IDBI Bank Ltd. RFP for Setting up of a captive Security Operation Centre(SOC) Responses to Bidder Queries

Transcription

1 IDBI Bank Ltd. for Setting up of a captive Security Operation Centre(SOC) Responses to Bidder Queries (IDBI/Pcell// /24) dated 24th March, 2015 Sr. Clause Document Control Sheet Schedule for Receipt of Bids April BID SECURITY / EARNEST MONEY DEPOSIT (EMD) The Bid Security shall be forfeited if. Can please amend the submission date till 2nd May 2015? Looking at the vast scope of requirements to provide a best response we need to have some more time Please confirm that the Bid Security will be forfeited on failure of the Bidder to sign the contract or furnish performance security after mutual agreement of both the parties on terms and conditions of the tender. Please confirm that any execution of the order/ purchase order/ service order by the Successful Bidder will be on mutually agreed terms. Refer Corrigendum 1. 1 of 91

2 Clause BID SECURITY / EARNEST MONEY DEPOSIT (EMD) ELIGIBILITY CRITERIA FOR BIDDERS EMD Forfeiture In the event of any evasion, avoidance, refusal or delay on the part of the Successful Bidder to sign and execute the order/ purchase order/ service order or any document, as may be required by IDBI Bank in case the Bid is accepted The bidder should have been providing onsite SOC Services with the proposed SIEM tool to at least one organization in India. The proposed SIEM tool must be implemented in at least 2 Banks in India / Globally(in similar line of business as IDBI Bank) during the last two years with at least one of the Bank having a network of more than 100 branches. It is submitted that any delays in relation to discussion over finalization of the terms of the Contract shall not be considered as a delays for the purpose of this Clause. Please modify it to "The bidder should have been providing onsite SOC Services with SIEM tool to at least one organization in India. The proposed SIEM tool must be implemented in at least 2 Banks in India / Globally(in similar line of business as IDBI Bank) during the last two years with at least one of the Bank comparable to the scale of the IDBI Bank in terms of geographical spread, number of hardware devices and software, complexity and heterogeneity in information systems etc.." Time will start once PO is raised.. 2 of 91

3 Clause ELIGIBILITY CRITERIA FOR BIDDERS ELIGIBILITY CRITERIA FOR BIDDERS ELIGIBILITY CRITERIA FOR BIDDERS SIEM tool deployed must be in the Leader or Challenger Quadrant of the latest Gartner s Report for SIEM. The bidder should be empanelled with CERT-in. The bidder should be empanelled with CERT-in. As IDBI bank is looking at setting up state of art SOC, it is important that the bank select the market leading and proven technology in its SOC. As for SIEM they are already 5 top vendors in the Gartner leader's Magic quadrant please modify it to "SIEM tool deployed must be in the Leader Quadrant of the latest Gartner s Report for SIEM" Will the bidder themselves should be empanelled or the outsourced partner performing the VA/PT empanelment would be sufficient? CERT in is more applicable for VAPT and so we request the bank to allow us for either Sub- contracting that work to a CERT IN company.main Bidder will still front end the bid and will have single point ownership. Refer Corrigendum 1 Refer Corrigendum 1 Or 3 of 91

4 Clause ELIGIBILITY CRITERIA FOR BIDDERS ELIGIBILITY CRITERIA FOR BIDDERS The bidder should have been providing onsite SOC Services with the proposed SIEM tool to at least one organization in India. The proposed SIEM tool must be implemented in at least 2 Banks in India / Globally(in similar line of business as IDBI Bank) during the last two years with at least one of the Bank having a network of more than 100 branches. The bidder should have been providing onsite SOC Services with the proposed SIEM tool to at least one organization in India. The proposed SIEM tool must be implemented in at least 2 Banks in India / Globally(in similar line of business as IDBI Bank) during the last two years with at least one of the Bank having a network of more than 100 branches. Allow to form a teaming arrangement with another CERT IN certified partner Please provide choice of clients across FSI Industry as references, not banks only Since this is more tool related, please allow references from OEM also, not just bidder Please modify it to "The bidder should have been providing onsite SOC Services with SIEM tool to at least one organization in India. The proposed SIEM tool must be implemented in at least 2 Banks in India / Globally(in similar line of business as IDBI Bank) during the last two years with at least one of the Bank comparable to the scale of the IDBI Bank in terms of geographical spread, number.. 4 of 91

5 Clause ELIGIBILITY CRITERIA FOR BIDDERS ELIGIBILITY CRITERIA FOR BIDDERS ELIGIBILITY CRITERIA FOR BIDDERS SIEM tool deployed must be in the Leader or Challenger Quadrant of the latest Gartner s Report for SIEM. The bidder should be empanelled with CERT-in. SIEM tool deployed must be in the Leader or Challenger Quadrant of the latest Gartner s Report for SIEM. of hardware devices and software, complexity and heterogeneity in information systems etc.." As IDBI bank is looking at setting up state of art SOC, it is important that the bank select the market leading and proven technology in its SOC. As for SIEM they are already 5 top vendors in the Gartner leader's Magic quadrant please modify it to "SIEM tool deployed must be in the Leader Quadrant of the latest Gartner s Report for SIEM" We request to drop this criteria As per Gartner, Leaders execute well against their current vision and are well positioned for tomorrow and Challengers execute well today or may dominate a large segment, but do not demonstrate an understanding of market direction.... Hence Request to please 5 of 91

