Please quantify the number of applications to be supported.

Transcription

1 Sl. RFP (Page No.) Pre-Bid Queries for RFP Reference No: OBC/HO/DIT/RFP/IS/SECURITY EQUIPMENTS/ 55 / Dated: 11th February 2015 Ref Points of clarification given in the Clarification Sought Requested/Suggested Change 's Reply Sections/Clause RFP requiring Clarification 1 22 Annexure-3/1. Firewall/ 3 Firewall Should have complete application control functionality from day one. In case of Application Control support, the respective solution should support maximum number of applications be classified and tagged as malignant (if applicable). Higher number indicates better coverage of application threat landscape. Please quantify the number of applications be supported. Firewall should have complete application control functionality and must support atleast 5000 applications from day one. Firewall Should be capable of all the Next Generation features. may at its discretion get the functionality activated at a later date Annexure-3/1. Firewall/ 12 Management of the entire solution should e realtime moniring, event logs collection, policy enforement. Real-time monitroing with policy enforcement is an ask, which will enable bank have next generation management. We request bank make statement more clear. Management of the entire solution should allow Administrar change signature configuration from moniring window/log itself. It should e real-time moniring, event logs collection, policy enforement 3 22 Annexure-3/1. Firewall/ Performance Requirement/ Annexure-3/1. Firewall/ Performance Requirement/ 6 The Firewall appliance/solution should have sufficient local harddisk in order keep the logs of minimum 90 days Solution should have minimum 1,50,000 connection per second processing Assuming 2 GB of logs per day, firewall appliance should have minimum of 180 GB of srage capacity. Please confirm. In our experience of BFSI segment, a ratio of 1:25 for new connection per second concurrent connections suffices most demanding banking DC enviroments. The requirement of 1,50,000 new connections per second for 25,00,000 concurrent connections seems on a higher side and it favors a specific vendor. The Firewall appliance should have atleast 180 GB of inbuilt local harddisk in order keep the logs of minimum 90 days. Solution should have minimum 1,00,000 connection per second processing However, logs should be retrievable and readable Annexure-3/1. Firewall/ Performance Requirement/ 6 Real world (multi-procol) throughput of IPS should be of 10 Gbps or higher "Real world (multi-procol)" terms are used by Please clarify. one specific vendor. Every vendor has a diffrent intrepretation for real world traffic and it leads diffrent sizing of appliance. Please clarify bank's understanding of real world traffic parameters so that every bidder can size the solution on those commonly defined parameters The intent behind the usage of word Real World (multi-procol) was discussed with all the prospective bidders ing those who raised this query and the term was as it is accepted by all the participants in the Pre-Bid meeting. Page 1 of 13

2 The Bidder shall be responsible for providing the operational and maintenance training the identified IT staff of the as and when asked by the. Request OBC provide the training duration, frequency, location & batch size for which training needs be conducted. The revised is asunder:- The successful bidder will be required hold training for 5 officials/ management team for 2/3 days duration covering Basic Concept, Configuring as per the different specs, Report generations in different cusmized formats like time wise, severity wise, procol wise, source/destination etc, Managing, Log analysis, Definition & software version update/upgrade. Successful bidder would repeat training for 2/3 days every year till Warranty/AMC. The training shall be conducted at vendor s location within India at no extra cost." 7 14 Payment Terms Request the bank change the payment terms as: The will make payment as per following scheduled terms. 70% - On delivery of the perimeter security equipments. 30% - After installation, Configuration, operationalization and integration of the same the satisfaction of the. may ask for a BG for payment 8 14 Delivery, Installation & Commissioning of Items Request OBC change the Delivery and installation time 12 weeks from 8 weeks (as delivery takes 4-6 weeks). Please confirm? The revised is as under:- The vendor shall be responsible for delivery and installation of the ordered item(s) at the sites i.e. Primary Data Centre, Navi Mumbai and Disaster Recovery Site, Delhi and making them fully operational at no extra charge within12 weeks of the date of purchase order. Page 2 of 13

