LIFE INSURANCE CORPORATION OF INDIA CENTRAL OFFICE IT/BPR DEPARTMENT

Transcription

1 S.No. RFP Document Reference (s) (Section & Page Number) 1 Page 39, 6.1 Part A,r LIFE INSURANCE CORPORATION OF INDIA CENTRAL OFFICE IT/BPR DEPARTMENT Clause (in brief) of RFP requiring clarification (S) LIC has implemented Active Directory in Windows desktops & laptops. Vendor should provide solution for integration of Active Directory implementation with 2FA. Similarly, vendor is required to provide assistance for integration of 2FA along with LDAP authentication. RFP:Ref: LIC/CO/IT-BPR/2FA/ Final set of query responses from LIC Brief Details / Query in reference to the clause Does vendor need to provide AD solution with biometric log on or 2FA is only required. Where are the credentials stored for windows log on. Is biometric log on required for Linux (RHE) based machines also if yes where are the credentials stored. Date: LIC response Vendor to provide only 2FA solution along with all necessary hardware. Scope for integration with LDAP or any other authentication used I LIC is required to be factored by the bidders. 2 LIC desires to implement centralized architecture for Fingerprint Scanner for enrollment Will user be authenticated only to finger print authentication or it will be combined with any password / PIN authentication? 2 factor means Password and fingerprint 3 Section a.ii, and Section b page 11 Rs 10 Lakhs is to be paid through DD payable to LIC of India at Mumbai. The next point b states that the EMD should be valid for a period of one year form the date of opening of eligibility bid. The validity period of DD is only three months form the date of issue of the DD. Kindly clarify. Or is it that this EMD amount has validity period of three months? All EMDs are to be submitted in the form of bank guarantee. These EMDs should be valid for a period of minimum one year from the date of submission of the Bid.

2 4 6) If vendor participates only for the part B, can the vendor give bank Guarantee for EMD instead of DD as it is not specified in the document. 6) If vendor participates only for the part B, can the vendor give bank Guarantee for EMD instead of DD as it is not specified in the document. All EMDs are to be submitted in the form of bank guarantee. These EMDs should be valid for a period of minimum one year from the date of submission of the Bid. 5 pg. 36, a Bidders who are short-listed based on criteria as mentioned under bidder s qualification criteria of this RFP will have to demonstrate Proof of Concept (POC) of their Biometric solution Will the device used for POC by the part A bidder have any bearing on the bidding for part B? What if a device being offered for part B is not part of any of the part A POCs? Bidder for Part A has to ensure that their proposed 2FA solution works with any fingerprint scanner device which are STQC certified. 6 Page 45 4) Page 45 : Hardware Sizing : should we give all the hardware or LIC will procure and give us based the Hardware specifications. 4) Page 45 : Hardware Sizing : should we give all the hardware or LIC will procure and give us based the Hardware specifications. Bidder for Part A has to provide all hardware required for this project except biometric scanner devices covered under Part B. 7 Cover page Two factor Authentication UIDAI defines two factor authentication (2FA) as one factor being biometric (either FP or Iris) and the second factor being OTP. Please clarify in case the mobile number is not registered then how will 2FA be handled. Also of the biometrics it is fingerprint sensor that will be supplied as part of this RFP. Therefore can biometric authentication be limited to fingerprint only or Iris also needs to be considered as one of the biometric factors for authentication. LIC proposes to use biometric fingerprint as 2nd factor and user password as 1st factor for authentication or vice versa.

3 8 Part B 2) What is the process of installation of the SDK? Will LIC give access/ permission to install the same. ( Part B). 9 Page 21, 3.C.10 The Bidder should have supplied installed similar software/services for at least one organization in India as ASA/KSA. 2) What is the process of installation of the SDK? Will LIC give access/ permission to install the same. ( Part B). LIC will allow installation of Drivers/SDKs as necessary. As we understand, this requirement is to No change in RFP conditions. enable LIC to act as ASA/ KSA in future. There are handful players who have active ASA solution deployed in live environment and a few of them are going to provide these services to 3rd party. Considering this, we request to consider the experience of integrating with UIDAI CIDR on UAT environment for ASA / KSA system also to be considered for this eligibility criteria as this is primarily to ensure the capability of organization for integrating directly with UIDAI. The system which is under development also should be allowed to be considered with prior confirmation of UIDAI authority 10 Page 21, 3.C.12 The proposed software should have handled at least 1 lakh ekyc/authentication transactions since We request to reduce this number to 50,000 and also to consider multiple instances of the same software, where the same is deployed at different clients' premises No change in RFP conditions.

