Reference No.: CO-IT/BPR/CSD/ /2 dated 16th October Points for clarifications. Kindly confirm the last date for submission of bids

Transcription

1 Central Office, I.T. Department, 2 nd Floor, North Wing, J B Annexe Building, Santacrutz (W), Mumbai Tele : / Tele Fax : co_itbpr@licindia.com Re: Empanelment of Information Security Conultant and election of bidder for information ecurity and related ervice for Life Inurance Corporation of India Reference : CO-IT/BPR/CSD/ /2 dated 16th October 2017 Thi i with reference to the RFP releaed by the Life Inurance Corporation of India on 16 th October, 2017 captioned above. Repone to querie raied by bidder and further modification to thi RFP are given below: Sl. Reference() (ection and 1. Pg 1 and 3 (cl. 8) clarification() Page 1 tate lat date for ubmiion i wherea on 3 cl. 8 it i tated a Page 8 Cl. 7 The purchae order in point no. 2 of Table-II below hould cover ervice, i.e. ISMS for IT procee (including ISO27001 certification / recertification /renewal), BCMS (including ISO22301 certification /recertification / renewal), Cyber ecurity review, and Information ecurity audit/review Kindly confirm the lat date for ubmiion of bid We recommend that the Purchae order value of R. 20 Lakh or more hould cover all or any of the ervice mentioned. Requet to uitably modify the ame Both Part A Reply to Querie Lat date of Submiion i at 3.30 PM. Modification-I ha been iued. The bidder hould have executed 1 (one) order of at leat R. 20 lakh ince covering the ervice like Aitance on readine for ISMS/ISO27001 implementation/aement, aitance on readine for BCMS a per ISO22301 tandard, Cyber ecurity review, and Information ecurity audit/review. Page 1 of 49

2 Reference() (ection and clarification() 3. Page 8 Cl. 7 The bidder hould have executed 1 (one) order of atleat R. 20 lakh in any of three financial year immediately preceding the date of publihing of thi RFP. 4. Page 9 cl Page 8 Cl. 8 The purchae order in point no. 3 of Table-II below hould cover ervice, i.e. VA & PT and recommendation for mitigation, Application ecurity and ecure code review, Secure network architecture review and pear The amount mentioned of one PO i R. 20 Lakh on 8 cl. 7 wherea the cumulative amount on 9 cl. 2 i R. 10 Lakh. We requet you to modify the one PO amount to R. 10 Lakh intead of R. 20 Lakh We recommend that the Purchae order value of R. 10 Lakh or more hould cover all or any of the ervice mentioned. Requet to uitably modify the ame Reply to Querie In cae the PO for eligibility criteria do not cover all the activitie a above, the bidder hould ubmit eparate copie of any other PO for thoe activitie, procured ince The bidder may ubmit multiple PO iued in the ame financial year to fulfill thi condition. The minimum PO value for uch ervice are to be produced given in point no. 2 of Table-II covering ervice e.g. Aitance on readine for ISMS/ISO27001 implementation/aement, aitance on readine for BCMS a per ISO22301 tandard, Cyber ecurity review, and Information ecurity audit/review. Part A Pl ee reply to querie in Sl no (2). Part B The bidder hould have executed 1 (one) order of at leat R. 10 lakh ince covering the ervice like Configuration audit (CA) or Vulnerability aement (VA), Penetration Teting (PT), Application ecurity and ecure code Page 2 of 49

3 Reference() (ection and clarification() phihing Reply to Querie review, Secure network architecture review and pear phihing. In cae the PO for eligibility criteria do not cover all the activitie a above, the bidder hould ubmit eparate copie of any other PO for thoe activitie, procured ince The bidder may ubmit multiple PO iued in the ame financial year to fulfill thi condition. The minimum PO value for uch ervice are to be produced given in point no. 3 of Table-II covering ervice e.g. Configuration audit (CA) or Vulnerability aement (VA), Penetration Teting (PT), Application ecurity and ecure code review, Secure network architecture review Page 8 Cl. 8 Page 10 cl. 3 The bidder hould have executed 1 (one) order of atleat R. 10 lakh in any of three financial year immediately preceding the date of publihing of thi RFP. 8. Page 9 cl.9 The certification detail with upporting document hould be provided by the bidder in TECHNICAL BID to be iued to elected bidder. The amount mentioned of one PO i R. 10 Lakh on 8 cl. 8 wherea the cumulative amount on 10 cl. 3 i R. 8 Lakh. We requet you to modify the one PO amount to R. 8 Lakh intead of R. 10 Lakh Since thi i only an Eligibility criteria and not technical bid, hence, confirmation from authoried ignatory hould be ufficient. Requet you to modify the ame Part B Pl ee reply in l. (5) Part A Certification detail required for evaluation of eligibility bid required. Page 3 of 49

