REPUBLIC OF CROATIA REVENUE ADMINISTRATION MODERNIZATION PROJECT TERMS OF REFERENCE

Transcription

1 REPUBLIC OF CROATIA REVENUE ADMINISTRATION MODERNIZATION PROJECT TERMS OF REFERENCE for the procurement of consulting services for Tax Administration's IT infrastructure enhancement Reference No. RAMP/C/05-11/CQS 1

2 1 GENERAL BACKGROUND 1.1 Introduction The Republic of Croatia received a Loan from the International Bank for Reconstruction and Development (IBRD) towards the Croatian Tax Administration, Department for European Integrations and International Cooperation (hereinafter: CTA). The objective of the Revenue Administration Modernization Project in Croatia (hereinafter: RAMP) is to achieve further improvements in efficiency, taxpayer services, and tax compliance through capacity-building and systems improvement in the Croatian Tax Administration (CTA). The detailed CTA's organizational structure is posted on the website of the Ministry of Finance, Tax Administration at: The Project's implementation will extend from 2008 to 2015, and will consist of the following components: A. Organizational Consolidation and Functional Realignment of Zagreb Regional Office. (Activities in this component are focused on the most important limitations of the Tax Administration regarding the available physical space and the usage of the existing buildings. Adaptation/renovation of some buildings in Zagreb will provide space for the large taxpayers offices, a training center and for a transitional space for the partial consolidation of the local offices in Zagreb). B. Knowledge and Professional Upgrading of Tax Officials and Stakeholders. (Strengthening the CTA s capacities in human resource management. Upgrading training and knowledge-sharing programs in the CTA. Establishment of a Tax Academy and distance learning facilities.) C. Technological Upgrading for Services, Management Information System and PIN (Cro. OIB) implementation. Modernizing business processes, including e-porezna (e-tax) functions. Acquiring contemporary, integrated tax administration application software. Implementing the appropriate security, business continuity and disasterrecovery capabilities. Implementing an integrated Management Information System. Helping to implement the new Personal Identification Number PIN (Cro. OIB). D. Modernization Management and Project Support. Development of a Strategy Plan for the CTA's modernization. Supporting project governance and project management, including supervision and evaluation. 1.2 Information System As-Is Status Description Due to the complexity of the Tax Administration infrastructure (Central Office, regional and local offices), and the high volume of transactions as well as the work involved in the required maintenance and enhancement of the IT application of the Tax Administration (ISTA, Cro. ISPU), developed by APIS-IT, the Tax Administration has outsourced most of the IT work to external partners. ISTA applications use CICS/PL1/IMS technologies with DB2/ISAM backend database on IBM z90 servers, and still use the simple screen emulation. The entire ISTA is at APIS-IT's and is managed by APIS-IT. The e-porezna application is owned by the CTA, but has been developed and is maintained by the external partner. The system uses the PKI (Public Key Infrastructure) technology for the identification/authorization of users and the electronic signing of forms. The application allows taxpayers to electronically submit forms and allows them an insight into their accounting file. The application is being continuously developed and there are plans to incorporate it in the new CTA consolidated system. The servers that host the system are located at APIS-IT. 2

3 The application for the issuance of PIN and the integration of PIN into the systems of different administrations was developed by the main partner of the Tax Administration, namely APIS-IT, and it is based on the same technologies as the VIES system. The OIB system and application enable a better exchange of information between administrations, an increase of the tax system efficiency as well as the increase of the collection of tax revenues. In 2013, the Tax Administration has set up the Fiskalizacija system (Fiscalisation) which is intended for data collection on invoices issued in cash transaction of all the taxpayers, and moreover in real time. This system is based on web technology (GUI and web services), PKI and relational database. Applications OIB, e-porezna and Fiskalizacija are constructed on the identical (SOA, web) architecture and are located on the same infrastructure in APIS-IT. The VIES system (VAT Information Exchange System) that was developed as part of the compulsory development of the Republic of Croatia in the process of preparation for the accession to the European Union, is based on SOA methodology (Service Oriented Architecture) and relational databases, namely as such it represents a new direction in the development of the IT System of the Tax Administration and enables fulfilling the obligations of the Republic of Croatia after it joins EU. The VIES system is located in the data center in CTA headquarters. Data Warehouse, DMS (Document Management System) and CMS (Case Management System) constitute an integral part thereof. This system will also be located in CTA headquarters. The data within ISTA are stored in DB2/ISF, while the data of other subsystems are stored in Oracle base. The IT systems of the Tax Administration are linked amongst each other, and are also linked to the systems of other public bodies and to the tax systems of other EU Member States. Users can access e-porezna, OIB, VIES and Fiskalizacija systems 24/7, while the internal system ISTA is available during CTA's extended business hours. Figure 1: Components of CTA's application system 3

