Punjab National Bank. Request For Proposal

Transcription

1 Punjab National Bank Request For Proposal Supply & installation of Data Loss / Leakage Prevention Solution for Mail Messaging System Information Technology Division I.T Procurement Department Head Office, 5 Sansad Marg, New Delhi Tel: (011) Extn: 228, 233, 234,408 Fax: (011) Page 1 of 52

2 DISCLAIMER The information contained in this Request for Proposal Document (RFP Document) or subsequently provided to Bidder/s, whether verbally or in documentary form by or on behalf of the Punjab National Bank or any of their representatives, employees or advisors (collectively referred to as Bank Representatives), is provided to Bidder(s) on the terms and conditions set out in this RFP Document and any other terms and conditions subject to which such information is provided. This RFP Document is not an agreement and is not an offer or invitation by the Bank Representatives to any party other than the entities who are qualified to submit their Proposal (Bidders). The purpose of this RFP Document is to provide the Bidder with information to assist the formulation of their Proposal. This RFP Document does not purport to contain all the information each Bidder may require. This RFP Document may not be appropriate for all persons, and it is not possible for the Bank Representatives, their employees or advisors to consider the investment objectives, financial situation and particular needs of each party who reads or uses this RFP Document. Each Bidder should conduct their own investigations and analysis and should check the accuracy, reliability and completeness of the information in this RFP Document and wherever necessary, obtain independent advice from appropriate sources. The Bank Representatives, their employees and advisors make no representation or warranty and shall incur no liability under any law, statute, rules or regulations as to the accuracy, reliability or completeness of the RFP Document. The Bank Representatives may in their absolute discretion, but without being under any obligation to do so, update, amend or supplement the information in this RFP Document. Page 2 of 52

3 The contents of RFP document are briefed under Sl. Contents of the RFP Document Page No. No 1. General Tender Details Introduction Eligibility Criteria Requirements/Scope of Work Instructions to Bidders Terms and conditions Annexure I Eligibility Criteria Annexure II Bidder s Information Annexure III Details of offered solution Annexure IV Reference Site Annexure V Compliance Statement Annexure VI Technical Specifications/Requirements/Scope of Work Compliance Annexure VII 13. Additional Features and functionalities and other 44 technical details of the solution offered Annexure VIII 14. Details of technical Support Centers Annexure IX Format for Commercial Bid Annexure X Bidder s undertaking letter- Annexure XI & Annexure XII 48 & Check list contents of documents to be submitted--xiii Performa for the Bank Guarantee for Earnest Money Deposit Annexure XIV Page 3 of 52

4 1. GENERAL TENDER DETAILS RFP for Supply & installation of Data Loss/Leakage Prevention solution for Mail Messaging System for Punjab National Bank 1. Date of commencement of 18/04/2015 Bidding Process. 2. Last date and time for sale 18/05/2015 up to 16.00hrs of Bidding Documents 3. Pre Bid Meeting 01/05/2015, 11:00hrs 4. Last date and time for 28/04/2015, 17:00hrs receipt of queries from bidder for Clarifications 5. Last date and time for Hash 18/05/2015, 16:00hrs submission 6. Last date and time for online 19/05/2015, 14:00hrs bid submission 7. Date and Time of Technical Please refer Tender Schedule Bid Opening 8. Place of opening of Bids Punjab National Bank, Information Technology Division, Head Office, 5- Sansad Marg, New Delhi Address for communication As above Tel:(011) / Fax:(011) Cost of RFP Rs.10000/- (Non refundable) should be submitted online only in favour of Punjab National Bank on or before last date of bid submission in the following account: 11. Earnest Money Deposit (EMD) IFSC Code : PUNB Bank & Branch : Punjab National Bank, Sansad Marg, New Delhi Account No.: ( 16 digits) Imprest account HO IT Division Rs.10,00,000/- (Rs. Ten Lacs Only) should be submitted online on or before last date and time of bid submission or in the form of Bank Guarantee (as per specified Performa, Annexure (XIV) in favour of Punjab National Bank, IT Division at New Delhi. BG should be valid for a period of 6 Months from the date of submission of bid. IFSC Code : PUNB Bank & Branch : Punjab National Bank, Sansad Marg, New Delhi Account No.: ( 16 digits) Imprest account HO IT Division 12. Contact to Bidders Interested Bidders are requested to send the to itdhw@pnb.co.in; mkm@pnb.co.in; Sateesh@pnb.co.in containing following information, so that in case of any clarification same may be conveyed to them. Page 4 of 52

5 Name of company, contact person, mailing address with Pin Code, Telephone No., Fax No., address, Mobile No. etc. Note: 1) Technical Bids will be opened online as well as in physical form but Commercial bid will be opened online only; Bidders may view the details through their terminal using their e-procurement [ registration login. 2) Vendors, who have not registered earlier with e-procurement site, would have to register with our e-procurement site. 3) All the technical supporting documents should be given in physical form only. Page 5 of 52