4 Reference() (ection and clarification() 9. Page 9 cl.10 The certification detail with upporting document hould be provided by the bidder in TECHNICAL BID to be iued to elected bidder. 10. Page 9 cl.9 Any reource having multiple certification in different categorie will be conidered a eparate certification, however, in cae of multiple certification ame category will not be conidered a eparate certification. 11. Page 9 cl.10 Any reource having multiple certification in different categorie will be conidered a eparate certification, however, in cae of multiple certification ame category will not be conidered a eparate certification. Since thi i only an Eligibility criteria and not technical bid, hence, confirmation from authoried ignatory hould be ufficient. Requet you to modify the ame Kindly clarify how a peron having multiple certification i.e. ISO 27001, CISA, CEH would be counted in total and in each of the category Kindly clarify how a peron having multiple certification i.e. ISO 27001, CISA, CEH would be counted in total and in each of the category 12. Page 13 Submiion of Bid We undertand there will be 1 outer envelope and 2 inner envelope each for Part A and Part B. kindly confirm 13. Page 13 Submiion of Bid Bid Price We undertand there each demand draft of R. 5,000/- for Part A and Part B ha to be Part B Reply to Querie Certification detail required for evaluation of eligibility bid required. Part A Category 1: ISO or BS or BS7799 or BS17799 or ISO27001 Lead Auditor and/or ISO or BS25999 or ISO27001 Lead Implementer (or their latet verion) Category 2: CISA/CISSP qualified (Valid certificate) Profeional Category 3: Ethical Hacker / Penetration Teter (CEH/ GCIH/OSCP) etc. pa/certified profeional CEH certification of verion 7 and above will be conidered. Part B Pl ee reply in l. (10) Both Both Ye. Ye. Page 4 of 49

5 Reference() (ection and clarification() ubmitted in their repective envelope. Kindly confirm 14. Page 3 Bid price of R. 5,000 each for Part A and Part B An MSME i exempted from paying the tender fee / EMD. We requet you to conider the ame and exempt mall and medium enterprie from paying the Bid Price 15. Page 15, Para We feel that the ame i redundant a thi i 1 to 3 only and Eligibility Criteria. Thi i neither a technical bid or commercial bid. Requet you to remove the ame 16. Page 15 Non Dicloure Agreement We undertand that the Non Dicloure Agreement i not to be ubmitted now with Eligibility Criteria. Kindly confirm 17. Page 30 Annexure E A confirmation from authoried ignature i ufficient during Eligibility Criteria and hence Annexure E hould be deleted 18. Excel Sheet- Part A and Part B I it mandatory to fill thee excel heet and ubmit in oft copy 19. Page 1 - Lat date of ubmiion The lat of date of ubmiion of tender document i mentioned a 20th November 2017 on no 1. However on no. 3 it i mentioned a 27th November. Pleae confirm the date of ubmiion of tender. 20. Page 5 - Point 2: 22 broad area There are only 14 activitie mentioned on 5: point 4. Pleae confirm of there are any other activitie to be covered which are part of 22 broad area a mentioned in point Both Both Both Both Both Part A and B Part A and B Reply to Querie The MSME act will apply provided the bidder ubmit documentary evidence for the ame. No change. Non Dicloure Agreement i to be ubmitted with Eligibility bid. No change. Ye. Pl refer 'Paword protection' para in no.13. Pl ee reply in l. (1) Other area will be covered in Technical bid. Page 5 of 49

