Travaux publics et Services gouvernementaux Canada. Title - Sujet PCI CONSULTANT. Solicitation No. - N de l'invitation EN /B

Transcription

1 Public Works and Government Services Canada RETURN BIDS TO: RETOURNER LES SOUMISSIONS À: Bid Receiving - PWGSC / Réception des soumissions - TPSGC 11 Laurier St. / 11, rue Laurier Place du Portage, Phase III Core 0A1 / Noyau 0A1 Gatineau, Québec K1A 0S5 Bid Fax: (819) SOLICITATION AMENDMENT MODIFICATION DE L'INVITATION The referenced document is hereby revised; unless otherwise indicated, all other terms and conditions of the Solicitation remain the same. Ce document est par la présente révisé; sauf indication contraire, les modalités de l'invitation demeurent les mêmes. Travaux publics et Services gouvernementaux Canada Title - Sujet PCI CONSULTANT Solicitation No. - N de l'invitation EN /B Client Reference No. - N de référence du client GETS Reference No. - N de référence de SEAG PW-$$ZG File No. - N de dossier 406zg.EN Part - Partie 1 of - de 2 See Part 2 for Clauses and Conditions Voir Partie 2 pour Clauses et Conditions CCC No./N CCC - FMS No./N VME Solicitation Closes - L'invitation prend fin at - à 02:00 PM on - le F.O.B. - F.A.B. Plant-Usine: Destination: Other-Autre: Address Enquiries to: - Adresser toutes questions à: Harrington, Ingrid Telephone No. - N de téléphone (819) ( ) Destination - of Goods, Services, and Construction: Destination - des biens, services et construction: Amendment No. - N modif. 001 Date Time Zone Fuseau horaire Eastern Standard Time EST Buyer Id - Id de l'acheteur 406zg FAX No. - N de FAX (819) Comments - Commentaires THIS REQUIREMENT CONTAINS A SECURITY REQUIREMENT - SEE PART 6. Vendor/Firm Name and Address Raison sociale et adresse du fournisseur/de l'entrepreneur Instructions: See Herein Instructions: Voir aux présentes Delivery Required - Livraison exigée Delivery Offered - Livraison proposée Vendor/Firm Name and Address Raison sociale et adresse du fournisseur/de l'entrepreneur Issuing Office - Bureau de distribution Business Management and Consulting Services Division / Division des services de gestion des affaires et de consultation 11 Laurier St. / 11, rue Laurier 10C1, Place du Portage Gatineau, Québec K1A 0S5 Telephone No. - N de téléphone Facsimile No. - N de télécopieur Name and title of person authorized to sign on behalf of Vendor/Firm (type or print) Nom et titre de la personne autorisée à signer au nom du fournisseur/ de l'entrepreneur (taper ou écrire en caractères d'imprimerie) Signature Date Canada Page 1 of - de 1

2 This Solicitation Amendment No. 001 is raised to answer questions pertaining to the RFP as well as to remind the Bidders to obtain the required security clearance promptly by requesting sponsorship from the Contracting Authority. Questions and Answers Q1. Can the Crown please confirm that for the purpose of the Mandatory Technical and Point Rated Technical Criteria in Attachment 1 to Part 4, the Bidder is defined as the firm, its employees and subcontractors? A1. As stipulated in the Request for Proposal (RFP) in Attachment 1 to Part 4 Mandatory Technical Criteria (MT) header row and in the Point Rated Technical Criteria (RT) header row, the experience of the Bidder will be considered. The definition of "Bidder", found in 2003 ( ) Standard Instructions - Goods or Services Competitive Requirements, forming part of the bid solicitation, is as follows: "04 Definition of Bidder "Bidder" means the person or entity (or, in the case of a joint venture, the persons or entities) submitting a bid to perform a contract for goods, services or both. It does not include the parent, subsidiaries or other affiliates of the Bidder, or its subcontractors." Additional information is provided in clause 1.3, Status and Availability of Resources, of Attachment 1 to Part 5, Certifications Precedent to Contract Award. More particularly, you should refer to the second paragraph as follows: "If the Bidder has proposed any individual who is not an employee of the Bidder, the Bidder certifies that it has the permission from that individual to propose his/her services in relation to the Work to be performed and to submit his/her résumé to Canada. The Bidder must, upon request from the Contracting Authority, provide a written confirmation, signed by the individual, of the permission given to the Bidder and of his/her availability." Q2. The RFP requires the Contractor personnel to hold a valid personnel security screening at the level of SECRET before contract award. Would the Crown consider revising this requirement to accept bidders whose proposed personnel will have Enhanced Reliability clearance with Secret clearance applications pending? A2. Canada will not revise the security requirements of this bid solicitation and resulting contract. The Summary contained in Part 1 - General Information of the RFP, states the following: Part - Partie 2 of - de 2 / Page 1 of - de 4