4 1.3 CTA's ICT Infrastructure As-Is Status Description The current organization of the IT directory service in the Tax Administration is based on Windows 2003 Active Directory AD technology. The AD system consists of one forest which contains one tree. There are several domains in the AD tree. The root domain is pu.mfin.hr; while there are 23 child domains below it in the hierarchy Part of ICT Infrastructure Installed in Tax Administration's Central Office A part of the CTA's ICT system infrastructure installed in the Central Office consists of an IBM server with operational systems and Microsoft server applications installed with the following functionalities as per subsystems: - Highly available exchange system. Implemented as cluster server comprised of four subservers linked into a cluster (MS Exchange Server 2003), - Highly available data storage and retrieval system (data base server). Implemented as three cluster servers comprised of two subservers each linked into a cluster (MS SQL Server 2005), - Internet access is available to all users, centralized through the Client's Data Center central location in Zagreb - System of protection against unauthorized Internet communication (MS ISA Server 2006), - System for managing the distribution and application of patches for Microsoft operational systems and applications, - Backup system (IBM Tivoli Storage Manager) - Centralized antivirus protection system for servers, work stations and (Trend Micro) - TA's internal and external portal are realized on MS SharePoint Server Part of ICT Infrastructure Installed in Tax Administration's Regional and Local Offices Most of the Client's locations are equipped with IBM Intel/Windows servers, PC client computers, HP, Samsung and other network printers and Cisco network equipment. All IT resources are linked to the local computer network (TCP/IP). Each location is connected to the Client's WAN network with the central location in the Client's central location in the Central Office in Zagreb. The Tax Administration is currently initiating a project for construction work on a building that will house the IT System Disaster-Recovery Center End Users' ICT Equipment The end users make use of desktop computers in their offices while the field auditors use laptops which are not connected to the TA's network so the documents exchange between the laptops and the other TA's infrastructure is carried out via portable devices (USB drives) or s. The CTA employees furthermore also use mobile telephones to access particular TA's resources / applications. 4

5 1.4 Tax Administration's Computer-Communication Network WAN network consists of regional networks which are linked to the central node in the Central Office at Boškovićeva St. and to the node in APIS by means of the inter-county MetroEthernet network. The link between the central node and the APIS' one is realized via the inter-county MetroEthernet network and the MetroEthernet network A of the Zagreb County and the City of Zagreb. Regional networks connect the local offices in the region through a regional MetroEthernet network with the regional center. In the regional center there are two routers which are, apart for being linked to the regional MetroEthernet network, also linked to the inter-county network. The usage of two routers in the regional center allows for a higher level of availability of network services. 1.5 Tax Administration s IT Strategy The preparation of the Tax Administration's IT Strategy will be completed by the end of In the course of drafting the plans and providing services under this assignment, the Consultant shall need to adhere to the objectives defined in the IT Strategy. 2 OBJECTIVE OF ASSIGNMENT The final objective of the assignment is to consolidate the TA's IT infrastructure and set up a systematic management thereof, achieving an optimum organization of the tax IT infrastructure, its reliability, accessibility and security whilst enabling business continuity and a fast disaster-recovery process. The current TA's IT infrastructure varies in terms of age and quality. In the course of the as-is status and business requirements analysis, a new TA's IT architecture needs to be prepared; the necessary replacement/procurement of hardware and software must be defined and specified; policies, IT infrastructure management methods and techniques prepared and implemented with security policies included as well as business continuity plans and disaster- recovery plans; a team required to manage such an infrastructure is to be defined and trained. The Project's focus lies on five key areas: 1. Defining and implementing policies related to the use of ICT, especially security policies. Furthermore creating and implementing Business Continuity Plan, with proposing methods and tools for ICT management system, in order to ensure Business Continuity.. Following the adopted policies and developed a Business Continuity Plan: 2. Consolidating IT infrastructure in the regional centers and the local offices with the as-is analysis; defining the solution proposal 3. Optimizing the data center in the TA headquarters in accordance with the requirements and plans, alongside with the specification of the necessary equipment and assistance with any public procurement, migration plan and supervising the execution of optimization. 5