6 Reference() (ection and 21. Page 9 - Point 9: 22. Page 9 - Point 10: 23. Page 9 - Table II: Pt 1 - clarification() Bidder hould have 15 certified employee for Part A a on Bidder hould have 10 certified employee for Part B a on Multiple order from a ingle company during one financial year hall be conidered to be one order. 24. Pg. 3 Activity Schedule Bid Price Part A R.5,000/- Part B R.5,000/- 2. Pleae confirm if thi date can be revied a, a on date. Pleae confirm if thi date can be revied a, a on date. If thee order are from the ame company covering different department or function, in that cae would be the conidered a eparate order? We are requeting to relax thi criteria. We are regitered with MSME (Udyog Aadhaar), A per the PPC, Companie who are regitered under MSME or Micro / mall are exempted from Tender fee & EMD ( baed on the Public Procurement Policy for MSE Order, 2012, dt , Claue 10 copy attached). We have added our MSME certificate alo. A per your RFP claue every bidder ha to pay Bid/ Tender cot of R.10,000/-, So pleae let u know whether we are eligible for exemption for Tender cot. Part A Part B Part A and B Reply to Querie Bidder hould have 15 certified employee in different categorie a given in the RFP for Part A a on Bidder hould have 10 certified employee in different categorie a given in the RFP for Part B a on The RFP condition i very clear. Pl ee the reply given above. Page 6 of 49

7 Reference() (ection and clarification() 25. Pg. 3 Lat Date Monday,27th Nov 17 by 4.0pm 26. Pg. 8 Eligibility Criteria Table- I, Point no- 7 The bidder hould have executed 1 (one) order of at leat R. 20 lakh in any of three financial year immediately preceding the date of publihing of thi RFP. The purchae order in point no. 2 of Table-II below hould cover ervice, i.e. ISMS for IT procee (including ISO27001 certification / recertification / renewal), BCMS (including ISO22301 certification / recertification / renewal), Cyber ecurity review, and Information ecurity audit/review. We have already got exemption from 2 PSU in thi year with the ame claue. On no 1, LIC had mentioned 20th Nov i the Lat date of Tender ubmiion & on no.3 in Activity Schedule it mentioned a 27th Nov i the lat date, o pleae clarify correct lat date along with the time. A per thi claue Bidder ha to ubmit 1 PO of R.20 Lakh. But while giving explanation in Table II point number 2, LIC ha bifurcated in a 4 different Service & 4 different PO value of total R. 10 lakh. Mean can we ubmit 4 different PO whoe total equal to 20 lakh or 10 lakh OR it ha ome different meaning, Pleae clarify. Reply to Querie Pl ee the reply given above. Pl ee the reply given above. 27. Pg. 8 Eligibility Criteria A per thi claue Bidder ha to ubmit 1 PO of Pl ee the reply given above. Page 7 of 49

8 Reference() (ection and clarification() Table- I, Point no- 8 The bidder hould have executed 1 (one) order of at leat R. 10 lakh in any of three financial year immediately preceding the date of publihing of thi RFP. The purchae order in point no. 3 of Table-II below hould cover ervice, i.e. VA & PT and recommendation for mitigation, Application ecurity and ecure code review, Secure network architecture review and pear phihing. R.10 Lakh. But while giving explanation in Table II, point number 3, LIC ha bifurcated in a 4 different Service & 4 different PO value of total R. 8 lakh. Mean can we ubmit 4 different PO, whoe total equal to 10 lakh or 8 lakh OR it ha ome different meaning, Pleae clarify. Reply to Querie 28. Activity Schedule & Page 3 Pre-bid meeting Point 4 of the Activity chedule table: 1. A per claue, (Pre-Bid Meeting, Only for bidder who have paid bid price before the pre-bid meeting), doe thi indicate that the DD i to be ubmitted before the pre-bid meeting? Are we uppoed to ubmit the Bid Price DD before the pre-bid meeting or during the prebid meeting. A per the RFP, we are aked to ubmit the DD with the eligibility criteria and alo before the pre-bid meeting. 29. Page 1, 3 Lat Date of ubmiion Pleae confirm on Lat date for ubmiion of tender document / bid Part A & B Part A & B Pl go through the modification-i. Pl ee the reply given above. Page 8 of 49