6 2. INTRODUCTION With over 82 million satisfied customers and around branches/offices geographically located at around 3000 centers all across India. The bank enjoys strong fundamentals, large franchise value and good brand image. Besides being ranked as one of India's top service brands, PNB has remained fully committed to its guiding principles of sound and prudent banking. Apart from offering banking products, the bank has also entered the credit card & debit card business; bullion business; insurance business & asset management business, etc. Since its humble beginning in 1895 with the distinction of being the first Indian bank to have been started with Indian capital, PNB has achieved significant growth both in branch network and in business. PNB has the 2nd largest network of branches (of around 6500 Service Outlets) among Indian banks. PNB has sponsored five Regional Rural Banks (RRBs) in order to mobilize financial resources from rural/ semi-urban areas and grant loans and advances mostly to small and marginal farmers, agricultural laborers and rural artisans. The area of operation of RRBs is limited to the area as notified by Government of India covering one or more districts in the State. Keeping in tune with changing times and to provide its customers more efficient and speedy service, the Bank has taken major initiative in the field of computerization. Bank is using Exchange 2010 as Mail Messaging System at all the offices/branches. The entire Mail Messaging system is installed centrally at Data Center located at New Delhi. Presently, approximately 1,00,000 mails are being sent across the existing mail setup on day to day basis. This has effectively improved communication across the Bank. PURPOSE OF THE RFP To ensure effective, convenient and secured communication across the Bank comparable to the best in the industry, Punjab National Bank invites proposals (technical and commercial) from bidders for Supply & installation of Data Loss/Leakage Prevention solution for Mail Messaging System for Punjab National Bank at Bank s Data Centre Delhi. Bank intends to implement Data Loss/Leakage Prevention (DLP) solution for Mail Messaging System for users (scalable upto users) to prevent the loss of confidential Bank data / Bank customer information that could leak out of the Bank and would enable bank to reduce the corporate risk of the unintentional or intentional disclosure of confidential information. Bank desires to select a vendor for supply & installation of Data Loss/Leakage Prevention solution for at their office in Delhi. Bidder who is interested in participating in this RFP must be in a position to supply, install & manage Data Loss/Leakage Prevention solution as per the technical specification of Data Loss/Leakage Prevention solution module specified in RFP. The Bidder is also required to install, configure & provide comprehensive onsite warranty & AMC /ATS services for the same over the tenure of the contract. Page 6 of 52

7 Existing Mail Messaging System setup in PNB Design Description: As per the solution design, following Microsoft components are deployed in PNB Active Directory: Active Directory servers are deployed in domain in primary Datacenter & One Additional Domain Controller based on Windows Server 2008 R2. Exchange Server 2010SP2: Four Exchange 2010SP2 Servers are configured with Four Mailbox Servers in DAG, Three servers with HUB & CAS roles collocated in Windows NLB. Active Directory In PNB, Active Directory is installed in Single Forest Domain model with domain name MAIL.PNB.CO.IN and users with approximately 1,00,000 mails in/out flow per day. Page 7 of 52

8 3. ELIGIBILITY CRITERIA Only those Bidders who fulfill the following criteria are eligible to respond to the RFP. Offers received from the Bidders who do not fulfill any of the following eligibility criteria are liable to be rejected. The bidder must fulfill the criteria mentioned below in order to bid: Sl. No. Eligibility Criterion 3.1 The bidder should be a registered company in INDIA as per the Companies Act or have its registered office within the jurisdiction of INDIA. The bidder should not be an individual/ proprietary concern/ HUF etc. the bidder may be a government organization / public sector unit / partnership firm / Limited Company / Private Limited Company having its Registered office in India. Relevant documents of the same are to be submitted. 3.2 Bidder should be OEM of the offered solution or an authorized partner of OEM. In case the bidder is not OEM of the offered solution, then a certificate from OEM certifying that in case the authorized distributor (bidder) is not able to perform obligations as per contract during contract period, the OEM shall ensure continuity of the services directly or through authorized partner In such cases, the mandate/authority of the official signing the letter of OEM of offered solution in favour of Bidder company should be clearly specified. 3.3 Each bidder should submit only one bid for Data Loss/Leakage Prevention solution for Mail Messaging System. In case, it is observed that bidder has submitted more than one bid, all such bids submitted by bidder will be summarily rejected. 3.4 Either the Indian agent on behalf of the Principal / OEM or Principal / OEM itself can bid however both cannot bid simultaneously for the same solution. In case it is observed that the Indian agent on behalf of the Principal / OEM and Principal / OEM itself have simultaneously submitted the bid for same solution, then all such bids will be rejected. Further, if the OEM is the Bidder then the OEM can only bid for own solution only. 3.5 Bidder should have Positive Net Worth as per the Audited Balance Sheet of financial year The bidder should be in operating profit (profit before tax and interest) for last 3.6 three financial years i.e , & Bidder should have minimum turnover of Rs. 20 Crores in each financial Year , & as per the audited Balance Sheet. 3.8 The bidder should have technical support center in India. Page 8 of 52