3 9 15 Order Cancellation The revised is as under:- "The reserves the right cancel the purchase order in the event of one or more of the following situations: 1. Delay in supply, installation, and commissioning of perimeter security equipment beyond the specified period (12 weeks) Penalty Request bank kindly review the penalty as this is on a higher side Uptime for single mode solution We recommend have high availability for should which requires 99.5% on management solution if it is that much critical. monthly basis should be Please confirm? removed, as there are so many facrs which impacts uptime of any solution. 12 Additional Point We propose that the pertaining Limitation of Liability be ed and the limitation of liability for direct damages should be limited 10% of contract value or the maximum aggregate liability of the Vendor shall not exceed the PO value Liquidated Damages LD should be applicable only if the delay is due reason solely attributable the Bidder. Also adequate notice must be given bidder before LD is imposed 2. Deviations of the perimeter security equipments proposed from those mentioned in the RFP ing nonintegration of these equipments with 's infrastructure as mentioned in Scope of Work above the satisfaction of the. In the event of order cancellation the vendor shall be responsible take back the faulty equipments at its own cost & expenses. In the event of cancellation of order, the shall also invoke the Performance Guarantee (PBG) submitted by the bidder." Clause inserted as under:- Limitation of Liability Except in respect of any third party claims resulting from infringement in terms of 25- Indemnity, of the RFP, the aggregate liability shall be limited the value of the purchase order placed the vendor. However, has the right invoke the performance Guarantee of the bidder over and above the claim amount as applicable as per the Terms of RFP. No change same as per existing. Page 3 of 13

4 14 22 Real world throughput of IPS should be of 10 Gbps or higher Real world throughput of Firewall with all features enabled (if required in future) should be of 5 Gbps or higher As per thumb rule, IPS throughput within any Request bank modify IPS UTM/Next generation Firewall bundle should throughput from 10Gbps 7 Gbps not be equivalent Firewall throughput. Kindly clarify the evaluation criteria for IPS throughput calculation Request bank clarify all the feature which Please clarify & confirm are being referred for enablement of full blow throughput of 5 Gbps alongwith Firewall The revised is "The real world throughput of Firewall with all the feature enabled (if required in future), should be 10 Gbps or higher." Firewall should have a provision support next generation firewall capabilities ing- IPS, Application Control, URL, Content Filtering features (if required in future) by adding software license or modules on the same firewall appliance. It is undersod that OBC is presently looking Please clarify & confirm for only Firewall fucntionality from day-1. Rest all features ing- IPS, Application Control, URL, Content Filtering features are not required be provisioned from day-1 & will be enabled as add-on in future (based on additional cost implication for bank as & when required). The IPS and Firewall are required from day one. Further, the Firewall Should be capable of all the Next Generation features. may at its discretion get the functionality activated at a later date High availability for redundancy: The firewall must support Stateful active-active OR Active- Failover architecture Solution should provide signature & protection against APT & zero day attack within 1 hour from the 1st encountering Bidder's Eligibility Criteria The Bidder should have minimum annual turnover of at least 50 Crores (Rupees Fifty Crore Only) in the last three financial years <i e , & ) and should also have reported cash profit during those years 20 7 Sl no 4.c Bidder should have minimum 5 CISA/CISM/CISSP certified professionals High Availability for Perimeter Firewall is a critical function & should support both the modes (Active- Active & Active- Passive/Failover architecture) out of the box. This should also be applicable for features (ing IPS) if required in future by the bank. Kindly clarity whether bidder needs provision required hardware & license deliver this fucntionality from day-1 while quoting As per DIT Guidelines, Positive Net-worth is better assessment of bidder's financial capability than the profit. Therefore we request the be amended as: "The Bidder should have minimum annual turnover of at least 50 Crores (Rupees Fifty Crore Only) in the last three financial years <i e , & ) and should also have reported positive networth during those years". In addition the bidder should have cash profit in minimum last financial year i.e " In order invite more bidder's participation pls reduce Minimum 2 Nos CISA/CISSP/CISM certified professionals. Please clarify & confirm Please clarify & confirm The Firewall Should be capable of all the Next Generation features. may at its discretion get the functionality activated at a later date. However this feature would be required when APT/Anti BOT feature is subscribed by the. Page 4 of 13

