Ref: Ltr No: 30865/CO: DIT/RFP-223/AV/Ram

Transcription

1 DEPARTMENT OF INFORMATION TECHNOLOGY CORPORATE OFFICE 2nd Floor, Commercial Complex, National Games Village Koramangala, Bengaluru Tel: , EPABX: Fax: , Ref: Ltr No: 30865/CO: DIT/RFP-223/AV/Ram To, All Eligible Bidders. Sub: / for Supply, Installation, Updation and Maintenance of Antivirus solution with End point protection and end point data loss prevention for use in our Branches/Offices. Ref: RFP 223/CO: DIT/AV/arm dated 19/01/2017 Banks / If the bidder quotes for the exisitng brand of AV 1- Brief licenses in Syndicate Bank, would that still Description of need additional hardware & OS requirements the Hardware/Software for DC, Mumbai and or the bidder can use the same hardware in No, vendor has to bring their 1. Requirements DRS Bangalore which it is currently running. If Yes, please own required hardware. Serial no- iii provide us the current configuration details for Page No- 3 us to know whether it can scale up further to additional AV licenses We request bank to amend the clause & allow bidders with positive net worth to quote. 2. The Bidder should have made net profit Eligibility Criteria The bidder should have made net profit after after tax for at least 2 out of the three Page No.4 tax for atleast 2 out of three consecutive consecutive financial years and average Point No: 2 financial years. net-worth of ~ 15 Crores. (OR) RFP term stands The bidder should have made net profit after tax for atleast 2 out of three consecutive financial years and should have positive Page 1 of 14

2 Ref: Ltr No: 30865/CO: DIT/RFP-223/AV/Ram Date: 13/02/ Clause No.1 networth in previous 3 years --~ ~j1~equest you amend the clause to Bidder / OEM as very few vendors will be qualified which will limit the participants of the OEM to for the bank Eligibility Criteria Page No.4 Point No: 5 The bidder should have provided and deployed in a Wide Area Network, a minimum 15,000 licenses of Antivirus solutions, to minimum 3 Banks/ PSU/Govt Organizations for the last five years (2011 and 2016) 2. Kindly request bank to Dilute the clause as: The bidder should have provided and deployed in a Wide Area Network, a minimum licenses of anti-virus solutions to minimum 1 bank/psu/govt organizations for the last five years( From 2011 to 2016 ) OR The bidder should have provided and deployed in a Wide Area Network, a minimum licenses of anti-virus solutions to minimum 3 banks/psu/govt organizations for the last five years( From 2011 to 2016 ) 3. We request the bank to clarify if upgrade/renewal/support experience qualifies during this period. RFP Clause modified as "The bidder should have provided and deployed Antivirus solutions in a Wide Area Network to minimum 3 Banks/ PSU/Govt Organizations for three years and bidder should have provided and deployed minimum of 15,000 licenses to at least one of them and cumulatively not less than licenses." ~~~W---_L ~ 4. The Bidder should have provided and deployed in Wide Area Network, a minimum 8000 licenses of Antivirus solutions to minimum of 2 bank/psu/govt organisation for the last five years (2011 and 2016) (OR) The Bidder should have provided and._::_d_:_ep._l~o:_ye~d_l, Page 2 of 14

3 Ref: Ltr No: 30865/CO: DIT/RFP-223/AV/Ram Date: 13/02/2017 in Wide Area Network, a minimum licenses of Antivirus solutions to minimum of 1 bank/psu/govt organisation for the last five years (2011 and 2016) a) We request the bank to amend the clause to: 1) 8 weeks for Delivery and Installation of 4. Delivery Period Clause No: 6 Page No: 6 Bidder shall be responsible for delivery/ installation of Antivirus solution with end point protection in PCs/ Servers within 1 month from the date of Purchase Order Software & hardware at DC & DRS 2) For deployment of client solution in all the end user devices we request bank to provide minimum 6 months' time b) Bidder shall be responsible for delivery of antivirus solution with endpoint protection in RFP clause stands. PCs/Servers within 1 month from date of Purchase order. And installation to be completed within 45 days of delivery of licenses. Liquidated Damages: For any delay in delivery, installation and commissioning of Antivirus solution, beyond the dates as 5. Liquidated Damages Clause No: 6 stipulated above, the Bank reserves the right to charge a LD (Liquidated Damages) as detailed below: We request bank to relax the clause and amend the same to 0.5% per week of undelivered product/services value to RFP clause stands. Page No: 6 The vendor will be liable for a penalty of 0.5% of the contract value per week subject to a maximum of 10% of the maximum of 5%. license fees. The amount of LD will be Page 3 of 14