9 Sl. Eligibility Criterion No. 3.9 The proposed solution should have been successfully implemented by the OEM/Bidder in atleast two organizations in BFSI segment and the proposed DLP solution should also be implemented in atleast one of the Banks in India within last two years (i.e before the date of submission of RFP) and should have been running successfully for more than 1 year Bidder should not have been black listed at any time by the Government / Government agency / Banks / Financial Institutions in India. Self Certificate/Undertaking is to be provided The bidder should not be involved in any litigation which threatens solvency of company. Undertaking is to be provided by company auditor The bidder should have presence for effective support and resolution of escalated queries within stipulated SLAs at Delhi, Mumbai and major cities in India 3.13 The proposed solution should have published/ declared product support life cycle for next 5 years Bidder must warrant that key project personnel (certified solution experts) to be deployed in this project have been sufficiently involved in similar projects in the past Bidder should provide Satisfactory Performance Certificate from at least 2 Clients referred in their proposal. Page 9 of 52

10 4. REQUIREMENTS/ SCOPE OF WORK Sl. No Requirements/Technical Specifications Requirements from the Bidder/OEM Support for the Solution: OEM and bidder both will have to guarantee availability of support including future upgrades for all components of the solution, without any exception, for a minimum period of 3 years from the date of going live, Bank may extend the contract for a further period of 2 year (1 Year + 1 Year) or any other period subject to satisfactory performance of vendor at the Bank s discretion. In case of takeover/amalgamation/merger of bidder with any other entity, the Service level agreements (SLAs) and other commitments entered into will be continued at the same terms and conditions of the SLA. Immediately after the launch of new versions of solution, bidder will install the same at Bank s site within 2 months and without interrupting the running solution and without any cost to the Bank. Onsite Technical Support: Successful Bidder will install/implement the solution at Bank s premises and may also be asked to provide Onsite Technical Support resource as per requirement of the Bank who would operate from Bank s location in Delhi to provide technical support with regard to the offered solution as per requirement of the bank. Support for application version / hardware-cum-software infrastructure upgrade: The successful bidder should be able to monitor complete environment of Bank s mail messaging applications during the entire contract period. In case of application version/hardware-cum-software infrastructure upgrade of mail messaging applications, the successful bidder should be able to integrate the solution to the new/upgraded version of respective applications and/or hardwarecum-software infrastructure within 2 months of up gradation while ensuring continuation of services during up gradation/migration. Training to bank employees: Successful Bidder will impart requisite operational training of the offered solution to Bank officials. The successful Bidder will involve Bank s nominated officials during installation and implementation of the solution. The selected Bidder will provide comprehensive training to Bank s nominated team on all aspects of solution including but not limited to system fundamentals, Operating Systems, application software, policy management, policy deployment, policy customization, databases, fault diagnosis and first line support etc. The training must enable Bank s staff to maintain the Solution with minimal support from the bidder. The training must be provided on site. Training manuals/cds must be provided along with the software documentation/ manuals/cds. Architecture: Bidder should provide details of architecture of the proposed solution containing complete details of specifications of components of proposed solution. Uptime & Availability: The Successful Bidder is expected to maintain 99.5% uptime and availability of its solution and services excluding planned maintenance. Excess downtime in providing monitoring services will attract penalty as explained in the RFP. The solution so provided must have high availability. Data security and confidentiality: Bidder to ensure no unwarranted, illegal, and fraudulent misuse of data shared by the Bank and Bidder to categorically indemnify the Bank against any losses that the Bank may suffer on account of any such fraudulent and illegal act by the Company or its employees (including ex-employees). Solution should provide for built-in/pre defined policies/templates for multiple industries and geographies, and can be accessed, used, and applied Page 10 of 52

