at à 02 :00 PM on le

Transcription

1 RETURN BIDS TO : Shared Services Canada / Services partagés Canada C/O Andrew Nimmo (Contracting Authority) Andrew.nimmo@canada.ca 180 Kent St.,13th Floor, Ottawa, ON, K1G 4A8 REQUEST FOR PROPOSAL DEMANDE DE PROPOSITION Proposal To: Shared Services Canada We hereby offer to sell to Her Majesty the Queen in right of Canada, in accordance with the terms and conditions set out herein, referred to herein or attached hereto, the goods, services, and construction listed herein and on any attached sheets at the price(s) set out thereof. Title Sujet Unified Threat Management Security Next Generation Devices Solicitation No. N de l invitation /A Client Reference No. N référence du client /A File No. N de dossier 019eo /A Amendment No. N de modif. 005 Date Solicitation Closes L invitation prend fin at à 02 :00 PM on le Time Zone Fuseau horaire Eastern daylight standard time EDST Heure normale de l'est HNE Proposition aux: Services partagés Canada Nous offrons par la présente de vendre à Sa Majesté la Reine du chef du Canada, aux conditions énoncées ou incluses par référence dans la présente et aux annexes ci-jointes, les biens, services et construction énumérés ici sur toute feuille ci-annexées, au(x) prix indiqué(s) F.O.B. - F.A.B. Plant-Usine: Destination: Other-Autre: Address Inquiries to : - Adresser toutes questions à: Nimmo, Andrew Telephone No. N de téléphone : Delivery required - Livraison exigée See Herein Destination of Goods, Services, and Construction: Destination des biens, services et construction : See Herein Buyer Id Id de l acheteur 019eo FAX No. N de FAX Not applicable Delivered Offered Livraison proposée

2 Comments - Commentaires Vendor/firm Name and address Raison sociale et adresse du fournisseur/de l entrepreneur This document contains a Security Requirement Facsimile No. N de télécopieur Telephone No. N de téléphone Name and title of person authorized to sign on behalf of Vendor/firm (type or print)- Nom et titre de la personne autorisée à signer au nom du fournisseur/de l entrepreneur (taper ou écrire en caractères d imprimerie) Signature Date

3 This amendment is raised to: AMENDMENT # 005 1) Respond to the questions from bidders relating to the content of the RFP, as set out in Appendix 001; 2) Amend the Request for Proposal (RFP), as set out in Appendix 002; Under Article 2.3 of the Request for Proposal, the deadline for submitting questions or enquiries will be January 19, Canada makes no commitment to provide answers to questions submitted after January 19, 2016 Appendix 001 Question 93 M117: Must provide customizable file limits. This is not applicable for stream-based anti-virus platforms. Can SSC please remove this requirement or move to rated or change the requirement to : "If solution is proxy-based anti-virus, must provide customizable file limits. If the solution is stream-based anti-virus, this requirement doesn t apply. Answer 93 The Crown accepts the new wording and has updated M117. La Couronne accepte le changement et a mis à jour O117. Question 94 M111: Content and language agnostic. Only one vendor claim to be content-type and language agnostic, can the Crown remove this requirement or change it to rated section? Answer 94 Point of clarification: This is meant to indicate that if a site should be blocked because of inappropriate content, as deemed by its category, it should not matter in which language the site is hosted. (i.e. extreme violence or pornography should still be blocked no matter the language of the site.) Précision : Ceci est destiné à indiquer que si un site doit être bloqué en raison de contenu inapproprié, défini par sa catégorie, il ne devrait pas importer la langue dans laquelle le site est hébergé. (par exemple, la violence extrême ou la pornographie doivent toujours être bloquées peu importe la langue du site.)

