Loading...
HomeMy WebLinkAbout2018 Resolution No. 027RESOLUTION NO. 27 SERIES OF 2018 A RESOLUTION A WARDING A SOLE SOURCE CONTRACT FOR THE PURCHASE OF A FIREWALL UPGRADE FOR THE CITY OF ENGLEWOOD COMPUTER NETWORK FROM SHI INTERNATIONAL CORPORATION WHEREAS, Section 116(b) of the Englewood Home Rule Charter and Section 4-1-3-1 of the Englewood Municipal Code 2000, allow contracts for public works or improvements to be negotiated, provided that contracts for which no competitive bids have been requested to be approved and accepted by resolution declaring the reason for the exception to the competitive bidding requirement; WHEREAS, the Englewood Information Technology department would like to purchase a firewall security upgrade from SHI International Corporation, for the installation and upgrade to the City's computer network; WHEREAS, the Information Technology Department has taken advantage of the pricing through the Fortinet Master Agreement, which allowed the City to utilize the cooperative bid through the National Cooperative Purchasing Alliance; WHEREAS, due to an increase in demand the City's current firewall has become out dated making the City's computer network vulnerable to outside computer attacks and data breaches, this upgrade will allow for the maximization of the City's investment in its computing infrastructure; WHEREAS, SHI International Corporation is a reseller of Fortinet, Inc., second-generation cyber security tools, which not only secure network connections, but ensure the integrity of the content inside the connections; WHEREAS, the funds for the purchase would come from the Information Technology Capital Funds IT Network Development 2018 budget which currently has $102,677.00; and WHEREAS, the cost of the installation of the firewall system would be $52,429.47. NOW, THEREFORE, BE IT RESOLVED BY THE CITY COUNCIL OF THE CITY OF ENGLEWOOD, COLORADO, AS FOLLOWS: Section I. The Englewood City Council hereby authorizes the purchase and installation of a firewall upgrade from SHI International Corporation the City Englewood's computer network system utilizing the National Cooperative Purchasing Alliance in lieu of the competitive bid process as allowed by Section I 16(b) of the Englewood Home Rule Charter in the amount of $52,429.47, as set forth in the SHI International Corporation Proposal, attached hereto as Exhibit A. ADOPTED AND APPROVED this 17th day of December, 2018. ATTEST: I, Stephanie Carlile, City Clerk for the City of Englewood, Colorado, hereby certify the above is a true copy of Resolution No. 27, Series of 2018. National Cooperative Purchasing Alliance Master Agreement F:::RTlnET. RFP 02-18, IT Securlly and Data Protection Solutions obligated, liable or responsible for any failure by the Public Agency to (I) comply with procedures or requirements of applicable law, or (ii) obtain the due authorization and approval necessary to purchase under the Master Agreement. NCPA makes no representations or guaranties with respect to any minimum purchases required to be made by Region 14 ESC, any Public Agency, or any employee of Region 14 ESC or Public Agency under this Agreement or the Master Agreement ► The Public Agency participating in the NCPA contract and Vendor may enter into a separate supplemental agreement to further define the level of service requirements over and above the minimum defined in this contract i.e. invoice requirements, ordering requirements, specialized delivery, etc. Any supplemental agreement developed as a result of this contract is exclusively between the Public Agency and Vendor. NCPA, its agents, members and employees shall not be made party to any claim for breach of such agreement ♦ Term of Agreement ► This Agreement shall be in effect so long as the Master Agreement remains in effect, provided, however, that the obligation to pay.all amounts owed by Vendor to NCPA through the termination of this Agreement and all indemnifications afforded by Vendor to NCPA shall survive the term of this Agreement. ♦ Fees and Reporting ► The awarded vendor shall electronically provide NCPA with a detailed monthly or quarterly report showing the dollar volume of all sales under the contract for the previous month or quarter. Reports shall be sent via e-mail to NCPA offices at reporting@ncpa.us. Reports are due on the fifteenth (15 1h) day after the close of the previous month or quarter. It is the responsibility of the awarded vendor to collect and compile all sales under the contract from participating members and submit one (1) report. The report shall include at least the following information as listed in the example below: Entity Name Zip Code State PO or Job# Sale Amount March 20, 2018 Total ► Each quarter NCPA will invoice the vendor based on the total of sale amount(s) reported. From the invoice the vendor shall pay to NCPA a n administrative fee based upon the tiered fee schedule below. Vendor's annual sales shall be measured on a calendar year basis. Deadline for term of payment will be included in the invoice NCPA provides. 