Head Office : Information Technology Division 5, Parliament Street, New Delhi Request For Proposal (RFP) For

Transcription

1 Head Office : Information Technology Division 5, Parliament Street, New Delhi Request For Proposal (RFP) For Monitoring of Internet & Identification of Threats & Providing Remedies Relating to Phishing, Pharming, Trojans, Spoofed s, Brand Abuseetc &Scanning Bank s 1 of 35

2 DISCLAIMER While the document has been prepared in good faith, no representation or warranty, express or implied, is or will be made, and no responsibility or liability will be accepted by Punjab National Bank (PNB) or any of its employees, in relation to the accuracy or completeness of this document and any liability thereof expressly disclaimed. The RFP is not an offer by PNB, but an invitation for service provider s responses. No contractual obligation on behalf of PNB, whatsoever, shall arise from the offer process unless and until a formal contract is signed and executed by duly authorized officers of PNB and the Bidder. 2 of 35

3 BID DETAILS 1. Date of commencement of Bidding 01/06/2015 Process 2. Last date and time for receipt of 08/06/2015 up to 1700 HRS queries for clarification from bidders 3. Last date and time for downloading of 22/06/2015 up to 1600 HRS Bidding Documents 4. Last date and time for Hash 22/06/2015 up to 1600 HRS submission and Bid preparation 5. Last date and time for online Bid submission From 22/06/2015, 1701 HRS to 23/06/2015, 1400 HRS 6. Last date and time for Bid submission 23/06/2015 up to 1400 HRS 7. Date and time of Technical Bid Please refer tender schedule opening 8. Place of opening of Bids Punjab National Bank, Information Technology Division, 2 nd floor, HO, 5 Sansad Marg,New Delhi Place for Submission of Bid The Chief Manager (Procurement Deptt) Punjab National Bank Information Technology Division 4 th floor, Head Office, 5 Sansad Marg, New Delhi Address for communication As above Tel:- (011) / Ext: 159 Fax:- (011) Earnest Money Deposit Rs. 5,00,000/- (Rs five lakh rupees only) in the form of Demand Draft/Pay order in favour of Punjab Nation Bank, IT Division payable at New Delhi. EMD should be enclosed with Technical Bid. 12. Cost of RFP Rs. 5000/- (Rs. Five thousand rupees only) in the form of Demand Draft/Pay order in favour of Punjab National Bank, IT Division payable at New Delhi. The DD/Cheque should be submitted in person at the time of bid submission. Please note that DD/PO should not be enclosed in Technical or commercial bid. 13. Contact to Bidders Interested Bidders are requested to send the to itdhw@pnb.co.in,itdaudit@pnb.co.in,birinder.si ngh@pnb.co.in containing following information, so that in case of any clarification the same may be issued to them: (a)name of Bidder, (b)contact person, (c)mailing address with Pin Code,(d)Telephone No., Fax No., Mobile No.(e) etc. Note: *The complete details of e-procurement process are available on Bank s e- procurement website Bids will be opened in presence of the bidders representative who chooses to attend. 3 of 35

4 1. INTRODUCTION Punjab National Bank (serving for more than 117 years) is the leading Public Sector Bank of India. Punjab National Bank has come a long way in offering best services to its customers. Bank is the giving services to the customers through ATM services, Internet Banking and other channels. As on date Bank has more than 20 Lac Internet Banking Customers. Bank has implemented ISO for ensuring the security of the critical assets. To ensure that customers enjoy the complete benefits of these services and protect customer s data going to the wrong hands, Bank is calling bids from the reputed, experienced and dynamic Service Providers and Original Equipment Manufacturers (OEMs) to provide proactive monitoring world wide web and blocking of cyber-attacks/ online frauds such as Phishing, Pharming, Trojans, Fraud s, Brand Abuse etc, retrieval of compromised customer information and forensic details of such attacks and scanning of Bank s websites for threats such as malware, blacklisted links and other threats. 2. Eligibility Criteria This invitation of bid is open to all the Indian Companies having presence in India who fulfill the minimum eligibility criteria as mentioned in below and in annexure B. The bidder shall submit the details of minimum eligibility criteria as per Annexure B. Sno. Eligibility Criteria 1. Bidder should be an established Indian Company (incorporated in India). Bidder must be currently a legal entity in India. Bidder to give certificate of incorporation or any other certificate of registration issued by competent authority from Government of India. 2. Bidder should have minimum turnover of Rs.20 Crores in last financial year ( ), Bidder must provide the details of turn over for last 3 years ( , , ) and reported positive net worth during these years. Bidder to submit the audited Balance sheets of the said 3 years. 3. Bidder must have supplied similar Information Security solutions to Banks / Government organizations/other financial organizations during last 3 years. Bidder to Submit copy of orders and / or certificates from customers as evidence of providing satisfactory services. 4. Bidder should not be warranted in any legal case that may affect the solvency / existence of firm or in any other way affect the bidder s capability to provide / continue the services to bank. Bidder to give undertaking from Company Secretary / Managing Director. The bidders who intend of getting in back to back arrangement for the services to OEM must mention this in technical bid along with the name of OEM. In such case the bidder will have to submit the letter from the OEM as per annexure I. OEM is also required to submit the acceptance of Non-Disclosure Agreement as per annexure-h that will be required to be signed by them with bank separately. 4 of 35