9 Reference() (ection and clarification() A it i mentioned on 1 of document RFP for IS Review of LIC-V1.1_eligibility a Lat date for ubmiion of tender document: 20th November 2017 and on Page 3 a Lat date & time for ubmiion of bid: Monday, 27th November 2017, latet by 3.30 pm Scope and expectation for pear phihing need to be defined. 30. Section-A & Page 4 Overview of RFP (Point 1) 31. More clarification i required on "Forenic On Demand " 32. Section-A & Overview of RFP (Point 4) Page 5 1. For configuration review, i LIC i having their own SCD document/cript or it to be conducted on indutry bet practice. Number of device/erver and type of erver to be conidered for config review need to be defined. 2. Do we need to conider network device for configuration review? If ye, Number of device and type of network device to be conidered. 33. Number of internal and external IP need to be defined for cope of vulnerability aement I penetration teting to be conducted a per cope of VA IP addree, In cae of difference pleae pecify detail 2. Number of IP for PT need to be mentioned Part B Reply to Querie Part of Technical Bid document. Part of Technical Bid document. Part of Technical Bid document. Part of Technical Bid document. Part of Technical Bid document Scope for Application Security need to Part of Technical Bid document. Page 9 of 49

10 Reference() (ection and clarification() mentioned (Number of Application/number of dynamic and tatic /number of role to be conidered for each application review) 2. I there any mobile application review required? If ye, pleae provide number of mobile application/number of dynamic and tatic /number of role to be conidered for each application review/type of platform to be conidered for review (Android/iOS/Window/BlackBerry) 3. I there any thick client or web ervice baed application need to be reviewed. If ye, provide more information. 36. Scope for Secure code review need to mentioned (Number of Application/Line of code for each application) What i the expectation to perform Secure Network Architecture review? Do we need to perform complete network connectivity including ZO,DO,BO,SO and CO along with all DC and DR or we need to perform network review baed upon each application. 2. Do we need to travel to any of above location (ample bai) for review? 3. Do we need to conider firewall rule bae review a part of ecure network architecture review? Reply to Querie Part of Technical Bid document. Part of Technical Bid document. 38. I confirmatory review alo part of thi Part of Technical Bid document. Page 10 of 49

11 Reference() (ection and clarification() engagement? If ye, then number of retet need to be mentioned. 39. Scope hall be defined for Information Security management ytem, Buine continuity management ytem, Data Governance & Data Privacy, Information ecurity Review, Cyber ecurity review, Incident Management capability, IS governance, Policie procedure and Rik management 40. Section-A & Page 4 Overview of RFP 41. Information Security Review (ZO, DO, BO & SO 42. Information Security Review (C.O. Department) Pleae provide a detailed explanation a to what would be the cope of work or activitie which would be required for all the ervice lited under Part A of the cope To be carried out remotely or on ite at repective location, pleae clarify How many department and approx. ize of department in term of people, proce and IT aet? 43. Incident Management capability Incident Management capability To review and meaure the effectivene of activitie of SOC by carrying out red team exercie regularly Can we have more clarity on expectation for red team exercie and it' frequency? 44. implementation of ISMS, BCMS, Data governance and Data privacy, Cyber Clarify, implementation acro location or only for corporate office & infratructure Part A Reply to Querie Part of Technical Bid document. Part of Technical Bid document. On ite review at repective location required to be carried out. The name of location will be given by LIC. Part of Technical Bid document. Part of Technical Bid document. Part of Technical Bid document. Page 11 of 49

12 Reference() (ection and 45. Section-B & Page Section-C & Page Section-C & Page 13 clarification() ecurity framework Eligibility Bid Document Table II Point 1 Multiple order iued to the bidder from a ingle company during one financial year hall be conidered to be one order for thi purpoe. If the work/cope i different, then would the PO be conidered a eparate The project detail ubmitted by bidder hould be executed in India only. Outide India Project executed by the bidder will not be taken into conideration. Pleae conider thi in addition to above claue to a it would indicate the knowledge bae and the experience of the bidder. Submiion of Bid Do we have to ubmit Eligibility, Technical and Commercial bid together on 27th November? Or Do we only ubmit the eligibility bid on 27th November and the technical and commercial bid would need to be ubmitted on a later date? Paword protection A mentioned "Technical and commercial bid are to be ubmitted in the ame preadheet format a per the RFP. The paword ued on the pread heet will be validated by LIC for checking the authenticity of the file. If the paword doe not match, the EMD may be forfeited." Do we need to ubmit technical/commercial Part A & B Part A & B Part A & B Reply to Querie Pl ee above. lat date of ubmiion of eligibility bid i ar 3.30 PM. Technical bid will be iued to the eligible bidder only. LIC will ue Quality cot baed ytem (QCBS) for election of ucceful bidder. Both hard copy and oft copy format to be ubmitted. Page 12 of 49