8nnmtl Sale~ Throu2l1 Contr!lct Admini~tratjve Fe~ 0 -$30,000,000 2% $30,000,001-$50,000,000 1.5% $50,000,001+ 1% 12 F S::RTlnET RFP 02-18, IT Security and Data Protection Solutlons Tab 3 -Vendor Questionnaire Please provide responses to the following questions that address your company's operations, organization, structure, and processes for providing products and services. ♦ States Covered March 20, 2018 ► Bidder must indicate any and all states where products and services can be offered. ► Please indicate the price co-efficient for each state if it varies. 181 SO States & District of Columbia (Selecting this box is equal to checking all boxes below) □Alabama □Maryland D South Carolina □Alaska D Massachusetts D South Dakota □Arizona D Michigan □Tennessee □Arkansas D Minnesota □Texas D California D Mississippi Dutah D Colorado D Missouri □Vermont D Connecticut D Montana □Virginia D Delaware D Nebraska D Washington D District of Columbia □Nevada D West Virginia 0 Florida D New Hampshire □Wisconsin D Georgia D New Jersey □Wyoming D Hawaii D New Mexico □Idaho D New York D [))inois D North Carolina D Indiana D North Dakota □Iowa □Ohio D Kansas Ooklahoma □Kentucky Ooregon D Louisiana D Pennsylvania □Maine D Rhode Island [g1 All US Territories and Outlying Areas (Selecting this box is equal to checking all boxes below) D American Samoa D Federated States of Micronesia OGuam D Northern Marina Islands D Puerto Rico D U.S. Virgin Islands 13 RFP 02-18, IT Security and Data Protection Solutions • Sales/Purchase Orders Contact Person: Title: Company: Address: City Phone: Jeff Jennings National SLED Practice Director Forti.net, Inc. 899 Kifer Rd. Sunnyvale (661) 302-8909 State Email: CA Zip w.86 jji;nnings@fmrinet,c!llll • Marketing Contact Person: Title: Company: Address: City Phone: Sowjanya O'Neill Senior Manager, SLED Marketing Forti.net, Inc. 12005 Sunrise Valley Drive, Suite 204 Reston State VA Zip 2fil.2l. ----- (703) 65106198 Email: sooeiD@fortinet.com --------- ♦ Pricing Information March 20, 2018 ► In addition to the current typical unit pricing furn ished herein, the Vendor agrees to offer all future product introductions at prices that are proportionate to Contract Pricing. • If answer is no, attach a statement detailing how pricing for NCPA participants would be calculated for future e!:_Oduct introductions. ~ Yes D No ► Pricing submitted includes the required NCPA administrative fee. The NCPA fee is calculated based on the invoice price to the customer. ~ Yes 0 No ► Vendor will provide additional discounts for purchase of a guaranteed quantity. See explanation below D Yes ~ No. Vendor~ provide additional discounts (discretionary) based on considerations including, but not limited to, guaranteed quantity or order size. 1$ F:::RTlnET RFP 02-18, IT Security and Data Protection Solutions ia1nc - ,, • I I By 2002. Fortinet had brought the approach described above to market with the introduction of FortiGate, our line of next-generation firewalls. By the time we became a publicly traded company (NASDAQ:FfNl) in 2009, our broad line of FortiGate firewalls had earned a solid reputation in the marketplace for scalability, high security effectiveness. and unsurpassed performance. This flagship product line is the reason why Fortinet is now recognized by Gartner, Inc. as a market leader in both the unified threat management (UTM) device and the enterprise firewall markets. It is also the key reason why data from the market research firm IDC (www.idc.com) shows that Fortinet now ships more network security appliances annually than Cisco, Checkpoint, Juniper, or Palo Alto Networks (See Figure 1.) Figura 1. Annual Shipments of Network Security Appliances With our IPO behind us and with the steady growth of our FortiGate customer base, Fortinet began to formulate is vision for a third-generation of cybersecurity tools. As Figure 2 shows, our vision acknowledges that it is no longer enough to secure IT networkr. In today's world, our focus must be on securing IT infazstmdurt -from the client to the network to the cloud to the Internet of Things. This shift has led us to expand our product portfolio to include new physical and virtual security appliances used to secure web applications, wireless networks, and email gateways. It has led also led us to introduce new products for detecting and analyzing zero-day threats and products that make it easier for organizations to manage their IT security operations and comply with applicable security policies and regulations. In expanding our product portfolio, we have stressed: (1) making it easier to share threat information not only among our own product but also with third-party products and (2) using artificial intelligence to automate many threat detection/response activities that, until now, had to be performed manually. This frees up our customers' security experts to focus on more complex tasks and means that our customers can respond faster to cyber threats. ------ 1 , 1" GENERATION ➔ 2"' GENERATION ➔ 3"' GENERATION I FIREWALL Connectivity ' F O ~n~ l!l'.15 NGFW Content 2000 N•twaftc Application S«u11y - Cloud Clmt/loT lioCla 5ec""'1 Infrastructure CD ! • 2015 ' sonw .. n~ + SECURITY + mTEQIIATIOl'4 • Pnocessons 1,uroMATION Figure 2. Cybersecurity from Generation 1 to Generation 3: Fortlnet's Role In This Evolution The corporate evolution summarized above has made us a profitable company. We