DeKalb County Schools STEP SOW - June 9, 2025 - DCSD Board Meeting Archive

STATEMENT OF WORK
DeKalb County Schools
PA-5440 FWs, VPN Failover Service, Aruba UXI
5/8/2024
INTRODUCTION

This Statement of Work (“SOW”) is between STEP CG, LLC, with a principal place of
business at 50 East Rivercenter Blvd., Suite 900, Covington, KY 41011 (“STEP CG”), and
DeKalb County Schools (“Client”). The purpose of this SOW is to set forth the terms under
which STEP CG will provide Client with services as defined. Pricing is valid for 90 days from the
above date of this SOW. This SOW will be governed by the Terms and Conditions as outlined in
this SOW.

CONTACTS

Client STEP CG
Account
Sponsor Dr. Kermit Belcher Rob Huff
Manager
Email kermit_belcher@dekalbschoolsga.org Email rhuff@stepcg.com
Phone Phone 859.653.0960
Technical Solution
Cedric Brown Keith Temple
Contact Architect
Lead
Email cedric_brown@dekalbschoolsga.org TBD
Engineer
Project
Phone TBD
Manager

SCOPE OVERVIEW

• WHO
o DeKalb County Schools IT engineers & STEP engineers & other supporting
resources such as relevant manufacturers.
• WHY
o Improve IT stability & bring dated firewall HW & SW up to current generation that
is able to handle increasing security & internet bandwidth demand.
o This is an SOW of multiple projects with partial billing along the way.
1. Replace a pair of internet PA-5250 FWs with a pair of PA-5440 FWs.
2. Managed VPN failover for business & education continuity at hub
locations when & if WAN fiber outage occurs.
3. Aruba UXI WLAN health sensors
• WHAT
o Remote & onsite technical expertise to design, configure, consult, deploy the
following along side DeKalb County IT engineer(s) with integration to existing
applications & network with manufacturer, customer & STEP network security
best practices.
o 2 PA-5440 FWs in HA pair, Free version of PA AIOPS.
o 25 small FGT-50G with optional FEX for 5G cellular.
o 6 Aruba User Experience Insight (UXI) wi-fi health sensors
• WHERE
o Remote & on-site work performed by multiple STEP engineers with a plan of 4-6
weeks not including added support & services from Apex co-managed service.
up to 2 business weeks on-site as needed & requested. These on-site visits are
expected to be over non-consecutive weeks resulting in 4-6 visits beyond what is
included in Apex co-managed service.
o Remote design, consulting, configuration, troubleshooting, advice & knowledge
transfer.
o On-site for firewall cutover & support for first 2 days of business after cutovers
with remote support beyond that leveraging Apex co-managed service.
o Expected engagement is from July 2025 to September 2025.
• HOW
o The Aruba UXI wi-fi health sensors can be configured & deployed the fastest with
training to ITTs at respective schools on their value & usage.
o The Managed VPN failover network for education & business continuity can
deployed in parallel to current network and separate from the Palo Alto Firewall
upgrade & swap out. Head-end VPN concentrator will be setup first & first site
tested along with second site & then the remaining 23 locations will roll out in
fairly quick order.
o Review & convert PA-5250 FW config to PA-5440 in an effort to complete before
school starts in early August 2025, but this is a stretch depending approval &
purchasing process & availability of maintenance window(s). Cutover can occur
during an evening or over a weekend. Multiple weeks of prep, review &
conversion followed by the cutover in one day. The new PA-5440 firewalls will
take advantage of both internet service providers at 2 of the 3 physical
datacenters.

This is a Statement of Work detailing the scope of services to be provided by STEP CG. All
planning, configuration, testing and production implementation will be coordinated and
completed remotely and onsite as is required by STEP CG Professional Services Engineering
and Solutions Architect Engineering Resources per this agreement. Remote access into the
Client’s network and compute platforms may be required.
A STEP CG project manager will be the primary contact for Client for the duration of the project
after the SOW is signed. The project manager will work with Client to establish specific timelines
for the project as well as scheduling appropriate STEP CG Professional Services Engineering
resources for project completion.