5 Please note that the bidders / OEM who have an un-satisfactory record in completion of any of earlier contracts with Punjab National Bank shall not be eligible for participating in this tender. The bids of the bidder who do not fulfill the eligibility criteria will be rejected. 3. SCOPE OF WORK Details of scope of work are as under:- o o o o o o o o o o o o o 24x7x365 proactive monitoring of World Wide Web etc. for Phishing, Pharming, Trojan, Spoofed s, Brand Abuse and any other threat or exploitation of vulnerabilities which lead to compromising of credentials of the customers unknowingly directed against the customers of the Bank. Detecting the attacks proactively and blocking / shutting down of the attacks anywhere in the world within the minimum possible time as specified in SLA. For the purpose of detection bidder may use any technique or combination of techniques such as but not limited to scanning of spam s and / or scanning of web server logs and / or Digital watermarking and / or monitoring chat rooms used by hackers etc. Daily scanning of all the websites of the Bank to detect any type of malware, injection, blacklisted links, suspicious activities etc. Reporting to Bank the exact nature and location of the infection for speedy removal of the infection / abnormality. Proactive Monitoring of major Mobile App stores and blocking/shutting down of Malicious App/Trojan used for online banking of Punjab National bank. Gathering the Forensic information such as IP address, exact URL, source of attack, images, screen shots, , account details, card details, compromised data etc. from the attacks and sharing the same with the bank. Pushing the bait details and countermeasures (like login through many dummy users to identify the source and try to shutdown) in the fraudulent sites. Reporting to Bank about all the attacks and providing detailed information through , dashboard, SMS alerts, Phone etc. Conference call facility with the vendor team should be available to bank in case requirement arises. Take up and coordinate the cases with CERTs and / or other legal agencies of any country in consultation with Bank. Providing customized dashboard to PNB team. Providing 1 day awareness training to PNB team (up-to 35 people per session) once every quarter. Training can be conducted at any location across India in PNB premises. as advised by the bank from time to time. Vendor will be required to submit monthly analysis and fraud intelligence reports (both high level/summarized and low level/detailed) to bank. Providing bank with review and advisories for phishing, malware incidents and how to avoid such incidents in future. Providing expert advises on, Phishing, Pharming, Trojan, Spoofed s, Brand Abuse and any other threat or exploitation of vulnerabilities, monthly basis or as and when Bank raises any query. 5 of 35

6 o Establishing and maintaining contacts with service providers, browser developers and other major agencies such as CERT, Anti Phishing Working Group / Data Security Council etc. to ensure effective closure of incidents. o Taking all necessary security aspects into account to ensure the confidentiality and integrity of the data related to above service. The selected bidder will be required to provide the above services for the period of 2 years from the date of initiation of services. Bank reserves the right to extend the period of services for one more year or part thereof at the same terms and conditions and prices. Bank can also increase or decrease the scope of services during the period of contract with a notice of 30 days. The list of Bank s websites is provided as annexure J. However this list is subject to change. Bidder will be required to monitor all the domains of the Bank including the new domains Bank may acquire during the period of contract. A description of the envisaged scope is enumerated as above. However, the Bank reserves its right to change the scope of the RFP considering the size and variety of the requirements and the changing business conditions. 4. BIDDING PROCESS (TWO STAGES) For the purpose of the present job, a two-stage bidding process will be followed. The response to the present tender will be submitted in two parts: Technical bid (Part-l) Commercial bid (Part-ll) The bidders shall duly complete the formats of Bid (Technical and Commercial) and the same must be submitted online through our e-procurement Systems at website on or before last date and time for acceptance of online Bids as specified in the RFP. Details of Earnest Money Deposit should also be filled in the format available in our e-procurement system website. The bid shall be signed using Digital Certificate (Signing/Encryption) by the Power of Attorney holder so as to bind the bidder to the contract. The complete detail of e-procurement process is available on Bank s e-procurement website Apart from the online submission of bids, bidders will also be required to submit hardcopy of their supporting documents along with DD for cost of bid, Earnest Money Deposit and supporting documents on or before last date and time for acceptance of online Bids as specified in the RFP. In event of the specified date for submission of bids/supporting documents being declared a holiday for the Purchaser, the bids/supporting documents will be received up to specified time on next working day. The physical bids / hardcopy can be submitted to the below mentioned address:- The Chief Manager (Procurement Deptt) Punjab National Bank Information Technology Division 4th floor, Head Office, 5 Sansad Marg, New Delhi of 35