11 simultaneously.solution that provides content, context, and destination awareness, allowing administrators to manage who can send what information where and how. Administrators should be able to build effective and flexible policies that enforce 9 regulatory compliance and protect against data loss. The proposed DLP solution should have central web-based management console and incident repository that is used across all Data Loss Prevention products. PNB administrators shall use this console to define, deploy, and enforce data loss policies, respond to incidents, analyze and report policy violations, and perform 10 system administration. The proposed DLP solution shall provide a single DLP solution management and policy creation interface for all DLP components. The product shall come with predefined policies which could be used to create new ones. Also the solution should be 11 able to create new policies as per Bank s requirements. The proposed DLP solution shall have extensive reporting and auditing capabilities. The solution should also provide out of box options to integrate with external Security and Incident Management system as well as provide customized reports and 12 notifications. The proposed DLP solution shall provide incident notification as well as escalation workflows for unattended incidents. The incident workflow should be configurable within the DLP system. The incident management configuration should be capable of querying the corporate LDAP directly to configure the user to be notified for each 13 incident. The proposed DLP solution shall have configurable different actions based on the user context and risk level associated with a particular data match and Identify high 14 risk employees by identifying activities that are indicative of data theft. The proposed DLP should block, quarantine or relocate containing sensitive 15 data to a secure location for administrator review and release The proposed DLP solution should allow processing of traffic based on the matched content in the form of blocking the mail, inserting X-headers or just 16 quarantining the mail 17 The proposed DLP solution should scales to thousands of PNB network users. The proposed DLP solution should allow user to initiate remediation actions such as releasing the message from quarantine, deleting the message, encrypting the 18 message, or performing other actions. The proposed solution should have advanced content filtering and data loss prevention technologies that protect and control sensitive data. The solution should 19 enforce policies to detect low and slow data leaks The proposed solution should act as an enforcement point for the proposed DLP solution, giving PNB ability to monitor and protect sensitive information being 20 communicated over mail SMTP and HTTP/s mails. Solution should have wizards to perform fingerprinting both structured and 21 unstructured data The DLP classification shall be based on various identification mechanisms including but not restricted to regular expressions, keywords and phrases, dictionaries, reusable entities to detect patterns, full and partial fingerprinting, using weightage as 22 well counting of detected parameters The proposed solution must be able to Integrate with any SMTP-compliant MTA and shall be deployed in either a reflecting (single MTA) or forwarding (multiple MTA) 23 architecture. The solution should allow DLP team to define DLP related reference extracted from documentation of legislations, regulations, industry standards such as ISO 27001:2013, IT Act 2008, PCI DSS, Basel II, RBI Regulations, COBIT, ITIL etc with 24 reference to DLP in a portal. These references should be mapped with current state Page 11 of 52

12 of DLP project and highlight non compliance if any System should provide a method for fingerprinting documents such as doc, excel, 25 pdf or merger and acquisitions documents or any confidential documents. Solution should have method of detecting fingerprinted documents support detection of the same text or portions of text in different file formats or any kind of manipulation. For example, if a fingerprinted document is in Microsoft Word format, then system should detect that same text that has been cut and pasted directly into 26 an . Solution should be capable to send automatic alert via to source & automated 27 work-flow. System should support the ability to automatically notify senders or their managers 28 when a policy has been violated. Solution should have feature to view identity information on the sender from AD and destination of the transmission (e.g., data sent to a blog, chat board, spyware site 29 etc) for web channels. The solution should have the capability to define bank specific information technology/ information security policies over and above the DLP policies. The solution should have the capability to map the policies to the reference 30 documentation mentioned above The solution must be present in the latest Gartner s leader quadrant for Data Loss 31 Prevention for 2 preceding years Solution should have option to create separate roles for technical administration of servers, user administration, policy creation and editing, incident remediation, and 32 incident viewing for data at rest, in motion. The solution should have performance capability of processing at least 50, message per hour. Solution should have capability to analyze text inside image with the help of OCR. Also, recognize sensitive data hidden in images, scanned documents and screen 34 shots Solution should allow users to perform keyword searches to quickly find specific information among various policies. Users need not necessarily know the policy names to find such information eg: incidents triggered at specific day of the month 35 can be easily tracked The solution should be compatible with all the leading anti-spam gateways and 36 incident and event management tools 37 The solution should have to ability to identify corporate specific financial information 38 The solution should detect on patterns in binary file types The solution should have Pre-Built Content Definitions (ex: PCI, etc.) Keywords, regex, entities, dictionaries with Contextual Criteria, Proximity Criteria, Weighting 39 Criteria The solution should detect and validate a wide range of sensitive data types (e.g., 40 UIDs, CCNs) The solution should detect classified Proprietary File types (types that are not 41 predefined) and on file content not on file extensions The solution should have the ability to detect Encrypted Files and Password 42 protected files The solution should create policies that support detection and prevention of full 43 Boolean expression for keywords/patterns (not just and/or) The solution should have the ability to build custom policy definition based upon File type (extension and true file type), Network Destination sender/recipient IP and/or address, Transmission attributes, protocol types, AD user and groups, content 44 type, Risk and Severity Page 12 of 52