5 21 7 Clause 2 Bidder's Eligibility Criteria Sl No 4. d) d) The bidder should have at least 2 professionals with necessary certifications on the OEM platform they are quoting Certification on similar technology will help more bidders participate. Therefore request amendment as: "The bidder should have at least 2 professionals with Industry certifications on similar products from same OEM or other OEM products." 22 9 Clause 3 Bidder shall be responsible for Scope of Work integration of offered solution Sl no 20 with 's Active Direcry System 23 7 Clause 2 Bidder's Eligibility Criteria Sl No Clause 2 Bidder's Eligibility Criteria Sl No 7 The Bidder should be empanelled with CERT-ln for Information Security Services. 1. The Bidder should be an OEM or their authorized partner with highest partnership level of the OEM Either the authorized partner on behalf of the Principal / OEM or Principal / OEM Itself can bid but both cannot bid simultaneously for the same item / product for this tender 2. One OEM can bid with maximum two bidders Please elaborate if integration is for VPN users or administrars of proposed solution. This will restrict only a few bidder's participate. Pls mak optional allow more bidder's participate 1. In order establish proven technology product, Pls ask OEM should be in Leader's or Challenger's quadrant rather than partnership level between OEM and bidder otherwis will favor a few selected bidder's only. 2. Pls delete the "One OEM can bid with maximum two bidders" as this may restrict more bidder's participation This integration is required for administrars of proposed solution The bidders should have minimal annual turnover of Rs 50 Cr(Fifty crores only)in last three financial year (I.e , and 13-14) and should have reported cash profit during these years This point which will sp strong technologies partners quote for the rfp. Request you kindly amend this point cumulative turnover of Rs 50 crores for last three financial year Bidders should have 5 CISA/CISM/CI SSP certified professional As this is firewall tender so competancy and certified professinal for OEM will be required. Request please amend this point as bidders should have certified progfessional from the OEM on quoted product Page 5 of 13

6 27 7 Thebidder should provide at least three public secr bank /financial institution /Govt./ PSU as cusmer reference where it has executed similar perimeter security solution for information security infrastructure project in last 5 years Please amend this point as the bidder should have executed the perimeter security solution at three enterprise/bfsi cusmer 28 7 The bidders should be empannelled with Cert-In for information security solution EMD of Rs 15, should be submitted by bidders Scope of work What features are required from day1? Is it firewall only or Firewallwith application control only or Firewall with IPS, Application Control, URL Filtering,Kindly clarify Scope of work Request you name the 150 predified/services/procols Scope of work Please clarify, full load on Firewall or the management server Request you please dilut point. Request you please amend this as Rs The IPS and Firewall are required from day one. Further, the Firewall Should be capable of all the Next Generation features. may at its discretion get the functionality activated at a later date. Further, the Point was clarified during the pre-bid meeting that the meant full load on Firewall. Page 6 of 13

7 33 Reque Termination st 34 Reque Limitation of st Liability 35 Reque Deemed st Acceptance Request addition of below : Either Party shall have the right terminate this Agreement at any time in the event that the other party commits a material breach of the Agreement and fails cure such default the non-defaulting party s reasonable satisfaction within thirty (30) days.in the event of termination Cusmer shall pay Bidder for goods delivered and services rendered till the date of termination. Request addition of below : Notwithstanding anything the contrary elsewhere contained in this Agreement, neither Party shall, in any event, regardless of the form of claim, be liable for (1) any indirect, special, punitive, exemplary, speculative or consequential damages, ing, but not limited, any loss of use, loss of data, business interruption, and loss of income or profits, irrespective of whether it had an advance notice of the possibility of any such damages; or (2) damages relating any claim that accrued more than two (2) years before the institution of adversarial proceedings thereon. Subject the above and notwithstanding anything the contrary elsewhere contained herein, the maximum aggregate liability of Bidder shall be, regardless of the form of claim, the consideration received by Bidder for the SOW / PO which the claim relates during the preceding three (3) months. Request addition of below : Deliverables will be deemed be fully and finally accepted by Cusmer in the event Cusmer has not submitted such Deliverable Review Statement the Implementation Partner before the expiration of the 15-day review period, or when Cusmer uses the Deliverable in its business, whichever occurs earlier ( Deemed Acceptance ). The revised is " shall have the right terminat Agreement at any time in the event that the bidder commits a material breach of the Agreement and fails cure such default the 's reasonable satisfaction within thirty (30) days.in the event of termination Cusmer shall pay Bidder for goods delivered and services rendered till the date of termination. Clause inserted as under:- Limitation of Liability Except in respect of any third party claims resulting from infringement in terms of 25- Indemnity, of the RFP, the aggregate liability shall be limited the value of the purchase order placed the vendor. However, has the right invoke the performance Guarantee of the bidder over and above the claim amount as applicable as per the Terms of RFP. Page 7 of 13