6 Clause ELIGIBILITY CRITERIA FOR BIDDERS SIEM tool deployed must be in the Leader or Challenger Quadrant of the latest Gartner s Report for SIEM. amend proposed solution should be in the Gartner sleaders or Challengers Quadrant for at least 5 years in a row. This condition will help Bank to get a matured solution to achieve their objectives from SIEM. As per Gartner, Leaders execute well against their current vision and are well positioned for tomorrow and Challengers execute well today or may dominate a large segment, but do not demonstrate an understanding of market direction. Hence Request to please amend proposed solution should be in the Gartner s Leaders or Challengers Quadrant for at least 5 years in a row. This condition will help Bank to get a matured solution to achieve their objectives from SIEM PAYMENT TERMS Payment terms We request that payment towards all the products/ software supplied under the.. 6 of 91

7 Clause contract is made 100% on delivery PAYMENT TERMS Payment terms Payment towards implementation and commissioning be made on milestone basis with final installment being due on completion and acceptance PAYMENT TERMS Payment terms Payment towards all services and AMC be made quarterly in arrears on submission of invoice PAYMENT TERMS Supply of Hardware and Software Bidder request to modify the payment term as Hardware and software to be paid on delivery PAYMENT TERMS Implementation Plan Implementation payment excluding hardware and software to be paid as per bidder's proposed delivery schedule PAYMENT TERMS DR Payment Clause We request the Bank to provide more clarity on the Payment clause for the Optional DR Requirement. How does the % model work?.... On the same lines as mentioned for DC in the 7 of 91

8 Clause PAYMENT TERMS Payment Terms For Clearer separation on Milestones, we request the Bank to modify the Payment terms against Delivery, Implementation Signoff & 3 Months after Signoff (60% against Delivery, 30% against Implementation Signoff and 10% on 3 Months post Signoff) PAYMENT TERMS Payment Terms for Service Components Please also refer to our earlier query on Project Implementation Period. We request the Bank to modify the Payment terms for Service Components as Quarterly in Advance as against the Current term of Quarterly in Arrears PAYMENT TERMS Ongoing Support services Bidder propose the same shall be paid on monthly in arrears basis SIGNING OF CONTRACT After Bank notifies the Successful Bidder that its bid has been accepted; the Bidder should sign the Contract and complete the execution of all other documents within 15 days of the acceptance of LOI / PO, whichever is earlier. We request this to make 45 days... 8 of 91

9 Clause SIGNING OF CONTRACT Signing of Contract After Bank notifies the Successful Bidder that its bid has been accepted; the Bidder should sign the Contract and complete the execution of all other documents within 15 days of the acceptance of LOI / PO, whichever is earlier PERFORMANCE SECURITY IN THE FORM OF BANK GUARANTEE Performance Security It is submitted that any delays in relation to discussion over finalization of the terms of the Contract shall not be considered for accounting towards the 15 day period for the purpose of this Clause. We request to modify this clause to include that PBG will be valid for the duration of contract only. With regard to invoking performance bank guarantee, we request can the same be amended as applicable only in case of material breach of contract term with a remedy period not less than 30 days provided to vendor. Bidder proposes that the PBG will be submitted within 15 days from the date of signing the contract as the process of PBG is initiated only after contract conclusion and signing... 9 of 91

10 Clause No Limitation of liability clause in the. Request for a limitation of liability clause in Section 3 or Contract Form There is no limitation of liability clause in Section 3 of the tender. Request to add the following clause in the tender terms or in the Contract Form: Notwithstanding anything to the contrary stated herein, Vendor's entire liability in respect of any act or omission or series of acts or omissions of Vendor, its employees, agents or subcontractors, arising from any breach of any of its obligations under the Contract or resulting from any representation, statement, tortuous act or omission or breach of any statutory duty arising under or in connection with the Contract shall be limited to direct damages in an aggregate amount equal to hundred percent (100%) the amount actually paid during the year (means a period of 12 months after the date on which the Services commence and each Refer corrigendum of 91

11 Clause anniversary of such date thereafter) in which the liability arose, provided that Purchaser claiming damages provides prior written notice to Vendor DEFINITIONS In case of a difference of opinion on the part of the Bidder in comprehending or interpreting any clause / provision of the Bid Document after submission of the Bid, the interpretation by Purchaser and decision of Purchaser in this behalf shall be final, conclusive and binding on the Bidder. In no event shall Vendor be liable for any special, indirect or consequential damages, including lost profits, lost data, loss of computer time, failure to realize expected savings, and any other commercial or economic loss of any kind and arising in consequence of Vendor s performance, failure to perform, or other breach under the agreement. The agreement provides for dispute resolution mechanism and it is our understanding that the bidder may invoke the dispute resolution clause in case of any dispute as per dispute resolution clause in section. 11 of 91

