Tender for conducting the Security Audit of website of the Pension Fund Regulatory and Development Authority from CERT-in Empanelled agencies.

Transcription

1 Tender for conducting the Security Audit of website of the Pension Fund Regulatory and Development Authority from CERT-in Empanelled agencies. 1. Pension Fund Regulatory and Development Authority (PFRDA) was initially established by the Government of India on 10 th October 2003 to promote old age income security by establishing, developing and regulating funds, to protect the interests of subscribers to schemes of pension funds and for matters connected therewith or incidental thereto, through National Pension System(NPS). The PFRDA Act 2013 governing the powers and functions of the Authority has been enacted by the Parliament and notified w.e.f The Central Government has introduced the National Pension System(NPS) with effect from 1 st January The NPS covers at present, new entrants to Central Government services (excluding Armed Forces), majority of the State Government services and autonomous bodies at their discretion and all citizens of India on a voluntary basis with effect from 1 st May The website of PFRDA is PFRDA is presently located at B-14/A, Chatrapati Shivaji Bhawan, Qutub Institutional Area, Katwaria Sarai, New Delhi Sealed Bids are invited on behalf of PFRDA from Cert-In Empanelled Agencies for Security audit of Website of the Pension Fund Regulatory and Development Authority i.e., 3. The bids duly filled in all respect enclosing necessary documents may be addressed to, The Deputy General Manager-IT, Pension Fund Regulatory and Development Authority, B-14/A, Chatrapati Shivaji Bhawan, Qutub Institutional Area, Katwaria Sarai, New Delhi so as to reach on or before till 12:00 hrs. 4. The bids will be opened on the same date at 15:30 hrs i.e at PFRDA, New Delhi in the presence of bidders who may wish to be present, either by themselves or through their authorized representatives. 5. The detailed Terms & Conditions as Annexure-I, Scope of Work as Annexure-II,Format for submitting Price bid as Annexure-III and Bidder Details as Annexure-IV are attached with this tender document and can be downloaded from PFRDA website DEPUTY GENERAL MANAGER

2 TERMS & CONDITIONS ANNEXURE-I 1. The website is to be hosted at NIC server after Security audit, so the security audit certificate should be in compliance with the NIC standards. The bidders may well acquaint themselves with NIC standards before applying for tender. 2. Eligibility Criteria: a. The bidder must be an empaneled auditor of CERT-In, having an empanelment certificate valid upto vember 30, Copy of authorization with valid CERT-in empanelment to be furnished. b. Documentary evidence of firm s GST Registration shall be furnished. Bids not satisfying the above eligibility criteria / not accompanied by the requisite documentary proofs shall be rejected. 3. The bid shall contain two envelopes as under: Part I Earnest Money Deposit (EMD) and Eligibility related documents The first envelope shall contain the requisite EMD / documentary proof for waiver of the same, as per clause 6 of this tender and the supporting documents fulfilling Eligibility Criteria mentioned in clause-1 above. Part II. Bid for security audit of PFRDA Website Second envelope shall contain the bid involving duly filled Form-I and Price bid as per Annexure-III of this tender. 4. The tender should be prepared in two separate sealed covers, each containing documents mentioned above under Part I & Part II and these covers should be superscribed as Earnest Money Deposit (EMD) and Bid for security audit of PFRDA Website respectively. These two sealed covers should be put inside a separate Sealed cover and super-scribed as Tender for conducting security audit of PFRDA Website 5. Tender must contain the name, office & addresses including telephone & mobile numbers of the authorized person(s), with their signatures in Form-I. Unsigned or unstamped tender shall not be accepted. 6. All pages of the bid being submitted must be signed and sequentially numbered by the bidder. 7. Earnest Money Deposit (EMD) a. All Bids must be accompanied by Earnest Money for an amount of Rs.3000(Rupees Three Thousand only) in the form of Demand Draft issued by any Scheduled / nationalized bank of India drawn in favour of Pension Fund Regulatory and Development Authority, payable at New Delhi.