7 The process for submission of hard copy of bids is detailed as under:- The bidder will have to submit the Bid in an envelope super scribed Bid for Monitoring of Internet and Identification of Threats and Providing Remedies Relating to Phishing, Pharming, Trojans, Spoofed s, Brand Abuse etc & Scanning Bank s Websites for Malware. Envelop must mention that it contains envelop namely Technical Bid. In case envelope is not properly super scribed then Bank can reject the bid. Technical bid are in red lac sealed envelopes (wax seal), duly super-scribing TENDER FOR RFP for Monitoring of Internet and Identification of Threats & Providing Remedies Relating to Phishing, Pharming, Trojans, Spoofed s, Brand Abuse etc.& Scanning Bank s Websites For Malware. A Non-Refundable amount of Rs.5000/- (Rs. Five thousand Only) in the form of Demand Draft favoring Punjab National Bank payable at New Delhi being cost of the bid document shall be submitted separately at the time of submission of bids, and it can be also paid online using the e-procurement system of the Bank. 4.1TECHNICAL BID: Technical Bid Envelope should contain Technical bid comprising of one hard copy and one soft copy (non-modifiable format such as PDF) of the technical bid. Hard copy of the Technical bid should be a complete document and placed in a sealed envelope superscribed as TECHNICAL BID. The soft copy (non-modifiable format such as PDF) of the Technical bid should be submitted on a CD sealed in an envelope marked as SOFT COPY OF TECHNICAL BID. Both of these sealed envelopes should be placed in a single sealed envelope super scribed as TECHNICAL BID FOR RFP of Monitoring of Internet and Identification of Threats & Providing Remedies Relating to Phishing, Pharming, Trojans, Spoofed s, Brand Abuse etc. & Scanning Bank s Websites for Malware The technical bid should consist of the following: I. Earnest Money Deposit as specified in this document II. A letter on bidder s letterhead mentioning the following: a) Details of EMD submitted, technical competence and experience of the bidder. b) Certifying that the period of the validity of the bids is 180 days from the target date of submission of bid, and c) Confirming that the bidder has quoted for all the items/services mentioned in the bid in their commercial bid. d) Supporting documents in respect of Eligibility Criteria as mentioned in Annexure B. III. Bidders Information as per Annexure D on bidder s letter head. IV. Power of Attorney authorizing to sign and submit the bid. V. Last three years published audited balance sheets and profit and loss account statements. VI. Technical details as per Annexure E. VII. Non-disclosure agreement as per Annexure H. VIII. Response to all points of the Technical evaluation format. IX. Documents as listed in Annexure C Bidder shall appoint an experienced Project Manager (with at least 1 year experience in 7 of 35

8 handling similar projects). The bidder should provide CV of the Program Manager that demonstrates proven experience in executing projects similar in scope and complexity Commercial Bid: The bidder should submit the commercial bid as per Annexure G of the bid document. The bidder should submit commercial bid only through online using the e- procurement system BIDDING DOCUMENT: Contents of Bidding Document: The bidder is expected to go through all the instructions, terms, forms and specifications of the tender document. Failure to furnish all information required by the tender document or submission of bid not substantially responsive to the tender document in every respect will be at bidder s risk and may result in the rejection of the bid Amendment of Bidding Document: At any time prior to the last date for receipt of the bid, PNB may, for any reason, whether at its own initiative or in response to a clarification requested by any of the prospective bidder, modify the tender document by an amendment. The amendment will be notified by posting the same on our official website and / or our e-procurement website In order to afford prospective bidders reasonable time to take the amendments into account in preparing their bids, PNB may, at its discretion, extend the date for the submission of the bid and the same will be notified on the said website. 4.4 Preparation of Bids: Language of bids: The bids prepared by the bidder and all correspondence and documents relating to the bids exchanged by the bidder and PNB, must be written in English Bid Prices: Bidder should quote rates per incident which will be valid for the period of 2 years from the date of signing of contract or starting of services whichever is later. The quoted price shall be uniformly applicable for delivery/performance to any part of the country and shall be inclusive of incidental charges such cost toward boarding, lodging, travel etc. Service Tax, Sales tax, VAT, other applicable local taxes shall be paid over and above on actual basis on production of documentary evidence. In case of extension of the contract as per clause 3, quoted rates will be valid for additional period of 1 year from date of extension. The extended rates will be inclusive 8 of 35

9 of incidental charges such cost toward boarding, lodging, travel etc. Service Tax, Sales tax, VAT, other applicable local taxes shall be paid over and above on actual basis on production of documentary evidence. Bank will not be making any other payment except those mentioned in the commercial bid Validity of bids: Bid shall remain valid for 180 days from date of submission mentioned in this document. A bid valid for shorter period is liable to be rejected by PNB. The bidders may be required to give consent for the extension of the period of validity of the bid beyond initial 180 days, if so desired by PNB in writing or by fax. Refusal to grant such consent would result in rejection of bid without forfeiture of the EMD. However any extension of validity of bids will not entitle the bidder to revise/modify the bid amount Revealing of Prices The rates and/or prices in any form or for any reasons should not be disclosed in the technical or other parts of the bid except in the commercial bid. Failure to do so will make the bid liable to be rejected. Before opening of the commercial bids, if price revision is envisaged by the bank, revised commercial bid may be required to be submitted in a separate sealed envelope Terms and Conditions of the bidder: The bidders are not allowed to impose their own terms and conditions to the bid. The bidders should also describe clearly in what respect and up to what extent the services being offered differ/ deviate from the specifications laid down in the specifications and requirements Local conditions: The bidder must acquaint himself with the local conditions and factors which may have any effect on the performance of the contract and / or the cost Sealing and Marking of Bids: The bidder shall seal and mark each of the copies (one hard and one soft copy) wherever applicable, of all the bid documents in accordance with clause 4.1, 4.2 and 4.3. In case of non-compliance, PNB will not assume any responsibility for bids misplacement or premature opening or any other damage Last date of receipt of bids: Bids must be received by PNB at the address specified under clause Bid Details not later than the time and date specified there in. In the event of the target date for the receipt of bids being declared a holiday for PNB, the bids will be received till the target time on the next working day. PNB may at its discretion extend the bid 9 of 35

