Travaux publics et Services gouvernementaux Canada. Title - Sujet PCI QSA/ASV. Solicitation No. - N de l'invitation EN /B

Transcription

1 Public Works and Government Services Canada RETURN BIDS TO: RETOURNER LES SOUMISSIONS À: Bid Receiving - PWGSC / Réception des soumissions - TPSGC 11 Laurier St. / 11, rue Laurier Place du Portage, Phase III Core 0A1 / Noyau 0A1 Gatineau, Québec K1A 0S5 Bid Fax: (819) SOLICITATION AMENDMENT MODIFICATION DE L'INVITATION The referenced document is hereby revised; unless otherwise indicated, all other terms and conditions of the Solicitation remain the same. Ce document est par la présente révisé; sauf indication contraire, les modalités de l'invitation demeurent les mêmes. Travaux publics et Services gouvernementaux Canada Title - Sujet PCI QSA/ASV Solicitation No. - N de l'invitation EN /B Client Reference No. - N de référence du client GETS Reference No. - N de référence de SEAG PW-$$ZG File No. - N de dossier 406zg.EN Part - Partie 1 of - de 2 See Part 2 for Clauses and Conditions Voir Partie 2 pour Clauses et Conditions CCC No./N CCC - FMS No./N VME Solicitation Closes - L'invitation prend fin at - à 02:00 PM on - le F.O.B. - F.A.B. Plant-Usine: Destination: Other-Autre: Address Enquiries to: - Adresser toutes questions à: Harrington, Ingrid Telephone No. - N de téléphone (819) ( ) Destination - of Goods, Services, and Construction: Destination - des biens, services et construction: Amendment No. - N modif. 003 Date Time Zone Fuseau horaire Eastern Standard Time EST Buyer Id - Id de l'acheteur 406zg FAX No. - N de FAX (819) Comments - Commentaires THIS DOCUMENT CONTAINS A SECURITY REQUIREMENT Vendor/Firm Name and Address Raison sociale et adresse du fournisseur/de l'entrepreneur Instructions: See Herein Instructions: Voir aux présentes Delivery Required - Livraison exigée Delivery Offered - Livraison proposée Vendor/Firm Name and Address Raison sociale et adresse du fournisseur/de l'entrepreneur Issuing Office - Bureau de distribution Business Management and Consulting Services Division / Division des services de gestion des affaires et de consultation 11 Laurier St. / 11, rue Laurier 10C1, Place du Portage Gatineau, Québec K1A 0S5 Telephone No. - N de téléphone Facsimile No. - N de télécopieur Name and title of person authorized to sign on behalf of Vendor/Firm (type or print) Nom et titre de la personne autorisée à signer au nom du fournisseur/ de l'entrepreneur (taper ou écrire en caractères d'imprimerie) Signature Date Canada Page 1 of - de 1

2 This solicitation amendment 003 is raised to answer questions pertaining to the RFP as detailed below: Questions and Answers: Q3. How many separate ROCs would be required during the term of the service? A3. Today, there are no departments at level 1 and therefore no ROCs are officially required. However, the RG considers that some departments could be deemed a Level 1 merchant and a decision taken to proactively assess them. This depends on many factors and different risk levels that will be discussed with the QSA. Q4. How many in scope external asset need ASV scanning (quarterly)? A3. We do not have the exact number of assets on IP lines that need scanning. As per Annex A, Appendix D, the SAQ type for each department is indicated. Q5. How many internal assets are in scope and need scanning (quarterly) ASV certification? A5. We do not have the exact number of assets on IP lines that need scanning. Penetration tests scoping, if required, will be based on the amount internal and external assets in scope. Q6. Will they be part of that project scope? A6. Penetration testing is not required. We see in the project scope the following: Contingency Planning (CP): security controls that support the availability of the information system services in the event of component failure or disaster Q7. this is not a mandatory control under PCI. So,Why is it is this RFP scope? A7. The security controls under Annex C and its associated attachment are put in place in order to assess the resulting contractor s Information Technology (IT) Systems and are not related to the PCI. The CP are security controls that support the availability of the contractor s information system services in the event of component failure or disaster. Annex C - Attachment 1: Q8. Is it the auditors role to define, prepare and produce evidence for the requirements detailed in annex C attachment 1? Or Is he expected to audit these requirements? (Note that these requirements are not directly related to PCI-DSS). A8. The security controls under Annex C Attachment 1 are put in place in order to assess the resulting contractor s Information Technology (IT) Systems and are not related to the PCI. The contractor is asked to produce evidence for the security requirements of their IT systems as detailed in Annex C Attachment 1. Part - Partie 2 of - de 2 / Page 1 of - de 8