12 Clause DEFINITIONS The Contract means the agreement entered into between Purchaser and the Bidder as recorded in the contract form duly signed by the Parties, including all annexure, schedules, exhibits, supplements, appendices, amendments, revisions, notations and modifications thereof for setting up of a SOC and operationalization of SIEM and VA tools for the IDBI Bank as inclusively stated under Sections IV INDEMNITY The Bidder shall execute and furnish to the Purchaser, a deed of indemnity in favor of the Purchaser in a form and manner, as given in Section-5, indemnifying the Purchaser its directors, employees, agents and representatives from and against any costs, loss, damages, expense, claims, litigations, suits, actions, judgments, and or otherwise including but not limited to those from third parties or liabilities of any kind howsoever suffered, arising Please confirm that the term "Contract" will include the proposal submitted by the Bidder. We request that the indemnification be limited to third-party claims due to infringement of Intellectual Property Rights.. 12 of 91

13 Clause out of or incurred inter alia during and after the Contract period including but not limited to third-party claims due to infringement of Intellectual Property Rights including but not limited to patent, trademark, copy-rights or industrial drawings and designs arising from use of the Services or any part thereof and/or otherwise. The provisions under this clause shall survive the termination of the Contract INDEMNITY Indemnity The Successful Bidder shall execute and furnish to the Bank, a deed of indemnity in favour of the Bank in a form and manner, as given in Section 5, indemnifying the Bank its directors, employees, agents and representatives from and against any costs, loss, damages, expense, claims, litigations, suits, actions, judgments, and or otherwise including but not limited to those from third parties or liabilities of any kind The word indemnify should be replaced with defend or settle. The Indemnity clause need to be a mutual/either party clause. Further, we request that the indemnity related obligation be limited to third party claim for bodily injury (including death) and IPR indemnification only. IPR Indemnity shall not be applicable for any claim or action due to any changes by. 13 of 91

14 Clause howsoever suffered, arising out of or incurred inter alia during and after the Contract period including but not limited to third-party claims due to infringement of patent, trademark, Intellectual Property Rights, copy-rights or industrial drawings and designs arising from use of the services or any part thereof and/or otherwise. The provisions under this section survive the Contract term. Section 5 - Deed of Indemnity the Bank or third party or use of product in a manner other than specified in product manual or specification or any claim due to use of product with any other products. We also request that the indemnification shall be mutual and both parties shall indemnify each other in relation to claims identified above. The clause shall be reworded. The does not provide the process of indemnification. We suggest the following process shall be applicable for Indemnification under this agreement and the clause for indemnification shall be replaced with following clauses: Both Vendor and Mother Dairy agrees to indemnify each other for any third party claim for bodily injury and death and any claim of infringement of IPR violation (including patent, copyright, design right, trademark) 14 of 91

15 Clause subject to process of indemnification suggested below. Indemnified Party shall mean party that is being indemnified and Indemnifying Parties shall mean party that indemnifies. a) the Indemnified Party shall as promptly as practicable, informs the Indemnifying Party in writing of the claim or proceedings and the Indemnified Party gives the Indemnifying Party all reasonable assistance in the defense of such claim including reasonable access to all relevant information, documentation and personnel b) the Indemnified Party shall not prejudice, pay or accept any proceedings or claim, or compromise any proceedings or claim, without the written consent of the Indemnifying Party; the Indemnifying Party shall be obligated to pay only the court awarded damage or 15 of 91

16 Clause settlement amount. c) the Indemnified Party shall account to the Indemnifying Party for all awards, settlements, damages and costs (if any) finally awarded in favor of the Indemnified Party which are to be paid to it in connection with any such claim or proceedings d) the Indemnified Party shall take such steps that the Indemnifying Party may reasonably require to mitigate or reduce its loss as a result of such a claim or proceedings; and e) in the event that the Indemnifying Party is obligated to indemnify an Indemnified Party pursuant to this Section, the Indemnifying Party will, upon payment of such indemnity in full, be subrogated to all rights and defenses of the Indemnified Party with respect to the claims to which such indemnification relates; 16 of 91

17 Clause INDEMNITY The Bidder shall execute and furnish to the Purchaser, a deed of indemnity in favor of the Purchaser in a form and manner, as given in Section-5, indemnifying the Purchaser its directors, employees, agents and representatives from and against any costs, loss, damages, expense, claims, litigations, suits, actions, judgments, and or otherwise including but not limited to those from third parties or liabilities of any kind howsoever suffered, arising out of or incurred inter alia during and after the Contract period including but not limited to third-party claims due to infringement of Intellectual Property Rights including but not limited to patent, trademark, copy-rights or industrial drawings and designs arising from use of the Services or any part thereof and/or otherwise. The provisions under this clause shall survive the termination of the Contract. Please confirm that such indemnities will be applicable only for infringement of patent and copyright cause by the use of the unaltered deliverables provided by IBM provided that IBM is provided with prompt notice of any such claim and is allowed to take sole defense and control of any such claim.. 17 of 91