are debt-free, have annual sales of more than $1.4 billion, and have more than $1 billion in cash on hand to continue doing what we do best innovate. March 20, 2018 11 RFP 02·18, IT Security and Data Protection Solutions • A dedicated Sales Engineering Leader who is responsible for managing the pre-sales engineering support we provide to customers and resellers in our US Sales regions. • Field Resource Teams that cover designated territories within each region. These teams include: o Account Managers and Sales Engineers who provide sales support to customers and resellers. This includes Account Managers/Sales Engineers who are focused specifically on the SLED market. o Channel Managers who recruit and support qualified, capable resellers throughout each region. o Field Marketing Managers who provide marketing support within the region. Figure 4 shows the project team responsible for the success of the NCPA contract. As the Figure shows, Mike Bossert, the Senior Vice President for North American Sales, is the Executive Sponsor for the contract. In that capacity he has overall responsibility for our performance on the contract. He will meet with our designated NCPA Contract Manager OD a regular basis to review contract status and will receive regular status reports. Our designated Contract Manager for the NCPA contract is Jeff Jennings, the Director of our SLED business unit. Jeff brings knowledge gained in past positions at two other companies where he served as the contract manager for their NCPA technology contracts. In managing this contract, he will draw OD the support of our SLED Marketing Manager, who brings an in-depth understanding of the SLED market to her role; a Contract Administrator with years of experience managing/administering/using large multiple award contract vehicles; and a Sales Operations Manager who uses her knowledge of educational procurement practices to help Fortinet provide effective sales support to educational customers. We will also establish two working groups to bring insight from the field into our management team: one will include sales Account Managers who work in the SLED Market and the other will include Channel Managers responsible for recruiting and supporting resellers with experience serving the SLED market. S.O'Helll SLED Marketing P.Pallaru Contract Administration Miki Bossert NCPA Contract Executive Sponsor Jeff Jennings NCPA Conlract Manager A.M.Mlller Sales Operations, SLED Procu11mtnt Officer Region t• Educ:atlonalS.rvlce Ctntlr Regional Sain Worlclng Group Reglonal Channel Working Group Figure 4. NCPA Contract Management Team 4.4.1 Office Locations ♦ Corporate office location. ► List the number of sales and services offices for states being bid in solicitation. March 20, 2018 10 F:::RTlnET RFP 02-18, IT Security and Data Protection Solutions 4.5 Standard Terms of Payment ♦ Define your standard terms of payment Customers that use this contract will make payments directly to the awarded vendor or to the NCPA-approved distributor/partner/reseller with whom the order was placed. Payment terms are net thirty (30) days from the date of the invoice. Late fees may be charged on all amounts not paid when due at the rate of one and one half percent (1.5%) per month or the highest rate permitted by law, whichever is lower. 4.6 Key Competitors ♦ Who is your competition in the marketplace? The table below identifies key cybersecurity market segments in which Fortinet competes. It uses data from Gartner Magic Quadrant Reports and NSS Labs Security Test Reports to identify our competitors in those market segments. The Gartner Magic Quadrant Reports are based on a proprietary qualitative methodology that classifies the established companies in a market segment into four categories: "market leaders", "challengers", "niche players,, and "visionaries". The NSS Labs security test reports use a proprietary test and analysis methodology to measure the security effectiveness and total cost of ownership of the products network security manufacturers submit for testing. It then uses the results to assign a rating of "recommend", "neutral", or "caution" to each tested product. Market Segment -.. --Kay Competitors Supporting Information Enterprise Firewalls • Palo Alto These two companies, along with Fortlnet, Definition: Purpose -built appliances for securing enterprise networks. Networks are ranked as "market leaders• in the latest Able lo support single-enterprise firewall deployments and large • Check Point Gartner, Inc. Magic Quadrant report on the and/or complex deploymen!s. The ability lo provide virtual versions Software Enterprise Firewall market for the data center is naN an expectation as Is the ability lo deploy In Technologies cloud environments. Unified Threat Management Devices • Check Point These two companies, along with Fortlnet, Definition: Multifunctional network security products designed for Software are ranked as "market leaders" in the latest small to medium-size organizations (100 to 1,000 employees). Technologies Gartner, Inc. Magic Quadrant report on UTM Typical capabilities provided Include enterprise firewall, intrusion • Sophos Devices. prevention, remote access, secure web/email gateway, routing