twelve (12).

Please submit an electronic copy of your RFP to [email protected] clearly marked “Request for Proposal for a Unified Threat Management (UTM) solution”, between the hours of 8:30 am to 4:30 pm, on the date specified.

Request for Proposal:

Unified Threat Management

(UTM) Solution

1. General Conditions 3 1.1 Cost of Proposals 3 1.2 Right of Rejection 3

2. Introduction 4 2.1 Purpose of RFP 4 2.2 Background Information 4

2.2.1 About the UWIOC 4 2.2.2 SDEC Project Funding 4

2.3 Existing Technology Infrastructure 5 2.3.1 Network Infrastructure 5

3. Project Description 7 3.1 Project Objectives 7 3.2 Project Scope Overview 7

3.2.1 Recommended Project Logistics 7 3.3 Solution Description 8

3.3.6 Site Requirements 10

4. Calendar of Events 12

5. Proposal Submissions 13 5.1 General 13 5.2 Proposal Format 13 5.3 References 14

6. Evaluation Process 15 6.1 Evaluation Criteria 15

Appendix A. Statement of Vendor’s Qualification 16

Appendix B. Contract Pricing Form 18

Appendix C. Detailed Pricing Form 19

Appendix D. Requirements Compliance Form 20

CONFIDENTIAL PAGE 2 of 22

1. General Conditions ● This RFP is not a contract offer. ● Receipt of a proposal neither commits UWIOC/SDEC to award a contract to any vendor,

nor limits our rights to negotiate in our best interest. ● UWIOC/SDEC reserves the right to contract with a vendor for reasons other than price. ● Failure to answer any questions in this RFP may subject the proposal to disqualification. ● UWIOC/SDEC reserves the right to request additional information that is necessary and

pertinent to the project or to assure that the vendor's adequate competence to perform according to bid specifications.

● Products and services which are not specifically requested in the RFP but which are necessary to provide the functional capabilities proposed by the vendor shall be included in the proposal.

● Prices are to be quoted in (US$) – VAT Exclusive. ● The final prices quoted shall include: the price delivered to site, as specified in the

contract pricing forms, inclusive of any handling charges, and any other incidental charges.

1.1 Cost of Proposals Expenses incurred in the preparation of proposals in response to this RFP are the sole responsibility of the vendor.

1.2 Right of Rejection UWIOC/SDEC reserves the right to accept or reject any and all proposals, or any part of any proposal, without penalty. UWIOC/SDEC may award a contract to a single contractor for all elements for the entire project or may award any of the elements separately. In addition, UWIOC/SDEC reserves the right to fund (and proceed with project or purchase), not to fund the project, or to partially fund the project. Any allowance for oversight, omission, error, or mistake by the bidder made after receipt of the proposal will be at the sole discretion of UWIOC/SDEC.


2. Introduction

2.1 Purpose of RFP UWIOC/SDEC is seeking the services from qualified vendors experienced in supplying and configuring a Unified Threat Management (UTM) solution for our sites throughout the Caribbean. This RFP provides the requirements and evaluative criteria and requests detailed responses from all prospective vendors, including pricing and service descriptions, in a specified format. UWIOC/SDEC will conduct a review of the responses received to this RFP.

2.2 Background Information

2.2.1 About the UWIOC The UWI, Open Campus is the newest campus of the 70-year-old University of the West Indies (The UWI, 1948), and was formally launched in Antigua & Barbuda in June 2008. The Open Campus is an amalgamation of the previous Office of the Board for Non-Campus Countries & Distance Education (BNNCDE), the School of Continuing Studies (SCS), the UWI Distance Education Centre (UWIDEC), and the Tertiary Level Institutions Unit (TLIU). The UWI Open Campus offers multi-mode teaching and learning services through virtual and physical site locations across the Caribbean region. There are nearly 50 site locations of the Open Campus in the region, serving 17 countries in the English-speaking Caribbean. The Open Campus has developed a unique approach in the Caribbean region to enhancing the student experience in innovative continuing and professional education, undergraduate, postgraduate and community-based outreach programmes and courses by distance, blended, online and face-to-face learning modes.

2.2.2 SDEC Project Funding On March 27, 2013 the Global Affairs Canada (GAC), formerly Department of Foreign Affairs, Trade and Development (GAC/CIDA) and the UWIOC signed a contribution agreement for a project entitled “UWI Open Campus – Strengthening Distance Education in the Caribbean” (SDEC). This agreement will covers the period from March 27, 2013 to March 31, 2019. Among other outputs, the project will create and implement new market-driven responsive Distance Education courses and programmes, and strengthen the long term capacity of UWI as an institution. The latter includes strengthening human resource and ICT-driven institutional


infrastructure such as structures, systems, business processes and, to a very limited extent, physical facilities of the University in support of the new programmes.