18 Clause ACCEPTANCE CERTIFICATES On successful completion of acceptability test, receipt of deliverables, etc, and after the Purchaser (which shall not be deemed to be an obligation on the Purchaser) is satisfied with the working of the System, the Acceptance Certificate in the format given in Section-5, The date on which such certificate is signed shall be deemed to be the date of successful commissioning of the Systems INCIDENTAL SERVICES The incidental services to be provided pursuant to and in accordance with the Contract are as under: Performance of on-site commissioning of the System; Furnishing of services required for maintenance of the rendered Systems Furnishing manuals for each appropriate unit of the rendered Systems Maintenance of the rendered equipment for the Contract Period, provided that this equipment shall not relieve the Bidder of any warranty period obligations We request that in case after submission of all acceptability documents if IDBI doesn't revert with any issues within 15 days then the delivery shall be deemed to be accepted We request IDBI to clarify that "related services" would mean only activities which are essentially required to complete the Scope of work as per in line with the technical proposal and exclude any activity which is outside the ambit of this and technical proposal.. Yes. Only related to scope of services. 18 of 91

19 Clause CHANGE ORDERS/ALTERATION/VAR IATIONS under and in accordance with this Contract; and Any other related services as the Purchaser may require and deem fit The Bidder agrees that the requirements given in specifications, charts, etc in the Bid Documents are minimum requirements of mere indicative nature and are in no way exhaustive. It shall be the responsibility of the Bidder to meet all the requirements of specifications, charts, etc and other criteria contained in the Bid Documents and any upward revisions and/or additions of quantities, specifications sizes given in specifications, charts, etc., of the Bid Documents required to be made during execution of the works shall not constitute a change order and shall be carried out without a change order as forming part of the Services agreed hereunder and shall be carried out without any time and cost effect to Purchaser. Further upward We request that any change including upward or downward revision shall be subject to change control process agreed between the parties as per the methodology specified in sub clause 3 & 4 of clause 14. We also request Bank to confirm that unless the change in the scope is agreed between the parties pursuant to clause 13.3 and 13.4, the scope shall remain same. We also request Bank to modify the sub clause seven such that change is mutually agreed between the parties. 19 of 91

20 Clause revisions and or additions required to make Bidder s selected equipment and installation procedures to meet Bid Documents requirements expressed and to make entire facilities safe, operable and as per specified codes and standards shall not constitute a change order and shall be carried out without any time and cost effect to Purchaser. Any upward revision and/or additions consequent to errors, omissions, ambiguities, discrepancies in the specification etc. of the Bid Documents which the Bidder had not brought out to the Purchaser s notice in his Bid shall not constitute a change order and such upward revisions and/or addition shall be carried out by Bidder without any time and cost effect to Purchaser Purchaser may, at any time, by a written order given to the Bidder, make changes within the general scope of the Contract in any one or more of 20 of 91

21 Clause the following: Functional specification The Services to be provided by the Bidder If any such change causes an increase or decrease in the cost of, or the time required for the Bidder s performance or observance of any provisions under the Contract, an equitable adjustment shall be made in the Contract price or delivery schedule, or both, and the Contract shall accordingly be amended as may be decided by Purchaser. Any claims by the Bidder for adjustment under this clause must be asserted within 30 (Thirty) days from the date of knowledge of Purchaser s change order by the Bidder Any change order as stated above comprising an alteration which involves change in the cost of the works (which sort of alteration is hereinafter called a Variation ) shall be the subject of an amendment to the Contract by way of an 21 of 91

22 Clause CHANGE ORDERS/ALTERATION/VAR IATIONS increase or decrease in the Contract Price and adjustment of the implementation schedule if any If the Contract provides applicable rates for the valuation of the variation in question, the Contract price shall be increased or decreased in accordance with those rates Any change order shall be duly approved by the Purchaser (including any modification/change in the Contract Price) in writing If there is a difference of opinion between the Bidder and Purchaser whether a particular work or part of the work constitutes a change order or not, the decision of the Purchaser shall be final, conclusive and binding on the Bidder. If there is a difference of opinion between the Bidder and Purchaser whether a particular work or part of the work constitutes a change order or not, the decision of the Purchaser shall be final, It is requested to delete this unilateral clause.. 22 of 91

23 Clause DELAYS IN THE BIDDER S PERFORMANCE conclusive and binding on the Bidder A delay by the Successful Bidder in the performance of its Contract obligations shall render the Successful Bidder liable to any or all the following sanctions: Forfeiture of its performance guarantee Termination of the It is submitted that Liquidated damages as per Clause 16 may be imposed in the event of delays. Only upon the maximum cap of LDs is reached, should the rights under this clause be enforced. Contract for default LIQUIDATED DAMAGES Liquidated Damages It is submitted that the aggregate cap of all LDs and Penalties to be imposed under this agreement be capped to a maximum of 5% of the value of the contract LIQUIDATED DAMAGES.In case of undue delay beyond a period of 15 (fifteen) days unless otherwise waived by the Purchaser, Purchaser by its discretion may consider termination of the Contract. Please confirm that such liquidated damages (LD) will be imposed if the bidder commits a critical delay or fails to deliver the products due to reasons solely and directly attributable to the bidder. Also, please confirm that IDBI will claim such LD as its sole and exclusive remedy for such delay or failure. Please confirm that notwithstanding anything of 91