3 b. In case the Bidder claims for waiver of EMD, he/she shall provide documentary proof of being registered with the Central Purchase Organization, National Small Industries Corporation (NSIC) or the concerned Ministry or Department as per Rule 170 of GFR 2017, of Government of India, as amended from time to time. The registration must remain valid till the Bid Validity period. c. Bids without Earnest Money or documentary evidence for waiver of the same as indicated above shall be summarily rejected as non-responsive. d. Unsuccessful bidder s EMD will be returned within 30 days from the date of placement of order to the successful bidder. e. The successful bidder s EMD will be released along with the final payment to it on completion of the work. f. interest is payable on the EMD. 8. Period of Bid Validity Bids shall remain valid for 90 days from the date of Bid Opening. Any Bid valid for a shorter period than the period specified shall be rejected as non-responsive. 9. General Terms and conditions The other terms and conditions of the tender shall be as per the enclosed Annexure-I. 10. Last date & Time for receipt of Bids: The last date for receipt of Bids is vember 15, 2017 till 12:00 PM. Bids will be opened on the same day at PM. 11. Submission of Bids: The completed bids may be submitted in person or alternatively the bids may be sent by registered post/speed post to The Deputy General Manager-IT, Pension Fund Regulatory and Development Authority, B-14/A, Chatrapati Shivaji Bhawan, Qutub Institutional Area, Katwaria Sarai, New Delhi so as to reach by the time and date stipulated for receipt of Bid. 12. Late Bid Any delay, even postal delay, in the receipt of bid would be considered late submission of bid and rejected. Mere handing over of the bidding documents at the Reception Counter or at any other counter or room or person of PFRDA shall not be considered. 13. Language of Bids a. The Bids prepared by the Bidder and documents relating to the bids exchanged by the Bidder and the auditee, shall be written in the Hindi/English language, provided that any printed literature furnished by the Bidder may be written in another language so long as the same is accompanied by an Hindi /English translation in which case, for purposes of interpretation of the bid, the Hindi/English version shall govern. 14. Bid Prices a. The prices shall be quoted in Indian Rupees only. b. All taxes, duties, levies applicable etc shall be clearly indicated. c. Prices quoted must be firm and shall remain constant throughout the period of validity of bid and hall not be subject to any upward modifications, whatsoever.

4 d. Bidders shall indicate their rates in clear/visible figures as well as in words and shall not alter/overwrite/make cutting in the quotation. 15. Bid Evaluation a. During Eligibility Criteria Evaluation, bidder s details shall be evaluated with reference to the required Eligibility Criteria as mentioned in this tender document and subsequently the bids of only eligible bidders shall be considered for final evaluation. b. The price bids shall be evaluated as under: i. If there is any discrepancy between words and figures, the amount in words ill prevail. ii. If there is a discrepancy between the unit price and the total price that is obtained by multiplying the unit price and quantity, the unit price shall prevail and total price shall be corrected. c. If the Bidder does not accept the correction of the errors as above, his bid will be rejected and the Earnest Money Deposit shall be forfeited. d. The bidder whose evaluated price is found to be lowest (L-1), shall be considered for placement of Work Order for Conducting Security Audit of PFRDA Website. 16. Work Period a. The completion of the work shall not take more than 15 days from the date of issue of Work Order. 17. Payment Terms a. Payment will be released after successful completion of work, submission of necessary certificate /documents / Report to PFRDA and receipt of pre-receipted bills in triplicate. b. advance payment shall be made. c. claim on account of any price variation / escalation shall be entertained. d. claim for interest in case of delayed payment will be entertained by the Authority. 18. Auditee s right to accept or reject any or all bids The auditee reserves the right to accept or reject any Bid, and to annul the Bidding process and reject all Bids at any time prior to Award of Contract without thereby incurring any liability to the affected Bidder or Bidders or any obligation to inform the affected Bidder or Bidders of the grounds. 19. Force Majeure a. Force Majeure means an event beyond the control of the Auditor and not involving the Auditor s fault or negligence and not foreseeable. This type of event may include but not limited to fires, explosions, floods, earthquakes, strikes, wars or revolutions,etc. b. The work execution period may be extended in case of Force Majeure condition. In order to be able to obtain an extension to the contract work period, the Auditor shall promptly notify auditee advising the existence of such an event, not later than one week of such