and wan connectivltv. Next-Generation Firewall • Barracuda These eight companies, along with Fortlnet, Definition. Deep-packet inspection firewalls that move beyond • Checkpoint received "recommend" ratings from NSS port/protocol Inspection and blocking to add application-level • Cisco Labs in its most recent tests on Next- Inspection, Intrusion prevention, and to bring In intelligence from • Forcepolnt Generation Firewalls. outside the firewall. • Palo Alto • Sophos • SonlcWall • WatchGuard Data Center Security Gateway (DCSG) • Juniper These three companies, along with Fortlne~ Definition. DCSGs protects data center servers and the applications Networks received "recommend" ratings from NSS that run on them (i.e., web servers, mall servers, DNS servers, • Palo Alto Labs, Inc. in that organization's first tests on application servers, etc.) from potential threats. They converge data Networks firewalls used as Data Center Security center firewall and data center Intrusion prevention system • Cisco Gateways. technologies and perform access control and deep packet Inspection to protect server applications from remote attacks. Data Center Intrusion Protection Systems (DCIPS) • Juniper These three companies, along with Fortlnet, Definition. Data center network security devices are deployed to Networks received "recommend" ratings from NSS protect servers and applications hosted in lhe data center. Data • McAfee Labs, Inc. in that organization's most recent center intrusion prevention systems (DCI PS) are deployed at critical • Trend Micro tests on Data Center Intrusion Protection points In the network. Their role ts to Identify and block sophisticated Systems. threats against web servers, application servers, and database servers without false positives or degradation or network oerformance. March 20, 2018 22 F :::RTlnET. RFP 02-18, IT Security and Data Protection Solutions 4.8 Fortinet Competitive Advantages ♦ What differentiates your company from competitors? The three attributes described below distinguish us from our competitors. 4.8.1 Our Corporate Strength and Stability When it comes to the cybersecurity industry -an industry that includes hundreds of new startups and has frequent mergers/acquisitions -Fortinet stands out as a stable, reliable partner for NCPA. We are a 17-year-old US company whose founders, Ken and Michael Xie, continue to serve as our company's Chief Executive Officer and our Chief Technology Officer. Under their leadership we have become a profitable, debt-free cybersecurity company with more than 5,000 employees worldwide, annual sales of more than $1.4 billion, and ample cash on hand to invest in our products and our people. These three metrics underscore the corporate strength that makes Fortinet a viable long-term partner for NCPA: • Innovation. As of February 2018, Fortinet has 441 issued patents. This is three to eight times more than the number of patents held by the companies we identified in Section 4.6 as competitors in these key markets: enterprise firewalls and UTM devices. • Growth. The Fortune Future 50 is an industry ranking introduced by Fortune in 2017 that ranks the US public companies with the best prospects for breakout growth in the future. Not surprisingly given the importance that organizations place on protecting their IT infrastructure and data, there are three cybersecurity companies on this list Fortinet is one of them. • Technology Adoption. In Figure 1, we showed the number of network security appliances shipped by Fortinet and by four other leading suppliers of firewalls from 2011 through 2016. The trend line shows that Fortinet now ships more than twice as many appliances as two of the companies shown in Figure 1 and more than six times as many as the other two companies shown in the figure. 4.8.2 Our Ability to Execute on our Vision In Section 4.2, we described Fortinet's vision for the evolution of the cybersecurity industry, which has moved from protecting nel1llork connedions to protecting the content inside of network connections to protecting IT infraslnldun. Explained simply, moving from the second generation of cybersecurity to the third means replacing point cybersecurity products that do not communicate with one another within an organization's IT infrastructure with an integrated security fabric in which every cybersecurity product deployed receives and acts on the same information in real time. If there is one fundamental attribute that distinguishes Fortinet from our competitors, it is that Fortinet has made this leap· others in the jndust[}' have not, The solution we sell that embodies this leap is the Fortinet Security Fabric. The Security Fabric, which is illustrated in Figure 5, acknowledges that in today's IT environment, an organization's network is not secure unless its entire IT infrastructure is secure -including cloud resources, web applications, email, network access points, endpoints, and JOT devices. It is built around Fortinet products which, because they are based on the same powerful, purpose-built security operating system, can receive, correlate, and automatically act in real-time and in a coordinated fashion on threat information provided around the clock by FortiGuard