10 submission date. The modified target date & time will be notified in the web site of PNB Late Submission of bids: Any bid received by PNB after target date and time of the receipt of bids prescribed at Bid Details, will be rejected and / or returned unopened to the bidder at his risk and responsibility Modification and Withdrawal: Bids once submitted will be treated as final and no further correspondence will be entertained on this. No bid will be modified after the target date & time for submission of bids. No bidder shall be allowed to withdraw the bid. In case of the successful bidder, he will not be allowed to withdraw/back out from the bid commitments. The bid earnest money in such eventuality shall be forfeited and all interests/claims of such bidder shall be deemed as foreclosed 4.5. BID OPENING AND EVALUATION The Bank will open the bids, in the presence of Bidders/their representative who choose to attend, at the time and date mentioned in Bid document at the address mentioned in Para- Submission of Bids. The bidders/their representatives, who are present, shall sign the register evidencing their attendance. In the event of the specified date of bid opening being declared a holiday for Bank, the bids shall be opened at the specified time and place on next working day. The evaluation of bid will be done as under: Technical Evaluation: In the first stage, only TECHNICAL BID will be opened and evaluated. Bidders satisfying the Minimum Eligibility Criteria and agree to comply with all the terms and conditions specified in this document will be evaluated for technical specifications as per Annexure E. Technical evaluation will be conducted based on marks obtained by bidders on key technical parameters. The technical evaluation matrix with marking pattern will be shared before opening of technical bids. The commercial bids for only those bidders will be opened who have met the technical requirements and have Technical score of more than 60 based on technical evaluation matrix. 70% weightage will be given to technical score in final evaluation of successful bidder Commercial Evaluation: In the second stage, the COMMERCIAL BID will be opened of only those bidders, whose technical bids are found eligible by the Bank in Technical Evaluation and have scored more than 60 marks in technical evaluation matrix in technical evaluation. The bidder with the lowest total cost as per the Annexure G will be allocated 100 in L score. The score of other bidders will be allocated keeping the lowest quoted rate as reference. The mechanism of arriving at commercial score is given below:- 10 of 35

11 L score of other bidder = Final price of lowest bidder x 100 Final price of other bidder For Example: Bidder Final price Minimum price L score (Out of 100) A (60x100 / 80)=75 B C (60x100 / 70) = 86 D (60x100 / 81) = 74.07=74(round-off) E (60x100/79)= 75.94= 76 (round-off) Please note that decimal values will be rounded to the nearest number i.e. decimal value less than 0.5 will be rounded to lower immediate number while decimal value greater than equal to 0.5 will be rounded to upper immediate number. If there is a discrepancy between words and figures, the amount in words will prevail. Total score will be calculated by the formula stated as under:- Total Score = (0.7xT Score) + (0.3x L Score) (T Score = Score from Technical Evaluation Matrix) (L Score = Score from Commercial Evaluation matrix as per annexure G) The bidder with the highest total score will be considered as successful bidder Clarifications If deemed necessary PNB may seek clarifications on any aspect from the bidder. However that would not entitle the bidder to change or cause any change in the substance of the bid already submitted or the price quoted. The bidder may also be asked to give presentation for the purpose of clarification of the bid. All expenses for this purpose, as also for the preparation of the documents and other meetings/presentations, will be borne by the bidders Clarification on RFP by bidders Interested bidders can seek clarification on RFP from Bank by submitting their queries in written. The queries can be submitted as per the contact details given in the Bid Details in the RFP. However the queries should be submitted on or before the last date for submission of queries for clarifications as mentioned in bid details. Any query submitted after the expiry of the time line for submission of queries will be rejected. The response to the queries shall be placed on the Bank s websites and / or 11 of 35