24 Clause LIQUIDATED DAMAGES The Purchaser may without prejudice to its right to effect recovery by any other method, deduct the amount of liquidated damages from any money belonging to the Bidder in its hands (which includes the Purchaser s right to claim such amount against Bidder s performance Guarantee / security) or which may become due to the Bidder. Any such recovery or liquidated damages shall not in any way relieve the Bidder from any of its obligations to complete the works / Services or from any other obligations and liabilities under the Contract FORCE MAJEURE If a Force Majeure situation arises, the bidder shall promptly notify IDBI Bank in writing of such conditions and the cause thereof. Unless stated to the contrary in this contract, the aggregate of all the LDs/ penalties that may be imposed under this contract shall not exceed 10% of the total contract value. We request that the clause (Any such recovery or liquidated damages shall not in any way relieve the Bidder from any of its obligations to complete the works / Services or from any other obligations and liabilities under the Contract.) be deleted and liquidated damages be the sole remedy for delays under the Contract. We request a provision for payment to Bidder for all services rendered, investments made by bidder and any stranded costs until.. 24 of 91

25 Clause otherwise directed by IDBI Bank in writing, the bidder shall continue to perform its obligations under the Contract as far as is reasonably practical and shall seek all reasonable alternative means for performance not prevented by the Force Majeure event. IDBI Bank may terminate the Contract / Agreement, by giving a written notice of minimum 30 (Thirty) days to the bidder, if as a result of Force Majeure the Vendor is unable to perform a material portion of the Service(s) for a period of more than 60 (Sixty) days. the date of termination due to the force majeure event, whether these services or deliverables have been accepted or not TAXES AND DUTIES Taxes and duties We request that the Price offered will be exclusive of taxes. All taxes & duties will be charged extra as per the current rate of taxation in force. Any increase in taxes and duties will be payable by the Customer. Any change in statutory taxes, duties and levies shall be borne by the customer on sufficient Prices will be exclusive of taxes and duties. 25 of 91

26 Clause documentary proof is submitted The Price offered will be exclusive of taxes. All taxes, duties, entry tax, octroi will be charged extra as per the current rate of taxation in force. Any increase in taxes and duties will be payable by the Customer. Any change in statutory taxes, duties and levies shall be borne by the customer on sufficient documentary proof is submitted TAXES AND DUTIES Road permit We request IDBI to provide road permits for expediting delivery to the location concerned NO SET-OFF, COUNTER- CLAIM AND CROSS CLAIMS. Set off CONTRACT PRICES Prices payable to the Bidder as stated in the Contract shall be firm and not subject to adjustment during performance of the Contract, irrespective of reasons whatsoever, including exchange rate fluctuations, IDBI's set off rights under this clause shall be limited to the amounts due/payable under this Agreement alone. Bidder request to clarify - If prices need to be submitted inclusive of taxes or exclusive of taxes and duties.. Prices will be exclusive of taxes and duties 26 of 91

27 Clause changes in taxes, duties, levies, charges, etc TERMINATION Termination for Default: The Purchaser, without prejudice to any other right or remedy for breach of Contract, by a written notice of default sent to the Successful Bidder / Vendor, may terminate the Contract in whole or in part TERM AND EXTENSION OF THE CONTRACT The Bank shall reserve the sole right to grant any extension to the term above mentioned and shall notify in writing to the Bidder, at least three months before the expiration of the term hereof, whether it will grant the Bidder an extension of the term. The decision to grant or refuse the extension shall be at the discretion of Bank. We request the clause to be read as: The Purchaser, for a material breach of Contract by bidder, may by a written notice of default of 30 (thirty) days sent to the Successful Bidder / Vendor terminate the Contract in whole or in part, if after the expiry of such cure period of 30 (thirty) days the material breach remains uncured. Any such extension will be based on mutual discussion and agreement between the parties of 91

28 Clause TERMINATION Termination for Default The Bank, without prejudice to any other right or remedy for breach of the terms and conditions of this /the Contract, by a written notice of default sent to the Bidder, may terminate the Contract in whole or in part TERMINATION Termination for Convenience Notwithstanding the provisions of the Contract and/or the Bid Documents the Bank, by written notice sent to the Bidder, may terminate the Contract, in whole or in part, at any time for its convenience. The notice of termination shall specify that termination is for Bank s convenience, the extent to which performance of the Bidder under and in accordance with the Contract is terminated, and the date upon which such termination becomes effective. Any termination should happen only for material breach remaining uncured even after providing a cure period of 60 days by the Purchaser. Further, upon such termination the Bidder will be entitled to receive payments for the products and services provided till effective date of termination, including any termination charges as mutually agreed. We request for deletion of this termination for convenience clause of 91

29 Clause TERMINATION The Purchaser may, terminate this Contract by giving the Bidder a prior and written 30 (thirty) days notice indicating its intention to terminate the Contract under the following circumstances: CONSEQUENCES OF TERMINATION Where the termination of the Contract is prior to its stipulated term on account of a default on the part of the Bidder or due to the fact that the survival of the Bidder as an independent corporate entity is threatened/has ceased, the Purchaser shall pay the Bidder for that part of the equipment procured which have been authorized by the Purchaser and satisfactorily performed by the Bidder up to the date of termination, without prejudice Please confirm that the termination under this clause will be only for material breach of the contract by one party who fails to cure such breach within the 30 days notice period served by the other party. Please confirm that the bidder will have similar termination rights under this clause in the event of material breach of contract by IDBI. Please confirm that there will not be any termination for convenience. We request that the subclause within be read as stated hereunder: In case of any loss or damage due to default on the part of the Bidder in performing any of its obligations with regard to executing the scope of work under this Contract [as laid down in the Service Specifications,] the Bidder shall compensate the Purchaser for any such direct loss, damages or other costs,.. 29 of 91