4 Question 95 M66: Would the Crown please confirm that the mandatory Enterprise requirement is to be achieved by a single physical modular chassis and it s single HA device? This would allow the crown to easily expand security processing resource utilization and automatically scale as new computing power becomes available. Answer 95 The Crown confirms that the above is in line with the intent of M66. La Couronne confirme que ce qui précède est conforme à l'intention de O66. Question 96 After amendment three, Annex A revised January 11, 2016 now contains in item M63 new specifications for SOHO. Is 1Gbp firewall, 250 Mbps IPS, 400Mbps IPSec and 100,000 sessions really a reasonable requirement for Smallest class of UTM unit for use in very small GC offices or for teleworkers? Typical home offices and teleworker Internet connections are often in the range of 5Mbps to 10Mbps and it seems difficult to imagine a few teleworkers generating 100,000 sessions worth of traffic under normal government of Canada working requirements. Many government departments today operate their entire facility on Internet feeds of less than 400Mbps and it seems unlikely that a few teleworkers alone need this much VPN throughput. Answer 96 The Crown has amended M63 to: Must support 100,000 concurrent sessions, must have 1 Gbps Internet Mix (IMIX) stateful firewall throughput, Must support 4000 new sessions per second, Must have 150 Mbps IMIX intrusion prevention throughput, must have 150 Mbps IPsec VPN throughput. La Couronne a modifié O63 à : "Doit prendre en charge sessions concurrentes. Le pare-feu doit avoir un débit de pare-feu dynamique IMIX de 1 Gbps. Doit prendre en charge 4000 nouvelles sessions par seconde. Doit avoir un débit de prévention des intrusions IMIX de 150 Mbps. Le pare-feu doit avoir un débit de RPV IPSec de 150 Mbps." Question 97 The original specification for the SOHO firewall was 0.15Gbps FW, 100Mbps VPN, 75Mbps IPS, 10,000k session. It has been increased to 1Gbps FW, 400Mbps VPN, 250Mbps IPS, 100,000 sessions. What caused the three to ten times increase in requirements for very small GC offices or teleworkers as it appears Shared Services no longer wish to have options for one or two workers on a normal residential or light commercial Internet connections of 5-25Mbps for which even original specification was at least three times larger than needed? Would the crown consider revising the specification to approximately double the original specification, for example 300Mbps FW, 200Mbps VPN, 150Mbps IPS, 20,000 sessions? Answer 97 Please refer to answer to Question 96. Veuilez vous référer à la réponse à la Question 96.

5 Question 98 M63-66: Requesting Antivirus protection is an excellent decision to better protect SSCs environment. However, it is very difficult, if not impossible to predict A/V performance on a UTM platform because they are based on the amount of files transmitting through the device at any point in time. The number of files to scan is very hard to predict and varies constantly with traffic. This is why a large number of vendors (although they fully support A/V scanning) do not publish A/V performance numbers. A/V scanning performance in the rated requirements of Annex C (from January 11th) ensures Canada has available the necessary AV protection without impacting on the predictable sizing of the solution, as stated in Question 74 of Amendment 4. Would the Crown please accept leaving A/V scanning performance in the rated requirements R39, 40, 41, 43 as per the earlier decision? Answer 98 The Crown agrees to move these requirements back to rated (R39 to R42). La Couronne accepte de déplacer ces exigences à côtés (C39 à C42). Question 99 M64: The requirements in Amendment 3 appear oversized given the actual GOC Medium sized requirements. Would the crown accept to reduce the performance requirements in Medium sized to better reflect current and future requirements as follows: ''must support 100,000 concurrent sessions, must have 4 Gbps Internet Mix (IMIX) stateful firewall throughput, Must support 45,000 new sessions per second, Must have 1Gbps IMIX intrusion prevention throughput, must have 350 Mbps IPsec VPN throughput? Answer 99 The Crown does not agree to change the requirement. La Couronne n'accepte pas de modifier l'exigence. Question 100 Answer 9 in amendment 001 agrees to allow bidders to submit pricing in USD and amends Appendix 002 to reflect that. We understand the Crowns willingness to help resellers who purchase in USD with exchange fluctuations over term being requested to bid. Many OEMs established in Canada provide Canadian currency price lists to protect clients from shortterm currency exchange rate fluctuations. As such, this requires the distributor and reseller network to quote and purchase in Canadian currency. Would the Crown please amend the bid to allow for pricing in Canadian currency, and confirm that US currency bids will be evaluated at the BoC exchange rate at the time of bid submission close? Answer 100 RFP is revised to accept submissions in both Canadian and US Dollars. SACC Clause C3010T will be inserted which offers bidders a choice to mitigate their risk by having Canada assume the risks and benefits of exchange rate fluctuations. The total price paid by Canada will be adjusted up or down based on currency fluctuations. The Bank of Canada Rate that will be used to evaluate USD bids will be ,

