SBU/10 Gbps Internet & DDoS Mitigation Services RFP

Overview: This Request for Proposal (RFP) is issued by the State University of New York, Division of Information Technology (herein after referred to as “SUNY”) to solicit proposals from qualified internet service providers to augment the connectivity to the internet for the State University of New York at Stony Brook, Stony Brook, NY 11794, as herein described in accordance with this SUNY RFP 25/26-034MC and exhibits and attachment attached hereto and made part of this RFP. Background: The State University of New York (“SUNY”) is the largest comprehensive university system in the United States, educating more than 467,000 students in more than 7,500 degree and certificate programs on 64 campuses with nearly 3 million alumni around the globe. SUNY is committed to reduce administrative costs, maximize efficiencies and move resources toward academics and student services. SUNY Stony Brook is Long Island’s premier academic medical center, Stony Brook Medicine represents Stony Brook University’s entire medical enterprise and integrates all of Stony Brook’s health-related initiatives: education, research and patient care. It encompasses Stony Brook University Hospital, Stony Brook Children’s Hospital, the six Health Sciences schools — Dental Medicine, Health Technology and Management, Pharmaceutical Sciences, Medicine, Nursing and Social Welfare — as well as the major centers and institutes, programs and more than 50 community-based healthcare settings throughout Suffolk County. Stony Brook University, part of the State University of New York system, is located 60 miles from New York City on Long Island's scenic North Shore. Our 1,100-acre campus is home to almost 26,000 undergraduate, graduate, and doctoral students and more than 14,500 faculty and staff. Stony Brook University is a comprehensive research-intensive university and a member of the prestigious Association of American Universities (AAU). It consists of 12 schools and colleges and a teaching hospital that provides state-of-the-art healthcare in the Long Island region. Stony Brook University offers more than 200 undergraduate programs, more than 100 master’s programs and more than 40 doctoral programs. Notable facts about Stony Brook University’s student population (Fall 2023): Total students– 25,865: Undergraduates – 17,549 Graduates - 8,316 Additional information about Stony Brook University and its students can be found at the following website: http://www.stonybrook.edu/ Scope of Services: State University of New York at Stony Brook is in need to select additional Internet Service Provider (ISP) connection for mainteining SUNY internet redundancy and diversity. SUNY requires a robust 10 Gbps commodity internet service along with a comprehensive Distributed Denial of Service (DDoS) mitigation service to ensure uninterrupted access to online resources. The selected provider will be responsible for delivering the following services: 10 Gbps symmetrical (upstream and downstream) Internet Service: Ensuring consistent connectivity and low latency for users accessing online resources. Compatibility with existing network infrastructure at Stony Brook University. Our strategy entails leveraging a 100Gb fiber network that establishes a connection between the SBU Campus and the NYSERNet Syracuse Colocation, where the new Internet Service Provider will be hosted at: NYSERNet Colocation: 2 S Clinton St, 2nd Floor, Suite 235, Syracuse, NY 13202 (PoP) Enhanced Security Measures: DDoS Mitigation Service. Security is a paramount concern. We are committed to selecting an ISP that offers robust security services to help mitigate cybersecurity attacks, particularly Distributed Denial-of-Service (DDoS) attacks. DDoS attacks pose a significant threat to the normal functioning of our network and services. The ISP selection process will include evaluating the provider's DDoS mitigation capabilities and other security features to fortify our network against such attack Key Events: RFP Opens 9/24/25 Bidder Questions due date and time 10/15/25 5:00 PM EST Proposal due date and time (any proposals received after the deadline will not be considered) 10/23/25 3:00 PM EST Presentation/Product Demonstration TBD Anticipated Notification of Award to Successful Bidder TBD Anticipated Contract start date TBD SUNY reserves the right, in its sole discretion, to modify the above schedule. Bidders will be notified via email of any changes in a timely manner. Acceptance of Bid Content: The contents of the Bid and the Bidder’s response to this Bid shall become contractual obligations if a contract ensues. Failure of the Bidder to accept these obligations may result in the rejection of the Bidder’s response. Any additional vendor terms which are attached or referenced with a submission shall not be considered part of the bid or proposal but shall be deemed included for informational purposes only. RESTRICTED PERIOD: In accordance with the requirements of New York State Finance Law Sections 139j and 139k (“Lobbying Law”), the RESTRICTED PERIOD for this procurement is now in effect. Therefore, all communications regarding this procurement must be handled through Stony Brook University’s “Designated Contacts” ONLY. See Exhibit L for additional information. Please see below for the DESIGNATED CONTACT information. DESIGNATED CONTACT: Margaret Remiszewski Senior Contracts Officer Email: contact@example.gov PH: +1 (555) 000-0000 Bidder Questions: Questions regarding the electronic bidding process should be directed to the designated contact(s). All questions should be submitted on the Q&A Board citing