Request for Proposal (Rfp) s9

Procurement Department

Date: October 14, 2016

REQUEST FOR PROPOSAL (RFP) RFP #SGC-0001-17CS

BID DESCRIPTION: Computer Forensic eDiscovery Services and HR Escrow of Electronically Stored Information (ESI)

BID DEADLINE: Thursday, October 27, 2016 by 5:00 pm EST

The Seneca Gaming Corporation Procurement Department is requesting bids for the above mentioned goods/service. All communications regarding this bid should be addressed to:

Seneca Gaming Corporation - Procurement Department Attn: Charles Saxe 310 Fourth Street Niagara Falls, NY 14303 RE: # SGC-0001-17CS Telephone: (716) 501-2161 [email protected]

All questions should be submitted in writing to Charles Saxe and answers will be distributed to all bidders. Proposals must be received by the Procurement Department on or before the date stated above by 5:00 pm EST. Proposals received after the deadline will not be considered. SGC recognizes e-mail as a sealed response in relation to this RFP.

I. Scope and Intent:

Seneca Gaming (SGC) seeks to obtain a vendor with expertise in the area of Computer Forensics and HR Escrow of ESI. The selected vendor must be able to meet all requirements stated within this scope of work. This contract will be awarded for a term of one year with the option to renew each of the following two years.

II. Specifications:

The enclosed details related to the goods and/or services in this RFP are based upon the operating department’s requirements. Include ALL associated cost and requesting same pricing for the three year potential period, or, provide your best offer.

of 11 All questions regarding this RFP should be submitted in writing to Charles Saxe, Buyer, [email protected]

All written questions must be submitted by Wednesday October 19, 2016 at 5:00pm EST.

All questions will be answered during the Friday, October 21, 2016 scheduled conference call. Please see details below.

VENDOR RESPONSE TO REQUIREMENTS

 Please indicate which high level business requirement can be fulfilled by your company’s solution. Please answer “Yes” if this requirement is met by your standard solution, “No” if you will not meet the requirement, and “D” if the solution will require development. Please enter additional information in the last column. Supporting materials may be attached as needed. IMPORTANT: Please reference the corresponding B u siness Requirement (BR) # if you are attaching supporting materials.

Yes, # High Level Business Requirement No, Additional information D In-house/on staff Computer Forensics & BR1 Data Recovery capabilities

Certified Computer Forensic Examiner BR2 (CFCE) certified staff

Qualifications necessary to testify as an Expert Witness in local, state, federal and BR3 international jurisdictions for Litigation Support if/as needed

DoD (Department of Defense) clearance BR4 (preferred)

Detailed customer service/support program BR5 to include 24/7/365 operations

On-site response within 24 hours if/as BR6 required (local presence)

Industry-accepted, documented chain of BR7 custody (CoC) procedures

Industry-accepted, documented evidence BR8 tracking reporting procedures/deliverables

of 11 Ability to validate and verify bit stream forensic image of hard disk drives (laptops, BR9 desktops, home computers, thumb drives, cell phones, PDAs, etc).

Yes, # High Level Business Requirement No, Additional information D Must be able to perform forensic analysis with comprehensive written forensic report for baseline activity to include:

Corporate Email (Outlook client)

Deleted e-mail containers and deleted - deleted e-mail

Web-based email (Gmail, Yahoo, Hotmail etc.)

Internet History Report (Various browsers)

Typed URLs (websites)

Searched URLs (websites)

User-created files (e.g. contents of My Documents, etc.)

User-created files that have been deleted BR10 Previous versions/recovered user-created files

External devices installed

Files copied to external devices (CDs, thumb drives, etc.)

Files sent to printer

Applications installed

Applications recently uninstalled

Application related data (e.g. P2P file sharing, iTunes, etc).