Labs (discussed in Section 4.8.3). By leveraging open standards and APis, third-party products from many leading manufacturers and software publishers can also be integrated into Fortinet Security Fabric solutions. If we are awarded an NCPA IT Security and Data Protection Solutions contract, agencies and educational institutions will be able to acquire our Security Fabric products at discounted prices. This includes physical and virtual products used for network security, management and analytics, multi-cloud security, web application security, email security, advanced threat protection, secure unified access (wired and wireless), and endpoint security. March 20, 2018 24 F :::RTlnET RFP 02-18, IT Security and Data Protection Soluttons 4.9 How We Will Market Our NCPA Contract ♦ Describe how your company will market this contract if awarded. Forti.net understands that an effective marketing plan is crucial to our success as an NCPA contract holder. This is reflected in our decision to designate Jeff Jennings as our Contract Manager for this effort and to include Sowjanya O'Neill as part of the NCPA Contract team. As noted previously,Jeffhas successfully managed NCPA contracts in the past and Sowjanya, who is Fortinet's Senior Manager for SLED Marketing, is ideally positioned to integrate our NCPA contract marketing objectives into our overall SLED marketing plan. She also brings extensive experience developing and executing go-to-market strategies for technology companies. Under her direction, we will implement a marketing approach that will include: • Social media promotion via Linkedln, FaceBook and Twitter • Collaboration with NCP A's marketing team, with an emphasis on identifying opportunities for co-branding • Deploying a dedicated contract website • Providing training on the NCPA contract to Field Marketing Managers • Integrating information on the NCPA contract into existing SLED marketing campaigns • The creation of marketing collateral targeting agencies eligible to use the NCPA contracts • Webinars for agencies eligible to use the NCPA contracts • The creation of marketing collateral for authorized resellers • Outreach and training for authorized resellers that sell to SLED customers • Webinars targeting resellers interesting in becoming authorized resellers on the contract • Collaboration with our resellers' marketing teams • Trade shows and industry events 4.10 How We Will Introduce NCPA to Our Company ♦ Describe how you intend to in troduce NCPA to your company. Our Contract Manager will take the lead on introducing the NCPA contract to Forti.net Sales Account Managers responsible for sales to the SLED market He will also introduce the contract to Channel Managers responsible for recruiting and supporting resellers who serve this market Our Contract Administrator will work closely with Jeff to ensure that our Sales Account Managers understand the contract terms and conditions. At contract award, we will use group conference calls and training webinars to reach these two internal audiences. We will also implement processes to monitor whether field teams are leveraging the NCP A contract and will provide follow-up training as needed. Finally, we will integrate information on using the NCPA contract into our training for new Sales Account Managers responsible for SLED sales and for new Channel Managers and Marketing Managers in the field . 4.11 On-line Catalog / Ordering Website ♦ Describe your firm's capabilities and functionality of your on-line catalog/ ordering website. Because Fortinet uses a channel model for sales, we do not have, nor do we intend to implement, and ordering website for the NCPA contract. What we do provide is a website (www.fortinetcom) that SLED customers can use to find detailed information on our products and services and to access technical support. As indicated in Section 4.9, we intend to add dedicated site for the NCPA contract to this website. We will use this site to provide information on how to use our NCPA contract to organizations interested in using the contract and to help them connect with qualified, capable authorized resellers who serve their geographic market March 20, 2018 26 F S::RTlnET RFP 02-18, IT Security and Data Protection Solutions 4.12.2 Software Maintenance Our price list includes perpetual licenses for a wide range of virtual appliances. We offer FortiCare Services packages (8 x 5 or 24 x 7) for these products in one-, three-, and five-year increments. These plans encompass technical support services for software products covered by an active warranty or maintenance plan. This support is available telephonically as well as through our web portal or by chat. Software error correction and software update services are also included. Our price list also includes the FortiGuard security software subscriptions discussed previously in Section 4.8.3. Forti Guard Labs issues updates for these software applications on a continuous basis as new cybcrsecurity threats arc identified. We make use of a global network of FortiGuard Distribution Servers (FDS) to distribute these software updates to registered Fortinet devices in the field. The FDS supports: • User-initiated updates • Hourly, daily, or