6 4. Drafting the implementation project for DRC (Disaster-Recovery Center), with the specification of equipment, assistance in the procurement process for any equipment; drafting of plans / procedures in the event of disaster-recovery and ensuring the Business Continuity Plan; The Recovery Plan in the event of IT system failure must contain all the relevant data on suppliers with contacts, sources of expertise for the recovery of damaged systems and a logical activity (actions) sequencing that should be taken in order to ensure a problem-free recovery. After the risk assessment is completed and the potential threats to IT infrastructure have been identified, it is necessary to establish which infrastructure elements carry the highest importance for the execution of the Tax Administration's business processes. Furthermore, it is necessary to prepare a specification of the required hardware and software where a tender will be issued. The Recovery Plan in the event of IT system failure must lay out a step-by-step description of the procedures for the recovery of the damaged IT systems and networks, and must assist the normal business continuity. The objective of these processes is to abate the negative impact of the disaster on the Tax Administration's business processes. The process for IT system recovery must identify the critical components of the IT system and network, the priorities for their recovery and the steps essential for restart and reconfiguration. 5. Defining of and support to the implementation of the user support services, together with process specification and the specification of the required technical support; assistance in the procurement process for any tools or other equipment for the systematic support management; and, in cases where external providers are involved, supervising these providers. 3 SCOPE OF WORK The Consultant for IT infrastructure enhancement shall perform the assignment s activities as described below. a) Activities The expected sequence of activities to be performed is as follows: 1. Preparation of the Work Plan, establishment of the scope of activities, setting up the team, holding the kick-off meeting. 2. Status analysis with collecting the relevant documentation related to the present infrastructure, equipment configuration, databases and tools. This includes collecting the existing IT relevant plans, which are presently valid and/or of the applied policies and service level agreements with the external providers, as well as all the other relevant information required for the realization of the assignment. 3. Analysis of the as-is TA's technical infrastucture (in the TA's regional and local units as well as in the Central Office), evaluation of its status, defining the draft of the new one including the migration plan; as required, preparing the proposal and specification of the new equipment and assisting the corresponding procurement process. 4. Analysis of the users' and IT infrastructure management method; drafting a report with gaps analyis whereby identifying the as-is versus planned status; preparation of the recommendations on how to achieve the required level of readiness; defining new procedures, methods, techniques and tools; defining and training the CTA's team to manage such an infrastructure. 5. Analysis of the as-is support to internal and external TA's IT/IS users (Help Desk); analysis of the business requirements and defining the appropriate technological system which includes defining the processes and establishing a team, alongside with the 6

7 specification of the necessary IT support, assistance with the procurement thereof, and supervising the support system implementation. 6. Identifying the most severe threats to the IT infrastructure (such as fire or other disasters, human error, system malfunction, insufficient security level) and the weakest points of the infrastructure. This includes an overview of the history of setbacks and system failures and the solutions thereof. 7. Identifying the most critical IT equipment (assets), defining the required level of its availability; defining the operational procedures in case of IT system failure; preparation of the recovery plan and the plan for testing the recovery plan; establishing a team to act in cases of emergencies for all the critical IT infrastructure breakdowns whereby this also includes the external providers; setting the required training and experience levels for taking the appropriate actions in cases of emergency as well as carrying out the required training. In parallel with the drafting of the recovery plan, a proposal to equip an alternative location for IT system disaster-recovery is to be prepared, as required. It should encompass all the essential infrastructure components with the specification of the hardware, software, network connections, data, services, administrative and supervision tools etc. in order that the recovery strategy can take place in accordance with the drafted plan. The Consultant shall also be responsible for supervising the implementation activities of other providers which includes the execution of infrastructure consolidation per the TA's regional units, optimization of the data center in the TA's headquarters, implementation of IT equipment at the DRC location, introducing data loss prevention, Help Desk implementation, and any other activities carried out as per the Consultant's specification or plans. b) Timeline The assignment shall commence in December 2013 and conclude in April The expected maximum duration of the assignment is 18 months. The intensity of the activities will vary and will be aligned during the planning phase. c) Languages The Consultant's work shall be conducted in English and Croatian. All communication shall take place in Croatian. All documents shall be prepared in Croatian with a translation to English. The Consultant may be requested to provide the CTA with assistance in the sense of ensuring highquality documents' translation and material interpretation services. The Consultant shall be responsible for providing the interpretation and translations services. 4 Reporting requirements The Consultant shall prepare: (a) Preliminary Report whereby providing the description of: i. proposed approaches of the Consultant for fulfilling its tasks under the Contract; ii. proposed clarifications of the Consultant regarding the resources to be ensured by the Consultant and the Client; iii. Consultant s standpoint regarding any preconditions for the successful execution of the assignment; iv. Consultant Action Plan for the execution of the assignment; and v. any other matters which the Consultant wishes to raise with reference to the assignment or the Project. 7