Full registry data report

Last boot time/last shut down time

of 11 Yes, Additional # High Level Business Requirement No, information D

Ability to provide expert analysis on technical electronic data, such as raw log BR11 files, web server logs, raw server data, telephone PBX data, access control data or other computerized billing data or similar. Ability to provide HR escrow services on encrypted media at the disk layer in multiple file formats (e.g. NTFS), when provided a BR12 recovery token, or a challenge and

response procedure. Must have industry accepted best practices, procedures and tools in place (e.g. EnCase). Ability to output data analysis in an e- discovery format that supports search, review, organize, produce and sharing of BR13 litigation documents in a standard format for scanned paper, email and other e-discovery outputs that were generated during discovery

Note: Please be sure you have included attached Detailed Pricing Structure and all possible additional costs are addressed.

III. Schedule of Events:

 Request for proposal issued 10/14/2016  Deadline for submitting written questions 10/19/2016  Vendor conference call 10/21/2016 1:00 pm EST - 1:30 pm EST Please use the following number:

Conference Number: 8005018979

Access Code: 5012161  Request for proposal due 10/27/2016 5:00 pm EST

of 11 IV. Vendor Requirements: A. Performance: Bidders must have the necessary experience, knowledge, abilities, skills, and resources to satisfactorily perform the terms, conditions and requirements of the RFP. Subcontracting of services is not permitted without advance, express written consent. Goods/services must be provided by the entity submitting proposal. B. Insurance: At all times, during the fulfillment of any resulting Purchase Order or Contract, the Awarded Vendor(s) shall obtain and keep in force insurance coverage acceptable to SGC’s Risk Management Department. SGC’s insurance requirements for vendors vary according to the nature of the contract and degree of risk, but normally include general liability, automobile liability, and workers’ compensation coverage. In addition, in appropriate cases, SGC may require professional liability/errors & omissions coverage and/or network security/data privacy coverage. Proof of insurance coverage must be provided to SGC Risk Management Department. For any questions regarding insurance, please contact the Risk Management Department at [email protected]. Please reference the Request for Proposal (RFP) number and Bid Description. C. Failure to maintain requisite insurance will entitle SGC to immediately rescind and/or terminate any resultant business relationship and contract with Awarded Vendor. D. Vendor Registration: Awarded Vendor(s) agrees to submit a completed Vendor Registration Form and designated fees as required by SGC’s regulator, the Seneca Gaming Authority (SGA). It is the Awarded Vendor(s) responsibility to fulfill the requirements, submit information and cooperate with any SGA investigation into its business functions, structures and principals when sales by said Awarded Vendor may reach or exceed Seventy Five Thousand Dollars ($75,000); and to maintain the registration/license through the duration of any purchase order or contract resulting from this RFP. Failure to do so will entitle SGC to immediately rescind and/or terminate any resultant contract or business relationship and may result in the suspension of payments to the Awarded Vendor. E. The SGA may also, in an appropriate case, require the licensure of individual employees of the Awarded Vendor who perform certain services that are or may be closely associated with SGC’s casino operation. As SGA retains the discretion to make this type of determination on a case-by-case basis, SGC is unable at the RFP point in the bidding process to state definitively whether such licensure will be required in any particular case. F. Seneca Nation of Indians Business License: In addition to SGA licensure, Awarded Vendor(s) with a calendar year spend of over $10,000 are required to obtain a Seneca Nation of Indians (SNI) business license throughout the course of any contract or business dealings with SGC. It is the Awarded Vendor(s) sole responsibility to maintain and renew the SNI business license in accordance with the terms set forth in the “Seneca Nation of Indians Business Code”. The cost of the license is currently $150 per calendar year. The Awarded Vendor must submit the application, together with the requisite fee, within 30 days following award of contract, to the following address: Seneca Nation of Indians, Business Permit Office, 12837 Rte. 438, Irving, NY 14081. To obtain the application form, and for any questions, please contact the SNI Business Office at (716) 532-4900, ext. 5033 or visit the SGC website at http://www.senecagamingcorporation.com/corp_standards.cfm. A copy of the Awarded