13 The solution should provide directory based policies to selectively monitor downloads based on user, business units, or directory groups, specific groups of computers and specific groups of users The solution should have the ability to detect sensitive content within SMTP including attachments. The Bidder should offer a comprehensive gateway level Data Loss/Leakage Solution for Data Protection Offered solution should have facility of storage and backup of data and other records for backup as well as for forensics purpose for six months. The Monitoring and Discovery capabilities should be separate preferably with storage capabilities. The solution should be capable of defining DLP Policy based on content, sender/recipient, file characteristics, and communications protocol The solution should allow creation of policies based on Metadata of files such as share/repository/date created, etc Events generated by the solution should be able to retain source IP address, destination IP address, protocol, port, sender/recipient address, recipient e- mail address Solution should be able to identify and store all event data with appropriate metadata(date/time, user, protocol) In case of Policy violation the solution should be able to retain all content/attachments in the transaction, not just the content that violated policy Solution should be able to display and highlight a summary content that violated the policy for any incident 56 Solution should provide an in built case management tool Solution should be able to Store and index event data for faster search even after the 57 incident has happened. Solution should be capable to search any traffic/ sent out on the basis of violation irrespective of: IP Address, URL, Ports & Protocols, document types, 58 keywords, hashes as configured in system. Reports built around stakeholder requirements should be easily created in the 59 solution Solution should allow export historical records from all traffic/content analyzed by the 60 DLP system. The solution should provide option to Preserve Last Access Time after scanning in 61 order to maintain archive sanctity Solution should have a dashboard view designed for use by executives that can 62 combine information in a single view. The OEM should take ownership of deployment and directly provide highest 63 premium support offering 24 * 7 * 365 for the solution during the contract period. Solution should be able to monitor / block the mails syncing with the mobile 64 through Active Sync. Bidder should provide DLP Administrator in two shifts per day for day to day DLP policy administration and incident/event management from 8 am till 8 pm, six days a week and/or as per requirement of the Bank and telephonic support on holidays and weekdays from 8 pm to 8 am. These resources will assess Bank s current policies, review them based on the history of data and accordingly classify data and redefine the policy on ongoing basis. The resource will provide complete support for DLP solution (including support for appliances / hardware / software / policies creation & 65 customization / reporting etc) Solution should allow designated business users to define business policies in the 66 portal environment, same policies should be accessible to DLP resource and Page 13 of 52

14 67 68 administrators so that they can manage and audit policies made by business owners. The solution should have the capability to manage DLP policy lifecycle from creation to decommissioning Solution should track version control for each of the DLP policies including but not limited to: author, reviewer, approver details, dates for creation/update, review and approval, version number, reason for change etc. 69 Solution should enforce periodic policy review and expiration 70 The OEM should have own TAC centre in India. The proposed solution should be able to provide real time data identifiers to detect and prevent sensitive information getting stolen by malware through web and channel. Solution should have pre-built signatures to detect information leaks through malware.(predefined policies to detect malware threads malware 71 communication or malware data theft) The proposed solution should be able to integrate with DR Mail setup in future as per 72 Bank s requirement. 5. INSTRUCTIONS TO BIDDERS 5.1 COST OF BIDDING The Bidder shall bear all the costs associated with the preparation and submission of its bid and Bank, will in no case be responsible or liable for these costs, regardless of the conduct or outcome of the bidding process. 5.2 BIDDING DOCUMENT The Bidder is expected to examine all instructions, forms, terms and conditions in the Bidding Documents. Failure to furnish all information required by the Bidding Documents or submission of a bid not substantially responsive to the Bidding Documents in every respect will be at the Bidders risk and may result in the rejection of its bid without any further reference to the bidder. Bidder should strictly submit the bid as per RFP failing which bid will be rejected as nonresponsive. 5.3 AUTHENTICATION OF ERASURES/ OVERWRITING ETC Any inter-lineation, erasures, or overwriting shall be valid only if the person(s) signing the bid initial(s) them. 5.4 AMENDMENT OF BIDDING DOCUMENTS At any time prior to the last Date and Time for submission of bids, the Bank may, for any reason, modify the Bidding Documents through amendments at the sole discretion of the Bank. All amendments shall be uploaded on the Bank s websites ( and ) and will be binding on all who are interested in bidding. In order to provide prospective Bidders a reasonable time to take the amendment if any, into account in preparing their bid, the Bank may, at its discretion, extend the deadline for submission of bids. 5.5 CONTACTING THE BANK Any effort by a bidder to influence the Bank in evaluation of the bid, bid comparison or contract award decision may result in the rejection of the Bidders' Page 14 of 52

15 bid. Bank's decision will be final and without prejudice and will be binding on all parties. 5.6 BANK S RIGHT TO ACCEPT OR REJECT ANY BID OR ALL BIDS The Bank reserves the right to accept or reject any bid and annul the bidding process or even reject all bids at any time prior to award of contract, without thereby incurring any liability to the affected bidder or bidders or without any obligation to inform the affected bidder or bidders about the grounds for the bank's action. The bank reserves the right to accept or reject any technology proposed by the bidder. The bank reserves the right to select more than one bidder keeping in view its large requirements. 5.7 MODIFICATION AND WITHDRAWAL Bids once submitted will be treated, as final and no further correspondence will be entertained on this. No bid will allowed to be modified after the submission of bid. No bidder shall be allowed to withdraw the bid, if bidder happens to be successful bidder. 5.8 REVELATION OF PRICES The prices in any form or by any reasons should not be disclosed in the technical or other parts of the bid except in the commercial bid. Failure to do so will make the bid liable to be rejected. 5.9 TERMS AND CONDITIONS OF THE BIDDING FIRMS The bidding firms are not allowed to impose their own terms and conditions to the bid and if submitted will not be considered as forming part of their bids. Bidder has to strictly comply with the terms and conditions mentioned in the RFP POWER OF ATTORNEY OR RESOLUTION COPY In case of company, Board Resolution in favour of authorized person and Power of Attorney in case the authorized person delegates authority to another person of the company to sign the Bid documents is to be submitted with bid documents LOCAL CONDITIONS The bidder must acquaint himself with the local conditions and factors, which may have any effect on the performance of the contract and / or the cost CLARIFICATIONS OF BIDS To assist in the examination, evaluation and comparison of bids the bank may, at its discretion, ask the bidder for clarification. The response should be in writing and no change in the price or substance of the bid shall be sought, offered or permitted. Page 15 of 52

