Request for Proposal for Vulnerability Assessment (VA) and Penetration Testing (PT) for Servers. Stock Holding Corporation of India Limited

Transcription

1 Stock Holding Corporation of India Limited (StockHolding) RFP REFERENCE NUMBER: IT-02/ DATE: FOR Vulnerability Assessment (VA) and Page 1 of 13

2 DISCLAIMER The information contained in this Request for Proposal (RFP) document or information provided subsequently to bidder(s) or applicants whether verbally or in documentary form by or on behalf of Stock Holding Corporation of India Limited (StockHolding), is provided to the bidder(s) on the terms and conditions set out in this RFP document and all other terms and conditions subject to which such information is provided. This RFP document is not an agreement and is not an offer or invitation by StockHolding to any parties other than the applicants who are qualified to submit the bids ( bidders ). The purpose of this RFP is to provide the bidder(s) within formation to assist the formulation of their proposals. This RFP does not claim to contain all the information each bidder may require. Each bidder should conduct its own investigations and analysis and should check the accuracy, reliability and completeness of the information in this RFP and where necessary obtain independent advice. StockHolding makes no representation or warranty and shall incur no liability under any law, statute, rules or regulations as to the accuracy, reliability or completeness of this RFP. StockHolding may in its absolute discretion, but without being under any obligation to do so, update, amend or supplement the information in this RFP. RFP Document Details Name of Organization Stock Holding Corporation of India Limited RFP Reference No. IT-02/ Requirement Vulnerability Assessment (VA) and Penetration (PT) Testing for Servers Date of issue of RFP document 27 th April 2016 Last date for submission of queries 29 th April 2016 (only through ) Start date for online submission of Technical bid 27th April 2016 from 10:00 Hours Last/End date for online submission of Technical 10th May 2016 on/or before 17:00 Hours bid Date for online Technical bid opening 11th May 2016, 10:00 Hours onwards E-bidding to be facilitated by M/s. e-procurement Technologies Ltd.(ETL), Ahmedabad, on behalf of Stock Holding Corporation of India Limited Address for online submission of bids (technical Bid must be submitted online on and commercial) itpr@stockholding.com Contact Details of M/s. e-procurement Ms. Manalee Madhu Technologies Ltd.(ETL), Ahmedabad Phone: manalee@auctiontiger.net 1.This bid document is not transferable 2.Stock Holding Corporation of India Limited reserves the right to conduct Reverse Auction (RA) Page 2 of 13

3 Submission of Proposal: The response to this RFP will be submitted by way of two stage bidding process. The technical proposal with the relevant information/documents/acceptance of all terms and conditions as described in this RFP document will be submitted online through M/s e-procurement Technologies Ltd.(ETL), Ahmedabad, the outsourcing agency approved by Stock Holding Corporation of India Ltd (StockHolding) for e-bidding on the website ( The Bidders (vendors) will be trained by e-procurement Technologies Ltd. for this purpose, and they will have to abide by the e-business rules in consultation with e-procurement Technologies Ltd. The vendors will have to upload the duly signed and scanned RFP submission relevant document(s) as part of technical bid. Technically qualified bidders will subsequently submit commercial bids online. All Annexure Forms will have to be filled and submitted online. The Technical Bid with relative documents must be submitted online. The vendors are requested to note that they cannot make their online submission after the time stipulated above and no extension of time will normally be permitted for submission of bid. The bidders are requested to note that it is mandatory to have a valid digital certificate issued by any of the valid certifying authority approved by Govt. of India to participate in the online bidding. The bidders are requested to ensure that they have the same, well in advance or if any assistance is required for the purpose, bidders can contact service provider (M/s e-procurement Technologies Ltd.). Minimum requirement for e-bidding: 1. Computer / Laptop (Notebook) with internet connection 2. Operating system - Windows XP Service pack -3 / VISTA/ Windows 7 or above 3. Digital certificate - Class II or III, Singing + Encryption. Invitation for bids This Invitation for bids is for Vulnerability Assessment (VA) and Penetration Testing (PT) for Servers at Stock Holding s offices Due Diligence: The bidder is expected to examine all instructions, Forms, Terms, Conditions and Specifications in this RFP. Bids shall be deemed to have been made after careful study and examination of this RFP with full understanding of its Implications. The Bid should be precise, complete with all details required as per this RFP document. Failure to furnish all information required by this RFP or submission of Bid not as per RFP requirements will be at the bidder s risk and may result in rejection of the bid and the decision of StockHolding in this regard will be final and conclusive and binding. Page 3 of 13