12 4.5.5 Bid Currency: Prices shall be expressed in Indian National Rupees only Preliminary Examination: The bids will be examined by PNB to determine whether they are complete, whether required bid security has been furnished, etc. and whether the bids are generally in order. A bid determined as not substantially responsive will be rejected. PNB may, at its discretion waive any minor non conformity or irregularity in a bid which does not constitute a material deviation, provided such waiver does not prejudice or affect the relative ranking of any bidder Contacting PNB or putting outside influence: Bidders are forbidden to contact PNB or its Consultants on any matter relating to this bid from the time of submission of bid to the time the contract is awarded. Any effort on the part of the bidder to influence bid evaluation process, or award of contract decision may result in the rejection of the bid COST OF BID The bidder will bear all cost(s) associated with the preparation and submission of bid, including cost of presentation(s), reference site visit, etc. for the purposes of clarification of the bid. Bank will not be responsible or liable for these costs, regardless of the conduct or outcome of the bidding process CANCELLATION OF BID/ BIDDING PROCESS The Purchaser reserves the right to accept or reject any bid and annul the bidding process or even reject all bids at any time prior to award of contract, without thereby incurring any liability to the affected bidder or bidders or without any obligation to inform the affected bidder or bidders about the ground for the Purchaser s action. The purchaser reserves the right to accept or reject any technical proposal of the vendor. The purchaser reserves the right to select more than one vendor keeping in view bank s large requirement. 5. SIGNING OF CONTRACT The successful bidder(s) shall be required to enter into a contract with PNB, within 7 days of the award of the tender or within such extended period as may be specified by Bank, (on the basis of the Tender Document), the letter of acceptance and such other terms and conditions as may be determined by the Bank to be necessary for the due performance of the work in accordance with the Bid and the acceptance thereof. Bank reserves the right to extend the validity of contract beyond two years for the period of one year, on same terms and conditions with the approved vendor. 12 of 35

13 6. PERFORMANCE BANK GUARANTEE The Successful bidder shall submit a Performance Bank Guarantee to the Bank for an amount equal Rs. 20,00,000/- (Rs. Twenty Lacs Only) within 7 working days of award of contract. The Bank guarantee will be valid for 27 months from the date of contract and retained by Bank and may be extended for further period as required by the Bank. The Performance Security may be discharged by the PNB upon being satisfied that there has been due performance of the obligations of the Supplier under the contract. Failure of the successful bidder to comply with the requirement as per the RFP terms and conditions shall constitute sufficient grounds for the annulment of the award and forfeiture of the bid security, in which event the Bank may make the award to the next lowest evaluated bidder or call for new bids. 7. PATENT RIGHTS The vendor shall indemnify the purchaser against all third party claims of infringement of patent, trademark or industrial design rights arising from use of the Goods/services, or any part thereof in India. a. The vendor shall, at their own expense, defend and indemnify the purchaser against all third party claims or infringement of intellectual Property Right, including Patent, trademark, copyright, trade secret or industrial design rights arising from use of the products or any part thereof in India or abroad. b. The vendor shall expeditiously extinguish any such claims and shall have full rights to defend itself there from. If the purchaser is required to pay compensation to a third party resulting from such infringement, the supplier shall be fully responsible therefore, including all expenses and court and legal fees. c. The purchaser will give notice to the vendor of any such claim without delay, provide reasonable assistance to the Supplier in disposing of the claim, and shall at no time admit to any liability for or express any intent to settle the claim. d. The vendor shall grant to the purchaser a fully paid-up, irrevocable, non- exclusive license throughout the territory of India or abroad to access, replicate and use software (and other software items) provided by the supplier, including-all inventions, designs and marks embodied therein in perpetuity. 8. INDEMNIFICATION The vendor shall, at its own expenses, defend, and indemnify the Bank against any dispute/claims from anybody for having used or using patented designs in their equipment. Any patented designs used will be under manufacturer s license agreement, and a copy of such agreement shall be provided by the vendor to Bank. 13 of 35

14 The vendor undertakes to indemnify and keep indemnify the purchaser for all losses and claim against the bank raised by its customer or third parties in case of breach of any of the terms relating to confidential information. 9. DELAYS IN THE SUPPLIER S PERFORMANCE The successful bidder will be required to initiate the services within the period of 7 days from the date of placing order. In case of delay on part of bidder in initiating services will attract a penalty / termination of contract as defined in this RFP. The bidder shall be required to provide bank with the dashboard and reports for the services from the first day of initiation of services. 10. GOVERNING LAWS AND DISPUTES (This clause will be applicable in case of successful bidder only) All disputes or differences whatsoever arising between the parties out of or in relation to the construction, meaning and operation or effect of these Tender Documents or breach thereof shall be settled amicably. If however the parties are not able to solve them amicably, the same shall be settled by arbitration in accordance with the applicable Indian Laws, and the award made in pursuance thereof shall be binding on the parties. The Arbitrator/Arbitrators shall give a reasoned award. Any appeal will be subject to the exclusive jurisdiction of the courts at Delhi. During the arbitration proceedings the Vendor shall continue to work under the Contract unless otherwise directed in writing by the bank or unless the matter is such that the work cannot possibly be continued until the decision of the arbitrator or the umpire, as the case may be, is obtained. The venue of the arbitration shall be Delhi. 11. Earnest Money Deposit (EMD) Bidder to submit the EMD of Rs.5,00,000/- (Rupees five Lac only) as Bid Security in the form of Demand Draft or Pay Order / Cash Order in favor of Punjab National Bank Information Technology Division drawn on Delhi. This security is required to protect interest of PNB against the risk of conduct of the bidder, which may warrant the forfeiture of the security in the following scenario: a) In the event of withdrawal of bid during the period of bid validity; Or b) In the case of a successful bidder, if the bidder fails to sign the contract in accordance with the Terms and Conditions and other requirement as specified in RFP. Or c) Any act of bidder, which is not in line with contract obligations. Any bid not accompanied with requisite EMD shall be treated as non-responsive and is liable to be rejected. The EMD of the unsuccessful bidder shall be returned as early as possible, but not earlier than 30 days after closure of bidding process against acknowledgment from the 14 of 35

