REQUEST FOR QUOTE (RFQ)

Transcription

1 REQUEST FOR QUOTE (RFQ) Texas Guaranteed Student Loan Corporation (referred to herein as TG ) is a private, nonprofit corporation that promotes public access to higher education and student success in education, enabling students to realize their college and career dreams. TG is a premier provider of information, products, and services to help students and their families plan and prepare the student for college, learn the basics of money management, and repay their Federal student loans. For additional information regarding TG, please visit TG s website at Request for Quote (RFQ) # Description of Project Network Penetration Testing RFQ Issue Date April 13, 2015 Due Date for Notice of Intent to April 15, 2015, 4:00 P.M., CDT Participate Due Date for Questions April 21, 2015, 4:00 P.M., CDT RFQ Due Date and Time April 28, 2015, 4:00 P.M., CDT Procurement Specialist Eric Francois Quotes must be submitted via electronic mail ( ) to: procurement@tgslc.org only. Bidders shall only contact the TG Procurement Specialist designated above regarding this solicitation. Contacting other TG personnel may result in the Bidder being disqualified from further participation in this RFQ solicitation process. Responses are due on or before the due date & time for quotes to be submitted as provided in the table above (Central Daylight Time). Quotes received by TG after the RFQ due date & time will not be accepted. All references to this RFQ must contain the RFQ number. Any amendments (if any) to Bidder s response to this solicitation must be signed and submitted to TG prior to the RFQ due date & time. All Bidders who intend to submit a response (i.e., proposal, quotation, etc.) in response to this RFQ should provide an as its Intent to Participate per the due date above. In the event that TG deems it necessary to provide one or more updates/amendments to this RFQ, or any additional or clarifying information concerning this solicitation, to Bidders subsequent to the due date for Intent to Participate, TG will make reasonable efforts to provide such updates/amendments and/or additional or clarifying information to the Bidders from whom TG has received a notice of Intent to Participate. TG will not send such updates/amendments or additional or clarifying information to any vendors/contractors from whom TG has not timely received a notice of Intent to Participate). Regardless of the foregoing convenience provided by TG, Bidders are solely responsible for obtaining all updates and/or amendments to this RFQ and all additional/clarifying information concerning this solicitation, which shall, upon release by TG, be made available on TG s website located at

2 Statement of Work TG desires to obtain external penetration testing services to assess TG information asset resiliency. TG desires execution of a comprehensive penetration assessment of specified TG network and web assets and creation of related reports to identify weaknesses and recommend remediation. TG requires all testing activities to be conducted during designated business hours. TG requires testing activities that demonstrate whether and how identified weaknesses can be exploited without resulting in negative impact to network and web asset confidentiality, integrity, and availability. TG requires immediate notification if vulnerabilities of a critical nature (CVSS score 10, exploits that allow unauthorized privileged access) are discovered during testing. This external penetration testing engagement may include: Enumeration of network and web assets to validate scope of engagement; Assessment of target network and web asset configurations; Identification and analysis of target network and web asset weaknesses; Detailed description of methods that may be used to exploit and impact identified network and web asset weaknesses and assessment of exploit probability; Recommendations for remediation priorities and actions to ensure TG information asset resiliency; Creation and delivery of appropriate reports. TG expects work to be accomplished and final deliverables to be provided to TG no later than August 31, 2015 for this one-time engagement. All work must be done during standard business hours (Monday Friday, 8:00 am 5:00 pm). A. Specific Requirements for Network Application Pen Test: 1. Scan TG s IP range (126 IP addresses, with approximately 40 live hosts) to verify Internet facing IP addresses. 2. Enumerate TG s Internet-facing IP range within TG s IP range. 3. Run port scans for TG s IP range to determine open ports and services. 4. Conduct DNS lookups for all internet facing IP addresses within TG s IP range. 5. Conduct external network vulnerability assessments for all internet-facing IPs within TG s IP range. 6. Perform vulnerability exploitation targeted at specific IP addresses (to be provided by TG) with the exception of Denial of Service exploits. 7. Attacks to include but not limited to: a. Buffer overflow b. Cookie tampering c. Identify any operating system specific exploits and attacks to specific coded applications without creating any Denial of Service, Distributed Denial of Service, brute-force, or password attacks 8. Provide executive summaries and remediation reports.