30 Clause any other rights, the Purchaser may retain such amounts from the payment due and payable by the Purchaser to the Bidder as may be required to offset any direct losses caused to the Purchaser as a result of any act/omissions of the Bidder. In case of any loss or damage due to default on the part of the Bidder in performing any of its obligations with regard to executing the scope of work under this Contract [as laid down in the Service Specifications,] the Bidder shall compensate the Purchaser for any such direct loss, damages or other costs, incurred by the Purchaser. (The Bidder shall not be liable for any indirect or consequential losses). Additionally, the sub Bidder / other members of its team shall continue to perform all its obligations and responsibilities under this Contract in an identical manner as were being performed hitherto before in order to execute an effective transition and to maintain incurred by the Purchaser which shall in no event exceed 5% of the annual contract value. 30 of 91

31 Clause CONSEQUENCES OF TERMINATION business continuity. All third Parties shall continue to perform all/any functions as stipulated by the Purchaser and as may be proper and necessary to execute the Services under the Contract in terms of the Bidder s Bid and this Contract. In the event of termination of this /the Contract for any reason whatsoever, the Bank shall have the right to publicize such termination to caution the customers/public from dealing with the Successful Bidder SCOPE OF WORK The Bidder shall setup an onsite Captive SOC at the bank s premises and provide the required security services for period of 5 years xiv SCOPE OF WORK Provide single integrated and consolidated enterprise view of security and compliance We request for deletion of this clause. It is understood that all SIEM components will be installed at bank datacenter only. Please confirm? Based on the scope of technology and services, A Single Consolidated Dashboard view would require integration of all these systems into a single Governance Framework, which would require compressive tools and. Yes. In the bank's premises. 31 of 91

32 Clause Processes. Hence we would request the bank to clarify if there is a need for an IT GRC Framework to be designed and Implemented within the scope of the Project? vii SCOPE OF WORK Manage and carry out rulebased Audit using automated tools of Security Devices/solutions Firewalls (at least once in six months for 10 sets of firewalls) Other security devices (Proxy, Antivirus, IDPS, Mail Gateway etc at least once in a year) ii SCOPE OF WORK Vulnerability management tool to be implemented for performing VA and configuration management activities as per the defined Secure Configuration Document(SCD) vi SCOPE OF WORK Providing knowledge transfer to the Bank s team including training on the technology solution, the technical architecture deployed at the Bank, the operations and Standard Operating Procedures Please suggest if Bank is looking for a separate tool like a firewall analyzer or the SI can use any freeware/ home grown scripts. For Other Security devices there is no automated tool available. Please confirm if the VM solution is tolicensed for IDBI Bank which would be installed in the bank's premises or if this can be provided as a Cloud Service? Kindly share the frequency of this training on an annual basis as well as the approximate batch size Only licensed tools will be allowed. On premise as a service. One time activity or in case of a major change in the product 32 of 91

33 Clause (SOP) for SIEM. Detailed training should be provided in two sessions of one week each for two sets of users vii SCOPE OF WORK Manage and carry out rulebased Audit using automated tools of Security Devices/solutions vii SCOPE OF WORK Firewalls (at least once in six months for 10 sets of firewalls) xiv SCOPE OF WORK Provide single integrated and consolidated enterprise view of security and compliance We request the bank to confirm whether this activity has to be done through a dedicated tool licensed for the bank or can this activity be done as a service Please confirm if the firewall count would remain the same over the period of 5 years. If no, kindly share an approx count of firewalls which the bank can have in the next five years of engagement Based on the scope of technology and services a single consolidated view dashboard would require integration of all these systems into a single Governance Framework, these would require compressive tools and process, we would require bank to clarify and further details of what all is required on these. As a service on the premises.. 33 of 91

34 Clause vi SCOPE OF WORK Providing knowledge transfer to the Bank s team including training on the technology solution, the technical architecture deployed at the Bank, the operations and Standard Operating Procedures (SOP) for SIEM. Detailed training should be provided in two sessions of one week each for two sets of users vii SCOPE OF WORK Manage and carry out rulebased Audit using automated tools of Security Devices/solutions What is the strength of batch to be considered for training? Also, whose premises will the training be facilitated? Do we have to factor for deployment of automated tool for conducting audit of security devices (firewall, IPS, Mail gateway etc)? Is bank ok if the tools proposed by vendor are all VM based? Will Bank provision for the required VM's? In the bank's premises in Mumbai. 20 participants per batch. Yes. 34 of 91

35 Clause i& v SCOPE OF WORK i. Supply, install, implement, integrate, customize, manage and maintain Security Information & Event Management (SIEM) and associated Tools, Technologies and Resource to meet Bank s Requirements. v. Integrate and Monitor incidents of tools/devices/solutions like - Firewalls, Routers, Switches, IDS, IPS etc. - DLP, PIM, Patch and inventory Management tools, Antivirus, etc. - Applications, web servers and databases etc v SCOPE OF WORK v. Integrate and Monitor incidents of tools/devices/solutions like - Firewalls, Routers, Switches, IDS, IPS etc. - DLP, PIM, Patch and inventory Management tools, Antivirus, etc. - Applications, web servers and databases etc. Pl. define the list of tools to be integrated with Pl. provide count of FW, routers, switches, IPS, etc to be integrated As per the. As per the. 35 of 91