8 (b) Monthly Progress Report whereby providing the summary of: i. results accomplished during the preceding period; ii. up-to-date cumulative deviations from the schedule of activities namely from the project's key progress milestones; iii. corrective actions to be taken in order to return to the planned schedule of project progress; iv. proposed revisions to the planned schedule of activities; v. proposed steps to be taken and information to be provided by the Consultant in the upcoming period; vi. resources that the Consultant expects to be provided by the CTA and/or steps to be taken by the CTA in the subsequent reporting period; vii. any other open issues or potential problems that the Consultant foresees could have an impact on the progress and/or effectiveness of the assignment. The reports shall be submitted to the Project Manager by the end of the first week of the subsequent month. (c) Final Report whereby providing a summary of the the work performed, results achieved, and recommendations for subsequent actions to extend the objectives of the contract or to promote the success of the Project in some other way. All plans and other documentation that the Consultant shall prepare under the Contract shall constitute an integral part of the Final Report. All documents and reports prepared by the Consultant under this Contract shall be prepared in Croatian and English. 5 Resources and restrictions The Consultant shall be responsible for ensuring all the necessary human resources as well as the logistical and material ones required for performing the assignment. The CTA shall provide coordination assistance with state bodies, including the organization units under the CTA as well as the suppliers imperative for the assignment s realization. Likewise, it shall also provide logistical support in the sense of holding meetings as well as the premises for the Consultant s presentations for the CTA purposes. The CTA shall provide timely access to any of its data that have been identified and agreed upon in the Preliminary Report (with due consideration of the legal requirements relating to data protection and confidentiality). All materials prepared under this Contract shall remain the sole property of the Tax Administration. Any re-use of the materials shall require the formal approval of the Tax Administration in written form. At the beginning of the assignment, the Consultant shall, jointly with the CTA, prepare a statement of confidentiality. Such a statement shall bind the Consultant to non-disclosure of any sensitive information that the Consultant may become knowledgeable of during the implementation of the assignment. The terms of such an agreement shall be made consistent with the relevant privacy laws of the Republic of Croatia. 8

9 6 Criteria / minimum qualification requirements The Consultant must possess education at least Masters Degree Academic level in computer science, information technology or similar. The Consultant shall possess attestable experience and expertise in the areas of: system engineering including complex IT environment planning, application of current technology and tools for the enhancement of IT services efficiency security management, preparation and implementation of IT security setup plans together with the business continuity plans and/or disaster-recovery plans. IS development, change management, IT management and IT audit, preferably in public sector i.e. in tax administrations, highly proficient in computer systems and networks, including but without limitation to network operations, data centers, different applicative solution architectures, operational experience in data center, with mainframe technology and several other technological environments The Consultant must: Be proficient in English Possess excellent communication and analytical skills Be proficient in report drafting Have excellent team work abilities, and Knowledge of Croatian language would be considered as advantage. The Consultant shall possess attestable experience in the area in question. The minimum being: List of references from the area of the subject of procurement (at least 5) containing the contract values, dates and the titles of the other contracting parties, clients or private owned entities with the confirmation of regularly performed contractual committments verified by the clients in question. Confirmations of the clients from the stipulated contracts on such a list must contain the name and the seat of the contracting parties, subject of the contracts, contract values, time and place of contract realization and the statement on regularly performed contractual committments. References from the public and/or financial sector will be separately evaluated. A minimum of 10 years active experiences as BR/DR consultant/manager. At least one instance of participating in crisis mangement in the procurement subject area. For the purpose of ensuring the level of quality and knowledge, the Consultant must possess at least two of the following certificates: 1. CISM (Certified Information Security Manager) 2. CRISC (Certified in Risk and Information System Control) 3. CISA (Certified Information System Auditor) 4. CISSP (Certified Information Security Professional) 5. CBCP (Certified Business Continuity Professional) 6. ISO27001LA Information Security Manager 7. Other equivalent certificates and proficiency in ITIL frameworks The given under items 1 through 6 are proved by presenting the required certificates (source and manner for the verification of the certificates must be stated). 9

10 7 Deliverables and timeline The Consultant should provide the CTA with services as per the schedule of activities and deliver reports, plans and other documentation. For each of the assignment planning phases, the Consultant shall need to deliver at least the documents listed below: Deliverable Deadline for execution Approx. 1. Preliminary Report with objectives and timelines 1 month from contract effectivness 01/ Monthly reports Until the 10th day of the month for the preceding month 3. IT infrastructure as-is analysis and the preparation and plan for IT infrastructure enhancement 4. Specification of equipment for procurement (for CTA and DRC locations) 2 months from contract effectivness 02/ months from contract effectivness 03/ IT system recovery plan 6 months from contract effectivness 06/ Procurement of equipment 8 months from contract effectivness 08/ Completed consolidation of equipment in the regional units and optimization in the Central Office 11 months from contract effectivness 11/ HelpDesk is set up 13 months from contract effectivness 01/ DRC is set up 15 months from contract effectivness 03/ Final Report 16 months from contract effectivness 04/