13 Reference() (ection and 48. Section-C & Page Section-D & Page 20, Annexure G & Page Annexure G & Page 34 clarification() bid in the preadheet format only or can you allow u to ubmit the printed technical/commercial document to LIC in ealed cover. Renewal of empanelment with Cert-in Cert-In procee may take more than 30 day, we requet that before applying any penalty a repone from the vendor i conidered and viewed objectively. Period may extend more than 30 day a pecified in RFP. Current Environment Do we need to conider all current environment location mentioned in the RFP a a part of the cope for thi review? If not, pleae pecify the location. Authorization for igning all document Authorization for igning all document a) To be igned by the bidder company Board / Director / Managing Director/ Owner. Pleae include partner in the above tatement. To be igned by the bidder company Board / Director / Managing Director/ Owner and Partner b) To be igned by the bidder Company Secretary Pleae include partner in the above tatement. To be igned by the bidder Company Secretary and Partner Part A & B Part A & B Part A & B Part A & B Reply to Querie 90 day will be allowed intead of 30 day. However, the bidder will have to ubmit proof of hi ubmiion of application to Cert-In regarding renewal of empanelment within 30 day of expiry of validity to LIC. It will be well defined in technical bid. 52. NA Commercial and Technical Bid There i no clarity or format on how to Part A & To be hared at a later date by LIC Agreed. Agreed. Page 13 of 49

14 Reference() (ection and 53. Overview of RFP - Part A - Page 04 clarification() Information Security Management Sytem Buine Continuity Management Sytem (BCMS) Data Governance And Data Privacy Information Security Review (ZO, DO, BO and SO) Information Security Review (C.O. Department) Incident Management capability To review and meaure the effectivene of activitie of SOC by carrying out red team exercie regularly preent the commercial and technical bid 1. Requet you to hare your expectation on the mentioned activitie. Doe ISMS include- 1. No of department in cope 2. ISO Gap aement / 3. IT Current State Aement 4. Preparation of IAC & RARTP 5. Updation / making new policy and procedure. 6.Training and no of employee to be given training 7. Internal Audit B Part A Reply to Querie Part of Technical Bid. 54. Section B - Eligibility Bid Document Point Overview of RFP - Part B- 5 hould be CISA/CISSP Certified with valid Certificate It refer to the IS ervice with recommendation for mitigation for Doe BCMS include- 1. No of department in cope 2. ISO Gap aement / 3. Preparation of BIA & RA 4. BCMS Framework 5.Training and no of employee to be given training 6. Teting and Drill Will CISM certificate alo be conidered? CISA/CISSP/ CISM. Requet you to hare device count for the cope: Part A Part B Part of Technical Bid. Page 14 of 49

15 Reference() (ection and Page Overview of RFP - Part B- Page 04 clarification() ervice like Vulnerability aement, penetration teting, application ecurity and ecure code review, pear phihing etc. Configuration Audit & Vulnerability Aement Of Critical Sytem Penetration Teting Application Security And Secure Code Review Secure Network Architecture Spear Phihing Forenic On Demand It refer to the IS ervice with recommendation for mitigation for ervice like Vulnerability aement, penetration teting, application ecurity and ecure code review, pear phihing etc. Configuration Audit & Vulnerability Aement Of Critical Sytem Penetration Teting Application Security And Secure Code Review Secure Network Architecture 1. Vulnerability aement, penetration teting - number of device/ router/ witche in cope? 2. application ecurity - number of app and approx. number of in cope. 3. Secure code review - number of line of code 4. Configuration Audit & Vulnerability Aement Of Critical Sytem - firewall, witche, router, dektop, erver? 5. Secure Network Architecture - network diagram, application deployment diagram, 6. Spear Phihing - number peron/ target audience? Number of time activity need to be conducted. 7. Forenic On Demand - the activity will charged hourly/ device bai. Requet you to hare device count for the cope: 1. Vulnerability aement, penetration teting - number of device/ router/ witche in cope? 2. application ecurity - number of app and approx. number of in cope. 3. Secure code review - number of line of code 4. Configuration Audit & Vulnerability Aement Of Critical Sytem - firewall, Part B Reply to Querie Part of Technical Bid. Page 15 of 49