weekly scheduled antivirus definition, IPS definition, and antispam rule set updates from the FON • Push updates 4.12.3 Premium Support Services In addition to the support services outlined above, Fortinet has included the following premium support services in our proposal as value-added services: • Premium -Enterprise. This is an annual service plan that provides fast-track access to an advanced services team. It also includes training and certification, a customized account plan, and pro-active after-hours support. • Business -Enterprise. This is an annual service plan that includes a designated engineer who will become familiar the customer's environment and assist in regular ticket reviews. It also includes bi-annual and root- cause analysis reporting. • First -Enterprise. This annual plan includes a designated lead engineer, aka technical account manager (TAM), who collaborates with the customer to build and maintain a long-term technical engagement, providing technical support, operational reviews and quarterly reporting. The service also includes best practice guidance, upgrade assistance, extended software support to facilitate upgrade planning, and advanced notifications. 4.13 Green Initiatives ♦ Green Initiatives ► As our business grows, we want to make sure we minimize our impact on the Earth's climate. We are taking every step we can to implement innovative and responsible environmental practices throughout NCPA to reduce our carbon footprint, reduce waste, energy conservation, ensure efficient computing and much more. To that effort we ask respondents to provide their companies environmental policy and/or green initiative. Fortinet is committed to environmentally responsible behavior. We have processes in place to ensure that our products reduce impact to the environment and are in compliance with applicable laws and regulations in the jurisdictions where we conduct business. Ongoing initiatives of note include: • A program to curb the use of hazardous substances in equipment sold in the European Union, • The introduction of recycling support for equipment sold in the European Union. March 20, 2018 28 F :::RTlnET RFP 02·18, IT Security and Data Protection Solutions Tab 5 -Products and Services ♦ Respondent shall perform and provide these products and/or services under the terms of this agreement. The supplier shall assist the end user with making a determination of their individual needs. The following is a list of suggested (but not limited to) IT Security and Data Protection Solutions categories. List all categories along with manufacturer that you are responding with: ► Content Filtering ► Anti-Virus/ Anti-Spam ► Network Forensics/ Real-Time Monitoring ► Network Access Control ► Firewalls ➔ Network Storage/ Archiving ► Wireless Networks ➔ Band,,.•idth Management ► Networking Hardware ► Application Security ➔ Email Security and Archiving ► Data Protection • Backup • Cloud Backup We have edited the list above to show the suggested capabilities that are addressed by hardware or software products included in our price list Described at a high levd, our price list includes: • Physical and virtual cybersecurity appliances (hardware appliances and perpetual software licenses) that provide functional capabilities in these areas: o Network Security o Cloud Security o Web Application Security o Email Security o Advanced Threat Protection o Secure Unified Access o Endpoint Security o Management and Analytics • FortiGuard Security Subscriptions (term software licenses) for: o Application control o Intrusion prevention o Antivirus o Sandboxing March 20, 2018 30 F S::RTlnET RFP 02-18, IT Security and Data Protection Solutions Tab 8 -Value Added Products and Services ♦ Include any additional products and/or services available that vendor currently performs in their normal course of business that is not included in the scope of the solicitation that you think will enhance and add value to this contract for Region 14 ESC and all NCPA participating entities. Fortinet's goal if awarded a contract under the new NCPA IT Security and Data Protection Solutions program is to establish a productive, mutually beneficial partnership with the Region ESC and NCPA that benefits NCPA's participating entities. To accomplish this, we have elected to include our entire commercial price list in this offer (with the exception of certain legacy products from our acquisition ofMeru Networks in 2015). Given the nature of our business, most of the products and services that we offer fall squarely within the scope of this offer. However, our decision to include are full price list means that NCPA participating entities will also be able to acquire products from our FortiVoice product line (IP PBX phone systems for business) and FortiCamera/FortiRccorder (our network- based video security solution. Based on the evaluation criteria included in the RFP, it is clear that for the Region 14 ESC and NCPA, providing good value to NCPA contract stakeholders also means demonstrating a commitment to effective support in these areas: • Marketing. To ensure we meet N CP A's expectations for providing effective marketing support, we have included a senior-level marketing resource on