15 bidder. Successful bidder s EMD will be returned upon the bidder signing the contract and submitting the required Performance Bank Guarantee. No interest is payable on the amount of EMD. This EMD amount (DD/PO) should be kept in the envelope containing Technical Bid. In the absence of EMD, bid will be rejected. 12. ASSIGNMENT If bidder intend to engage any other organization to provide services or products, it is essential that bidder engage at most Two organization to provide all the relevant service or products. It should be confirmed that the OEM services are being provided by themselves and not outsourced from any other party. The same should be indicated clearly in the bid itself. The OEM will also be required to sign the Non-Disclosure Agreement with Bank as per the Annexure H. The acceptance letter from third party along with the documentary proof of their capabilities as detailed in bidding process must be provided in Technical bid. An undertaking from third party as per Annexure - I is to be submitted as part of technical bid. 13. UPTIME REQUIREMENTS Services must have 100% uptime and should be available on 24x7x365 basis. 14. SERVICE LEVEL AGREEMENT The successful bidder will also have to enter into a Service level agreement for Service Support as per the terms and conditions of the RFP and covering the scope of work and technical requirements. The SLA requirements are as under:- 24x7x365 monitoring with 100% uptime. Informing Bank regarding any incident through online Dashboard and within 30 minutes of detection. Resolution of incidents excluding Trojans & Spoofed s within 6 hours (To be calculated on quarterly average basis) Resolution of Trojans / Spoofed incidents within 7 days / 168 hours (To be calculated on quarterly average basis) Identifying and informing the Bank s website owners regarding the malware identified on the website within 30 minutes of identification. 15. Payment &Penalty 15.1 Payment Payment will be made to selected bidder for each incident (all incidents except malware identified on Bank s websites) closed during the quarter at the rate finalized as per the RFP. Payment shall be released quarterly in arrears on submission of invoice by the bidder. Payment shall be released only for unique incidents closed during the quarter. No payment shall be released for reopen incidents. 15 of 35

16 (An incident shall be counted as reopen incident if it meets the following criteria:- 1. Incident with same IP address and 2. Incident with same Fully Qualified Domain Name (FQDN) e.g. in URL FQDN is pnbindia.in. 3. A reopen incident within 90 days of the previous incident closure will not be treated as separate incident for purpose of calculation of number of incidents for payment.) Payment for scanning of Bank s websites for malwares will be releases quarterly in arrears on fixed basis Penalty a) Failure to maintain response time for incidences like Phishing, Pharming, Brand Abuse etc. (other than Trojans and spoofed )(calculated on quarterly average basis for all incidents):- In case vendor is not able to maintain the response time, a penalty of 5% of quarterly payment for the above services will be charged for the response time more than 6 hour but less than 12 hours. Penalty of 10% of quarterly payment of above services will be charged for response time more than 12 hours but less than 24 hours. If quarterly response time exceeds beyond 24 hours, penalty equivalent to 20% of quarterly payment of above services will be charged. In case an incident is not closed within the period of 7 days from the date of its identification then Bank shall not consider the incident for the payment. The total duration during which such incident is live will be taken into calculation of quarterly average during the quarter in which the 7 days of the incidents are completed. If incident is not closed during the quarter in which the period of 7 days elapsed then total time from detection to end of quarter shall be used for calculation of quarterly average. Also bank will reserve the right to get such incidents closed from other parties, expenses for which shall be recovered from the vendor. b) Failure to maintain response time for Trojan and spoofed incidents, malicious apps (calculated on quarterly average basis for all incidents):- In case vendor is not able to maintain response time, a penalty of 5% of quarterly payment for above services will be charged for response time more than 168 hours but less than 240 hours. Penalty of 10% of quarterly payment for above services will be charged for response time more 240 hours but less than 360 hours. If quarterly response time exceeds beyond 360 hours penalty equivalent to 20% of quarterly payment for above services will be charged. In case incident is not closed within the period of 30 days from the date of its identification, then Bank shall not consider the incident for payment. The total duration during which such incident is live will be taken into calculation of quarterly average during the quarter in which the 30 days of the incidents are completed. If incident is not closed during the quarter in which the period of 30 days elapsed then total time from detection to end of quarter shall be used for calculation of quarterly average. Also bank will reserve the right to get such incidents closed from other parties, expenses for which shall be recovered from the vendor. 16 of 35