16 5.13 BID EARNEST MONEY Bidder has to submit the Bid Earnest Money of Rs Lac in the form of Pay Order/Demand Draft/BG as per Annexure (XIV) for the period of 6 months favoring PUNJAB NATIONAL BANK, IT DIVISION payable at Delhi and filling all the details in the format available for the same in our e-procurement system at website In case of unsuccessful bidder, EMD will be returned on completion of tender process and no interest will be payable on EMD amount. The EMD will be returned to the successful bidder upon submission of Performance Bank Guarantee DEADLINE FOR SUBMISSION OF BIDS Bids must be submitted not later than the specified date and time mentioned in the Bid Document. If specified date of submission of bids being declared a holiday for the Bank, the bids will be received up to the specified time in the next working day. The Bank may, at its discretion, extend this deadline for submission of bids by amending the bid documents, in which case all rights and obligations of the Bank and bidders, previously subject to the deadline, will thereafter be subject to the deadline extended PERIOD OF VALIDITY OF BIDS Bid shall remain valid for 6 Months from last date of submission of bid prescribed by Bank. A bid valid for shorter period is liable to be rejected by Bank. The bidders may be required to give consent for the extension of the period of validity of the bid, if so desired by Bank in writing or by fax. Refusal of such consent would not forfeit the Bid Security and granting of request will not allow the bidder to revise/ modify his bid LATE BIDS Any bid received by the Bank after the deadline for submission of bid will be rejected BID CURRENCY The Prices in the bid document shall be expressed in Indian Rupees (INR) only LANGUAGE OF BID The bids prepared by the bidder and all correspondence and document relating to the bids exchanged by the bidder and Bank, shall be written in English BIDDING PROCESS (TWO STAGES) For the purpose of the present job, a two-stage bidding process will be followed. The response to the present tender will be submitted in two parts: Technical bid (Part-l) Commercial bid (Part-ll) Page 16 of 52

17 The bidders will have to submit the technical bid in banks e-procurement system as well as in hard copy and commercial bids in only online form through bank s e-procurement system. TECHNICAL BID (Part I) The bidder will have to submit the technical supporting document in sealed envelopes, duly super scribing RFP for Data Loss/Leakage Prevention solution for Mail Messaging System. Technical supporting document will also contain all the documents (including Annexures) as per RFP document. All the Annexures should be duly signed and sealed. TECHNICAL SUPPORTING DOCUMENTS will NOT contain any pricing or commercial information at all. Technical supporting documents with any commercial information will be rejected. In the first stage, only TECHNICAL BIDs will be opened and evaluated. Only those bidders satisfying the technical requirements as determined by the Bank and accepting the terms and conditions of this document shall be short-listed for next stage of evaluation. The bid shall contain no interlineations, erasures or over writing except as necessary to correct errors made by the Bidder, in which case such corrections shall be duly confirmed under signature/initials of the person(s) signing the bid. COMMERCIAL BID (Part II) Under the second stage, the COMMERCIAL BID of only those bidders, whose technical bids are responsive, will be opened. Commercial bids should be submitted in online form only through bank s e-procurement system SUBMISSION OF BIDS Bidders are required to strictly submit their bids in electronic form using the e- procurement system at the Bank by using their digital certificates of authorized signatory as per the Board resolution. Digital Certificate should be class II and above (both encryption and signing). All the interested bidders should register themselves in the e-procurement system for submitting the bids online, if they have not done earlier. The RFP document and further corrigendum, if any can also be downloaded from bank s website Bids received after closing of the bid in the e-procurement system are summarily rejected without any reason. The commercial bid should be submitted online only. All the technical supporting documents should be submitted manually before the final date & time of bid submission at the following address - The Chief Manager Punjab National Bank, IT Procurement Department, I.T. Division, HO: 5 Sansad Marg, New Delhi Page 17 of 52