the particular event section where applicable. Bidders should make efforts to ensure all questions are submitted no later than the date listed in the Key Events section, as questions received after the closing date for questions may not be responded to prior to the proposal due date. Bidder identifying information will not be included in the response. Only answers posted on the Q&A Board are official. Responses to inquiries that substantially change or clarify the event in a substantial manner will be posted as an addendum. It is the responsibility of the Bidder to inquire about any requirement of this event that is not understood. SUNY will not be bound by oral responses to inquiries or written responses other than addenda. Pre-Bid Conference: No Pre-Bid Conference will be held. Bid Opening: SUNY reserves the right to not hold a public bid opening or at any time to postpone or cancel a scheduled bid opening. In the event a public bid opening is scheduled, Bidders will be notified. Cost Proposal Submission Instructions: The Bidder can only submit ONE pricing proposal. No multiple pricing schedules will be accepted. The cost proposal grand total, as provided by the Bidder, must include a full term cost of the total ownership of the proposed system solution and it is the final pricing SUNY will pay for the system under this RFP for the term of a resulting contract. All the items listed in the Items section of this RFP must be priced unless these items are provided at no cost for SUNY or they are not available in the bidder offered system solution. Items not identified in the financial proposal (including third party items) but required for the system functionality will be considered part of the final solution and free add-ons at the price included in this RFP response. No modifications may be made to the cost proposal and any modifications may result in disqualification. SUNY is exempt from sales tax. All prices should be quoted without the sales tax. All travel and per diem expenses (if any) are responsibility of awarded Bidder and SUNY will not reimburse separately for these charges. Price Hold: The submission of a proposal constitutes a non-revocable, binding offer to perform and provide said services. Such binding offer shall be firm and not revocable for a period of 185 days from event close date. Subsequent to such 185 days, the proposal is subject to withdrawal communicated in writing and signed by the Bidder. Method of Award (RFP): This RFP is part of a competitive procurement process designed to serve the best interests of the SUNY and the People of the State of New York. It is also designed to provide all bidders with a fair and even opportunity to have their products and services considered. SUNY will conduct a comprehensive review of each responsive bid submitted in accordance with the terms of this RFP. Proposals will be evaluated on the basis of “best value”, by an evaluation committee comprised of SUNY representatives, and shall be conducted in the following steps: Administrative Review: Each proposal received by the due date and time will be screened for completeness and conformance with requirements for proposal submission in accordance with this RFP. Each proposal remaining after Administrative Review will advance to a committee to review the response to the Minimum Bidder Qualifications and References. Minimum Bidder Qualifications/References (Pass/Fail) Review: Information provided in the proposal will be used to validate Minimum Bidder Qualifications and references. SUNY reserves the right to contact bidder references to validate required experience. If review of response and reference checks determine the Bidder does not Minimum Bidder Qualifications/References the proposal will be deemed inadequate and will not be considered further. Mandatory Technical Requirements (Pass/Fail) Review: Each proposal remaining after Minimum Bidder Qualifications/References review will advance to a committee review of the responses to Mandatory Technical Requirements. Information provided in the proposal will be used to validate Minimum Bidder Qualifications. If the technical evaluation determines the Bidder's proposal does not meet all mandatory requirements, the proposal will be deemed inadequate and no further considered. Weighted Technical Capabilities Review: Each bid remaining after Mandatory Technical Requirements review will advance for review and independent evaluation and scoring by the technical review evaluation committee Cost Evaluation: The Cost Proposals of each bid remaining after the Technical Evaluation will be independently evaluated and scored by the designated contract officer. (First Stage) Selection: Proposals will be evaluated on the basis of “best value” by a technical evaluation committee comprised of SUNY representatives, utilizing an evaluation methodology that considers the following factors: Technical Evaluation Criteria Points: Evaluation Criteria Points Minimum Bidder Qualifications/References Pass/Fail Mandatory Technica Requirements Pass/Fail Weighted Technical Capabilities: Section 1 10% Section 2 20% Cost/Financial Proposal 30% Total for Technical and Cost 60% The technical criteria above will be evaluated and scored by the University on a scale of 0-5, with 5 being the highest and, using the following proportion tool: 0 0% 1 20% 2 40% 3 60% 4 80% 5 100% The University will add the results from “Cost” plus the results from “Technical” together to come up with the “Composite” score for each bidder. Product Presentation/Demonstration: Bidders receiving the highest combined composite score (technical + cost) that are susceptible to