17 c) Failure to detect incidences like Phishing, Pharming, Brand Abuse, Trojan, Spoofed , malicious apps etc.(to be calculated for each and every incident):- If selected bidder fails to detect and inform bank about any incident prior to bank detecting/ any other party informing bank about any of the incidents then penalty at the rate of 3 times the cost of closure of that type of incident (as per the agreement between the bank and the selected bidder for this RFP) will be charged from the selected vendor. d) Failure to maintain response time for Scanning of Bank s websites for Malware (To be calculated on quarterly average basis):- Penalty at the rate of 10% of quarterly payment for Website scanning services will be charged for delay in response time more than 30 minutes but less than 4 hours. In case of response time more than 4 hours the penalty at the rate of 20% of quarterly payment of website scanning services will be charged. 16. CONFIDENTIALITY / NON DISCLOSURE AGREEMENT (NDA) i) The bidder (and his employees) shall not, unless the bank gives permission in writing, disclose any part or whole of this RFP document, of the proposal and/or contract, or any specification, plan, drawing, pattern, sample or information furnished by the bank, in connection therewith to any person other than a person employed by the bidder in the performance of the proposal and/or contract. The employees or the third party engaged by the bidder will maintain strict confidentiality. ii) The bidder, his employees and agents shall not without prior written consent from the bank make any use of any document or information given by the user, except for purposes of performing the contract award. iii) In case of breach, the bank shall take such legal action as it may be advised. Successful bidder will have to sign the Non-disclosure Agreement with the Bank as per draft enclosed in the annexure H. If the bidder is planning to engage OEM for the services, then OEM is also required to sign the same NDA with the Bank. Duly signed copy of the same has to be submitted as a part of the Technical bid. 17. TERMINATION a) Bank will have the right to terminate the contract after giving one month s advance notice to the vendor in case of unsatisfactory services or noninitiation of services within 7 days of order. b) Bank will have the right to terminate the contract after giving one month s advance notice to vendor in case of failure of vendor to maintain the prescribed uptime for the 2 consecutive quarters. c) Bank will have the right to terminate the contract after giving one month s advance notice to vendor in case of failure of vendor to maintain the response time for consecutive 2 quarters. 17 of 35

18 d) Bank will have the right to terminate the contract after giving one month s advance notice to vendor in case of failure of vendor to maintain the uptime of more than 99% in any quarter. 18. FORCE MAJEURE Any failure or delay by vendor or Bank in performance of its obligations, to the extent due to any failure or delay caused by fire, flood, earthquake or similar elements of nature, or acts of God, war, terrorism, riots, civil disorders, rebellions or revolutions, acts of governmental authorities or other events beyond the reasonable control of non-performing Party, is not a default or a ground for termination. The affected Party shall notify the other party within reasonable time period of the occurrence of a Force Majeure Event. 19. Miscellaneous 1. Billing for the services has to be done through bidder only. 2. No direct payment shall be made to OEM. 3. In case services are abruptly stopped without proper notice then the Bank reserves the right to a. Blacklist the vendor / OEM from future procurement processes b. Get the outstanding incidents blocked through alternate vendors and the expenses of the same shall be recovered from the successful bidder. 20. Obligations of PNB 1. Bank shall share with successful bidder the logs of web-servers of bank s websites 2. Bank shall share abuse mailbox with successful bidder. 21. Obligations of Successful Bidder 1. Bidder shall ensure that data shared by Bank is used only for the purpose of the services for which it is shared. In no case the information shared by Bank will be used for any other purpose without explicit written permission of Bank. 2. Bidder shall ensure that forensic evidence like snapshots, source code of WebPages, URLs, IP address, country, compromised details etc. is captured for all incidents. This information shall be provided to Bank (for all cases) as well as law enforcement agencies (on written directions from Bank). 3. Bidder shall keep the record of all the incidents as well as forensics of these incidents during the period of contract and for 1 year after that. 4. Bidder shall not withhold any information relevant to incidents related to Bank. 18 of 35

19 Bank reserves the right to verify the authenticity and accuracy of the documents submitted by bidder by communicating with any party through written mail, , telephonic calls or any other medium. Bank reserves the right to conduct negotiations. 19 of 35

20 Annexure A To, The Chief Manager IT Procurement Deptt. Punjab National Bank Information Technology Division HO: 5, SansadMarg New Delhi Sir, Undertaking-I Reg.: OUR BID FOR Monitoring of Internet and Identification of Threats & Providing Remedies Relating to Phishing, Pharming, Trojans, Spoofed s, Brand Abused.& Scanning bank s We submit our Bid Document herewith. We understand that You are not bound to accept the lowest or any bid received by you, and you may reject all or any bid. If our Bid for the above job is accepted, we undertake to enter into and execute at our cost, when called upon by the Bank to do so, a contract in the prescribed form. Unless and until a formal contract is prepared and executed, this bid together with your written acceptance thereof shall constitute a binding contract between us. If our bid is accepted, we are to be jointly and severally responsible for the due performance of the contract. You may accept or entrust the entire work to one vendor or divide the work to more than one vendor without assigning any reason or giving any explanation whatsoever. Vendor means the bidder who is decided and declared so after examination of commercial bids. The names of short listed bidders after the completion of first stage (Technical Bid), and the name of successful bidder to whom the contract is finally awarded after the completion of second stage (Commercial Bid), shall be displayed on the Notice Board of the Bank (i.e. the Bank) at Punjab National Bank, Information Technology Division, 2nd Floor, Head Office, 5, Sansad Marg, New Delhi The same shall be displayed on the corporate website of the Bank (i.e. PNB website Dated at this day of Yours faithfully For Signature: Name: 20 of 35