5 event happening and produce the necessary documents such as Certificate of Chamber of Commerce or any other competent authority indicating the scope of such an event, and its impact on the performance of the contract and establish that such an event is not attributable to any failures on its part. 20. Laws /Jurisdiction /Arbitration:. All disputes arising out of this notice inviting tender shall be subject to the exclusive jurisdiction of Courts at Delhi only.

6 ANNEXURE-II Scope of Work for the Security Audit 1. PFRDA has hosted a website with its URL as and it consists of about 100 numbers of static html pages with ASP as client-end scripting language and CSS design files on Microsoft Windows platform. The website is bilingual and has been hosted on NIC Server. 2. The Auditor is expected to carry out an assessment of the vulnerabilities, threats and risks that may exist in the above website through Internet Vulnerability Assessment and Penetration Testing which includes identifying remedial solutions and recommendations for implementation of the same to mitigate all identified risks, with the objective of enhancing the security of the website. 3. The website audit should be done by using Industry Standards and as per the Open Web Application Security Project (OWASP) methodology. 4. During Security Audit, if any lapse is found, the same shall be reported by the auditor to PFRDA to make the website fully secured for hosting on NIC server. 5. The audit of the website should be conducted in conformity with NIC audit guidelines. After successful security audit of the website, the security audit report from the auditor should clearly state that all web pages along with respective linked data files (in pdf / doc / xls etc. formats), all scripts and image files are free from any vulnerability or malicious code, which could be exploited to compromise and gain unauthorized access with escalated privileges into the webserver system hosting the said website. 6. Audit Environment: URL of PFRDA website is and would be a audited on the system provided by auditee at PFRDA office. Supply / installation of auditing / testing tools, if any, for the audit purpose will be liability of the auditor. In case of utilizing the hardware of the auditee as mentioned above, the auditor shall inform auditee in advance before conducting the audit, about any additional software dependencies / requirements. 7. Responsibilities of Selected Auditor: The Selected Auditor will conduct website security Audit for the PFRDA website as under: 7.1. Verify possible vulnerable services, only with explicit written permission from the auditee tify the auditee whenever there is any change in auditing plan / source test venue / high risk findings or any occurrence of testing problem Responsible for documentation and reporting requirements for the audit Task-1: Web Security Audit/Assessment Task-2: Re-audit based on recommendation report of Task On successful security audit, furnish certificate for the website as per NIC norms stating that the website is safe for hosting on the NIC server.