36 Clause v SCOPE OF WORK Integrate and Monitor incidents of tools/devices/solutions like - Firewalls, Routers, Switches, IDS, IPS etc. - DLP, PIM, Patch and inventory Management tools, Antivirus, etc. - Applications, web servers and databases etc v SCOPE OF WORK Integrate and Monitor incidents of tools/devices/solutions like - Firewalls, Routers, Switches, IDS, IPS etc. - DLP, PIM, Patch and inventory Management tools, Antivirus, etc. - Applications, web servers and databases etc vi SCOPE OF WORK Providing knowledge transfer to the Bank s team including training on the technology solution, the technical architecture deployed at the Bank, the operations and Standard Operating Procedures (SOP) for SIEM. Detailed training should be provided in two sessions of one week each for two sets of users. Pl. confirm the DLP, PIM, AV, Patch & Inventory management tools Pl. confirm list of applications, web servers & DB to be integrated We expect IDBI to provide the training location in Mumbai. As per the. As per the. In the bank's premises in Mumbai 36 of 91

37 Clause vi SCOPE OF WORK Providing knowledge transfer to the Bank s team including training on the technology solution, the technical architecture deployed at the Bank, the operations and Standard Operating Procedures (SOP) for SIEM. Detailed training should be provided in two sessions of one week each for two sets of users vii SCOPE OF WORK Manage and carry out rulebased Audit using automated tools of Security Devices/solutions v SCOPE OF WORK Integrate and Monitor incidents of tools/devices/solutions like - Firewalls, Routers, Switches, IDS, IPS etc. - DLP, PIM, Patch and inventory Management tools, Antivirus, etc. - Applications, web servers and databases etc. Kindly confirm the number of participants for the training. Pl. provide list of automated tools that will be provided for conducting rule-based audit Please provide make, model and quantity of network and security devices that need to be integrated In the bank's premises. 20 participants per batch. Licensed tools to be brought by the vendor as a service model. Number of devices have been provided. Only Tier 1 products are being used. (Refer list of devices / assets as per the AnnexureI of this corrigendum 1) 37 of 91

38 Clause v SCOPE OF WORK Integrate and Monitor incidents of tools/devices/solutions like - Firewalls, Routers, Switches, IDS, IPS etc. - DLP, PIM, Patch and inventory Management tools, Antivirus, etc. - Applications, web servers and databases etc v SCOPE OF WORK Integrate and Monitor incidents of tools/devices/solutions like - Firewalls, Routers, Switches, IDS, IPS etc. - DLP, PIM, Patch and inventory Management tools, Antivirus, etc. - Applications, web servers and databases etc vii SCOPE OF WORK Manage and carry out rulebased Audit using automated tools of Security Devices/solutions Please provide make, model and quantity of web servers, database servers, etc. that need to be integrated Please provide number and list of applications that need to be integrated. Please suggest log format supported by these applications Please provide make, model and quantity of devices that need to be audited using automated tools of Security Devices/solutions Number of devices have been provided. Only Tier 1 products are being used. (Refer list of devices / assets as per the Annexure I of this corrigendum 1) As per the. Number of devices have been provided. Only Tier 1 products are being used. (Refer list of devices / assets as per the Annexure I of this corrigendum 1) 38 of 91

39 Clause vii SCOPE OF WORK Manage and carry out rulebased Audit using automated tools of Security Devices/solutions vii SCOPE OF WORK Manage and carry out rulebased Audit using automated tools of Security Devices/solutions v SCOPE OF WORK Integrate and Monitor incidents of tools/devices/solutions v SCOPE OF WORK Firewalls, Routers, Switches, IDS, IPS etc. Please provide frequency of audit to be carried out using automated tools for Security Devices/solutions Does the Bank have automated tool to perform this activity or they expect bidder to get this tool? Request you to share details of devices for which the bidder is supposed provide SIEM, we presume IDBI Bank would like to have SIEM services for only core devices, please confirm 1. Please share the Device Make & Model with count details for Firewall, Router, Switches, ISD, IPS, etc 2. Kindly also specify the total number of L3 Switches in the network As per the. Licensed tools to be brought by the vendor as a service model Number of devices have been provided. Only Tier 1 products are being used. (Refer list of devices / assets as per the Annexure I of this corrigendum 1) Number of devices have been provided. Only Tier 1 products are being used. (Refer list of devices / assets as per the Annexure I of this corrigendum 1) 39 of 91