of 11 Vendor’s application should contemporaneously be sent to Seneca Gaming Corporation - Procurement Department, 310 Fourth Street, Niagara Falls, NY 14303. G. Confidentiality: This document contains information (and Bidders may have access to) confidential information of the SGC and/or its affiliate. Bidders are authorized to use this information solely in connection with the preparation of a response to this RFP and fulfillment of any resulting purchase order or contract award. In submitting response(s) to this RFP, Bidder(s) agree and represent that the Bidder(s) will not directly or indirectly use the Confidential Information beyond the scope of the authority granted by SGC or disseminate, disclose or in any way reveal the Confidential Information or any part thereof, except upon the express written approval of SGC. SGC will keep all documents received from Bidders on a confidential basis, save to the extent disclosure is required to comply with requirements of SGC’s corporate Charter, as regards the approval of SGC’s Audit Committee, Board of Directors and Council of the Seneca Nation of Indians, if applicable. H. Disclosure of Potential Conflicts of Interest: If Bidder, or any director, officer, employee or owner of Bidder has a business or personal relationship with a director, officer or employee of the Seneca Gaming Corporation (or its affiliates) that may create a conflict of interest, or appearance of impropriety, for or relating to such director, officer or employee in connection with the entry into, or ongoing performance of, the transaction(s) or service(s) contemplated under this RFP, Bidder must disclose such conflict to the Corporation, in writing, to the extent Bidder has knowledge thereof. I. Kickback Covenant: SGC will not tolerate Kickbacks in any form. A “Kickback” shall be defined as any cash, fee, commission, credit, gift, gratuity, thing of value or compensation of any kind in exchange for favorable treatment in obtaining or retaining any purchase order or contract servicing SGC. Bidder agrees that its officers or employees have not and will not provide or attempt to provide, either directly or indirectly, any Kickback to any employees of SGC, the Seneca Nation of Indians (the “Nation”) or their respective officers, directors, employees or agents, nor to any citizens of the Nation. J. Conditions: Bidders shall question the conditions under which the goods and/or services will be used by SGC to guarantee the goods and/or services will be of sufficient quality and fit for the purposes of the bid specification. To proceed with the supply of goods and/or services shall mean acceptance of site conditions. Failure to comply with this clause shall in no way serve as the basis of any claims by the Bidder against SGC. No allowances will be made for failure to make proper site investigations or to completely understand the full nature of the requirements involved. K. Monetary threshold: At no time will the Awarded Vendor’s aggregate fees, billings, requests for reimbursement and/or invoices (collectively, “Billings”) to SGC exceed two million nine hundred ninety-nine thousand nine hundred ninety-nine dollars ($2,999,999) (the “monetary threshold”) unless and until advance written authorization to exceed the monetary threshold is granted by the Council of the Seneca Nation of Indians. SGC will not be liable for Billings which exceed the monetary threshold unless the requisite approval of the Council of the Seneca Nation of Indians has been obtained, Awarded Vendor must notify SGC when aggregate Billings reach the level of two million five hundred thousand dollars ($2,500,000). For this purpose, the term “SGC” includes the Seneca Gaming Corporation and all subsidiaries. L. Intellectual Property Indemnification: Awarded Vendor, at its own expense, will defend, indemnify and hold SGC harmless in any third party action brought against SGC to the extent that it is based on a claim that all or part of the goods or services supplied by