2.3 Existing Technology Infrastructure

2.3.1 Network Infrastructure The UWI, Open Campus has a private IP network connecting nearly 50 sites in 16 countries. The topology of the network is a dual hub and spoke with the hubs in Miami, Florida, United States and St. Augustine, Trinidad and Tobago as illustrated below. Figure 1: UWIOC Network

Each site is connected to the internet (via ADSL or Cable Modem). Each site is equipped with a Cisco ISR 4331 (large sites are equipped Cisco ISR 4431 router) and uses Cisco’s Dynamic Multipoint Virtual Private Network (DMVPN) technology to provide secure inter-site connectivity over the Internet UWIOC sites are categorized into small, medium and large based on the number of staff, students, computers, switch ports, access points, IP Phones and internet connectivity.


Table 1: UWIOC Site Types

Small Medium Large

No. of Staff 1-5 10-20 50-100

No. of Students 20-100 100-500 500-1000

No. of Computers 1-25 25-50 50-100

No. of Switch Ports 4-24 24-96 96-144

No. of Access Points 1-5 5-10 10-20

No. of IP Phones 1-5 10-20 50-100

Internet Connection Type: ADSL/Cable Type: ADSL/Cable Type: DIA

Down: 1-10Mbps Up: 256Kbps – 2Mbps

Down: 5-20Mbps Up: 768Kbps – 3Mbps

Down: 50-100Mbps Up: 10-100Mbps


3. Project Description

3.1 Project Objectives UWIOC/SDEC is soliciting proposals from experienced and highly qualified firms to provide a solution for a Unified Threat Management (UTM) solution for our sites. An award from this RFP is expected to result in a fixed price contract for the purchase, configuration and delivery of the proposed UTM solution at our sites. The proposed solutions should include product support and maintenance for one year.

3.2 Project Scope Overview The following is a summary of the scope of the project:

a. Supply, configure and deliver a Unified Threat Management solution meeting or exceeding the requirements specified in section 3.3

b. Provide training for a minimum of five staff on the solutions proposed The following is a summary of items not in the scope of the project:

a. Project management b. Network migration c. Final installation of appliance at UWIOC sites

3.2.1 Recommended Project Logistics The following is the recommended delivery process and schedule:

a. Solution to be delivered in four batches i. Trinidad ii. Jamaica iii. Barbados iv. All other countries with UWIOC sites. The British Overseas Territories (BOTs) of

Anguilla, Bermuda, British Virgin Islands, Monserrat, The Cayman Islands and Turks and Caicos Islands are not funded under the UWIOC/ SDEC Project.

b. Batch i, ii, and iii to be delivered first c. Batch iv to be held until batch i, ii, and iii have been deployed


3.3 Solution Description In an effort to evaluate all available solutions, UWIOC/SDEC has established an independent set of minimum requirements. Each bid must meet or exceed the requirements in order to be considered. Each bid must submit a completed requirements compliance sheet indicating the solutions compliance/non-compliance with the requirements listed below: Table 2: UTM Requirements Technical Specifications and Standards for UTM

1 General Requirements

1.1 Must be an appliance based device deployed at each UWIOC site network edge

1.2 Must be rack mountable

1.3 Should provide a virtual machine (VMWare compatible) or cloud based central management services

1.4 Should NOT be licensed by the total number of users

2 Network Requirements

2.1 Must have Gigabit Ethernet (GE) WAN port(s).

2.2 Must have Gigabit Ethernet (GE) LAN port(s).

2.3 Must support a minimum throughput of 250Mbps with all UTM features simultaneously enabled

2.4 Must support a minimum of 100 concurrent users, 1000000 sessions with all UTM features enabled

2.5 Must support bandwidth management based on application and user identity

2.6 Must support the standards based switching protocols (e.g. IEEE 802.1q, 802.1d)

2.7 Must support the standards based routing protocols (e.g. RIPv2, OSPFv3, BGPv4)

2.8 Must support standards based security protocols (e.g. IPSEC, IKE, SSL, TLS, SSH)

2.9 Must support local (on appliance) password authentication, and network based RADIUS or LDAP or other centralised/network authentication

2.10 Must allow pass thru of Cisco DMVPN traffic or provide alternative dynamic site to site VPN solution that supports multiple sites behind NAT