8 36 Reque Change st Request Request addition of below : Either party may request a change order ( Change Order ) in the event of actual or anticipated change(s) the agreed scope, Services, Deliverables, schedule, or any other aspect of the Statement of Work. Implementation Partner will prepare a Change Order reflecting the proposed changes, ing the impact on the Deliverables, schedule, and fee. Absent a signed Change Order, Implementation Partner shall not be bound perform any additional services. The parties agree negotiate in good faith all Change Order proposals. 37 Reque Nonst Solicitation Request addition of below : During the term of this Agreement and for a period of one year thereafter shall not, directly or indirectly, hire or solicit for hire, any of the personnel engaged by Bidder, without the prior written consent thereof from Bidder. Thus, the agrees the entry of an injunction against it in the event of actual or threatened breach of its obligations hereunder, and acknowledges such relief shall be in addition such other and further relief as may be available Bidder at law or in equity 38 Reque Change order st 39 Reque Savings st Clause Either party may request a change order ( Change Order ) in the event of actual or anticipated change(s) the agreed scope, Services, Deliverables, schedule, or any other aspect of the Statement of Work. Bidder will prepare a Change Order reflecting the proposed changes, ing the impact on the Deliverables, schedule, and fee. In the absence of a signed Change Order, Bidder shall not be bound perform any additional services. Bidder s failure perform its contractual responsibilities, perform the services, or meet agreed service levels shall be excused if and the extent Bidder s non-performance is caused by Company s omission act, delay, wrongful action, failure provide Inputs, or failure perform its obligations under this Agreement. Page 8 of 13

9 40 Reque Risk and Title st The risk, title and ownership of the products shall be transferred the cusmer upon dispatch of such products the cusmer 41 2 Firewall should have a provision support next generation firewall capabilities ing- IPS, Application Control, URL Filtering, Content Filtering features (if required in future). 42 Technical Specifications 8 High availability for redundancy: The firewall must support Stateful Active-Active or Active- Failover architecture. As Anti-virus, Anti-malware, Anti-bot are integrated part of a next generation firewall, Therefor please e the same. More over Malware is the main threat vecr for ing cusmers. Please modify the as :Firewall should have a provision support next generation firewall capabilities ing- IPS, Application Control, URL Filtering, Content Filtering features, Anti-virus, Antimalware, Anti-bot (if required in future). It is extremely important for ing cusmers that all sessions should be failovered during failure of one device. Therefore, the firewall must support stateful syncronization of all sessions like Firewall, IPS, Application, VPN, Anti-virus, etc. Firewall Should be capable of all the Next Generation features. may at its discretion get the functionality activated at a later date. Please modify the as: High availability for redundancy: The firewall must support Stateful Active-Active or Active-Failover architecture., the firewall must support stateful syncronization of all sessions like Firewall, IPS, Application, VPN, Anti-virus, etc. Page 9 of 13

10 43 Technical Specifications 9 Solution should have capability that even in case of full load on it, the administrar must be able log-in for management activities. This is very important point with reference firewall management.in order achiev the firewall should have dedicated resources ( RAM, HDD etc) for management and dedicated resources for traffic management.therefore request you modify the as: Therefore request you modify the as:solution should have capability that even in case of full load on it, the administrar must be able log-in for management activities. The firewall should have dedicated resources ( RAM, HDD etc) for management and dedicated resources for traffic management. 44 Technical Specifications 10 The IPS should be able inspect SSL, https etc. traffic. Integrated IPS should not make use of additional external device perform these functions. Most of the core banking applications are accessed through SSH, therefore it is important so that threats can be checked within encrypted SSH tunnel. Moreover the inspection should be done for both inbound and outbound traffic. Therefore Please modify the as : The IPS should be able inspect SSL, SSH, https etc. traffic. Integrated IPS should not make use of additional external device perform these functions. The solution should be able decrypt both inbound and outbound SSL, SSH, https connections. 45 Performance Requirements 2 Real world (multi-procol) throughput of Firewall should be 10 Gbps or higher As 95% traffic in any banking and enterprise network is TCP in nature and es 100% applications. Moreover the has requested Application control from day one. Therefore please mention full application visibility of applications while measuring throughput. The intent behind the usage of word Real World (multi-procol) was discussed with all the vendors and the term was as it is accepted by all the vendors in the Pre-Bid meeting. Therefore please modify the as: Real world (multi-procol) throughput of Firewall should be 10 Gbps or higher with TCP traffic and with full application visibility. Page 10 of 13