3 Q9. Can we work as QSA and utilize a certified ASV as a subcontractor for us with the ASV scan efforts? A9. As per the Bid Preparation Instructions under MT1 (Attachment 1 to Part 4), bidders can subcontract an ASV to perform scans. Doc, Attachment 1 to part 5 Certification precedent to contract award Page 23: TA Authority and limit: Q10. please explain in more details the expense limit of $75,000 limit for the TA? A10. Any TA with a value that exceeds $75,000, must be authorized by the Contracting Authority prior to issuance to the Contractor. Q11. Section 2-Summary, 2.2 states; There is a security requirement associated with this requirement, Bidders are reminded to obtain the required security clearance promptly.. Bidders who currently do not meet the facility security clearance requirements and/or personnel security clearance are advised to initiate the security clearance process immediately. Please confirm that personnel who meet all the mandatory and rated requirements of the RFP with Secret clearance in process satisfy the security requirements of this RFP. A11. The proposed personnel must meet the mandatory criteria to qualify. All security clearances must be met prior to award of a contract as indicated in Part 6 - Security Requirements and Part 7, Article 3. Security Requirement. Q12. Given that the crown has identified that the contract will be awarded to start April 1, 2014, we respectfully ask that MT3 and MT4 be amended as follows: A. MT3 From: At bid closing, the Bidder must propose a Senior QSA who must be a qualified QSA in good standing with the PCI Council for the past three (3) years. To As of contract award (April 1, 2014), the Bidder s proposed Senior QSA must be a qualified QSA in good standing with the PCI Council for the past three (3) years. B. MT4 From: At bid closing, the Bidder must propose a Junior QSA who must be a qualified QSA in good standing with the PCI Council for the past three (3) years. To As of contract award (April 1, 2014), the Bidder s proposed Junior QSA must be a qualified QSA in good standing with the PCI Council for the past three (3) years. A12. Canada has indicated that the work under any resulting Contract would be performed during the period of March 1, 2014 to February 28, Canada has revised Technical Criteria MT3 and MT4. Please refer to the revised Attachment 1 to Part 4 Technical Criteria, included herein. The solicitation is hereby amended as follows: Part - Partie 2 of - de 2 / Page 2 of - de 8

4 2. IN PART 4 - EVALUATION PROCEDURES AND BASIS OF SELECTION, ATTACHMENT 1 TO PART 4 TECHNICAL CRITERIA: DELETE: ATTACHMENT 1 TO PART 4 TECHNICAL CRITERIA, in its entirety; INSERT: ATTACHMENT 1 TO PART 4 TECHNICAL CRITERIA, included herein. Part - Partie 2 of - de 2 / Page 3 of - de 8

5 ATTACHMENT 1 TO PART 4 TECHNICAL CRITERIA Mandatory Technical Criteria The bid must meet the mandatory technical criteria specified below. The Bidder must provide the necessary documentation to support compliance with this requirement. Bids which fail to meet the mandatory technical criteria will be declared non-responsive. Each mandatory technical criterion should be addressed separately. Mandatory Technical Criteria (MT) For the purpose of the mandatory technical criteria the experience of the Bidder will be considered. Number MT1 Mandatory Technical Criterion At bid closing, the Bidder must have possessed the following certifications for at least four (4) years: Bid Preparation Instructions The Bidder should include copies of these certifications with their bid. Qualified Security Assessor (QSA) company certification, qualified by the PCI Security Standards Council to ensure employees assess compliance to the PCI DSS Standard; The bidder can subcontract an ASV company to perform the scans. MT2 AND Approved Scanning Vendor (ASV) certification, qualified by the PCI Security Standards Council to ensure employees perform vulnerability scans of Internet facing environments of merchants and service providers. At bid closing, the Bidder must have acquired three (3) years, within the last five (5) years, experience in providing resources to clients exterior to the Bidder's own organization, that have experience in conducting PCI compliance assessment activities, as defined in the Statement of Work, in the area of. Policy/procedure, Risk, Information security, PCI audits, The Bidder must include their company's history and demonstrate relevant and significant experience by submitting the following for each project of similar quality/quantity: The name and a brief description of the project and for whom; and Part - Partie 2 of - de 2 / Page 4 of - de 8