3 B. Specific Details of Web Application Pen Test: 1. Perform an automated scan of all applications on one (1) TG web site, with verification of results through manual penetration testing or code review.* 2. Perform manual testing of the high risk, non-obsolete applications at the time of the test.* Create dynamic tests to verify an application s proper design, implementation, and use of security controls using the requirements detailed listed below: a. Un-validated parameters b. Broken access controls c. Broken account and session management d. Cross-site scripting flaws e. Buffer overflows f. Command injection flaws g. Error handling problems h. Insecure use of cryptography i. Remote administration flaws j. Web and Application server mis-configuration (insure configuration management) k. Denial of service: No denial of service testing should be attempted against the web applications involved.. l. Privileged testing 3. Provide executive summaries and remediation reports. C. Timeline: Provide a proposed timeline for this project with an August 31, 2015 completion deadline for final deliverables. * These tests referred to in OWASP Application Security Verification Standard Questions 1. Can your company complete the network application and web application penetration testing as described in the statement of work above? 2. Can your firm meet the August 31, 2015 deadline for completion of work and delivery of final report? 3. Can your firm complete the work during standard business hours (Monday Friday, 8:00 am 5:00 pm)? 4. Does your firm have any suggestions for the requirements described in the statement of work above which would enhance your firm s ability to provide meaningful recommendations to TG? 5. Does your firm conduct PCI-DSS level penetration testing methods?

4 TG Holidays Memorial Day Monday, May 25 Independence Day Saturday, July 4 Labor Day Monday, September 7 Veterans Day Wednesday, November 11 Risk Management Questions The following questions are asked due to TG s due diligence in regards to protecting TG data, whether it is the data of TG s clients, employees or suppliers. Please respond to these questions in an effort to assist TG in ensuring that no TG data or systems are compromised. The Successful Bidder or semifinalists may be required to respond to additional questions related to vendor risk management at a later date. 1. Is your firm controlled by, in control of, or under common control with another firm? If so, please identify the firm(s), and the relationship(s). 2. Are there any anticipated changes in ownership or control of your firm during the next twelve (12) month period? If yes, please provide a brief description. 3. Describe the background checks conducted with respect to your employees/new hires. 4. Are employees, consultants, temporary employees and contractors required to sign nondisclosure agreements? 5. Will your company utilize any third party service providers to perform this project? Bidder s Experience Please describe any skills and experience that Bidder holds that is relevant to this RFQ. Please provide documentation (e.g. certifications) and three references for work in process or completed within the past 24 months. Please include the references: representative name, address and company name. Disadvantaged Business Enterprises TG encourages the use of Disadvantaged Business Enterprises (DBE), in its procurement practices. Furthermore, TG encourages larger suppliers to subcontract for goods and services from such businesses as a practice of inclusiveness. If Bidder will subcontract with a DBE for this RFQ, please provide information in the section below. If Bidder is a DBE, please disclose this information in the section below. The U.S. Federal Government determines designations and TG accepts such designations as being compliant with the TG program. Is Bidder a certified Small, Veteran, Minority or Women-owned Business? Yes No (If answered yes, please include a copy of Bidder s current certification with quote). Will Bidder utilize a certified Small, Veteran, Minority or Women-owned Business? Yes No (If answered yes, please include a copy of Bidder s current certification with quote).

5 If yes, please provide Supplier or Subcontractors name and telephone number; services and/or goods to be provided. Please also include the actual dollar amount to be subcontracted. Insurance Requirements Vendor shall maintain the following insurance coverage during the Term and for one (1) year thereafter except as otherwise noted. All such insurance required in Section shall be placed with an insurance carrier possessing an A- VIII rating or better as listed in the A.M. Best Guide. Vendor shall furnish TG with certificates of insurance evidencing: Workers' Compensation. Workers' Compensation insurance as required by applicable law. Employer's Liability. Employer's Liability insurance with limits of $1,000,000 each accident / $1,000,000 disease each employee / $1,000,000 disease limit with respect to any employee, of Vendor performing Services for TG. Commercial Auto Liability. Automobile liability insurance (including owned (if applicable), non-owned, and hired autos) with a minimum limit of $1,000,000, combined single limit per accident. Commercial General Liability. Commercial General Liability, including products/completed operations, personal injury (without limitation), blanket contractual liability and broad form property damage, with $1,000,000 per occurrence, $1,000,000 Personal Injury/Advertising Liability, $2,000,000 Products/Completed Operations Aggregate, $2,000,000 General Aggregate limits of liability. Vendor's insurance will be primary and not contributory in order to protect TG and Vendor from claims for bodily injury (including death resulting there from), personal injury and/or property damage which may arise from or in connection with Vendor's performance of or failure to perform its obligations under this Agreement; Commercial Crime with 3 rd party coverage, with an endorsement naming TG as an insured. Commercial Crime insurance, which includes employee dishonesty and computer fraud as well as third party coverage (aka known as client property coverage or property of others coverage) for dishonest acts, committed by Vendor s employees with limits not less than $1,000,000 for each loss, $2,000,000 aggregate. Electronic Data Processing/Service Provider Professional Liability / Errors and Omission. Professional Liability / Errors and Omissions coverage, which shall include coverage for, but not be limited to: loss or damage resulting from errors and omissions, advertising injury, personal injury (including invasion of privacy), intellectual property offenses related to electronic data services, software, internet, network and e-business activities, malicious code, attack, programming error and theft, disclosure or damage of electronic data, claims of code misappropriation, code theft, and copyright/trademark infringement with a limit of no less than $5,000,000 per claim. Coverage must respond to the acts of rogue employees, and Umbrella Liability Coverage. Umbrella Liability coverage with not less than $5,000,000 per occurrence. Insurance Certificate. The description section on the certificate of insurance will include the following: Texas Guaranteed Student Loan Corporation and its subsidiaries and affiliates