3 UTM Appliance Requirements

3.1 Must support configurable policies

3.2 Must support stateful policy inspection

3.3 Must have intrusion detection system and intrusion prevention system (IDS and IPS)

3.4 Minimum 250 Mbps of IPS throughput

3.5 Must have antivirus and anti-malware system (AV)

3.6 Must have update mechanism of definitions and signatures for IPS, IDS and AV


3.7 Minimum 250 Mbps of Antivirus Throughput

3.8 Must have configurable web content filtering, supporting: a. URL blocking and exemption, b. URL rating c. URL categorisation

3.9 Must have configurable application filtering / Web Application Firewall (WAF)

3.10 Must have configurable protection against Denial of Service (DoS) and Dynamic Denial of Service (DDoS)

3.11 Must provide filtering capability that includes parameters like source addresses, destination addresses, source and destination port numbers, protocol type

4 Management and Reporting Requirements

4.1 Must have centralised management system with logging, alerting and reporting features

4.2 Must have management system capable of simplified device provisioning

4.3 Must have management system capable of pushing policies and configurations to individual or multiple devices (under the control of the management system)

4.4 Must have management system capable of providing basic statistics about the health of the devices and the amount of traffic traversing the firewall

4.5 Must have management system capable of generating reports of blocked connections, intrusion, detected malware, etc

5 Training Requirements

5.1 Provide official vendor training for a minimum of five (5) staff members on the proposed products. Online self-paced training is preferred. Instructor led training is acceptable.

5.2 Provide hands on training for a minimum of five (5) staff members on the operations, administration and maintenance of proposed solution inclusive of hardware and software.


3.3.6 Site Requirements Table 3: UWIOC Sites UTM Appliance Requirement

Country Site UTM Appliance Required

Small Medium Large

Anguilla The Valley 0 0 0

Antigua St. John's 0 1 0

Bahamas Nassau 0 1 0

Barbados Cave Hill 0 1 1

Barbados The Pine 0 1 0

Barbados Belleville 1 0 0

British Virgin Islands Road Town 0 0 0

Cayman Islands George Town 0 0 0

Dominica Roseau 0 1 0

Grenada St. George's 0 1 0

Jamaica Brown's Town 0 1 0

Jamaica Camp Road 0 1 0

Jamaica Junction 0 1 0

Jamaica Mandeville 0 1 0

Jamaica May Penn 0 1 0

Jamaica Mona 0 1 1

Jamaica Morant Bay 0 1 0

Jamaica Ocho Rios 0 1 0

Jamaica Port Antonio 0 1 0

Jamaica Savanna-La-Mar 0 1 0

Montserrat Plymouth 0 0 0

St. Lucia Castries 0 1 0

St. Kitts and Nevis Nevis 0 1 0

St. Kitts and Nevis Basseterre 0 1 0

St. Vincent Kingstown 0 1 0

Tobago Signal Hill 0 1 0

Trinidad Alpha East 1 0 0

Trinidad Barataria 1 0 0


Trinidad Belmont 1 0 0

Trinidad Carapichaima 1 0 0

Trinidad Chaguanas 0 0 1

Trinidad El Dorado 1 0 0

Trinidad Gordon Street 0 1 0

Trinidad Marabella 1 0 0

Trinidad Mayaro 1 0 0

Trinidad Mucurapo 0 1 0

Trinidad Point Fortin 1 0 0

Trinidad Pre-University 1 0 0

Trinidad Princes Town 0 1 0

Trinidad San Fernando 0 1 0

Trinidad Sangre Grande 0 1 0

Trinidad St. Augustine 0 1 1

Trinidad Valpark 0 1 0

Turks and Caicos Cockburn Town 0 0 0

United States Miami 0 0 1

Subtotals 10 28 5

Total 43

The British Overseas Territories (BOTs) of Anguilla, Bermuda, British Virgin Islands, Monserrat, The Cayman Islands and Turks and Caicos Islands are not funded under the UWIOC/ SDEC Project, and no UTM Appliance will be allocated to these UWIOC sites.


4. Calendar of Events The following table summarizes the calendar of events. Table 4: RFP Calendar of Events Event Proposed Date

Distribute RFP 30th July 2018

Mandatory vendor conference 6th August 2018 (10:00AM EC Time)

Deadline for submission of questions 13th August 2018 (4:00PM EC Time)

Response to questions 20th August 2018 (4:00PM EC Time)

Deadline for receipt of proposals 27th August 2018 (4:30PM EC Time)

Review proposals and make recommendation for selection of vendor(s).