of 11 Awarded Vendor and used as directed infringe any third party trademarks, copyrights, patents, or other intellectual property rights. M. Standard Service Agreement: Awarded Vendor will be expected to sign SGC’s standard services agreement, subject to such changes as are necessary to reflect the terms of this RFP and Awarded Vendor’s bid or proposal, and such further changes as the parties, acting reasonably, may agree. N. Exclusivity: Awarded Vendor will be expected to agree not to consult or provide any services in any manner or capacity to a direct competitor of SGC during the term of its contract with SGC unless express written authorization to do so is given by SGC. A direct competitor of SGC is defined as any individual, partnership, corporation and/or other business entity that engages in the business of casino gaming (including racinos). O. Data Security: Awarded Vendor must use the highest applicable industry standards for sound data security and software development practices to resolve critical security issues as quickly as possible. The term “highest applicable industry standards” shall be defined as the degree of care, skill, efficiency, and diligence that a prudent person possessing technical expertise in the subject area and acting in like capacity would exercise in similar circumstances. Awarded Vendor shall be responsible for verifying that all members of its development team who perform any programming or software development for SGC have been successfully trained in secure programming techniques. Upon request, Awarded Vendor will supply a current SAS 70 compliance report issued by an independent auditor or “Statement on Standards for Attestation Engagements 16 [SSAE 16]” SOC Report, if applicable based on proposed service delivery. Software supplied must not contain any code that weakens the security of SGC’s IT systems and applications, including computer viruses, worms, time bombs, back doors, Trojan horses, Easter eggs, and all other forms of malicious code. Awarded Vendor must share with SGC in writing all security-relevant information regarding the vulnerabilities, risks and threats to its software immediately upon identification. SGC reserves the right at any time during the term of the contract, to conduct an audit of Awarded Vendor’s data security measures, either by means of its own personnel or through a service provider retained by SGC. Should the audit reveal that Awarded Vendor’s data security processes and procedures are inadequate or that Awarded Vendor is in breach of this provision, the cost of the audit shall be borne by Awarded Vendor, and SGC may, in its discretion, forthwith terminate the contract or any business relationship between SGC and Awarded Vendor. P. Directives and Minimum internal control standards: Awarded Vendor must comply with SGC’s reasonable directives as regards IT security and other matters. In addition, as contemplated in § 542.16 and 543.20 of NIGC Information Technology MICS, Awarded Vendor must comply with SGC’s internal control standards, including change control procedures and SGC hereby reserves the right to monitor and audit compliance with said internal control procedures, either directly or through an appointed representative such as an external auditor.

V. Bid Information:

A. This RFP does not commit SGC to award a contract, to pay any costs incurred in the preparation of the RFP, nor to procure or contract for services or supplies. B. Alternate Proposals (if applicable) are accepted based on the following conditions: SGC will consider alternative proposals from Bidders provided they have submitted a