6 and their respective officers, directors and employees are named as additional insured on the required commercial general liability, commercial auto liability and umbrella liability policies; and is provided a waiver by insurer's of any subrogation rights under the General Liability, Auto, Workers Compensation and Umbrella policies. Provide copies of these endorsements. Coverage Trigger: The general liability and umbrella liability policies will be written on an occurrence form. The professional/errors and commission policy can be written on a claimsmade or claims made and reported basis. For policies written on a claim made basis, the retroactive/prior acts date must be subsequent to the date the service agreement is executed. Coverage will be maintained during the active term of services. If coverage is cancelled after the active engagement of services, tail coverage will be marinated for a minimum of five years after the termination of this service agreement. Primary Insurance. Vendor insurance shall be primary with no right of contribution by TG or their respective insurers. Vendor shall be solely and fully responsible for any deductibles or self-insured retentions under any required coverage, and will declare any deductibles or self-insured retentions that are in excess of $100,000. Insurance Procedures. A certificate of insurance evidencing all required coverage under this agreement will be provided prior to the commencement of Services under this Agreement and while this Agreement remains in effect, evidence of renewal coverage will be provided within ten (10) days of the expiration date of such coverage. All required coverage will not be subject to cancellation, non-renewal or material change without thirty (30) days prior written notice. The policy period for all such required insurance shall coincide with the term of this Agreement. Vendor will provide to TG certificates of insurance evidencing its compliance with this provision. All certificates shall be mailed to: TG. Vendor will also provide TG, prior to the execution and final approval of this agreement, a full copy of the professional/errors and omission policy and general liability coverage form and endorsement which are subject to TG review and approval. Liability. Vendor shall be liable for any insurance obligations required under this agreement and which are not satisfied; however, these minimum insurance requirements shall in no way restrict or reduce Vendor s liability under this Agreement, including without limitation, Vendor s indemnity obligations. Bid Submission and Award Late quotes will not be accepted. Quotes must be held open for ninety (90) days from proposal due time/date. TG reserves the right to accept or reject all quotes. Pricing must be submitted on the form or format provided. Failure to sign quote may result in disqualification. Award of contract may be made without discussion with Bidders after quotes are received. Any amendment issued regarding this solicitation must be signed and returned by the specified time/date. All amendment(s) or clarification(s) issued regarding this solicitation will be posted on TG s website.

7 Contractor must comply with all laws, ordinances, regulations, orders and directives issued by any regulatory or enforcement agency having jurisdiction. All prices must be fully burdened and inclusive of all services and materials required to complete the project as well as freight and delivery. Travel will be per General Services Administration travel rates and per diem. Once the Successful Bidder is selected, all travel within the course of this project will be approved [in writing] by the TG Point of Contact prior to actual travel, unless otherwise noted within the actual contract between TG and the Successful Bidder. TG has been designated by the Internal Revenue Service as being a tax exempt organization. TG can provide documentation upon request. Pricing: Provide pricing information in U.S. dollars ($). Quoted pricing must be complete and indicative of all charges to be applied. List or otherwise indicate separately, utilizing a separate page (attaching it to this attachment), any components associated with each charge or fee. TG desires pricing for a one-time engagement described here-in. Network Testing Hours Rate Extended Cost Web Testing Please specify any other costs that are associated with your quotation for providing said services. SUPPLIER INFORMATION By completing and signing this form and signing below, supplier confirms that pricing is valid for no less than ninety (90) days of date provided below and that the supplier adheres to TG s terms and conditions. Company Address Phone Fax Federal Identification Number Please have authorized personnel write/print, sign and date in the spaces provided below indicating agreement with terms and conditions and authority to submit pricing. Print Signature

8 Company Name Date This page must be signed and returned. disqualification. Failure to sign quote may result in SUBMITTALS Please examine the Solicitation, the Statement of Work, and all other parts of this solicitation, whether incorporated by reference or otherwise, prior to the submission of an offer. Failure to do so shall be at the Bidder s risk.