4 Cost of Bidding: The bidder shall bear all costs associated with the preparation & submission of its bid and StockHolding will in no case be held responsible or liable for these costs, regardless of the conduct or outcome of the bidding process Contents of this RFP Document: The requirements, bidding procedure, general terms & conditions are prescribed in this RFP document with various sections (A) Bids Preparation and Submission Details (B) Requirement with Bill of Material, Scope of Service and Terms and Conditions (C) Format for Technical and Commercial Bids Clarifications regarding RFP Document: Before bidding, the bidders are requested to carefully examine the RFP Document and the Terms and Conditions specified therein, and if there appears to be any ambiguity, contradictions, gap(s) and/or discrepancy in the RFP Document, they should forthwith refer the matter to StockHolding for necessary clarifications. A bidder requiring any clarification for their queries on this RFP may be obtained via to itpr@stockholding.com StockHolding shall not be responsible for any external agency delays. StockHolding reserves the sole right for carrying out any amendments / modifications / changes in the bidding process including any addendum to this entire RFP At any time before the deadline for submission of bids / offers, StockHolding may, for any reason whatsoever, whether at its own initiative or in response to a clarification requested by bidders, modify this RFP Document. All bidders who have received this RFP document shall be notified of the amendment by phone or , and all such amendment(s) shall be binding on them StockHolding reserves the rights to extend the deadline for the submission of bids, if required. However, no request from the bidders for extending the deadline for submission of bids, shall be binding on StockHolding. StockHolding reserves the right to amend / cancel / postpone / pre-pone the RFP without assigning any reasons Validity of offer: The offer should remain valid for a period of at least 90 days from the date of submission Eligibility Criteria (Documents to be submitted online along with Technical Bid) Important Bidder should upload all supporting documents at the time of submitting technical bid, duly signed and stamped on their company s letter head. SI. Criteria Documents to be submitted by vendor (bidder) 1. The vendor (bidder) should have registered office in India Certificate of incorporation selfattested by the vendor Page 4 of 13

5 2. The vendor (bidder) should be CERT-IN Empanelled 3. The vendor (bidder) should be profitable in the last three years 4. The vendor (bidder) should have at least Three (3) clients from financial sector preferably BFSI 5. The vendor (bidder) should have minimum Five (5) years of experience in VA/PT and related audit services A self-declaration by the bidder on letter head and Cert-In empanelled certificate Audited and certified copies of balance sheet for the last 3 years, Letter mentioning Turnover and Profitability of last three years duly certified by Chartered Accountant Contact details of customer, address, contact person(s), telephone nos., address on company s letter head A self-declaration by the bidder on its company s letter head (A) BID PREPARATION AND SUBMISSION [ Vendor (bidder) should submit bids online ] 1. Technical Bid a. The vendor (bidder) will submit the Technical Bid online (Bids must be submitted online on b. The vendor (bidder) should quote only in the format given (Technical Bid for Vulnerability Assessment (VA) and Penetrating Testing (PT) for Servers) - refer ANNEXURE-I c. There should not be any hidden / conditional costs in the bids and in the event of their presence in the bid, the bid is liable to be rejected. d. No indications pertaining to price or commercial terms should be made in the online Technical Bid submission. If any price indications are made, then the bids may be rejected. e. No open ended / conditional bid shall be entertained and are liable for rejection. 2. Commercial Bid a. The vendor (bidder) will submit Commercial Bid online (Only technically qualified bidders) b. The Commercial Bid should be should be as per the prescribed format - refer ANNEXURE-II 3. Submission of Bids a. The Technical Bid and Commercial Bid must be submitted online. Technical Bid and Commercial Bid should be complete in all respects and contain all information asked for in this RFP document b. Technical Bid should be complete in all respects and contain all information and documents, except price information. c. The offer should be valid for a period of at least 90 days from the date of submission of bid d. The vendor (bidder) shall fulfill all statutory requirements as described by the law and Government notices. The vendor (bidder) shall be solely responsible for any failure to fulfill the statutory obligations and shall indemnify StockHolding against all such liabilities, which are likely to arise out of the agency s failure to fulfill such statutory obligations Page 5 of 13