4 Ref: Ltr No: 30865/CO: DIT/RFP-223/AV/Ram Date: 13102/2017 recovered from the vendor from payments due to them or by invoking Bank Guarantees provided by the vendor. If the LD reaches the maximum, the Bank will be at liberty to terminate the contract and invoke all BGs. 6. Payment Terms Clause No: 8(a) & 8(c) Page No: 7 Payment terms mentioned as A. License 100% of the Licence fee along with one time Implementation Charges, if any, will be released on satisfactory customization, implementation and deployment of Licenses at the needed branchesl offices We request the bank to amend the payment upon submission documents... terms to: C. Payment for Hardware, Database & OS Licenses: License fees: 100% on delivery site-wise i) On Delivery and Installation: Seventy Installation charges to be released post (70) % of the Contract Price of the Goods installation site-wise along with 100% sales tax, 100% Octroi, Hardware, Database & OS licenses: wherever applicable, shall be paid on successful installation of goods and upon submission of the documents (separate requests for release of Octroi payments will not be entertained): => On Delivery: 90% of contract price site-wise => On final acceptance: 10% of contract price site-wise. RFP clause stands. ii) On Final Acceptance: Thirty (30) % of the Contract Price of the Goods shall be paid 30 days after successful working and Page 4 of 14

5 Ref: Ltr No: 30865/CO: DIT/RFP-223/AV/Ram Date: 13/02/2017 upon submission of the documents. B. Onsite Support Charges: Even though, Onsite support charges are taken up to 31/03/2020, payments will be released quarterly in arrears on pro-rata basis from the date of providing on-site support of the relevant quarter within Payment Terms Clause No: 8(b) Page No: 7 days of receipt of claim. Payments will be released on receipt of confirmation from DIT based on verification from the Central We request the bank to release the same quarterly in advance. RFP clause stands. console. However, all the licenses and support shall be properly provided irrespective Non-claiming/ Non-renewal of maintenance charges/ on-site support charges by the vendor in time. of 9. License, Hardware and For all the problems which could not be resolved through telephone or and Software 8. Maintenance [...,::::;:;:::j:::_~and. Penalty /.;ll~l$ e No: 9 fmrfa ~ 0: 8 I *~'~~:; - *.II \. sse opj47..., IV ~._ which requires the presence of Successful Bidder engineer, the response time would be 2 hours from the reporting time at Metro/Urban centres & and at other locations outside the Metro/Urban centres within 4 hours. If the problem is We request bank to provide 24 working hours response time at site & 48 working hours for rectification of reported problem. RFP Clause stands. Page 5 of 14

6 Ref: Ltr No: 30865/CO: DIT/RFP-223/AV/Ram Date: 13102/ Clause No.1 not rectified within 24 hours of lodgement of complaint, penalty will be levied the vendor will be liable for penalty as detailed in service level & uptime subject to a maximum of 10% of the license fees for each complaint. If the penalty reaches the maximum, the Bank will be at liberty to terminate the contract and invoke all BGs. Service Level and Uptime: License, Hardware and Software Maintenance and Penalty Clause No: 9 Page No: 8 The vendor shall ensure that the system gives minimum 99.50% uptime (Calculated on monthly basis). For every 0.05% or fraction thereof of additional downtime, Bank will impose a penalty of 1% of the monthly payment on the onsite support (subject to maximum of 10% of the contract value during Contract Period of three years). We request the bank to relax the clause to 99% up-time calculated on quarterly basis. We request bank to relax the penalty clause to 0.5% per week of faulty/down equipment value to maximum of 5% of faulty/down equipment value. RFP Clause stands. 9. License, Hardware and Software Maintenance 10. and Penalty ~:f:=::::s...the Broad ~ ~~~ice Levels ~?;~~J\O:1 I~ sen95 "'~~ II / ~.~600 ~ Deployment latest antivirus definitions: of Antivirus Software and Latest antivirus software version if any during the contract period is to be deployed in all machines within 4 weeks release of the version without any additional cost. 85% assets covered by Solution shall have We request bank to limit the version change deployments to 1 during the contract period. Also please provide min 6 months required for such deployments as it involves huge effort and time. Also consider 75% assets to be covered by solution shall have latest virus definitions older than 3 working days. not RFP Clause stands. ~1,!"'" ~ T Page 6 of 14