SCOPE TIMELINE

STEP CG will engage Client to establish the timeline and work schedule for the defined
services, estimated to be onsite & remote engagement as described above. The timelines and
project start date will be established based upon Client product receivable dates and both Client
and STEP CG resource availability. It is generally understood that the work is desired to begin
as soon as possible after full execution of this SOW.

STEP CG and Client mutually agree that product and project resource lead-times may vary
based upon the project plan and respective resource availability. In addition, atypical hardware
delivery lead times due to global supply chain demands will be communicated by STEP CG to
Client and coordinated with Client accordingly.

The timeline will reflect best-case scenario information and planning. In the event the project is
disrupted due to severe weather or other catastrophic, regulatory, or legal events beyond the
control of STEP CG or Client, the timeline will be adjusted.

Lastly, if the scope of this SOW is altered after the SOW is signed and already in-process, then
the Scope Change Process will govern the changes.

Client is requesting to perform project during January April to complete tasks that would impact
network connectivity and application operations.

SCOPE OF WORK

1. Client Dependencies
a. Provide VPN access for STEP engineer(s)
b. Firewall & core configs for conversion to new PA-5440 firewalls
c. 2 points of contact. 1 technical & 1 project manager or executive.
d. Administer & configure Microsoft Active Directory & Entra ID integrations as
needed with advice & direction from Fortinet & STEP as it relates to the
purchased SW & HW

2. Implementation / Configuration
a. Remote design, configuration, troubleshooting, & cutover leadership as
described in the above scope overview.
3. Turnover / Knowledge Transfer
a. STEP CG will provide the following deliverables:
i. Inventory of all installed hardware with serial numbers, software with
licenses, and asset tag numbers (if provided by Client as outlined above)
ii. Backups of configurations as appropriate.
iii. If applicable and requested, knowledge transfer and post-implementation
review with Client staff (up to 4 hours).
iv. If applicable, a Lucidchart drawing of the installed network components
and corresponding uplinks.

SCOPE CHANGE PROCESS

In the event a change in project scope is requested during the delivery of this service, the
following Scope Change process will be used:

1. A written description of the changes (Scope Change Request Form) will be prepared
jointly by STEP CG and Client.
2. The document will describe the change, the rationale for the change, and specify any
change in charges, estimated schedule, or other items.
3. The Scope Change Request Form shall indicate the detailed cost and any impact of the
change request upon the planned deliverables and their respective timelines.
4. STEP CG and Client must sign the Scope Change Request Form to authorize
implementation of the proposed changes.
5. The terms of the mutually agreed upon Scope Change request will prevail over those of
this Agreement or any previous Scope Change request.

OUT OF SCOPE

Any changes to the Statement of Work or rescheduling of dates/time for this engagement will
initiate the Scope Change process and could be subject to additional costs. No oral statements
by any party will constitute an official modification of statement of work. All SOW changes will be
requested in writing and accepted/rejected by the Client and STEP CG Project Manager in
writing.

Out of Scope:
1. Relocation and/or re-install of equipment that was removed as part of performing the
installation services contained within this engagement.
2. Installation, configuration or troubleshooting of third-party products and solutions, not
included in this SOW. Charges associated with technical support for third-party hardware
or software is the responsibility of Client.
3. Configuration of end user devices.
4. Access Points not accessible via 12’ ladder or Client-provided lift.
ASSUMPTIONS

1. Products in support of this SOW will be shipped as they become available and invoiced
upon delivery.
2. Site and system preparations are the responsibility of Client, unless otherwise noted in
this Statement of Work (See Client Responsibility Section).
3. All work to be completed remotely during normal business hours except if otherwise
specified.
4. Any missing, dead-on arrival (DOA), unrelated equipment and network unavailability may
require additional visit(s), which will be billed at normal Time and Material rates, plus a
visit charge per occurrence with associated travel cost.
5. Client represents that it has made routine backups of data and completed a successful
test of data restoration and recovery. Client will continue to make such routine backups
during the project.
6. Client recognizes that Internet access and computer network connections may be made
temporarily unavailable during installation of products.