of 11 response based on the original requirements. The alternative Proposal will be submitted separate and apart from the basic Proposal. It is assumed that the materials included in the alternate Proposal meet all of the qualifications of the original Proposal. Bidders must apply in writing for SGC permission to use substitute materials or methods. In such circumstances, the Bidder must state the return on investment/benefit(s) in increased efficiency, longevity and or monetary value to be derived through use of substitute materials or methods. C. Proposal- Awarded Vendors should expect that their response to the RFP and any accompanying supporting materials (collectively, the “Proposal”) will be incorporated into any contract signed with Seneca Resorts and Casinos. D. Substitutes Any recommended substitutions should be attached separately. Products may require testing before acceptance. Bidder’s pricing must include the conversion calculations if your size, pack, weight, etc. is not the same as the specified product(s). Without requiring disclosure of confidential information, SGC solicits Bidders’ recommendation(s) for new products and/or services leading to lower costs. E. Bidders are advised that the actual items and quantities which may be required are subject to change based on the needs of the SGC departments or business units for which the goods and/services are destined. F. Tax Exempt Status: Seneca Gaming Corporation is a governmental instrumentality of the Seneca Nation of Indians and will provide a New York State tax exemption certificate issued in the name of the Seneca Nation of Indians, as applicable. G. Minority Bidders: SGC encourages Bidders to solicit Native American, minority or women-owned businesses and small disadvantaged businesses as potential product suppliers. If your company falls into any of these categories, please note as such on your proposal. H. Payment Terms: Please provide your most competitive pricing and any additional offers. SGC will compensate Awarded Vendors based on submitted invoices according to payment and cycle dates mutually agreed upon and stated in the contract. SGC standard payment terms are FOB destination, Net 45 days after delivery of goods and/or services and receipt of a correct invoice. Bidder is encouraged to indicate any additional early payment/ discount terms in its Proposal. It is the policy of SGC not to provide deposits unless significant discounts or special circumstances apply. I. Travel time and expenses: In the absence of specific agreement to the contrary, travel time and travel expenses are not compensable. Where travel expenses are compensable, the following limitations apply: SGC will reimburse Vendor for Vendor’s reasonable travel expenses which are directly related to performance of the services. Travel expenses are reimbursed at cost, and no overhead or administrative charges are allowed. All travel must be approved in advance by SGC and all air travel must be economy class. Mileage charges for Vendor-owned vehicles and other travel-related expenses will be reimbursed in accordance with the CONUS rate applicable to Niagara Falls, New York. SGC may instruct Vendor personnel to stay in SGC’s hotels or in another hotel in close proximity to SGC property and to eat in SGC’s employee dining room. Vendor must provide receipts for expenses other than mileage together with the invoice to which such expenses relate. Where Vendor operates out of multiple regional or national offices, Vendor’s local office closest to Buyer’s property will be deemed the point of departure for travel expenses, i.e., SGC will reimburse travel expenses incurred to and from the Seller’s office located closest to SGC’s property where the work is to be performed, not from any other offices of Vendor.

of 11 J. SGC Standard Terms and Conditions: Any purchase order or contract flowing from this RFP is subject to the terms and conditions hereof as well as to SGC Terms and Conditions which are available on the following website: http://www.senecagamingcorporation.com/corp_standards.cfm. Reference to, or inclusion of, the Bidder’s preprinted terms and conditions with Bidder’s Proposal will not be considered as exception to SGC Terms and Conditions. K. Audit/Performance Review: SGC must be permitted to conduct financial or inventory audit(s) with any or all of its Procurement, Financial and/or Internal Audit resources (or using a third party accounting/auditing firm )during or after the term of the contract with Awarded Vendor. Contract audits may also be performed periodically to evaluate performance against pre-determined metrics and focus on what can be improved. L. Include if interruption in their business would be critical to SGC. Business Continuity: For RFP’s involving strategic commodities/services, provide an overview of your disaster recovery/business continuity plan (the “Plan”). The Plan indicates how Bidder minimizes the risk of interruption to Bidder’s ability to provide the goods and/or services contemplated in this RFP in the event of specified occurrence ; Bidder’s critical supplier strategy to ensure continuity of suppliers in such event; and Bidders process or criteria for prioritizing customer demands during a crisis. M. It is the policy of SGC that all Proposals are to be held unopened and confidential until after the closing date and time. At the bid opening, Proposals will be opened by the RFP contact and are reviewed by a compliance representative. N. SGC reserves the right to assess damages for the non-delivery of goods/services. O. SGC reserves the right to terminate or rescind any agreement, contract or purchase order if, in its opinion, there is a failure by the Awarded Vendor (s), at any time, to perform/supply adequately the stipulations of the Scope of Work, as stipulated in this RFP, the contract or purchase order, or if the goods or services supplied by the Awarded Vendor are, in the opinion of SGC of unacceptable quality. P. Bid Validity: Bidder’s bid submission shall remain valid a minimum of ninety (90) days from the bid closing date.