6 Question 101 Rated Requirement no. 3 requests bidders to provide three references for a similar solution of size and complexity within the last 5 years demonstrating a minimum of three years experience. Given there are three references it is the Crowns intention to award up to 20 points per reference? If it is not the intention of the Crown could you please explain how points are awarded if references demonstrate varying years of experience? Answer 101 A maximum of 20 points will be given for 3 references demonstrating 5 years of experience. No points will be given if fewer than 3 references are given regardless of the number of years. Un maximum de 20 points sera accordé pour 3 références démontrant 5 ans d'expérience. Aucun point ne sera accordé si moins de 3 références sont données quel que soit le nombre d'années. Question 102 The pricing sheet provided in amendment 4 appear to have had firm price cells removed for Professional Services and Knowledge transfer (initial and optional term) List price field is all that remains an. Given the Crown is requesting that all pricing including Profession services and Knowledge transfer be submitted in US funds would Canada consider adding the field for each year in each of these categories so bidding companies can account for anticipated Canadian/ US currency Fx? Answer 102 Please refer to Appendix 002 Question 103 It is understandable that the Government of Canada would accept pricing in US dollars to protect resellers from currency fluctuation when partnering with a manufacturer that has standardized on US Dollars for list price. That being said, not all manufactures and resellers have standardized on US funds for Canadian operations which presents a level of risk to Canadian organizations who operate in Canada using Canadian funds while re-selling to the Government of Canada. Given the circumstances that a Canadian organization will be awarded the contract for GoC; we ask that Canada accept pricing in Canadian funds as well, and not limit to US$ only. Not only will this allow Canadian companies to price in our currency, it will minimize the exposed risk to GoC moving forward as Fx will not have to be considered for future orders. Answer 103 Please refer to question 100 Question 104 For Mandatory Requirements M63-66 The most recent Amendment 004 contains several questions surrounding the significant incremental throughput requirements that were identified for the 4 UTM user classes in Amendment 003. The Crown has acknowledged (as pointed out, by respondents, in Question 29 through Question 31) there were some deficiencies and inconsistences in what the Crown asked for in regards to throughputs for the various classes of equipment. These inconsistencies and deficiencies were identified and amended

7 very late into the RFP process, and are significantly different from the original requirements definition, effectively eliminating several vendors from being compliant for this bid. To promote and ensure a competitive, fair, and equitable bidding process, would the Crown consider moving M63-M66 to Rated requirements? Answer 104 The Crown does not agree to change the requirement. La Couronne n'accepte pas de modifier l'exigence. Question 105 For Mandatory Requirement M45 The most recent Amendment 004, Question/Answer 55 states that "This is a capability that SSC requires to be able to offer services to multiple clients while maintaining the security stance of each partner." Given that this feature/capability has been identified as clearly favouring one vendor, would the Crown consider moving M45 to a Rated requirement promote and ensure a competitive, fair, and equitable bidding process? Answer 105 The Crown does not agree to change the requirement. La Couronne n'accepte pas de modifier l'exigence. Question 106 For Mandatory Requirement M46 Amendment Question/Answer 41 speaks to concerns around major UTM features becoming unavailable once the platform is moved into a mixed mode (L2 and L3). Amendment Question/Answer 76 speaks to security concerns with running UTM appliances in Layer 2 and Layer 3 mode on the same device. Additionally - many of the major UTM vendors identified in Gartner s Magic Quadrant for UTM in _magic_quadrant_for_unified_threat_management_ pdf do not support this functionality on their devices, or only support it on their Enterprise class products. Given the inherent security and functionality concerns, and the limited number of vendors who are compliant with this Mandatory requirement, would the Crown consider moving M45 to a Rated requirement to promote and ensure a competitive, fair, and equitable bidding process. Answer 106 The Crown does not agree to change the requirement. La Couronne n'accepte pas de modifier l'exigence. Question 107 For Mandatory Requirement M56 M56 states that IPSec ISAKMP methods must support Diffie-Hellman Group 2,5,14 & 19. The large majority of deployed production IPSec VPN environments are not and have never been configured to support Diffie-Hellman Group 14 and 19 configurations, due to complexity and interoperability issues. It is highly unlikely that SSC will be moving forward with these types of