CLIENT RESPONSIBILITIES

Client involvement and preparedness is critical for a successful engagement and will reduce
project risk and help support the engagement timeline. Client recognizes that its failure to
provide the required engagement support items as identified in the Client Responsibility Section
may impact the project. If the Client responsibility items cause a project delay, change in scope,
or project impact, a Scope Change process will be initiated requiring approval and additional
cost could be incurred. Client responsibilities include:

Client Resource Availability and Documentation:
1. Provide a dedicated point of contact for the engagement (i.e., Project Sponsor).
2. Provide on-site contact that has authority to make decisions related to implementation /
deployment as scoped in this SOW.
3. Facility escort and/or assistance as needed for all required access locations.
4. Participation in network design and consultation meetings.
5. Assist with network operation validation upon implementation.
6. The sharing of network discovery or other requested information and documentation
needed for the successful execution of the engagement.

Facility and Access Readiness:
1. Building Facilities and Networking equipment access as needed along with premise
access arrangements.
2. Equipment room / environmental readiness including the completion of required power
installation, and any required wiring/cabling not covered under the scope of this
engagement.
3. Secure location for product delivery, equipment staging, or lab setup.
4. Installation materials (i.e., wiring, racks, p-panels, cords, jacks, cabling, Amphenol tails,
punch blocks, cabling peripherals, etc.) not covered under this SOW.
5. Appropriate maintenance window allowing for required downtime along with managing
notification to end Clients for any temporary service outages.
6. Remote VPN access including VPN or SAL concentrator access as required.

Network Preparation Readiness:
1. Network readiness (i.e., Internet Access, VLANs, DHCP, etc.).
2. Physical equipment and configuration to support this engagement.
a. Rack space, appropriate copper and fiber cabling as required.
i. Inter and Intra Switch connectivity.
ii. Pre-switch installation patch panel and cable labeling.
b. LAN/WAN including the installation of Layer 2 edge LAN switches
c. Switching, router, or other data configuration services as required.
d. Applicable wiring including toning/tested, tagged, and labeled.
e. Servers/VM hardware and resources required in support of the engagement.
3. Applicable IP addresses, subnet mask, default gateway.
4. If needed, DMARC has been extended and the wiring tested to the equipment room
where the equipment will be installed.

STEP CG RESPONSIBILITIES

STEP CG is focused on providing Client with a project engagement that is structured for
success. We strive to deliver the engagement as planned to limit risk and provide the best
outcome for your business. Our Professional Services team of Project Managers and Engineers
are highly trained and have industry leading certifications. STEP CG project execution
responsibilities include:
1. Provide a project status communication plan and a project plan.
2. Provide skilled engineering resources to perform the work as outlined in this SOW.
3. Identify and report any issues relating to implementation to the Client Project Manager,
STEP CG engineering resources, and management as needed.
4. Ensure project plan and scope is in line with SOW and escalate project issues to the
Client Project Sponsor.
5. Execute the Scope Change process if needed to document changes from original scope
and identify changes in risk, timeline, and cost.
6. Coordinate resource scheduling to targeted assignments and timeframes.
7. Host project update meetings based on an agreed frequency with Client and STEP CG
assigned project manager, and technical resources as needed.
8. Provide as-built diagrams and documentation – digital and hardcopy.

COST AND INVOICING Single invoice

The total fixed price cost for the scope as documented in this SOW includes travel, and will be
invoiced based on partial billing based on project completion detailed in tables bleow. Any scope
and/or schedule changes will be documented and pre-approved using the Scope Change
process, and those changes could incur additional costs.
% of
Milestone / Deliverable Project Invoice
Project 1: Palo Alto Firewall Professional Services kick-off 50% $23,050
Project 1: Palo Alto Firewall Professional Services completion 50% $23,050
TOTAL 100% $46,100

% of
Milestone / Deliverable Project Invoice
Project 2: Managed VPN Failover Services kick-off 50% $5,750
Project 2: Managed VPN Failover Services completion 50% $5,750
TOTAL 100% $11,500