16 Reference() (ection and 57. RFP-for-IS- Review-of- LIC.PDF 58. RFP-for-IS- Review-of- LIC.PDF 59. RFP-for-IS- Review-of- LIC.PDF 60. RFP-for-IS- Review-of- LIC.PDF 61. RFP-for-IS- Review-of- LIC.PDF 62. RFP-for-IS- Review-of- LIC.PDF 63. RFP-for-IS- Review-of- clarification() Spear Phihing Forenic On Demand Overview of RFP Overview of RFP Overview of RFP Overview of RFP Overview of RFP witche, router, dektop, erver? 5. Secure Network Architecture - network diagram, application deployment diagram, 6. Spear Phihing - number peron/ target audience? Number of time activity need to be conducted. 7. Forenic On Demand - the activity will charged hourly/ device bai. How many IP in cope for Vulnerability aement? How many IP in cope for Penetration teting? How many application in cope for application ecurity teting? What type of application in cope for pentet? Whether web, mobile, web ervice? How many application code in cope for ecure code review? Part B Part B Part B Part B Part B Reply to Querie Part of Technical Bid. Part of Technical Bid. Part of Technical Bid. Part of Technical Bid. Part of Technical Bid. Overview of RFP How many application are internet facing? Part B Part of Technical Bid. Overview of RFP State if target application tet environment are "live production" or "tet taging" Part B Part of Technical Bid. Page 16 of 49

17 Reference() (ection and LIC.PDF 64. RFP-for-IS- Review-of- LIC.PDF 65. RFP-for-IS- Review-of- LIC.PDF 66. RFP-for-IS- Review-of- LIC.PDF 67. RFP-for-IS- Review-of- LIC.PDF 68. RFP-for-IS- Review-of- LIC.PDF 69. Section B, Page no Section: Table 1 Pt 7 & 8 clarification() Overview of RFP Overview of RFP Overview of RFP Overview of RFP Overview of RFP Eligibility Criteria The bidder hould have executed 1 (one) order of at leat R. 20 lakh in any of three financial year State the number of phyical location under purview of network Vulnerability aement and penetration teting Specify if the target ytem are acceible over the internet or only from within LIC network How many network and ecurity device in cope for conducting config audit What are the technology/platform in which code i written which i in cope for ecure code review? Can the code be made acceible for ecure code review at offhore location or it ha to be done from LIC location? Our CERT-In Empanelment ha expired a year back. We have applied for renewal in Augut and competed the firt etp. However completion of econd and third tep depend on the timeline given by the CERT In Body. We can ubmit the Proof of the renewal but many not get the certification on the day of bid ubmiion due to long proce. Pleae guide can we be conidered a eligible If we do not have a ingle PO of R. 20 lac/10 lac covering all the mentioned ervice, we would be ubmitting multiple PO a per Part B Part B Part B Part B Part B NA Reply to Querie Part of Technical Bid. Part of Technical Bid. Part of Technical Bid. Part of Technical Bid. Part of Technical Bid. The certificate from Cert-In mut be ubmitted along with the eligibility bid. Replied to the querie above. Page 17 of 49