18 At the time of physical submission of bid, bidder has to show acknowledgement received after completion of the bid submission in proof of having submitted the bid online OPENING OF BIDS All the bids will be opened at the date, time and locations mentioned in RFP (as per tender schedule). The technical bids will be opened in the presence of representatives of the bidders who choose to attend. The date and time of bid opening will be intimated to bidders after last date of submission separately. The bidders names, modifications, bid withdrawal and the presence or absence of requisite Bid Security and such other details, as Bank at their discretion, may consider appropriate will be announced at the bid opening 5.22 PRELIMINARY EXAMINATION The Bank will examine the bids to determine whether they are complete, whether any computational errors have been made, whether required information has been provided as underlined in the bid document, whether the documents have been properly signed, and whether bids are generally in order. The bid determined is not in order as per the specifications will be rejected by the Bank EVALUATION AND AWARD CRITERIA After opening of the technical bids, all the documents and annexure (except commercial documents/offer) will be evaluated first by the bank. First, received bids will be evaluated based on the eligibility criteria. Technical bids of only those bidders satisfying the eligibility criteria will be evaluated. Only those bidders satisfying the technical requirements and accepting the terms and conditions of this document shall be short-listed for further steps. Technically qualified and successful bidders may be called to make presentation of the solution offered by them as per the schedule decided by PNB. PNB may also visit and inspect the onsite / development centers and other installation of the bidders. PNB will determine to their satisfaction whether the bidder selected as having submitted the best evaluated responsive bid is qualified to satisfactorily perform the contract. The decision of PNB will be final in this regard. The determination will take into account bidder s financial, technical and support capabilities, based on an examination of documentary evidence submitted by bidders. The commercial bids for only those bidders will be opened who have qualified on the basis of technical evaluation and reviewed to determine whether the commercial bids are substantially responsive. Commercial bids that are not substantially responsive are liable to be disqualified at PNB s discretion. Page 18 of 52

19 The award of contract will be based on evaluation of technical and commercial bids. The L1 price for the awarded contract will be decided as per reverse auction 5.24 REVERSE AUCTION Bank may hold Reverse Auction in the event of 2 or more bidders are technically eligible. The procedure for the same is available on our e-procurement website. It will be mandatory for all the bidders to quote rates of all optional components that may be required. a) Price Variation Factor If a bidder quoting higher prices, higher by more than 40% as compared to the average quoted prices (of all technically qualified bidders) for all items in aggregate, the same bidder shall not be called for reverse auction process. b) Procedure for Finalizing L1 Vendor : The L-1 bidder will be decided on the least price mentioned in commercial offer Annexure X. The L1 bidder has to perform the POC and if it is found technically not acceptable then firm order will not be placed. In case the POC of L1 is not technically acceptable, then L2 has to match the price of L1 and conduct POC. In case the POC of L2 is also not technically acceptable, then L3 has to match the price of L1 and conduct POC and so on 5.25 CONTACTING Bank OR PUTTING OUTSIDE INFLUENCE Bidders are forbidden to contact Bank or its Consultants on any matter relating to this bid from the time of submission of commercial bid to the time the contract is awarded. Any effort on the part of the bidder to influence bid evaluation process, or contract award decision may result in the rejection of the bid VERIFICATION OF REFERENCE INSTALLATIONS/ IMPLEMENTATIONS Bank may, if deemed necessary, conduct verification of reference implementation to satisfy themselves on the performance of the solution/services offered with reference to their requirements CANCELLATION OF BID/ BIDDING PROCESS Bank reserves the right to accept or reject any bid and annul the bidding process and reject all bids at any time prior to award of contract, without thereby incurring any liability to the affected bidder or bidders or any obligation to inform the affected bidder or bidders of the ground for its action ASSIGNMENTS The bidder shall not assign to anyone, in whole or in part, it s obligations to perform under the contract, except with the Bank s prior written consent. Page 19 of 52

20 5.29 NON DISCLOSURE By virtue of Contract, as and when it is entered into between the Bank and the successful bidder, and its implementation thereof, the Successful Bidder may have access to the Confidential Information and data of the Bank and its customers. The Successful Bidder will enter into a Non-Disclosure Agreement to maintain the secrecy of Bank s data as per following: a) That the Successful Bidder will treat the Information as confidential and shall not disclose to any third party. The Successful Bidder will also agree that its employees, agents, sub-contractors shall maintain Confidentiality of the Confidential Information. b) That the Successful Bidder will agree that it shall neither use, nor reproduce for use in any way, any Confidential Information of the Bank without consent of the Bank. That the Successful Bidder will also agree to protect the Confidential Information of the Bank with at least the same standard of care and procedures used by them to protect its own confidential Information of similar importance. Without limitation of the foregoing, the Successful Bidder shall use reasonable efforts to advise the Bank immediately in the event that the Successful Bidder learns or has reason to believe that any person who has had access to Confidential Information has violated or intends to violate the terms of the Contract to be entered into between the Bank and the Successful Bidder, and will reasonably cooperate in seeking injunctive relieve against any such person. c) That if the Successful Bidder hires another person to assist it in the performance of its obligations under the Contract, or assigns any portion of its rights or delegates any portion of its responsibilities or obligations under the Contract to another person, it shall cause its assignee or delegate to be bound to retain the confidentiality of the Confidential Information in the same manner as the Vendor is bound to maintain the confidentiality. This Clause will remain valid even after the termination or expiry of this agreement. d) That the Successful Bidder will strictly maintain the secrecy of Bank s data USE OF CONTRACT DOCUMENTS AND INFORMATION The bidder shall not, without the banks prior written consent, make use of any document or information provided by Supplier in Bid document or otherwise except for purposes of performing contract CONFIDENTIALITY The vendor shall not, without the written consent of the Bank, disclose the contract or any provision thereof, any specification, or information furnished by or on behalf of the Bank in connection therewith, to any person(s). The vendor shall not, without the prior written consent of the Bank, make use of any document or information except for purposes of performing this agreement. Page 20 of 52