3rd September 2018

Approval and announcement of vendor selection 10th September 2018


5. Proposal Submissions

5.1 General The proposals shall be used to determine the applicant’s capability of rendering the services to be provided. Failure to fully comply with the instructions in this RFP may eliminate the vendor’s proposal from further evaluation as determined at the sole discretion of UWIOC/SDEC. UWIOC/SDEC reserves the right to evaluate the contents of proposals submitted in response to this RFP and to select a successful vendor, or none at all. UWIOC/SDEC reserves the right to waive any requirements of this RFP when it determines that waiving a requirement is in the best interest of UWIOC/SDEC. The proposal is to include contact information, including principle contacts and officers, main and local business addresses, tax identification number, voice and fax phone numbers and email addresses.

5.2 Proposal Format All proposals should be typewritten; have consecutively numbered pages; including any exhibits, charts, or other attachments. Proposals shall be organized into the following major sections: 1. Cover Letter

The letter shall identify core team, provide name of contact person, phone number and fax number, summarize vendor’s history and other completed projects most relevant to the RFP. 2. Executive Summary

The Executive Summary shall provide an overview of the project and indicate the project’s complexity and the vendor’s ability to resolve inherent project problems. This section should also include a brief narrative highlighting company’s background and experience. Narrative should clearly demonstrate vendor ability to provide the products and services required in this RFP. 3. Company Background and History

a. Describe experience of firm in general providing consulting/professional services. b. Describe relevant services carried out in the last three (3) years that illustrate firm’s

experience as it relates to this RFP. c. Include partner certifications for all products proposed. d. Provide CVs/resumes of all professional staff that will be working on the project.


4. Project Management and Logistics

Please include the following information in the section: a. Provide a brief description of how the vendor proposes to successfully manage this

project and meet the goals and objectives of this RFP. b. Include a description of how the project team will be structured, its roles and

responsibilities, location within the company’s organizational framework. c. Provide a detailed timeline and milestone schedule.

5. Cost Proposal

a. Provide an overview of the proposed solution. b. Provide a completed UTM Solution Requirements Compliance form c. Define scope of work and all costs associated with the services defined in your proposal.

Provide detailed pricing for the proposed solution; include separate costs for hardware components, software components, and support costs. The cost proposal must set forth all costs associated with the proposed scope of work for the RFP. The vendor must acknowledge that all costs, including travel required to meet the RFP requirements are included. Any purchase contract signed will be a fixed price contract and no other costs will be allowed for performance of vendor proposed solution. A proposal for the price of purchase should be submitted with a purchase contract if required. 6. Exceptions to the RFP

Any variance to the requested technical specifications or proposal must be explained under this section. 7. Required Attachments

a. Appendix A. Statement of Vendor’s Qualification b. Appendix B. Contract Pricing Form c. Appendix C. Detailed Pricing Form d. Appendix D. Requirements Compliance Form

5.3 References Include three references for customers of similar scope and size. References in higher education are preferred. This reference list shall include the following information:

● Organization Name ● Customer Contact – name, title and contact information ● Address ● Date of work performed ● Brief description of work performed


The applicant must sign proposals. An unsigned proposal may be rejected.

6. Evaluation Process Selection of the successful proposal shall be generally based on the information provided by the vendor/supplier in response to the RFP and any subsequent interviews that may be conducted. Vendor/supplier interviews will be held solely at the option and discretion of UWIOC/SDEC. The process for selection shall occur in the following sequence:

● Review and evaluate proposals ● Establish a "short list" of qualified firms ● Interview "short-listed" firms ● Identify the best qualified firm ● Contract negotiations ● Award contract

6.1 Evaluation Criteria UWIOC/SDEC evaluates and weighs the follow criteria when evaluating vendor’s responses. These standards are listed in descending order of importance. Table 5: RFP Evaluation Criteria and Weighting

Evaluation Criteria Weight

Cost 40

Technical Specifications 40

Implementation methodology 10

References, experiences and capabilities of vendor 10


Appendix A. Statement of Vendor’s Qualification

1. Legal Business Name:

2. DBA (Doing Business As) Name, if applicable:

3. Business Office Address:

1. Street:

2. City, State, Zip:

3. Country:

4. Telephone Number:

5. Fax Number:

6. Email:

7. URL:

4. Business Effective Date:

5. Organized Business Status:

___ Corporation ___ Partnership

___ Individual/Sole proprietor

___ Other

6. How many years have you been engaged in the business under your present name?

7. What other names(s) if any has your business/company operated under and taxpayer number used?

8. Please list the names of your personnel authorized to sign legal and binding Bid Documents.

9. Please attach to this statement at least three references, including: name, address, title, telephone number and brief description of work performed, including dates of work.