award will be invited to make a presentation and discuss their proposal. SUNY will notify the Bidders and schedule the time, location and format. The presentation shall in no way change Bidders’ original proposals. The presentation will be evaluated and scored by a technical review evaluation committee. All costs associated with the Bidder’s attendance will be borne by the Bidder. The presentation/demonstration has an established weight value that will be scored and proportioned back to the original total score. For consistency, the presenting Bidders will be asked to show the same scenario within their systems. Presentation Evaluation Criteria Points: Presentation 40% Please share detailed information regarding the DDoS Mitigation Engine/process used along with Geographic maps of all scrubbing/data transit locations. If a fiber line is cut between Syracuse and your primary scrubbing center, what is the automated failover process and where does our traffic get redirected? 6% We run BGP with our current ISPs,providers. Walk us through the exact BGP attributes (e.g., AS-PATH prepending, MEDs, Communities) you would have us use to steer our outbound traffic to you during normal operation, and then the specific BGP communities you would have us use to signal a demand for mitigation during an attack on a specific IP prefix. 5% Describe a specific instance where you integrated your DDoS mitigation data (e.g., NetFlow, alerts) with a client's existing SIEM or MDR provider. What was the use case? What API or logging method did you use? How did it change their security team's response to an event? 3% Illustrate/demonstrate how your system provides BGP-Based Mitigation and Traffic Steering to support multi-homed environments with multiple ISP(s)? Walk us through, step-by-step, what happens when your system detects a volumetric attack on our /24 IPv4 block. How is BGP used to steer our traffic to the scrubbing center and what is the maximum propagation time for this BGP update to be accepted by the global internet routing table, and what evidence can you show from past events to prove this timeline. 6% Redundancy: Include requirements for failover and redundancy to ensure continuous service. Please explain how your infrastructure addresses these concerns at the following location: NYSERNet Colocation: 2 S Clinton St, 2nd Floor, Suite 235, Syracuse, NY 13202 4% Walk us through the exact step by step process of how your mitigation engine/system would handle a sophisticated, low-and-slow application layer attack (like a http-https flood targeting a specific university application endpoint) that doesn't trigger any volumetric thresholds. How do you distinguish between a legitimate traffic spike during course registration and an attack? 5% If your system falsely identifies any data transfer from the University Network to Cloud ( AWS, AZURE etc.) as a volumetric attack and begins to mitigate it. Describe the technical process for creating a custom fingerprint or whitelist rule for specific traffic. Does this require a support ticket, or can our network engineers implement it themselves in real-time via an API or portal? What specific parameters can we use to define the exception (e.g., source IP, protocol, specific packet signature)? 3% For encrypted attacks -https, how does your platform perform deep packet inspection without compromising end-user privacy? Do you require us to share our private SSL keys, or do you use a different method? 3% Describe the architectural differences in how you mitigate an IPv6 attack versus an IPv4 attack. Are your system capacities and capabilities truly identical for both? 2% Can you take a real, anonymized DDoS incident from one of your other customers and show us the live dashboard our team will see? Can you explain how we differentiate between total bandwidth and attack bandwidth, and how we identify the attack vector (e.g., NTP reflection vs. SYN attack) in real time? After an attack is over, can you show us an example report? What does it include—just top talkers, or also attack origin ASNs, packet captures -PCAPs, and recommended future rule changes etc. 3% The criteria above will be evaluated and scored by the University on a scale of 0-5, with 5 being the highest using the following proportion tool. 0 0% 1 20% 2 40% 3 60% 4 80% 5 100% The Bidder earning the highest final composite score (technical, cost and presentation) will be selected to contract with SUNY and will be notified by SUNY. Contract award shall be made by issuance of an award notice. SUNY contracts may be subject to approval by the NYS Attorney General and the Office of the State Comptroller. SUNY reserves the right to award no contract pursuant to this RFP. Finalist Review: In accordance with Section 163 (9) f of the New York State Finance Law, prior to making a contract award each contracting agency shall make a determination of responsibility of the proposed contractor as discussed under Vendor Responsibility. SUNY will conduct a review of vendor responsibility for the Bidder earning the highest final composite score, and any proposed subcontractors. SUNY will consider any information that raises issues concerning the vendor’s responsibility, with consideration given to its relevance to the scope of work. The review will include factors such as financial and organizational capacity, legal authority, integrity and previous contract performance. Reserved Rights: SUNY Reserves the right to: Reject any and all proposals received in response to this RFP, make a contract award in whole or in part. Make no contract award. Reject any or all portions of any proposal, to negotiate