6 e. The vendor (bidder) shall be solely responsible either for any injury, damage, accident to the workman employed by the vendor (bidder), if any for any loss or damage to the equipment/property in the areas of work as a result of negligence/carelessness of its deployed resources. f. No request for any further extension of the above deadline shall be entertained. Delayed and/or incomplete bid shall not be considered. g. All employees engaged by the vendor (bidder), if any shall be comprehensively insured for accidents and injuries by the vendor (bidder) at his/her/their cost 4. Evaluation of Bids StockHolding will evaluate the bid submitted by the bidders under this RFP. It is Stockholding s discretion to decide at the relevant point of time. The eligibility bid submitted by the vendor (bidder) will be evaluated against the Eligibility criteria set forth in the RFP. The vendor (bidder) needs to comply with all the eligibility criteria mentioned in the RFP to be evaluated for evaluation. Non-compliance to any of the mentioned criteria would result in outright rejection of the bidder's proposal. The decision of StockHolding would be final and binding on all the bidders to this document. StockHolding may accept or reject an offer without assigning any reason what so ever. The bidder is required to comply with the requirement mentioned in the RFP. Non-compliance to this may lead to disqualification of a bidder, which would be at the discretion of StockHolding. a. Please note that all the information desired needs to be provided. Incomplete information may lead to non-consideration of the proposal. b. The information provided by the bidders in response to this RFP document will become the property of StockHolding. 5. Stock Holding reserves the right to conduct an online Reverse Auction (RA) through M/s. e- Procurement Technologies Ltd. (ETL), if required. The same will be notified to the eligible bidders by an amendment / corrigendum which will be appear on our website and stockholding.auctiontiger.net and not be published. (B) REQUIREMENT Stock Holding Corporation of India Limited (StockHolding) intends to get Vulnerability Assessment (VA) and (Qty: 17 Nos.) at its Mahape and Bangalore Locations on quarterly basis. The VA-PT for the Bangalore may be conducted from our Mahape office. Note: StockHolding reserves the right to alter, addendum or reduce or remove the bill of material required during the contract period with prior intimation to the vendor (bidder). Page 6 of 13

7 Terms and Conditions (1) Payment: (a) 50% payment on submission of Tax Invoice for the quarter (b) Balance 25% on submission of Tax Invoice and on submission of draft report(s) for VA-PT for the quarter (c) Balance 25% on submission of Tax Invoice and on submission of final report(s) for VA-PT post re-validation for the quarter (d) Applicable TDS will be recovered (deducted) from the payment(s) (2) Location Details (contact numbers will be shared to shortlisted bidder) S/N. Location Details Location 1. Stock Holding Corporation of India Limited Mahape (Navi Mumbai) SHCIL House, Plot No. P-51, TTC Industrial Area, MIDC, Opposite L&T Infotech, Mahape, Navi Mumbai C/o Sify Technologies IDC, Cyber Park, Plot no 76 & 77, Electronic City Phase - 1, Bengaluru Bengaluru (Karnataka) (3) Delivery Time Lines: The delivery time-lines to be given by the vendor based on our requirement in this RFP (4) Scope of Work: (I) Vulnerability Assessment of Systems a. Testing from internal network of the following web server components 1. Operating System 2. Database b. Findings related to the following areas (Not Limited to): 1. Security Patches 2. Database and OS 3. Network Settings 4. User Accounts 5. System Security 6. Security Policies (Password, Auditing & logging, etc.) 7. Services Running 8. Timeout (Session, Idle) 9. File & Folder Permissions Page 7 of 13

8 10. Banners 11. Remote Access c. Deliverables 1. Vulnerability Assessment Report 2. Severity Ratings 3. Vulnerability Reference (OWASP, CIS, CVE (Common Vulnerabilities and Exposures), CWE (Common Weakness Enumeration), OSVDB (Open Source Vulnerability Database) etc.) 4. Impact 5. Detailed Recommendation 6. Revalidation and Final Report (II) Penetrating Testing a. Testing or Findings related to the following areas but Not Limited to: b. Deliverables 1. External/Internal Open Ports 2. Network Vulnerabilities 3. Password Protection Mechanism 4. Information Leakage 5. Denial of Service 6. Exploiting the Found vulnerabilities which are exploitable 7. Impact Assessment as per OWASP 8. Suggestions for mitigation 9. Report and Recommendations 1. External Penetration Testing Report 2. Result at each stage (Info. Gathering, Fingerprinting, Scanning) 3. Proof Of Concept (POC) of successful exploitation (screenshots, actual tests, log results any others) Page 8 of 13