4 11 General Considering increased coverage of UID across the country and most of the Govt entities adopting Aadhar based Services for Attendance, we request to reconsider the scope of 2FA Solution to eliminate FP Capturing / De-duplication & Authentication so as to leverage on UID infrastructure and avoid cost and efforts on Enrollment / Verification / De-duplication software solutions, operations as well as infrastructure maintenance No change in RFP clause 12 Section 3 Eligibility Criteria point C-10, page 21 The bidder should have supplied installed similar software /services for at least one organization in India as ASA/KSA Since there are only a few ASA KSA organizations the scope of production deployment is limited. We have developed and installed the AUA and KUA software. ASA and KSA server software can be similarly deployed. We have the expertise and we will complete this service without impacting the project schedule. We therefore request you to kindly relax this criteria. No change in RFP clause 13 RFP Pg Ref 52 Warranty Point Warranty replacement due to normal wear and tear for 5 years Warranty replacement is as per standard terms No change in RFP clause.

5 14 pg. 17, LIC, at its discretion, may place repeat orders with the successful bidder for additional requirement of devices (not exceeding 25% above the quantities defined in the commercial bid) within a period of one year from the date of issue of 1st purchase order, with no escalation in price. Provided, however, if there is reason to believe that the prices of the devices under consideration have fallen in the market LIC may negotiate the price with the successful bidder before placing order for such additional requirement. Request that either no change in price be allowed, or that negotiation be allowed for both parties, upwards or downwards depending on market conditions. No change in RFP conditions p The bidder will ensure that the scanners remain compatible with any hardware, software, firmware and patches/upgrades done periodically on the branch/office desktops, as per LIC s Policy. 16 In both( Part A & Part B) 3) In both( Part A & Part B) payment terms states 20 % at the end of 1 year on submission of Bank Guarantee of equivalent amount Valid till the expiry of contract period In case, We give the Bank Guarantee earlier can we get the payment of 20 % before the one year period. Request that the requirement be very specific since general integration with any third party hardware, software and firmware in the future will be a challenge. 3) In both( Part A & Part B) payment terms states 20 % at the end of 1 year on submission of Bank Guarantee of equivalent amount Valid till the expiry of contract period In case, We give the Bank Guarantee earlier can we get the payment of 20 % before the one year period. No change in RFP conditions. No change in RFP conditions.

6 17 pg. 16, It will be the responsibility of the bidder providing biometric authentication engine and related systems to ensure the compatibility of its biometric authentication engine with the fingerprint devices delivered by any other vendor either under this RFP or any other RFP in future and various applications used by LIC at present or to be used in future. Request that compatibility be restricted to applications listed in the current RFP only. For future applications / RFPs a change request may be raised if required. No change to RFP condition 18 Annexure VI Commercial Bid Details (PART A) 19 Section 3 Eligibility Criteria Point C.10 HSM The Bidder should have supplied installed similar software/services for at least one organization in India as ASA/KSA. As this product is not related 2 FA solution No change. we request LIC to separate this line item from commercials from PART A and procure it directly. Restricts number of eligible participants. As No change. per best of our knowledge only NCPI as an ASA/KSA has used service of external vendor and most of the other ASA/KSAs have used their n house or co-authored solution hence makes most of the current solution providers ineligible. Hence request the eligibility to be amended to include ASA/KSA or "AUA/KUA"