21 5.32 PATENTS RIGHTS The bidder shall indemnify the bank against all third party claims of infringement of patent, trademark or industrial design rights arising from use of the Goods, or any part thereof in India. a) The bidder shall, at their own expense, defend and indemnify the Bank against all third party claims or infringement of intellectual Property Rights, including Patent, trademark, copyright, trade secret or industrial design rights arising from use of the products or any part thereof in India or abroad. b) The bidder shall expeditiously extinguish any such claims and shall have full rights to defend it there from. If the Bank is required to pay compensation to a third party resulting from such infringement, the supplier shall be fully responsible for, including all expenses and court and legal fees. c) The Bank will give notice to the bidder of any such claim without delay, provide reasonable assistance to the bidder in disposing of the claim, and shall at no time admit to any liability for or express any intent to settle the claim. d) The bidder shall grant to the bank a fully paid-up, irrevocable, nonexclusive license throughout the territory of India or abroad to access, replicate and use services (and other software items) provided by the supplier, including-all inventions, designs and marks embodied therein in perpetuity FORCE MAJEURE Notwithstanding the above provisions, the successful bidder shall not be liable for penalty or termination for default if and to the extent that it s delay in performance or other failure to perform its obligations under the contract is the result of an event of force majeure. For purposes of this clause, force majeure means an event beyond the control of the bidder and not involving the bidders fault or negligence and not foreseeable. Such events may include, but are not restricted to, war or revolution and epidemics. If a force majeure situation arises, the bidder shall promptly notify the bank in writing of such condition and the cause thereof. Unless otherwise directed by the bank in writing, the bidder shall continue to perform its obligation under the contract as far as is reasonably practical, and shall seek all reasonable alternative means of performance not prevented by the force majeure event INDEMNITY The bidder assumes responsibility for and shall indemnify and keep the Bank harmless from all liabilities, claims, costs, expenses, taxes and assessments including penalties, punitive damages, attorney's fees and court costs which are or may be required to be paid by reasons of any breach of the bidder's obligation under these general conditions or for which the bidder has assumed responsibilities under the purchase contract including those imposed under any contract, local or national law or laws, or in respect to all salaries, wages or other compensation to all persons employed by the bidder or bidders in Page 21 of 52

22 connection with the performance of any system covered by the purchase contract. The bidder shall execute, deliver such other further instruments to comply with all the requirements of such laws and regulations as may be necessary there under to conform and effectuate the purchase contract and to protect the Bank during the tenure of purchase order. Where any patent, trade mark, registered design, copyrights and/ or intellectual property rights vest in a third party, the bidder shall be liable for settling with such third party and paying any license fee, royalty and/ or compensation thereon. In the event of any third party raising claim or bringing action against the Bank including but not limited to action for injunction in connection with any rights affecting the machine supplied by the bidder covered under the purchase contract or the use thereof, the bidder agrees and undertakes to defend and / or to assist the Bank in defending at the bidder's cost against such third party's claim and / or actions and against any law suits of any kind initiated against the Bank TERMINATION OF CONTRACT The quality of services given by the bidder will be reviewed every 3 months and if the services are not found satisfactory, the bank reserves the right to terminate the contract by giving 30 days notice to the bidder. The decision of the bank regarding quality of services shall be final and binding on the bidder. The Bank shall have the right to terminate/cancel the contract with the selected bidder at any time during the contract period, by giving a written notice of 30 days, for any valid reason, including but not limited to the following : a) Excessive delay in execution of order placed by the Bank b) Discrepancies / deviations in the agreed processes and/or products c) Failure of vendor to maintain the SLAs such as Uptime & Availability, Reporting of Incidents/Alerts and Resolution of Problems related to solution as specified in the RFP for 2 consecutive quarters. d) Failure of vendor to complete implementation of solution within the time as specified in the RFP document e) Violation of terms & conditions stipulated in this RFP 5.36 INTELLECTUAL PROPERTY RIGHTS The Bidder warrant that in the course of providing the services, they shall not infringe upon any third party Patent, Copyright, Design, Trademark, or any other Intellectual Property Rights for system software and application software. The Bidder shall indemnify and at all times keep the Bank fully indemnified and hold harmless against any and all loss, damages, costs and expenses including Attorney's fees, which may be incurred as a result of any claim or action associated with such infringement, PROVIDED HOWEVER, the Bank agrees to give prompt notice to the Bidder of any such claim or action, gives complete authority and freedom to the Bidder in defending and/or settling such claim and gives all reasonable assistance to the Bidder in doing so. The remedy available to the Bank under this clause will survive termination of the Purchase Order such that in the event of violation of IPR claim by any third party after the Page 22 of 52