7 Ref: Ltr No: 30865/CO: DIT/RFP-223/AV/Ram Date: 13/02/2017 Page No: 9 latest virus definitions not older than 3 days from release of the updates. Daily report is to be submitted Consolidated report every week. 99.5% uptime for solution server For every 0.10% drop, we request bank to consider 0.5% of the monthly payment. For every corrupted PC that remain unsolved to reduce the penalty to Rs 500 per day. We request bank to consider overall max SLA penalty to 5% of the monthly charges, as uncapped penalty is considered as huge risk for the bidder/si Reporting and validation of installations: License, Hardware and Software Maintenance and Penalty The Broad Service Levels SI No: 2 Page No: 9 Usage of bandwidth from Solution server to Network distribution point and from Network distribution point to branch distribution point should not cross the threshold limit as per Bank's Bandwidth Management Policy, which is currently 10% of total bandwidth during Business Hours (i.e. 10:00 HRs - 17:30 HRs). Bandwidth throttling report is to be submitted daily. More than 98% clients shall be online in Daily reporting of status of antivirus clients. We request Bank to consider 95% of the clients to be online in daily status report (provided machines are switched on status). For every 0.10% drop, we request bank to consider 0.5% of the monthly payment. For every corrupted PC that remain unsolved to reduce the penalty to Rs 500 per day. We request bank to consider overall max SLA penalty to 5% of the monthly charges, as uncapped penalty is considered for the bidder/si as huge risk RFP Clause stands. Consolidated report every week. 9. License, Hardware and ~I-Software #~syn!'. tenance ~ivt: a & ~nalty 3f( ~~Ihe ~}~ad Trouble shooting & Resolution of 1. We request to consider "Based on the computers, which remain infected: signatures/patches/solution made available by OEM, 97% of the tickets lodged for distribution Identify and apply within 1 day any nodes shall be resolved in 24hrs and 95% of signature/ solution that needs to be used for tickets lodged for clients in less than 48hrs" all "still infected" machines. Daily report to be RFP Clause stands. Page 7 of 14

8 Ref: Ltr No: 30865/CO: DIT/RFP-223/AV/Ram Date: 13/02/2017 Service Levels submittedconsolidatedreport every week. For every 0.10% drop, we request bank to SI No: 3 consider 0.5% of the monthly payment. In case of any compatibilityissue with Page No: 9 For every corrupted PC that remain unsolved respectto the Antivirus Software installation/ up-gradation,the SI shall troubleshoot, to reduce the penalty to Rs 500 per day. resolve,test and deploy the necessary We request bank to consider overall max SLA patch/ solutiononto the affected machines. penalty to 5% of the monthly charges, as uncapped penalty is considered as huge risk 97% tickets loggedfor distributionnode shall for the bidder/si be resolvedin less than 12 hours and 95% tickets loggedfor clients in less than 24 Hours. Daily reportto be submitted. Consolidatedreport every week License, Troubleshoot & resolution computers 2. For every 0.10% drop, we request bank to Hardware and corrupted due to virus attack: consider 0.5% of the monthly payment. Software Identifyand apply any signature needed for For every corrupted PC that remain unsolved Maintenance all corruptedmachineswithin 1 day. to reduce the penalty to Rs 500 per day. and Penalty The Broad Performanceand scalability review report We request bank to consider overall max SLA Service Levels every quarter penalty to 5% of the monthly charges, as SI No: 4 Providinghistoricaldata of last 6 months uncapped penalty is considered as huge risk Page No: 9 immediately. for the bidder/si RFP Clause stands. ~s~ r~~ 11. BID c) THE BID SECURITY MAYBE SECURITY AND FORFEITED ~STOFRFP ~'"" ~~S7 No: 11 (c Ben~aluru, '~ '.gv (b) If a Bidder fails to participate and quote price in Online Sealed bids or fails We request the bank remove this clause. RFP Clause stands. ~If'" :::!',. -- Page 8 of 14