VI. Proposal Evaluation/Vendor Selection: A. Proposals will be evaluated to determine their completeness and compliance with the mandatory requirements and qualifications specified throughout this document. Failure to comply with one or more of these requirements may result in the proposal being judged non-responsive. SGC reserves the right to waive deviations it deems non- material and/or to reject any and all Proposals in its sole discretion. B. It is SGC’s intent to identify those providers: deemed best qualified based on experience and capabilities; that have demonstrated the ability to conform to the requirements defined herein; that can assist SGC in reaching ultimate patron and team member satisfaction; and that have the best quality product/service for the most competitive pricing. When applicable, a weighted evaluation table with different percentages for each factor will be used. Proposals will be evaluated using a scorecard on the following factors including, but not limited to: adherence to the scope of work, price, service, terms,

of 11 quality, technology, incentives, history, completeness and overall responsiveness to this RFP. C. Those Bidders whose Proposals are judged most suitable will be considered high-ranking contenders for contract award and may be asked for additional information to verify financial stability, emergency response/business continuity plans, and other pertinent questions to validate the viability of the business relationship. Bidders at this point, may also be asked to interview with (or present to) the SGC commodity team or management dependent on goods/services. D. A final Bidder (occasionally Bidders) will be selected and will have the opportunity to discuss provisions of their Proposal with SGC. Should negotiations fail, SGC will return to the finalist list and initiate negotiations with one or more alternate Bidders.

VII. Bid Submittal Checklist:

A. Electronic copy of proposal (Email acceptable) B. Proposal/Pricing as outlined in Section II. C. Additional Offers/Bid Notes: Discounts, rebates, marketing funds, etc should be listed separately. D. Evidence of current insurance is to be provided. If current levels do not meet the RFP requirements listed in Section IV, please list what the additional cost would be to meet them as a separate line item in bid. E. Sign and date bid (section VIII Certifications and Representations). F. Include three comparable references including contact information. G. Where applicable, include the following documents: Standard contract or agreement, Service Level agreement, Hosting agreement, Statement of Work Contract, Technical Services contract, Support Services Agreement, Master Service Agreement, Maintenance Agreement, Warranty information or any similar contract or agreement. SGC reserves the right to and generally utilizes its own standard forms of contract and agreements.

VIII. Certifications and Representations- the Bidder certifies the following:

A. Bidder is a reputable company fully qualified and regularly engaged in providing products and/or services necessary to meet the terms, conditions and requirements of the RFP. B. Bidder is aware of, is fully informed about, and is in full compliance with all applicable federal, state and local laws, rules, regulations and ordinances. C. Bidder understands the requirements and specifications set forth in this RFP and affirms that no compensation has been received for participation in the preparation of the specifications for this RFP. D. Bidder represents and warrants that all articles and services quoted in response to this RFP will meet or exceed the safety standards established and promulgated under the

of 11 Federal Occupational Safety and Health Law (Public Law 91-596) and its regulations in effect or proposed as of the date of this solicitation. E. All statements, information and representations prepared and submitted in response to this RFP are current, complete, true and accurate. Bidder acknowledges that SGC will rely on such statements, information and representations in selecting the Awarded Vendor. If selected by SGC as the Awarded Vendor, Bidder will notify SGC immediately of any material change in any matters with regard to which Bidder has made a statement or representation or provided information.

F. I, the undersigned, hereby certify that I am authorized to sign as a representative for the Bidder listed below:

Legal Name of Bidder: ______

DBA (if applicable): ______

Address: ______

Telephone: ______Fax:______

E-Mail: ______

Website: ______

Representative’s Signature: ______

Representative’s Printed Name: ______

Representative’s Printed Title: ______

Date: ______NAICS code # ______

 Seneca Allegany Resort & Casino Salamanca, NY  Seneca Buffalo Creek Casino Buffalo, NY  Seneca Niagara Resort & Casino Niagara Falls, NY  Seneca Hickory Stick Golf Course Lewiston, NY

Combined, the three gaming properties currently have more than 6,800 slot machines, 150 table games, 263,000 square feet of gaming space, 1,017 rooms (including 134 suites), 20 restaurants, lounges and snack bars along with accompanying entertainment and convention amenities. For additional information, please visit our website at www.senecagamingcorporation.com.