terms and conditions consistent with this RFP and to make an award for any or all remaining portions. Withdraw the RFP at any time, at SUNY’s sole discretion. Disqualify any Bidder whose conduct or proposal fails to conform to the requirements of the RFP. Use proposal information obtained through site visits, management interviews and the state’s investigation of a Bidder’s qualifications, experience ability or financial standing, and any material or information submitted by the Bidder in response to SUNY’s request for clarifying information, in the course of evaluation and/or selection under the RFP. Prior to the bid opening, amend the RFP specifications to correct errors of oversights, or to supply additional information, as it becomes available. Adjust or correct cost or cost figures with the concurrence of the Bidder if mathematical or typographical errors exist. Waive requirements or amend this RFP upon notification to all Bidders. Mandatory requirements may be eliminated if unmet by all Bidders. Negotiate with Bidders responding to this RFP within the requirements necessary to serve the best interests of SUNY. Begin contract negotiations with another Bidder in order to serve the best interests of SUNY should contract negotiations with the Successful Bidder be unsuccessful within a time frame acceptable to SUNY. Require clarifications from Bidders for purposes of assuring a full understanding of responsiveness, and permit revisions from all Bidders determined to be susceptible to contract award prior to award. Contract Period: The University anticipates that any contract awarded under this RFP shall be effective upon the date approved by the New York State Attorney General and Office of the State Comptroller, as applicable. The University shall have the right to terminate this contract early for: (i) cause; or (ii) convenience. Contract Term: The anticipated term for any Resulting Agreement is three (3) years with two (2) one year renewals subject to any termination options provided for in the resulting Agreement. The terms and conditions of this RFP specification shall be incorporated into an agreement developed by the SUNY as well as the successful Bidder’s response, and shall become part of any agreement award. Failure of Bidder to accept these obligations shall result in the rejection of Bidder’s response. Financial Statements: Upon SUNY request, Bidder shall provide certified financial statements as evidence of its ability to meet the service and requirements of the SUNY Stony Brook. Licenses, Permits, Certifications: Bidder needs to possess and provide upon request all licenses, permits and any other certification required to engage and perform the required services as per the bid specification. Successful bidder must assure that licenses/certification will not expire during the contract period. Responsibility: University will not be held responsible for any service made without prior authorization by University via a purchase order number. Contractor shall perform only those services and/or provide only those materials as authorized by the University. University will not be held responsible for any additional costs other than for the services outlined herein or for any work performed or materials delivered which has not been properly authorized. Legislature Changes: In the event any governmental restrictions are imposed which would necessitate alteration of the material, quality, workmanship or performance of the items and/or services offered in this proposal whatsoever, prior to their delivery or thereafter, it shall be the responsibility of the successful bidder to immediately notify the University in writing of the specific regulation which requires alteration. Upon acceptance of such alteration by the University, it shall be the responsibility of the successful bidder to give effect to such alterations in accordance with terms and conditions of the agreement entered into hereinafter. Any price adjustments occasioned due to any alterations shall be subject to the approval of the University. Award Protest: Upon notification of the selection and award of the contract, the bidder or offeror whose bid or proposal was not selected as the successful bid or proposal is entitled to submit a Bid Protest in accordance with SUNY’s Contracts Award Procedure (Document # 7561). The SUNY’s Protest Procedure is available at http://www.suny.edu/sunypp/documents.cfm?doc_id=699. The University's Protest Officer is Assistant Vice President Procurement Services, RSS Bldg., Stony Brook, NY, 11794-6000. The Appeals Officers is Vice President for Finance & Administration, Administration Bldg., Rm 221, Stony Brook NY, 11794-1002. Report of Contract Purchases: Contractor shall furnish quarterly data and contract spend reports to Margaret Remiszewski, Contract Officer. Reports shall be broken out to match the items contained on the pricing page of this solicitation and shall be delivered in accordance with the following schedule: 1st Quarter (April 1 – June 30) Due July 05 2nd Quarter (July 1 – Sept 30) Due Oct 05 3rd Quarter (Oct 1 – Dec 31) Due Jan 05 4th Quarter (Jan 1 – March 31) Due April 05 The report is to be submitted electronically in Microsoft Excel and shall reference the Contract Number, sales period, and contractor's, subcontractor (or other authorized agent) name. The outlined sales report is the minimum information required. Additional related sales information, such as monthly reports, and/or detailed user purchases may be required and must be supplied upon request. Reports are a deliverable of the contract. The University reserves the right to withhold payment if