11 46 Performance Requirements 5 Solution should have minimum 25,00,000 concurrent connections. Palo Al Networks despite a Leader in Enterprise Firewalls is not able comply this point. Moreover 20,00,000 concurrent connections are sufficient handle 2 Lac users assuming 10 connections per user. Therefore please modify the as : Solution should have minimum 20,00,000 concurrent connections. 47 Performance Requirements 6 Solutio should have minimum Palo Al Networks despite a Leader in 1,50,000 connection per second Enterprise Firewalls is not able comply processing. this point.please modify the provide us equal opportunity. Solutio should have minimum 1,20,000 connection per second processing. 48 Performance Requirements 7 Solution should have at least 8x 10/100/1000 Mbps RJ 45 Ethernet interfaces and 8 x 10 Gbps SFP ports Please relax the e both 1 Gbps SFP and 10 Gbps SFP interfaces e all vendors. Solution should have at least 12x 10/100/1000 Mbps RJ 45 Ethernet interfaces and 4x 1 Gbps SFP and 4 x 10 Gbps SFP ports. 49 New Query As core banking applications The Firewall should allow cusm signatures like Finacle and other cusm for home grown and cusm applications like applications are important for Finacle and other banking applications.. Therefor it is important that the Firewall provides security for these applications. As these applications are cusm/home grown applications and no signature is available by default in Firewalls secure them. Therefore please specify that the Firewall should allow cusm Application signatures for Core ing applications. Bidders may provid additional feature over and above the functionalities asked for. Page 11 of 13

12 50 New Query As deployment mode decides the coverage of Firewall security. Therefore it is important secify that the firewall supports all possible deployment modes- Route mode, Transparent mode, Layer 2 mode, Tap mode and Mixed mode (combination of any). This will allow the have security not only at outbound/inbound traffic but also complete visibility for nternal traffic. Firewall should support all possible deployment modes- Route mode, Transparent mode (bump in the wire), Layer 2 mode, Tap mode and Mixed mode (combination of any). 51 New Query Firewall being a critical infrastructure for the bank, the OEM proposing the solution should be validated by globally reputed third party accredition agency like Gartner (4) To be considered for selection, Firms / Companies should meet the following conditions.- a) Should have strong competence in Information Systems Security Management. b) Should have among their existing clientele, banks financial Institutions with an ali-india presence. c) Bidder should have minimum 5 CISA/CISM/CISSP certified professionals d) The bidder should have at least 2 professionals with necessary certifications on the OEM platform they are quoting (5) The Bidder should be empanelled with Cert-In for information Security Services The proposed solution must be in the Leader s quadrant in Gartner Magic Quadrant of Enterprise Firewall for 3 years Bidders may provid additional feature over and above the functionalities asked for. We request the kindly relax and change the CISA/CISM/CISSP/OEM certified professionals. Since looking at the project, will require engineers/professionals who can install and maintain entire project for the period mentioned in RFP. Hence we request the bank kindly add OEM certified professionals options also. Cert-In empanelment is required mainly for Security assessment and bank has not asked for any security assessment services in this RFP. So we request the kindly remov. Page 12 of 13

13 54 7(6) The Bidder should be an OEM or their authorized partner with highest partnership level of the OEM. Either the authorized partner on behalf of the Principal / OEM or Principal / OEM Itself can bid but both cannot bid simultaneously for the same item / product for this tender. One OEM can bid with maximum two bidders. The Bidder should be an OEM or their authorized partner on behalf of the Principal / OEM or Principal / OEM Itself can bid but both cannot bid simultaneously for the same item / product for this tender. One OEM can bid with maximum two bidders Corrigendum A Corrigendum B Revised L1 Commercial Format (Annexure V) is uploaded along with Reply Pre-Bid queries as Corrigendum A on 's Corporate Website ( & e-tendering portal. The revised L1 Commercial Format es the following:- Cost of Mandary deliverables Cost of Next Generation Firewall at PDC & DRS Cost of Centralized Management Gateway (PDC/DRS) Buy Back of PIX 535 & PIX 525 Cost of Optional deliverables Cost of Application Control / Visibility feature Cost of APT / Anti-BOT feature Cost of Optional FM Resource 24x7x365 FM resource for above mentioned Firewall Solution with respect their configuration. Apart from the solution being offered, the FM resource would also be responsible for configuration of existing Cisco ASA 5550 & ASA 5540 firewalls, Cisco 4270 IPS. The FM resource is required be a graduate New Annexure in Engineering - Corrigendum having B at Annexure least one - VIII (Scope of Work of Optional FM Resources) is uploaded along with Reply Pre-Bid queries as Corrigendum A on 's Corporate Website ( & e-tendering portal. Page 13 of 13