our contract team for this contract. In Section 4.4, we outlines some of the strategies she will use to ensure that NCPA stakeholders are aware of our contract and know how to leverage it to obtain our best-of-breed cybersecurity products/ solutions at competitive prices. • Increasing the presence of MWBEs and HUBs in the NCPA contracting program. Fortinet intends to allow authorized resellers to use our contract and has strong program in place for recruiting and supporting our channel partners. This puts us in a strong position to create opportunities for MWBEs and HUBs as authorized resellers. • Customer Service. See Section 4.12 for our description of our comprehensive customer support program. This is the same customer support program that US Federal agencies and some of the world's largest financial institutions and tdecommunications carriers rely on to provide support for their Fortinet Network Security and Security Fabric solutions. March 20, 2018 34 RFP 02-18, IT Securlty and Data Prolecllon Solutions Clean Air and Water Act & Debarment Notice I, the Vendor, am in compliance with all applicable standards, orders or regulations issued pursuant to the Clean Air Act of 1970, as Amended ( 42 U.S. C. 1857 (h), Section 508 of the Clean Water Act, as amended (33 U.S.C.1368), Executive Order 117389 and Environmental Protection Agency Regulation, 40 CFR Part 15 as required under 0MB Circular A-102, Attachment 0, Paragraph 14 (1) regarding reporting violations to the granter agency and to the United States Environment Protection Agency Assistant Administrator for the Enforcement. I hereby further certify that my company has not been debarred, suspended or otherwise ineligible for participation in Federal Assistance programs under Executive Order 12549, "Debarment and Suspension", as described in the Federal Register and Ru les and Regulations Potential Vendor Fortinet, Inc. Print Name John Whittle Address 899 Kif er Road City, Sate, Zip Sunnyvale, CA 94086 Authorized signature Date ' IG 2ol 'f f March 20, 2018 F:::RTlnET: RFP 02-18, IT Security and Data Protection Solutions Antitrust Certification Statements (Tex. Government Code § 2155.005) I affirm under penalty of perjury of the laws of the State of Texas that: (1) I am duly authorized to execute this contract on my own behalf or on behalf of the company, corporation, firm, partnership or individual (Company) listed below; (2) In connection with this bid, neither I nor any representative of the Company has violated any provision of the Texas Free Enterprise and Antitrust Act, Tex. Bus. & Comm. Code Chapter 15; (3) In connection with this bid, neither I nor any representative of the Company has violated any federal antitrust law; and (4) Neither I nor any representative of the Company has directly or indirectly communicated any of the contents of this bid to a competitor of the Company or any other company, corporation, firm, partnership or individual engaged in the same line of business as the Company. Company name Fortinet, Inc. Address 899 l(jfer Road City/State/Zip Sunnyvale, CA 94086 Telephone No. ( 408) 235-7700 Fax No. (408) 212-9290 Email address jwhittle@fmtinet.com Printed name John Whittle Position with company Vice President, General Counsel Authorized signatur March 20, 2018 F :::RTlnET RFP 02·18, IT Security and Data Protection Solutions representatives to inspect and photocopy such records for the purpose of making audit, examination, excerpts, and transcriptions. 8) Pursuant to 44 CFR 13.36(i)(11), Contractor shall retain all required records for three years after FEMA or participating agency makes final payments and all other pending matters are closed. In addition, Contractor shall comply with record retention requirements set forth in 44 CFR 13.42. March 20, 2018 40 RFP 02-18, IT Security and Data Protection Solutions Commission (EEOC) implementing regulations, "Age Discrimination in Employment Act", 29 CFR Part 1625, prohibit employment discrimination by Contractor against individuals on the basis of age, including present and prospective employees. In addition, Contractor agrees to comply with any implementing requirements FTA may issue. c. Disabilities. In accordance with Section 102 of the Americans with Disabilities Act of 1990, as amended (ADA),42 U.S.C. Sections 12101 et seq., prohibits discrimination against qualified individuals with disabilities in programs, activities, and services, and imposes specific requirements on public and private entities. Contractor agrees that it will comply with the requirements of the Equal Employment Opportunity Commission (EEOC), "Regulations to Implement the Equal Employment Provisions of the Americans with Disabilities Act," 29 CFR, Part 1630, pertaining to employment of persons with disabilities and with their responsibilities under Titles I through V of the ADA in employment, public services, public accommodations, telecommunications, and other provisions. d. SeifeK3ted Facilities. Contractor certifies that their company does not and will not maintain or provide for their employees any segregated facilities at any of their establishments, and that they do not and will not permit their employees to perform their services at any location under the Contractor's control where segregated facilities are maintained. As used in this certification the term "segregated facilities" means any waiting rooms, work areas, restrooms and washrooms, restaurants and other eating areas, parking lots, drinking fountains, recreation or entertainment areas, transportation, and housing facilities provided for employees which are segregated by explicit directive or are in fact segregated on the basis of race, color, religion or national origin because of habit, local custom, or otherwise. Contractor agrees that a breach of this certification will be a violation of this Civil Rights clause. 