The above statements must be subscribed and sworn before a Notary Public.

Authorized Representative

Signature

Date

Name

Title

Email Address

Telephone Number

Fax Number


Appendix B. Contract Pricing Form Item Description Cost

1 Professional Services

1.1 Project Management

1.2 Logistics

Sub-total

2 UTM Appliance

2.1 Hardware

2.2 Software

2.3 Configuration Services

2.4 Maintenance

2.5 Shipping/Handling/Customs/Duties

Sub-total

3 UTM Central Management

3.1 Software

3.2 Configuration Services

3.3 Maintenance

Sub-total

4 Training

4.1 Vendor Training

4.2 Hands-on Training

Sub-total

Grand Total


Appendix C. Detailed Pricing Form

Item # Part # Description Quantity Unit Price Academic

Discount

(%)

Discounted

Price Ext Price

1

1.1

1.2

2

2.1

2.2

2.3

2.4

2.5

3

3.1

3.2

3.3

4

4.1

4.2


Appendix D. Requirements Compliance Form Please state compliance for each item (Yes/No)

Technical Specifications and Standards

for UTM Compliance Remarks/Notes

1 General Requirements

1.1 Must be an appliance based device deployed at each UWIOC site network edge

1.2 Must be rack mountable

1.3 Should provide a virtual machine (VMWare compatible) or cloud based central management services

1.4 Should NOT be licensed by the total number of users

2 Network Requirements

2.1 Must have Gigabit Ethernet (GE) WAN port(s).

2.2 Must have Gigabit Ethernet (GE) LAN port(s).

2.3 Must support a minimum throughput of 250Mbps with all UTM features simultaneously enabled

2.4 Must support a minimum of 100 concurrent users, 1000000 sessions with all UTM features enabled

2.5 Must support bandwidth management based on application and user identity

2.6 Must support the standards based switching protocols (e.g. IEEE 802.1q, 802.1d)

2.7 Must support the standards based routing protocols (e.g. RIPv2, OSPFv3, BGPv4)

2.8 Must support standards based security protocols (e.g. IPSEC, IKE, SSL, TLS, SSH)

2.9 Must support local (on appliance) password authentication, and network based RADIUS or LDAP or other centralised/network authentication

2.10 Must allow pass thru of Cisco DMVPN traffic or provide alternative dynamic site to site VPN solution that supports multiple sites behind NAT


3 UTM Appliance Requirements

3.1 Must support configurable policies

3.2 Must support stateful policy inspection

3.3 Must have intrusion detection system and intrusion prevention system (IDS and IPS)

3.4 Minimum 250 Mbps of IPS throughput

3.5 Must have antivirus and anti-malware system (AV)

Must have update mechanism of definitions and signatures for IPS, IDS and AV

3.6 Minimum 250 Mbps of Antivirus Throughput

3.7 Must have configurable web content filtering, supporting: a. URL blocking and exemption, b. URL rating c. URL categorisation

3.8 Must have configurable application filtering / Web Application Firewall (WAF)

3.9 Must have configurable protection against Denial of Service (DoS) and Dynamic Denial of Service (DDoS)

3.10 Must provide filtering capability that includes parameters like source addresses, destination addresses, source and destination port numbers, protocol type

4 Management and Reporting Requirements

4.1 Must have centralised management system with logging, alerting and reporting features

4.2 Must have management system capable of simplified device provisioning

4.3 Must have management system capable of pushing policies and configurations to individual or multiple devices (under the control of the management system)

4.4 Must have management system capable of providing basic statistics about the health of the devices and the amount of traffic traversing the firewall


4.5 Must have management system capable of generating reports of blocked connections, intrusion, detected malware, etc

5 Training Requirements

5.1 Provide official vendor training for a minimum of five (5) staff members on the proposed products. Online self paced training is prefered. Instructor led training is acceptable.

5.2 Provide hands on training for a minimum of five (5) staff members on the operations, administration and maintenance of proposed solution inclusive of hardware and software.


THE UNIVERSITY OF THE WEST INDIES · a.Supply, configure and deliver a Unified Threat Management...

Documents

Transcript of THE UNIVERSITY OF THE WEST INDIES · a.Supply, configure and deliver a Unified Threat Management...