6 MT3 Compensating controls and; Strategies for fraud prevention. At bid closing, the Bidder must propose a qualified Senior QSA. The Senior QSA must be a qualified QSA in good standing with the PCI Council for the past three (3) years by March 1, 2014 (Contract award). The Senior QSA must have also completed a bachelor's degree in the field of Finance, Accounting, Commerce, Business Administration, Information Technology, Security or equivalent and must have acquired five (5) years of full-time professional work experience, within the last ten (10) years, conducting analysis, as defined in the Statement of Work, in at least four (4) of the following areas: Policy/procedure, Risk, Information Security, PCI audits, Compensating Controls, or Strategies for fraud prevention. OR At bid closing, the Bidder must propose a qualified Senior QSA. The Senior QSA must be a qualified QSA in good standing with the PCI Council for the past three (3) years by March 1, 2014 (Contract award). The Senior QSA must also have acquired seven (7) years of full-time professional work experience, within the last ten (10) years, conducting analysis, as defined in the Statement of Work, in at least four (4) of the following areas: Policy/procedure, Risk, Information Security, PCI Audits, Compensating Controls, or Strategies for fraud prevention. The duration of each project including start and end dates. (must be chronologically indicated in years/months, e.g. May 2011 to March 2012) The Bidder must provide the name of the proposed resource, including: Indication of when the proposed resource will attain three (3) years good standing with the PCI Council; Relevant work/project experience; Language capabilities; and Relevant academic attainments of the proposed resource in relation to the requirements. The Bidder must demonstrate the experience of the Senior QSA by submitting information including the following for each relevant acquired experience. The name and a brief description of the project and for whom; The duration of the project including start and end dates. (must be chronologically indicated in years/months, e.g. May 2011 to March 2012) How the Senior QSA meets the educational requirement listed; and Where and when the proposed candidate acquired education. Part - Partie 2 of - de 2 / Page 5 of - de 8

7 OR Experience: For the purpose of resource qualifications, experience gained during formal education will not be considered work experience. All requirements for work experience must be obtained in a work environment as opposed to an educational setting. Co-op terms are considered work experience provided that they are related to the required services. Listing experience without providing any supporting information describing where, when and how such experience was obtained will result in the experience not being included for evaluation purposes. For evaluation purposes: Where means the name of the employer as well as the position/title held by the individual; When means the start date and end date (e.g. from January 2008 to March 2009) of the period during which the individual acquired the qualification/experience; and How means a clear description of the activities performed and the responsibilities assigned to the individual under this position and during this period. Furthermore, Bidders are advised that the month(s) of experience listed for a project in which the time frame overlaps that of another referenced project for the same named Resource must only be counted once. For example: Project #1 time frame is July 2008 to December 2008; Project #2 time frame is October 2008 to January 2009; the total months of experience for these two project references is seven (7) months. MT4 At bid closing, the Bidder must propose a qualified Junior QSA. The Junior QSA must be a qualified QSA in good standing The Bidder must provide the name of the proposed resources including: Part - Partie 2 of - de 2 / Page 6 of - de 8

8 with the PCI Council for the past three (3) years by March 1, 2014 (Contract award). The Junior QSA must have also completed a bachelor's degree in the field of Finance, Accounting, Commerce, Business Administration, Information Technology, Security or equivalent and must have acquired three (3) years of full-time professional work experience, within the last five (5) years, conducting analysis, as defined in the Statement of Work, in the at least two (2) of the following: Risks; Information Security Controls; PCI Audits; Compensating controls; or Financial analysis. OR At bid closing, the Bidder must propose a qualified Junior QSA. The Junior QSA must be a qualified QSA in good standing with the PCI Council for the past three (3) years by March 1, 2014 (Contract award). The Junior QSA must also have acquired four (4) years of full-time professional work experience, within the last five (5) years, conducting analysis, as defined in the Statement of Work, in the at least two (2) of the following: Indication of when the proposed resource will attain three (3) years good standing with the PCI Council; Relevant work/project experience; Language capabilities; and Relevant academic attainments of the proposed resource in relation to the requirements. The Bidder must demonstrate the experience of the Junior QSA by submitting information including the following for each relevant acquired project experience: The name and a brief description of the project and for whom; and The duration of the project including start and end dates. (must be chronologically indicated in years/months, e.g. May 2011 to March 2012). The Bidder must include the following: How the Junior QSA meets the educational requirements listed; and Where and when the proposed candidate acquired education. Risks; Information Security Controls; PCI Audits; Compensating controls; or Financial analysis. Experience: For the purpose of resource qualifications, experience gained during formal education will not be considered work experience. All requirements for work experience must be obtained in a work environment as opposed to an educational setting. Co-op terms are considered work experience Part - Partie 2 of - de 2 / Page 7 of - de 8

9 provided that they are related to the required services. Listing experience without providing any supporting information describing where, when and how such experience was obtained will result in the experience not being included for evaluation purposes. For evaluation purposes: Where means the name of the employer as well as the position/title held by the individual; When means the start date and end date (e.g. from January 2008 to March 2009) of the period during which the individual acquired the qualification/experience; and How means a clear description of the activities performed and the responsibilities assigned to the individual under this position and during this period. Furthermore, Bidders are advised that the month(s) of experience listed for a project in which the time frame overlaps that of another referenced project for the same named Resource must only be counted once. For example: Project #1 time frame is July 2008 to December 2008; Project #2 time frame is October 2008 to January 2009; the total months of experience for these two project references is seven (7) months. Part - Partie 2 of - de 2 / Page 8 of - de 8