7 20 Section 3 Eligibility Criteria Point C RFP c) Page 16 The proposed software should have handled at least 1 lakh ekyc/authentication transactions since In case L1 bidder expresses his inability or fails in POC or fails to deliver and implement the entire solution with stipulated time line LIC may decide to provide opportunity to the L2 Most of the solutions under AES (Aadhar No change. Enabled Service) are still under rollout process of just started operations and hence the number of transactions mentioned in the eligibility criteria will also make most of the current solution providers ineligible except for agencies involved in Aashar Enrolment and Bank's business correspondents. LIC can look for exploring option of 50:30:20 share between L1/L2/L3. This will reduce dependency on one vendor and increase probabity of success No change. Pl refer to RFP and Clarifications /Corrigendum(all queries up to 19th Feb,2015) to the RFP. 22 Part B 1) Availability of one free USB for connecting the finger print scanner in all desktops/laptops used by LIC ( Part B ). 1) Availability of one free USB for connecting the finger print scanner in all desktops/laptops used by LIC ( Part B ). one free USB for connecting the finger print scanner shall be made available.

8 23 Bidder should be an Original Software Developer (OSD) for the Aadhaar Enabled Gateway Services i.e. ASA,KSA, AUA and KUA Servers as stated in the Authentication Service Agency (ASA) Handbook We need clarification on who is actually called Original Software developer in this regard and under what criteria one is called OSD. We have even sought a technical clarification with UIDAI on the same they responded back saying they are not aware of any such terminology(original Software Developer) being used in Aadhaar echo system(mail attached). OSD here has the same meaning as OEM (Original Equipment Manufacturer) in the information technology industry. 24 Page 36, The 2FA solution along with hardware security module proposed by the bidder should confirm to the requirements listed out in Annexure-IV 25 Page 36, Part A, Proof of Concept The scope of the POC will be advised along with letter intimating short-listing of the vendor We understand the role of HSM for managing Security Keys for encrypting / decyrpting / transaclating secured data. For which General Purpose HSM should be adequate and the Payment HSM is not required. Pls confirm Please clarify scope of work for POC as its not mentioned in the RFP and Please clarify the POC evaluation criteria. It will be difficult to prepare and accept for POC criteria if released later. We request you to please release the same with Pre-bid response as this will allow us to prepare in advance. Payment HSM is not required. Pl refer to Clarifications /Corrigendum(all queries up to 19th Feb,2015) to the RFP. Pl refer to the published POC document.

9 26 Page 42, 7.1,a Hardware & Software for the implementation of end to end 2FA Solution : Successful Bidder should arrange to deliver two sets of customized version of complete 2FA Software (including licences) along with necessary hardware and 100 fingerprint scanners, 5 Iris scanners and 10 wall mounted scanners (5 LAN based and 5 wireless based) at the Primary DC and Disaster Recovery site addresses specified in the Purchase Order within 20 weeks from the time of signing of contract. Delivery for the above purpose will be deemed to be completed only when customized 2FA Solution is ported on the Production Server for Go Live purpose. In your presentation shown in pre bid meeting you are asking to deliver all these items in POC by all bidders (ref last para of page no 13 in ppt) Please clarify whether only successful bidder has to provide these devices or all bidders have to provide for POC during technical evaluation Pl refer to the published POC document.

10 27 pg.9, 2.2 LIC expects to procure about 1,00,000 (one lakh) fingerprint scanner devices in phased manner. The number is only indicative and may not be treated as a commitment for on account of increase in number of users, number of offices or any change in solution implementation architecture. Such change if any will be intimated to all the bidders. Minimum number of purchases to be made. LIC reserves its right to increase or decrease the quantity or add to or delete from the requirement any item Request that the exact requirement in terms of number of units be specified before the submission of the commercial bid Please refer to annexure for commercial bid. 28 The user must be able to login with any of the finger print which should be validated and authenticated. The user should be able to login through any PC/desktop within a branch location. So does that mean the PC / desktop should use biometrics as the authentication mechanism Please refer to RFP clause 2.1