18 Reference() (ection and Table 2 Pt 2 & 3 Page No: 8,9,10 clarification() immediately preceding the date of publihing of thi RFP. The purchae order in point no. 2 of Table-II below hould cover ervice, i.e. ISMS for IT procee (including ISO27001 certification / recertification / renewal), BCMS (including ISO22301 certification / recertification / renewal), Cyber ecurity review, and Information ecurity audit/review. Minimum PO Value. Pleae let u know how many PO hould be ubmitted per ervice in thi cae. Reply to Querie 71. Section: Table 2, Pt 1 Page No: Section: Annexure D Page No: 29 The bidder hould have executed 1 (one) order of at leat R. 10 lakh in any of three financial year immediately preceding the date of publihing of thi RFP. The purchae order in point no. 3 of Table-II Multiple order iued to the bidder from a ingle company during one financial year hall be conidered to be one order for thi purpoe. Thee order hould have been executed by the bidder himelf and not a a conortium. The Bidder ha to furnih the detail of project executed a expected in the RFP in the RFP for qualifying in eligibility bid. Pleae clarify if multiple PO for different type of activitie/ervice from a ingle client in a given financial year would be conidered a different order E.g: For Client A, we have received three eparate PO in a financial year for BCMS review, VAPT and information ecurity review. Requet you to conider them a different order. Pl clarify how many number of project that need to be given for each activity. NA NA Pl ee above. Given in the RFP. Page 18 of 49

19 Reference() (ection and 73. ELIGIBILITY BID DOCUMENT clarification() A per RFP 74. Scope Thi empanelment will be valid for 5 year from the date of iue of 1t PO under thi and may be ued for any future requirement related to information ecurity and related ervice. 75. However in exceptional condition, LIC may, at it dicretion, reduce the validity period or extend the validity up to 1 year on the ame term and condition tated in the bid document and ucceful vendor will have to Period of maintain the final quote given for thi Validity of Bid bid in the extended period alo. 76. Violation of NDA will lead to legal action and blackliting. 77. Limitation of Liability Except in cae of criminal negligence or willful miconduct, and in the cae of infringement puruant to Condition of Contract Claue, the vendor hall not be liable to LIC, whether in contract or otherwie, for any indirect or conequential lo or damage, lo of ue, lo of production, or lo of profit or requet you to kindly remove the claue related to exiting ervice provider Thi empanelment will be valid for 5 year from the date of iue of 1t PO under thi and may be ued for any future requirement related to information ecurity and related ervice mentioned in RFP. However in exceptional condition, LIC may, at it dicretion, reduce the validity period or extend the validity up to 1 year on the ame term and condition tated in the bid document and ucceful vendor will have to maintain the final quote given for thi bid Plu 10% in the extended period alo. Violation of NDA will lead to legal action and blackliting. Except in cae of criminal negligence or willful miconduct, and in the cae of infringement puruant to Condition of Contract Claue, tthe vendor hall not be liable to LIC, whether in contract or otherwie, for any indirect or conequential lo or damage, lo of ue, lo of production, or lo of profit or interet cot, provided that thi excluion hall not apply to any obligation of Reply to Querie Not relevant. No change. No change. No change. No change. Page 19 of 49

20 Reference() (ection and Settlement of Dipute/Arbit ration Indemnifying LIC clarification() interet cot, provided that thi excluion hall not apply to any obligation of the bidder to pay liquidated damage to LIC; and the aggregate liability of the bidder to LIC, whether under the Contract, in tort or otherwie, hall not exceed the total value of purchae order() iued to the bidder. The vendor hall not be entitled to upend the Service() or the completion of the job, pending reolution of any dipute between the Partie and hall continue to render the Service() in accordance with the proviion of the RFP notwithtanding the exitence of any dipute between the Partie or the ubitence of any arbitration or other proceeding 1) The vendor hall indemnify LIC: (a) Againt all action, proceeding, claim, demand, cot and expene which may be made againt LIC by a third party ariing out of ale of vendor ervice to LIC. (b) Againt all third party claim of infringement of patent, copyright, trademark etc. ariing from ue of the the bidder to pay liquidated damage to LIC; and the aggregate liability of the bidder to LIC, whether under the Contract, in tort or otherwie, hall not exceed 25% of the total annual value of purchae order() iued to the bidder. The vendor hall not be entitled to upend the Service() or the completion of the job nor Purchaer i entitled to delay payment due to Wipro, pending reolution of any dipute between the Partie and hall continue to render the Service() in accordance with the proviion of the RFP notwithtanding the exitence of any dipute between the Partie or the ubitence of any arbitration or other proceeding 1) The vendor hall indemnify LIC: (a) Againt all action, proceeding, claim, demand, cot and expene which may be made againt LIC by a third party ariing out of ale of vendor ervice to LIC. (b) Againt all third party claim of infringement of patent, copyright, trademark etc. ariing from ue of the good and ervice, oftware package or any other part Reply to Querie No change. No change. Page 20 of 49