3 "There is a security requirement associated with this requirement. Bidder's are reminded to obtain the required security clearance promptly. Please refer to Part 6, Security Requirements, Part 7, Resulting Contract Clauses Security Requirement and Annex C Security Requirements Checklist and its associated attachment. Bidders who currently do not meet the facility security clearance requirements and (or) personnel security clearance are advised to initiate the security clearance process immediately by requesting sponsorship from the Contracting Authority." Part 6 - Security Requirements of the RFP states the following: "PART 6 - SECURITY REQUIREMENTS 1. Security Requirement Before award of a contract, the following conditions must be met: (a) the Bidder must hold a valid organization security clearance as indicated in Part 7 - Resulting Contract Clauses; (b) the Bidder's proposed individuals requiring access to classified or protected information, assets or sensitive work site(s) must meet the security requirement as indicated in Part 7 - Resulting Contract Clauses; and (c) the Bidder must provide the name of all individuals who will require access to classified or protected information, assets or sensitive work sites. 2. Bidders are reminded to obtain the required security clearance promptly. Any delay in the award of a contract to allow the successful bidder to obtain the required clearance will be at the entire discretion of the Contracting Authority. 3. For additional information on security requirements, bidders should consult the "Security Requirements for PWGSC Bid Solicitations - Instructions for Bidders" ( document on the Departmental Standard Procurement Documents Website." Prior to contract award Canada will verify through the Canadian Industrial Security Directorate (CISD) that the proposed personnel hold a valid personnel security screening at the level of Secret. Any delay in the award of a contract to allow the successful bidder to obtain the required clearance will be at the entire discretion of the Contracting Authority. Q3. In Attachment 1 to Part 4, MT1 requires the Bidder to possess a Qualified Security Assessor certification for at least 4 years. Our organization has been a Qualified Security Assessor Company qualified by the PCI Security Standards Council since October 2008 and has been providing information security advisory and assurance services to public and private sector Part - Partie 2 of - de 2 / Page 2 of - de 4

4 organizations, including financial institutions, for many years. We believe that this meets the substance of this requirement. Would the Crown consider revising MT1 to accept bidders who possess a QSA certification and have a minimum of four years of experience providing information security advisory and assurance services that is relevant to the Statement of Work for this RFP, as equivalence to possessing QSA certification for four years? A3. Canada will not revise the mandatory technical criterion MT1 to allow for equivalencies to the certification requirements. Q4. In Attachment 1 to Part 4, MT1 requires the Bidder to be an Approved Scanning Vendor for at least 4 years. Our organization has been providing vulnerability scanning and network/system penetration testing services to public and private sector organizations, including financial institutions, for many years and was at one time (2009 to 2011) an ASV qualified by the PCI Security Standards Council. We believe that this meets the substance of this requirement. Would the Crown consider revising MT1 to accept bidders who have a minimum of four years of experience providing vulnerability scanning and network/system penetration testing services that is relevant to the Statement of Work for this RFP, as equivalence to possessing an ASV certification for four years? A4. See response to Q3 above. Q5. The PCI advisory services that are described in Annex "A" Statement Of Work, Section 3.0 "Scope of Work" include certain activities where it may be more effective, efficient and better financial value to Canada for some of the work to be performed by personnel that are less experienced and thus more economical than the Senior PCI Advisor or PCI Advisor personnel. Examples where this might apply are listed below. Would the Crown consider: 1) revising Attachment 1 to Part 3 "Pricing Schedule" to allocate a portion of the level of effort to a Junior PCI Advisor? 2) accept that this Junior PCI Advisor be the resource who can provide services in both official languages for the purpose of Section 7.4 "Language of Work" of Annex "A" Statement Of Work. Activities that could be performed by a Junior PCI Advisor: Achieving PCI DSS Compliancy: o identify security measures and internal controls over financial reporting in each department o Tailor the PCI assessments available from the PCI SSC to the individual departments' business processes including the appropriate application of compensating controls o Provide PCI compliance audit readiness assessments to identify the current degree of compliance for the in-scope projects/ environments Part - Partie 2 of - de 2 / Page 3 of - de 4

5 o Draft an audit program to share with departments Knowledge Transfer o Training the RG and departments on using compensating controls. A5. 1) Canada will not revise the pricing schedule. Bidders are to provide a bid based on the current attachment 1 to Part 3. A5. 2) For information purposes Canada has revised the wording of Section 7.4 Language of Work in the Statement of Work, as follows: DELETE: 7.4 Language of Work The Contractor must provide services in English, but at least one PCI Advisor resource must be able to provide services in both official languages of Canada. Deliverables and documentation such as rules, regulations and material, must be provided in English and when available in French. INSERT: 7.4 Language of Work The Contractor must provide services in English, but at least one resource must be able to provide services in both official languages of Canada. Deliverables and documentation such as rules, regulations and material, must be provided in English and when available in French. Part - Partie 2 of - de 2 / Page 4 of - de 4