% of
Milestone / Deliverable Project Invoice
Service: Incident Response Package up-front 100% $32,000
TOTAL 100% $32,000

Payment terms are net 30 days from the date of invoice. Fees are exclusive of sales and use
taxes, VAT and all other taxes, except taxes imposed on STEP CG’s income. Overdue fees shall
be subject to interest at the rate of one and one-half percent (1½%) per month or the highest
rate allowed by applicable law, whichever is lower. Client shall indemnify STEP CG for all costs
and expenses, including without limitation reasonable attorneys’ and collections agency fees,
incurred by STEP CG in attempting to collect past due amounts from Client. STEP CG may, in
its sole discretion, suspend its performance of this SOW and the Agreement, as well as the
provision of products and services to Client, in the event Client fails to pay any invoices on time.

RISK TO PROJECT ESTIMATES

It is understood that STEP CG and the Client have established this SOW using best effort to
document engagement scope, responsibilities, and assumptions. In the event the engagement
encounters unforeseen items, schedule delays, lack of readiness (facility, network, staffing,
etc.), or scope changes, the Scope Change process will be initiated and could impact the
project timeline and incur additional cost.

TERMS AND CONDITIONS
This SOW may be terminated by either party for any reason upon 30 days prior written notice
to the other party. Upon termination, Client will pay those fees and expenses applicable to the
Services performed by STEP CG through the effective date of termination. This Section entitled
“Terms and Conditions” will survive termination of the SOW.

This SOW may be amended only upon mutual written agreement of the parties. Client may not
assign this Contract without the prior written consent of STEP CG.

IN NO EVENT WILL STEP CG BE LIABLE FOR ANY CONSEQUENTIAL, INCIDENTAL,
INDIRECT, SPECIAL OR EXEMPLARY DAMAGES OF ANY KIND, EVEN IF STEP CG IS
AWARE OF THE POSSIBILITY OF SUCH DAMAGES OR IS NEGLIGENT. STEP CG'S TOTAL
LIABILITY UNDER OR IN RELATION TO THIS SOW, REGARDLESS OF THE BASIS OF THE
CLAIM, WILL NOT EXCEED THE TOTAL FEES PAID BY CLIENT TO STEP CG IN THE
TWELVE MONTHS IMMEDIATELY PRECEDING THE CLAIM. STEP CG MAKES NO, AND
DISCLAIMS ALL, EXPRESS AND IMPLIED WARRANTIES IN RELATION TO OR UNDER THIS
CONTRACT.

STEP CG will not be liable for any delays or failure to perform caused by events beyond the
reasonable control of STEP CG.

The parties’ confidentiality obligations under or in relation to this SOW will be governed by the
Nondisclosure Agreement (“NDA”) entered into by the parties. Absent an NDA, each party
agrees to maintain the confidentiality of the other party’s confidential information, not disclose
such information to third parties, and use the information solely for purposes of performing this
SOW.

Each party will retain all rights, title, interest and ownership of each pre-existing intellectual
property and all modifications, updates, upgrades, enhancements and derivatives thereof
(“Preexisting IP”). STEP CG will retain ownership of all deliverables created and provided by
STEP CG under this SOW, provided that STEP CG hereby grants to Client a perpetual right and
license to use (i) such deliverables for Client’s internal business purposes and (ii) any STEP CG
Pre-existing IP contained in the deliverables for the purpose of utilizing the deliverables.

AUTHORIZED SIGNATURE

The Client contact shown below, acting with proper authority, has executed this SOW as an
authorized representative of Client. Such representative’s signature also certifies authorization
to invoice the Project Initiation milestone and commence the services, acknowledges a good
understanding of the Scope as documented in this SOW, and reflects that a purchase order is
not a pre-requisite for STEP CG to commence services or invoice Client.

For STEP CG, LLC: For Client:
Signature: Signature:

Printed Name: Printed Name:

Title: Title:

Date: Date:

Agenda Item