8 deployments, therefore would the Crown consider removing these Diffie-Hellman groups from the Mandatory requirement, or moving M56 to a Rated requirement. Answer 107 The Crown agrees to remove Diffie-Hellman Group 14 and 19 from M56. La Couronne accepte de retirer Groupe Diffie-Hellman 14 et 19 de O56. Question 108 Part 3.1 Bid Prepartion Instructions does not provide details for the number of hard and soft copies of the Certifications. Can the Crown please clarify how many copies of the Certifications are required with submission of the response? Answer 108 Please refer to Appendix 002 Question 109 Amendment 004 contained a significant number of answers to questions that resulted in changes to requirements or shifts of requirements from Mandatory to Rated. Would it be possible for the Crown to issue a revised version of the 'en_annex_a_- _technical_requirements_revised_january_11_2016.docx' to ensure that all responses contain the expected information and the rated and mandatory questions are listed correctly. Answer 109 Yes. Oui. Question 110 There were a significant number of changes that resulted from the answers given in Amendment 004. Would the Crown consider granting a short extension to allow for the volume of new work to be completed on time in response to the latest amendment (or more that may still arrive)? Amendment 4 makes a number of changes to the Mandatory and Rated requirements contained in Annex C (eg. Q56, Q71, Q74, Q85, Q91) however, there is no new version of the Annex C available? Will the crown be providing this? Answer 110 No more extensions will be granted. Plus de prolongation ne sera accordée.

9 Question 111 The resulting contract will contain professional services and technical support services to implement and support the solution. The individuals that will be providing these services will have access to sensitive information relating to these devices for e.g. firewall logs, security configurations on firewalls, feature functionality, level of protection enabled on firewalls, and other uniquely identifiable information such as IP addresses, addresses of SSC personnel. Because of this, would the crown consider including this mandatory requirement: The bidder must provide profession services, training, and technical services from personnel that possess Secret level clearance. Answer 111 The Crown does not agree to add the requirement. La Couronne n'accepte pas d ajouter l'exigence. Question 112 M45 states that the solution Must support multiple UTM instances on the same hardware... Some manufacturers provide this feature by licensing according to the number of UTM instances that will be run on the hardware. Thus, we interpret this requirement to mean that the proposed unit has the ability to run multiple UTM instances and that SSC can purchase the number of instances that are needed at a later time when SSC requires them. Please confirm if this is correct. Answer 112 The interpretation is correct although the Crown expects that there will be a minimum number of 3 instances available before requiring additional licensing. L'interprétation est correcte par contre la Couronne s'attend à ce qu'il y aura un nombre minimum de 3 instances disponibles avant d'exiger des licences supplémentaires. Question 113 Reference amendment 4 Q&A 56 the requirement number mentioned is for M85 and not M86. Can the Crown please confirm it is meant for requirement M86. Answer 113 Yes, the amendment was meant for M86. Oui, l'amendement était pour O86.

10 Appendix 002 AMENDMENT TO THE REQUEST FOR PROPOSAL (RFP) 1.0 PART 3 - BID PREPARATION INSTRUCTIONS Insert Section I: Certifications (1 hard copy) and (1 soft copy) on CD, DVD; 2.0 At Part 7 Resulting Contract Section Insert Exchange Rate Fluctuation Risk Mitigation C3010T ( ) Exchange Rate Fluctuation Risk Mitigation 3.0 Delete Annex A -Technical Requirements Revised January 11, 2016 Insert Annex A -Technical Requirements Revised January 20, Delete Annex B Pricing Sheets revised January 17, 2016 Insert Annex B Pricing Sheets revised January 20, Delete Annex C - Form 2 and 3 - Revised January 11, 2016 Insert Annex C - Form 2 and 3 - Revised January 20, 2016