21 Annexure B Minimum Eligibility Criteria For Bidder Table 1 Sno. Eligibility Criteria Compliance 1. Bidder should be an established Indian Company (incorporated in India). Bidder must be currently a legal entity in India. Bidder to give certificate of incorporation or any other certificate of registration issued by competent authority from Government of India. 2. Bidder should have minimum turnover of Rs.20 Crores in last financial year ( ), Bidder must provide the details of turn over for last 3 years ( , , ) and reported positive net worth during these years. Bidder to submit the audited Balance sheets of the said 3 years. 3. Bidder must have supplied similar Information Security solutions to Banks / Government organizations/other financial organizations during last 3 years. Bidder to Submit copy of orders and / or certificates from customers as evidence of providing satisfactory services. 4. Bidder should not be warranted in any legal case that may affect the solvency / existence of firm or in any other way affect the bidder s capability to provide / continue the services to bank. Bidder to give undertaking from Company Secretary / Managing Director. Bidder should submit a detailed response along with documentary proof for all of the above eligibility criteria. The eligibility will be evaluated based on the bid and documentary proof for the above criteria. Bids not meeting the above eligibility criteria will be rejected. 21 of 35

22 Following documents are to be furnished by the bidder: a) EMD as stated b) Full address of the registered office and established office. Annexure C c) Registration certificate under Indian Companies Act / or any other certificate of registration issued by competent authority from Government of India. d) Audited balance sheets of the last 3 financial years (i.e , , ) indicating turnover and net profit. e) Proof of similar work in last 3 years. f) Power of Attorney: Power of Attorney for the authorized signatory from Company Power of Attorney should be on stamp paper in the favour of official who has signed the bid documents. Power of attorney and mandate of board resolution should be submitted. Power of Attorney should be effective on the date of submission of bid documents. Power of Attorney will not be revoked during the validity of Bid and shall remain inforce during the currency of bidding process until its finalisation. g) Documents supporting eligibility and Technical Bid criteria. h) Undertaking as per annexure A. i). Documents as per Eligibility criteria (Annexure B) j). Company information as per Annexure D k). Documents as per Technical Table (Annexure E) l). Compliance statement as per annexure F m). Non disclosure Agreement as per annexure H. n). Letter / Undertaking from OEM as per Annexure I. If the bid is not accompanied by all the required documents, the same would be rejected. 22 of 35

23 Company Details / Bidder information Annexure D Detail of the bidder: i. Name ii. Date of incorporation and / or commencement of business. iii. Address of the corporate headquarter and its branch office(s) iv. Address for communication v. Certificate of incorporation of company vi. Brief description of the Bidder including details of its main lines of business. vii. Company website URL viii. Particulars of the authorised signatory of the Bidder: Name: Designation: Address: Phone number: Fax Number: Address: Signature & Seal of Company 23 of 35

24 Technical Specifications and Technical Evaluation Criteria Annexure E Sno. PARAMETER (Online Fraud Monitoring) 1 Dedicated 24*7*365 support, DR setup, ability to handle any critical issue within the earliest possible time and capability to monitor fraud related activities through popular mechanisms (Please describe the mechanisms used) 2 Ability to monitor all kind of incidents given below: Phishing: Pharming Trojan Brand Abuse Compromised Servers Spoofed address Domains (old / new) similar to Punjab National Bank/PNB/PNB India etc Malware on Bank s website 3 Ability to monitor major Mobile app store for Malicious App/Trojan etc. 4 Ability to report incidents through all modes of communication ( , sms, phone call, dashboard etc) and sending list of compromised accounts immediately on detection. 5 Ability to close any incident within the earliest possible time, take proper counter measures wherever required, ensuring continuous monitoring for repeated incidents and maintaining sufficient contacts with ISP/third parties to act on behalf of PNB for timely closure of incidents 6 In how many international languages is service provider able to communicate (minimum 10 languages should be supported) Reference Check (In addition to the response that will be submitted) 1. Official address with phone number and address 2. DR plan/location details 3. Client references for SLA met so far. 4. References or membership certificates (Anti Phishing work Group/Cert-IN etc) 5. Response document to RFP 1. White paper of services 2. Client reference or experience certificate 3. Gartner report / third party independent source 4. Response document to RFP 5. Please provide undertaking from service provider for mentioned requirements, and for the period of contract with the Bank. 1. White paper 2. Response document to RFP 3. Please provide undertaking from service provider for mentioned requirements, and for the period of contract with the Bank. 1. Client reference 2. White paper 3. Response document to RFP 4.Please provide undertaking from service provider for mentioned requirements, and for the period of contract with the Bank. 1. Client references 2. List of contacts 3. Response document to RFP 4.Please provide undertaking from service provider for mentioned requirements, and for the period of contract with the Bank. 1. Number of people who are skilled in listed and additional languages 2. Any other documentary evidence 3. Response document to RFP 4. Please provide undertaking from service provider for mentioned requirement Complied (Yes / No) Remarks 24 of 35