9 Ref: Ltr No: 30865/CO: DIT/RFP-223/AV/Ram Date: 13102/2017 Mod ifications (b)) Page No: 11 to login in Reverse Auction Process, or I. BID SECURITY: BID SECURITY AND COST OF RFP Clause No: 11 (c (b)) Page No: 11 a) The Bidder shall furnish, as part of its Bid, a Bid security for an amount of~. 15,00,0001- (Rupees Fifteen Lakh only) in the form of a Bank Guarantee issued by a reputed Bank in India other than Syndicate Bank in the format enclosed valid up to Six months from the date of RFP and to be submitted along with the Bid. Other Leading PSU Banks provide EMD Exemption if the Bidder is MSME registered. Requesting you to extend the same benefit to bidders as well Yes, Bidder registered as MSME units in India will be exempted from payment of cost of RFP and submission Bid Security. of 16. Page No: 29 Point No: 8 INTERNET-BASED SCAN & DELIVER - Should enable automatic submissions of unknown 1 suspected virus samples to vendor and automatic of the cure response 1 delivery Do we mean that the files when suspected be sent to the vendor cloud? What if the will suspected file is a classified file? We suggest that all submissions happen on On Premise and any Automatic response/delivery happen from on Premise solution for unknown threats. It is the discretion of the bank to submit the filel virus data to the OEM website. The requested functionality should be available in the solution. 17. Page No: 29 Point No: 11 ~e;s ndic~ f#/~~ ifl(~.engal~~~11 ROAMING CLIENT SUPPORT - The antivirus software should be able to automatically detect and update definitions & scan engine from the nearest parent server in the network By roaming we understand that the user is outside the LAN, the user should not only be able to get updates but should be able to do submission to on premise Threat intelligence. In case the dedicated updater is down then the updates should be taken up by the nearest updater within LAN. ~~ -r Page 9 of 14

10 Ref: Ltr No: 30865/CO: DIT/RFP-223/AV/Ram Date: 13/02/2017 Banks / 18. Page No: 30 Point No: 28 Should have Improved Security with Network Audit - to find out which antivirus solutions are installed on protected workstations and network servers (includes AntiVirus Corporate Edition, McAfee Virus Scan, Trend Micro OfficeScan, Computer Associates, Innoculan, Sophos, Panda etc.,) And find out which workstation and network servers are unprotected Solution can have that capability but as per understanding the Bank currently has SEP. The bank will have only one vendor AV across thus it is imperative to show how many machines are protected/not protected by current AV not multi vendor as it would not be compliant. RFP Clause is clear. 19. PageNo:31 Point No: 39 Should have Internet Zone Control Need Clarity on the same. The solution should have the capability to prevent the attacks coming through internet traffic when deployed in the machines which are in the internet zone. 20. Page No: 31 Point No: 41 Should have VPN Support Need Clarity on the same. Machines which are connecting through VPN installed with AV client should have the capability to connect to the parent machine for updates. 21. Page No: 31 ~ Synd.~nt No: 46 M'7 A ~~, j'jl( ~~.~ W~ ---=- Should have Closed Loop Automation through the Digital Immune System Symantec term, Layer technology term suggested with Pattern Matching, Heurestrics, Behaviour Monitoring, Machine learning, Ransomware Protection, Sandbox submission on premise. RFP clause dropped Page 10 of 14

11 Ref: Ltr No: 30865/CO: DIT/RFP-223/AV/Ram Date: 13/02/ Clause No.1 Need more clarity on this. Should have Unknown Virus Detection & Kindly elaborate as this would include APT as 22. Page No: 31 Repair well Point No: 48 RFP clause dropped 1) IDS/IPS on host should not be preconfigured with static rules (They might be applicable or not applicable to endpoint). IDS/IPS should have automatic provisioning as per the Vulnerability posture of the endpoint Should maximize deployment flexibility by providing the Why we need anti-spam on endpoint, it should ability to pre-configure Anti- Should maximize deployment flexibility by be protected at the gateway? Dedicated Virus, FW & IDS installation providing the ability to pre-configure Anti- solution also availble, not necessary to packages from the central Virus, FW & IDS installation packages 23. Page No: 31 make AV client very heavy level. Point No: 52 Should Support Anti-Spam 2) Generally spam attack takes place through RFP clause stating "Should for which dedicated Mail Security is Support Anti-Spam" stands preferable cancelled. - ~ ~SYnd/~. (% ' ~~ <9~ I.~ Benga/u :_ II ~ i:i V -if,.j-"f' V' T 3) Generally spam attack takes place through for which dedicated Mail Security is preferable. Page 11 of 14