7 8. Audit report The Auditor shall submit a report indicating about the vulnerabilities as per OWASP and recommendations for action after completion of Task-1. The final formal IT security Audit Report should be submitted by the Auditor after the completion of all the tasks of Audit. The reports should contain: 8.1. Identification of auditee (address & contact information) Dates and locations(s) of audit (Task-1 and Task-2) 8.3. Terms of reference (as agreed between the auditee and auditor), including the standard for audit, if any Audit Plan Explicit reference to key auditee organization documents (by date or version) including policy and procedure documents, if any Additional mandatory or voluntary standards or regulations applicable to the auditee Summary of audit findings including identification tests, tools used and results of tests performed Analysis of vulnerabilities and issues of concern Recommendations for action Personnel involved in the audit, including identification of any trainees. In addition to this, reports should include all unknowns clearly marked as unknowns. 9. Responsibility of Auditee 9.1. The auditor will submit the vulnerability report to the auditee. PFRDA will be responsible to remove vulnerabilities if any, which are identified by the auditor. After removing the vulnerabilities, the PFRDA has to send confirmation to the auditor, stating that the vulnerabilities have been removed as mentioned by the auditor As there are only two rounds of audit, the IT Department should take necessary action to remove the vulnerabilities by second round Auditee will refrain from carrying out any unusual or major changes during auditing / testing. If necessary for privileged testing, the auditee can provide necessary access to the auditor as mentioned in the clause Audit Environment above. 10. Confidentiality All documents, information and reports relating to the assignment would be handled and kept strictly confidential and not shared/published/supplied or disseminated in any manner. 11. Technical Details of the applications are as follows: S. Parameters/Information about the Website Description Web application Name & URL Operating system details (i.e. windows - Windows Server 2003, Linux, AIX, Solaris etc.,) Application Server with Version (i.e. IIS 5.0.Apache, Tomcat, IIS etc. ) Front end Tool [Server side Scripts] (i.e. ASP, Asp.NET, JSP, ASP.NET PHP, etc.) Back end Database (MS-SQL Server, PostgreSQL, Oracle, etc.) MS-SQL

8 Authorization. of roles & types of privileges for the different roles Admin for content management Whether the site contains any content management module Yes (Customised CMS) (CMS) (If yes then which?) of input forms Can be checked after Login. (Approximate) of input Fields Can be checked after login. of login modules 1 How many application roles/privilege levels of users? Does the application provide a file download feature (Yes / )? Does the application use Client-side certificate (Yes / )? Is there a CMS (Content Management System) present to maintain the public portal/login module? Does the application has SMS integration (Yes/)? Does the application has integration (Yes/)? Does the application has Payment Gateway integration (Yes/)? Does the application provide a file upload feature (Yes / )? Number of Web Services, if any Number of methods in all web services Creator,Approver,Publisher Yes Yes in CMS NA Deliverables and Audit Reports: The successful bidder will be required to submit the following documents in printed format (2 copies each) after the audit of above mentioned two web application: i. A detailed report with security status and discovered vulnerabilities weakness and misconfigurations with associated risk levels and recommended actions for risk mitigations. ii. Summary and detailed reports on security risk, vulnerabilities and audit with the necessary counter measures and recommended corrective actions to be undertaken by PFRDA. iii. The final security audit certificate for and should be in compliance with the NIC standards. iv. All deliverables shall be in English language and in A4 size format. v. The vendor will be required to submit the deliverables as per terms and conditions of this document.

9 ANNEXURE-III PRICE BID (On Company Letter Head) To, The Deputy General Manager-IT, Pension Fund Regulatory and Development Authority, B-14/A, ChatrapatiShivajiBhawan, Qutub Institutional Area, Katwaria Sarai, New Delhi Subject : Price Bid for tender for conducting the Security Audit of PFRDA Website from CERT-in empanelled agencies. Name of the Bidder : Address for Correspondence : I/we hereby submit the commercial bid for conducting Security Audit of PFRDA website as per the Scope of work given in this tender document within the time specified and in accordance with the terms and conditions. S. Description Total Price Taxes Total Price including all taxes Work for conducting comprehensive Security audit of PFRDA Website. 1. The rate should not be provided as a percentage figure but in absolute Indian Rupees. 2. The rate quoted must be reasonable and valid for the period of contract from the date of opening of financial bid. SIGNATURE WITH SEAL OF TENDERER NAME IN BLOCK LETTERS: Company Name with Full Address:

10 ANNEXURE-IV BIDDER S PARTICULARS S. Particulars Details 1 Name of the Bidder 2 Full Address of the Bidder 3 Name of the Authorized Signatory 4 Name & address of the officer to whom all references shall be made regarding this tender Telephone Fax. Mobile Bidder: Signature Name Designation Company Date Company Seal