3) Solicitations for Subcontracts, Includine Procurements of Materials and Equipment In all solicitations, either by competitive bidding or negotiation, made by Contractor for work to be performed under a subcontract, including procurements of materials or leases of equipment, each potential subcontractor or supplier shall be notified by Contractor of Contractor's obligations under this Contract and the regulations relative to non-discrimination on the grounds of race, color, creed, sex, disability, age or national origin. 4) Sanctions of Non-Compliance. In the event of Contractor's non-compliance with the non- discrimination provisions of this Contract, Public Agency shall impose such Contract sanctions as it or the FTA may determine to be appropriate, including, but not limited to: 1) Withholding of payments to Contractor under the Contract until Contractor complies, and/ or; 2) Cancellation, termination or suspension of the Contract, in whole or in part. Contractor agrees to include the requirements of this clause in each subcontract financed in whole or in part with Federal assistance provided by FTA, modified only if necessary to identify the affected parties. DISADVANTAGED BUSINESS PARTICIPATION This Contract is subject to the requirements of Title 49, Code of Federal Regulations, Part 26, "Participation by Disadvantaged Business Enterprises in Department o/Transportation Financial Assistance Programs", therefore, itis the policy of the Department of Transportation (DOT) to ensure that Disadvantaged Business Enterprises (DBEs), as defined in 49 CFR Part 26, have an equal opportunity to receive and participate in the performance of DOT-assisted contracts. 1) Non-Discrimination Assurances. Contractor or subcontractor shall not discriminate on the basis of race, color, national origin, or sex in the performance of this Contract. Contractor shall March 20, 2018 42 F :::RTlnET RFP 02-18, IT Security and Data Protection Solutions NO FEDERAL GOVERNMENT OBLIGATIONS TO THIRD PARTIES Agency and Contractor acknowledge and agree that, absent the Federal Government's express written consent and notwithstanding any concurrence by the Federal Government in or approval of the solicitation or award of the underlying Contract, the Federal Government is not a party to this Contract and shall not be subject to any obligations or liabilities to agency, Contractor, or any other party (whether or not a party to that contract) pertaining ta any matter resulting from the underlying Contract Contractor agrees to include the above clause in each subcontract financed in whole or in part with federal assistance provided by the FTA. It is further agreed that the clause shall not be modified, except to identify the subcontractor who will be subject to its provisions. PROGRAM FRAUD AND FALSE OR FRAUDULENT STATEMENTS Contractor acknowledges that the provisions of the Program Fraud Civil Remedies Act of 1986, as amended, 31 U.S.C. §§ 3801 et seq. and U.S. DOT regulations, "Program Fraud Civil Remedies," 49 CFR Part 31, apply ta its actions pertaining to this Contract Upon execution of the underlying Contract, Contractor certifies or affirms the truthfulness and accuracy of any statement it has made, it makes, it may make, or causes ta me made, pertaining to the underlying Contract or the FT A assisted project for which this Contract Work is being performed. In addition to other penalties that may be applicable, Contractor further acknowledges that if it makes, or causes to be made, a false, fictitious, or fraudulent claim, statement, submission, or certification, the Federal Government reserves the right to impose the penalties of the Program Fraud Civil Remedies Act of 1986 on Contractor ta the extent the Federal Government deems appropriate. Contractor also acknowledges that if it makes, or causes to me made, a false, fictitious, or fraudulent claim, statement, submission, or certification to the Federal Government under a contract connected with a project that is financed in whole or in part with Federal assistance originally awarded by FTA under the authority of 49 U.S.C. § 5307, the Government reserves the right to impose the penalties of 18 U.S.C. § 1001 and 49 U.S .C. § 5307 (n)(1) on the Contractor, to the extent the Federal Government deems appropriate. Contractor agrees to include the above clauses in each subcontract financed in whole or in part with Federal assistance provided by FTA. It is further agreed that the clauses shall not be modified, except to identify the subcontractor who will be subject to the provisions. March 20, 2018