11 29 pg. 39, e Customization of the application software and its integration with the LIC s core insurance application and any other web application chosen by LIC has to be done by the bidder at no additional cost to the LIC. LIC will provide requisite technical information about the existing web-based application from any system integration (if any) shall be provided for this purpose. Changes will be required to LIC applications for integration with 2FA solution. In this case who pays for the changes and how will the time taken by application vendor be factored in? Please refer to RFP clause Changes to the LIC's applications will be made by LIC. Necessary APIs/ Components for such integration will have to be made available by the selected bidder for Part A. 30 LIC desires to implement centralized architecture for Fingerprint Scanner for enrollment 31 LIC desires to implement centralized architecture for Fingerprint Scanner for enrollment 32 The price quoted by the bidders should not exceed the price available for the quoted devices in the DGS&D/NICSI rate contract what is the finger print device specification LIC is looking for? What is the false positive / false negative expectations from the authentication system Request for removal of this clause Refer to RFP Refer to RFP clause (8) SLA for Part A The discovered rate in reverse auctions shall be lesser than or equal to the DGS&D /NICSI rate contracts for the same product. 33 pg. 39, f The 2FA solution must return the success/failure response to any login attempt within 3 seconds. Please clarify that the response time is for the biometric authentication process only and only post capture of the user fingerprint. Also please clarify how network latency will be factored into this. Your understanding is correct. Network dependencies or specific requirements related to the network should be clearly spelt out in the Technical response to the bid.

12 34 pg.40, r LIC has implemented Active Directory in Windows desktops & laptops. Vendor should provide solution for integration of Active Directory implementation with 2FA. Similarly, vendor is required to provide assistance for integration of 2FA along with LDAP authentication. Please clarify the architecture of LIC CIS integration with LDAP / AD The total no. of devices under part B is 1,00,000. Currently there are 14 domain controllers in LIC. 35 Page 20 RFP ref Eligibility Criteria Technical Competence Point devices supplied to any private sector company with a minimum turn over 500 cr 36 Page 46 5) Page 46 : Finger Print Enrolment and Authentication : Device ID capturing : What Device ID should be captured? Is it like serial number? 37 Page 43, 8.1 Part A, h Migration of the existing LIC employees & other authorized users data in various formats, databases, files, etc. to the proposed2fa solution devices supplied to any public sector/public sector undertaking 5) Page 46 : Finger Print Enrolment and Authentication : Device ID capturing : What Device ID should be captured? Is it like serial number? As per our understanding we only need to enroll finger print data of all employees and link it with employee/ unique ID in current database. Please provide complete details of this employee and other authorized users data with respective formats. The turnover criteria is applicable only if the 1000 devices are supplied to any Private sector company. There is no requirement of minimum turnover for PSU or govt. bodies, where 1000 devices were supplied. YES, Serial Number of the fingerprint scanner device. Yes, your understanding is correct. The data formats will be shared with the chosen implementation vendor.

13 38 Page 50,8.6.6, f Vendor has to handle fingerprint enrollment of all LIC employees & other authorized users working at the remaining LIC offices during pan India roll-out implementation. This will have a huge cost impact as our No change in RFP format. engineers need to personally visit each and every LIC office PAN India. As a general practice in such large PAN India projects this exercise is done by company engineer at regional/ zonal level and rest of the offices are taken care by regional zonal / staff. we can train team of select officials at regional level to do the same. 39 Annexure VI Commercial Bid Details (PART A) Training cost for train the trainer program (Finger Print devices installation and enrollment) per day Please specify the complete details of locations where we need to conduct this training. The trainings will have to be conducted at 8 zonal and one central location. 40 Opex Model Seek the solutions on an OPEX model Seek the solutions on an OPEX model Query not clear, OPEX model is applicable only for Part C, which means that the entire EKYC solution has to be provided the costing for which will be on a per transaction basis. 41 Page 55 SLA Schedule: Authentication accuracy for finger-print authentication should be 100 % As per Field POC by UIDAI and STQC test, FRR is considered less than equal to 1% as good. As per Biometric optimization of FAR and FRR, FRR can't be kept zero. Hence Accuracy 100% is n't possible. Request you to please amend the clause to FRR less than 1% Suggestion Accepted

14 42 CORRIGENDUM Bidders should note that the contract period for Part A as well as for Part B will be eight years inclusive of warranty period and AMC period post warranty. Hence, clause '4.2 Option to extend Contract Period' stands deleted. The clarifications/ corrigendum issued shall be an integral part of the referenced RFP and shall form the part of contractual deliverables as an outcome of this RFP. Executive Director (IT/BPR)