9 4. Vulnerability Reference (OWASP, CIS, CVE, CWE, OSVDB, etc.) 5. Severity Ratings 6. Impact 7. Detailed Recommendation 8. Revalidation and Final Report (III) (IV) Vendor (bidder) hereby indemnify, protect and save StockHolding against all claims, losses, costs, damages, expenses, action suits and other proceedings, resulting from infringement of any patent, trademarks, copyrights etc. or such other statutory infringements in respect of all the equipment offered by the vendor. Any publicity by vendor (bidder) in which name of StockHolding is used should be done only with the explicit permission of StockHolding. Vendor (bidder) will sign Non-Disclosure Agreement and its validity will be as per guidelines of SHCIL Legal department and CISO (5) Taxes & levies: (a) Applicable taxes payable at actual as per prevailing rate of taxes as per Government notification (b) In case of tax exemption or lower TDS; vendor has to submit letter from Government Authority for tax exemption or lower TDS (to be submitted along with each of the invoice(s) (c) Applicable TDS/WCTDS will be deducted from payment(s). (6) Force Majeure: The vendor (bidder) will not be held responsible for breach of executing any obligation or delay in executing any obligations during below given circumstances / conditions: (a) War, Riots, Strike, Fire, Flood, Earthquake, Storm, Epidemic breakout, Power failure, Theft etc. (b) Any Governmental priorities (Necessary proof for validation viz. Govt. Gazette notifications, Leading Newspaper reports, etc. should be made available) (c) Sabotage or omission of StockHolding (7) Dispute Resolution: In the event of any dispute arising out of or in connection with this Order, the parties shall use their best endeavor to resolve the same amicably AND if the dispute could not be settled amicably, the matter shall be settled in the court under Mumbai jurisdiction only. The final payment will be released only after the vendor (bidder) complies with above-mentioned clause Page 9 of 13

10 ANNEXURE-I Technical Bid Format SI. Criteria Documents to be submitted by vendor (bidder) 1. The vendor (bidder) should Certificate of incorporation selfhave registered office in India attested by the vendor 2. The vendor (bidder) should be A self-declaration by the bidder CERT-IN Empanelled on letter head and Cert-In empanelled certificate 3. The vendor (bidder) should be profitable in the last three years 4. The vendor (bidder) should have at least Three (3) clients from financial sector preferably BFSI 5. The vendor (bidder) should have minimum Five (5) years of experience in VA/PT and related audit services Audited and certified copies of balance sheet for the last 3 years, Letter mentioning Turnover and Profitability of last three years duly certified by Chartered Accountant Contact details of customer, address, contact person(s), telephone nos., address on company s letter head A self-declaration by the bidder on its company s letter head Compliance (Yes/No) SI. Description Number and location details 1 Head office or Registered office in India 2 Other offices in India SI. IT-Security/Audit/ISO Certifications Employee Count 1 CISA, CEH, ISO Lead Please provide count of employees against each Implementer/Auditor, BS25999 Lead Auditor, MSSP, CCNA, MSCE,etc. applicable certification Page 10 of 13

11 ANNEXURE-II Commercial Bid Format SI. Requirement Price in INR exclusive of Taxes and Levies 1. VA-PT Quarter 1 Remarks 2. VA-PT Quarter 2 3. VA-PT Quarter 3 4. VA-PT Quarter 4 5. TOTAL (of all quarters) Note: All the above prices should be exclusive of all applicable local taxes and levies Note: Bidder must take care in filling price information in the Commercial Offer, to ensure that there are no typographical or arithmetic errors. All fields must be filled in correctly. Please note that any Commercial Offer, which is conditional and / or qualified or subjected to suggestions, will also be summarily rejected. This offer shall not contain any deviation in terms & conditions or any specifications, if so such an offer will also be summarily rejected. Page 11 of 13

12 Compliance Statement Request for Proposal for Vulnerability Assessment (VA) and (To be submitted along with technical bid) Subject: RFP for Vulnerability Assessment (VA) and Ref: RFP IT-02/ Dated DECLARATION We understand that any deviations mentioned elsewhere in the bid will not be considered and evaluated by the Stockholding. We also agree that the Stockholding reserves its right to reject the bid, if the bid is not submitted in proper format as per subject RFP. Compliance Compliance Remarks / Deviations (Yes / No) Terms and Conditions Technical Specifications Scope of Work Any other T&C in this RFP (If left blank it will be construed that there is no deviation from the specifications given above) Date Signature with seal Name : Designation : Page 12 of 13

13 Details of the Bidder Request for Proposal for Vulnerability Assessment (VA) and Details filled in this form must be accompanied by sufficient documentary evidence, in order to facilitate StockHolding to verify the correctness of the information. 1) Name of Company: 2) Postal Address: 3) Telephone, Mobile and Fax Numbers: 4) Name and designation of the person authorized to make commitments to StockHolding 5) Address: 6) Website address of the Company: 7) Year of commencement of Business: 8) Sales Tax / VAT / CST Registration Number: 9) Service Tax Registration Number: 10) Authorized product partner / dealer: 11) Complete company name with address, contact person, Telephone No(s)., address on which the Purchase Order should be placed if contract is awarded Place: Date: Signature of authorized official, designation and stamp Page 13 of 13