40 Clause v SCOPE OF WORK DLP, PIM, Patch and inventory Management tools, Antivirus, etc SCOPE OF WORK Applications, web servers and databases etc. 1. Request Bank to share details of any Patch Management Tools deployed 2. Request you to provide the details of the DLP setup, no. of end-users, current DLP Incident Management process, and number of DLP incidents per day 3. Request you to provide the details of the PIM setup, no. of servers under PIM, Y- O-Y additions of servers to PIM system, number of PIM service request such as providing passwords and others 4. Please provide the details of the AV system, of endpoints, update servers, AV SLAs etc. 1. Request Bank to share details of the applications, web servers & Databases deployed along the number of instances for each technology Number of devices have been provided. Only Tier 1 products are being used. (Refer list of devices / assets as per the Annexure I of this corrigendum 1) Number of devices have been provided. Only Tier 1 products are being used. (Refer list of devices / assets as per the Annexure I of this corrigendum 1) 40 of 91

41 Clause vi SCOPE OF WORK Providing knowledge transfer to the Bank s team including training on the technology solution, the technical architecture deployed at the Bank, the operations and Standard Operating Procedures (SOP) for SIEM. Detailed training should be provided in two sessions of one week each for two sets of users vii SCOPE OF WORK Manage and carry out rulebased Audit using automated tools of Security Devices/solutions v SCOPE OF WORK Integrate and Monitor incidents of tools/devices/solutions like - Firewalls, Routers, Switches, IDS, IPS etc. - DLP, PIM, Patch and inventory Management tools, Antivirus, etc. - Applications, web servers and 1. Request you to share the number of users who would be trained in each set 2. Kindly also confirm the location where the training would need to be conducted Request you to let us know whether IDBI Bank currently has any such automation tool implemented, if Yes request you to share the details of same Please provide the details and number of the other devices mentioned in the of which Rule base analysis to be done. Please share the make, model and qty of each type of device that needs to be integrated with SIEM. Also, please share the distribution of these devices. Also please mention the list of applications and their details that need to be integrated In the bank's premises in Mumbai. 20 participants per batch. Licensed tools to be brought by the vendor as a service model Number of devices have been provided. Only Tier 1 products are being used. (Refer list of devices / assets as per the Annexure I of this 41 of 91

42 Clause vi SCOPE OF WORK Manage and carry out rulebased Audit using automated tools of Security Devices/solutions: - Firewalls (at least once in six months for 10 sets of firewalls) - Other security devices (Proxy, Antivirus, IDPS, Mail Gateway etc at least once in a year) viii SCOPE OF WORK Build custom interfaces if required for integration xi SCOPE OF WORK Integrate and monitor any other tools/solutions/devices procured by the Bank xii SCOPE OF WORK Supply, install, implement, integrate, customize, manage, and maintain Vulnerability Management(VM) solution and databases etc. with the SIEM solution corrigendum 1) Please share the make, model and qty of each type of device that needs to be audited. Also, please share the distribution of these devices. For Non Standard connectors, please specify the count of custom connectors to be built. Also Does the Bank want to fetch standard logs from non standard devices before the connectors are built? Would request Bank to add that the point will be considered if the new devices are within the Limit of the EPS capacity purchased. Also only for the standard readily integrated Devices Kindly share an approx count of IP/ devices which would be under the scope of vulnerability management Number of devices have been provided. Only Tier 1 products are being used. (Refer list of devices / assets as per the Annexure I of this corrigendum 1) Currently only standard products are being used. However this might be required in future. EPS will not change. Approx. 300 per year 42 of 91

43 Clause run Vulnerability Management program to meet Bank s Requirements xii SCOPE OF WORK Supply, install, implement, integrate, customize, manage, and maintain Vulnerability Management(VM) solution and run Vulnerability Management program to meet Bank s Requirements xii SCOPE OF WORK Supply, install, implement, integrate, customize, manage, and maintain Vulnerability Management(VM) solution and run Vulnerability Management program to meet Bank s Requirements SCOPE OF WORK The bank is procuring the SIEM tool as part of this. The bidder shall bring their own licensed tools, methodologies and processes required for the delivery of all the other services to meet the deliverables and SLA listed in this. Process implementation should be done in consultation with the We request the bank to kindly specify the count of devices/ IP which would be under the scope of vulnerability management over a period of 5 years Pl. provide list of tools/solutions/devices to be integrated This clause is very vague and all inclusive. The bank is requested to notify the tools, if any, expected from the SI. The SI will supply only equipment, tools, licenses being procured as part of the PO. Approx. 300 per year Number of devices have been provided. Only Tier 1 products are being used. (Refer list of devices / assets as per the Annexure I of this corrigendum 1) As per the. 43 of 91

44 Clause Bank xi SCOPE OF WORK Integrate and monitor any other tools/solutions/devices procured by the Bank xv SCOPE OF WORK xv. Provide a Dashboard covering SIEM, DLP, PIM, Patch & Inventory Management tool, Incident Management, Antiphishing, Global Intelligence, Risk Metrics, Service Desk (Helpdesk ticketing tool)and host of other disparate systems implemented / to be implemented in the Bank with the drill down data mining capability up to the end point /system for investigation / analysis. Please provide list of any other tools/solutions/devices that need to be integrated A ) We assume that Bank expects bidder to deploy the Helpdesk ticketing tool as a part of Dashboard Solution - Please Validate B) Can you please elaborate on the Drill down data mining capability up to endpoint /System? We assume that drill down data mining capability means, if the alert / event is displayed on the dashboard, the authorized user should be able to drill down to the alert / event to the source of the endpoint / system that generated the alert/event - Please validate As per the. (for future requirement) Yes. 44 of 91