12 Ref: Ltr No: 30865/CO: DIT/RFP-223/AV/Ram Date: 13102/ Page No: 31 Point No: 54 Should incorporate a privacy control function that prevents distribution of userdefined confidential information without user knowledge This is more of a DLP feature that should stop the same with or without user knowledge. RFP Clause is clear Page No: 31 Point No: 55 Solution should have the capability of machine learningl similar mechanisms (on premise) to detect advanced malware threats. Machine learning should be on premise and so should submissions RFP Clause is clear, capability of machine learningl similar mechanisms is on premises. 26. Page No: 32 Point No: 70 The Antivirus product should also have the capability to identify phishing attacks and inform to end user Request bank to bring more clarity on this point Request the bank to bring more clarity on the same. The Antivirus product should also have the capability to identify phishing attacksl phishing sites and inform to end user and administrator. 27. Specs, Page No 32, Point 75 Virus incident alerting: the proposed system should be configurable to alert the designated administrators of virus incidences at the very minimum using LAN messages and messages. SMS (short messaging service) alerting for critical occurrences (configurable) is an added advantage Please define and indicate level of SMS Support and alerts required We request the bank to clarify the same RFP Clause is clear. The solution should have the capability to send SMS to administratorsl operational department personals which is less than 15 in no. Specs 28.,Page No 33, b.~ sy~'nt 82 ar;:~~~ anrn In" Y\~_ 'Jl1 Solution should have the capability to integrate with advanced threat prevention mechanisms. Is it required only with Endpoint ATP? Need more clarity on this. The clause is modified as: Solution should have the capability to integrate with advanced threat prevention mechanisms at endpoint level. Page 12 of 14

13 Ref: Ltr No: 30865/CO: DIT/RFP-223/AV/Ram Date: 13102/2017 No. PageNo. RFPTerm Bidders Requestfor following Clause No: Page No: 33 Capability to integrate with Advance Threat Protection. Is it required only with Endpoint ATP? Please clarity on this. The clause is modified as: Solution should have the capability to integrate with advanced threat protection at endpoint level. 30. Page No: 35 Point No: End Point DLP solution shall provide support for the following platforms: Microsoft Servers of all variants Windows 7 and above Linux, AIX etc. DLP is very user centric and required on endpoints and gateway, not sure on the used case for Linux and AIX, kindly clarify RFPclause modified as following: "Solution shall provide support for the following platforms: Microsoft Servers of all variants Windows 7 and above" 31. ~Synd~ f~~ I * BengaIU~" ~ ,' Price Schedule for License Fee and other charges Notes) a. point Page No: 46 a. Quantity shown for new licenses above is for evaluation purpose only. Payment will be made on Actual number of Licenses supplied & installed. Requesting Syndicate Bank to modify this clause as: The quantity mentioned above, is indicative and the Bank reserves the right to vary the quantity as per requirement but maximum up to 5% +1-. Variation of number of Users 1 assets 1ticket data up to +/- 5% will be absorbed in the initial pricing. Any addition beyond 5% or any addition of location where the desktop engineer or on call support is required, needs to be charged extra to the customer irrespective of resource increase 1 decrease at the rate to be quoted and agreed between customer and HCL. RFP clause stands. ~~ '.~~ T Page 13 of 14

14 Ref: Ltr No: 30865/CO: DIT/RFP-223/AV/Ram Date: 13102/2017 Annexure P Annexure P Details of Hardware & 32. Page No: 59 Operating System If the bidder quotes for the exisitng brand of AV Bidder has to provide brand licenses in Syndicate Bank, can he use the new hardware tailored to meet existing hadrware & OS infrastructure banks requirements. 33. new Frequency of Preventive Maintenance is We request the bank to define the frequency of not mentioned Preventive Maintenance. frequency of Preventive Maintenance should be on Quarterly basis All the participating bidders are requested to make note of the above clarification and all other Terms and conditions of RFP will remain the same. Last date for submission of bid documents has been extended up to 22/02/2017 by 1600 hours at this office Yours faithfully, ~~ General Manager (IT) ((Iv ~~ Page 14 of 14