a vendor is delinquent in report submittal. Recycle Clause: In accordance with the provisions of Section 177 of the State Finance Law, the State University is required to purchase recycled products, if available, made with significant recycled content in accordance with standards established by the State Department of Environmental Conservation. The law provides that if the price of a recycled product is within 10% of the price of a comparable product made without significant recycled content, or within 15% of such comparable product if the recycled materials used in such products are generated in New York State, the recycled product must be purchased. If you believe any products you will provide hereunder should be considered as qualifying recycled products under this law, please attach a copy of the authorization from the Department of Environmental Conservation confirming that such product has been approved for inclusion in the State recycling program. In the absence of such written confirmation, the product(s) will not be considered as qualifying for purposes of determining the selected vendor hereunder. Payment Terms: Payments under the resulting contract award shall be made to the Contractor, upon receipt of goods/services and properly approved and completed invoice/s (Go to attached link to ensure you are meeting New York State proper invoicing requirements: https://osc.state.ny.us/agencies/guide/MyWebHelp/Content/files/XII.4.Fatt.pdf) and State of New York Department of Labor, Bureau of Public Works, Certified Payroll submitted to the attention of Accounts Payable, SUNY at Stony Brook. Payment may be withheld if a contractor has outstanding data, sales or MWBE reports. The Bidder shall provide complete and accurate billing invoices to the University in order to receive payment for its services. Billing invoices submitted to the University must contain all information and supporting documentation required by the University and OSC (All invoices must be submitted with contractor’s Federal ID number). Payment for invoices submitted by the Bidder shall only be rendered electronically unless payment by paper check is expressly authorized by the Vice President for Administration or designee, in her/his sole discretion, due to extenuating circumstances. Such electronic payment shall be made in accordance with ordinary New York state procedures and practices. The Contractor shall comply with the OSC procedures to authorize payments. Authorization forms are available at the OSC website at www.osc.state.ny.us/vendors/index.htm, by email at contact@example.gov or by telephone at +1 (555) 000-0000. The Bidder acknowledges that it will not receive payment on any invoices submitted under this contract if it does not comply with the OSC’s electronic payment procedures, except where the Vice President or designee has expressly authorized payment by paper check as set forth above. Parking and Other Regulations of the University: It will be the responsibility of the successful contractor to contact the Traffic Office at +1 (555) 000-0000 to make arrangements for parking passes or permits if required. Illegally parked vehicles are subject to ticketing and/or towing. Bidder will operate vehicles responsibly under campus rules and regulations and will not park vehicles in unauthorized areas. Illegally parked vehicles will be towed. Successful bidder will abide by all the applicable rules and regulations of the University, and breach whereof shall make vendor liable under such rules and regulations. Proper Bidder Identification: The successful bidder is required to obtain authorized identification badges or cards (“Contractor Identification”) for his/her employees issued by the University directly through the Campus Card Office at the Contractor’s expense. The contractor identification badge/card shall be worn by the employee at all times while doing work on campus. The campus cards may be renewed each year. Bidder Personnel: All Bidder personnel assigned to any requirements of a contract award must be fully qualified and cognizant of the required and applicable laws, rules and regulations pertaining to such contract award and the safety requirements which contractor must adhere to. Use of University Name/Logo: Bidders agree not to use the name/Logo of the University, or to quote any employees of the University, without obtaining prior written consent of the University. Customs Clearance: If the product is being manufactured in another country and will require customs service, the cost of such service and any applicable importation fees shall be borne by the vendor and incorporated in the price bid. Early Pay Discount: Where Bidder generally offers more advantageous special price promotions or special discount pricing to other customers during the Contract term for a similar quantity, and the maximum price or discount associated with such offer or promotion is better than the discount or net pricing otherwise available under this Contract, such better price or discount shall apply for similar quantity transactions under this Contract for the life of such general offer or promotion. If the Bidder offers an early payment discount, at any point in time, that is more advantageous to the State than the terms that are contractually obligated, the Bidder shall include the payment terms of the discount on the applicable invoice(s). Miscellaneous: Failure of Bidder to familiarize him/herself with each separate location will not relieve Bidder from responsibilities under the resulting contract award. Security of contractor’s material and equipment shall be the responsibility of the Bidder.