21 Reference() (ection and clarification() good and ervice, oftware package or any other part thereof upplied by the vendor provided that thi indemnity hall not apply to in the following cae: (i) the modification of the Vendor deliverable provided hereunder by any peron other than the Vendor or it peronnel (ii) LIC failure to ue of any modification to the Vendor deliverable made available by Vendor where ue of uch modification would have avoided the infringement; (iii) Information, material intruction or pecification that are themelve infringing which are provided by or on behalf of LIC or which LIC requet or require Vendor to ue; (iv) the ue of the Vendor deliverable in a manner not agreed to. (c) Againt all demand or reponibilitie ariing from accident or lo of life a a reult of vendor negligence. 2) If the vendor fail to indemnify LIC againt above event and if LIC i required to pay compenation to a thereof upplied by the vendor provided that thi indemnity hall not apply to in the following cae: (i) the modification of the Vendor deliverable provided hereunder by any peron other than the Vendor or it peronnel (ii) LIC failure to ue of any modification to the Vendor deliverable made available by Vendor where ue of uch modification would have avoided the infringement; (iii) Information, material intruction or pecification that are themelve infringing which are provided by or on behalf of LIC or which LIC requet or require Vendor to ue; (iv) the ue of the Vendor deliverable in a manner not agreed to. (c) Againt all demand or reponibilitie ariing from accident or lo of life a a reult of vendor gro negligence. 2) If the vendor fail to indemnify LIC againt above event and if LIC i required to pay compenation to a third party reulting from uch event, the vendor hall be reponible for the compenation including all expene (court cot, lawyer fee etc.). LIC will give notice to the vendor of uch claim. Bidder hall not have any liability to Reply to Querie Page 21 of 49

22 Reference() (ection and 80. Compliance with IS Security Policy clarification() third party reulting from uch event, the vendor hall be reponible for the compenation including all expene (court cot, lawyer fee etc.). LIC will give notice to the vendor of uch claim. The Vendor hall have to comply with LIC IT & IS Security policy in key concern area relevant to the RFP, detail of which will be hared with the finally elected Bidder. Some of the key area are a under: Cutomer under thi Section to the extent that any infringement or claim thereof i attributable to: (1) the combination, operation or ue of a Deliverable with equipment or oftware upplied by Cutomer where the Deliverable would not itelf be infringing; (2) compliance with deign, pecification or intruction provided by Cutomer; (3) ue of a Deliverable in an application or environment for which it wa not deigned or contemplated under thi Agreement; or (4) modification of a Deliverable by anyone other than Bidder where the unmodified verion of the Deliverable would not have been infringing. Bidder will completely atify it obligation hereunder if, after receiving notice of a claim, Bidder obtain for Cutomer the right to continue uing uch Deliverable a provided without infringement, or replace or modify uch Deliverable o that they become noninfringing. Requet LIC to hare the aid policie Reply to Querie Policie, procedure and guideline have been defined in line with ISO tandard. Bidder may refer to thi tandard. Page 22 of 49

23 Reference() (ection and clarification() a) Reponibilitie for data and application privacy and confidentiality; b) Reponibilitie on ytem and oftware acce control and adminitration; c) Cutodial reponibilitie for data, oftware, hardware and other aet of LIC being managed by or aigned to the Vendor; d) Phyical Security of the facilitie; e) Phyical and logical eparation from other cutomer of the Vendor; f) Incident repone and reporting procedure; g) Paword Policy; h) Acce management Policy; i) Acceptable uage Policy (Authentication and Identity Management, Authorization and acce control); j) Data Encryption / Protection requirement of LIC; k) Cyber Security Policy; l) Auditing; m) In general, confidentiality, integrity and availability, non-repudiation, authenticity, privacy of data/information mut be enured; n) Reponibilitie in carrying out Reply to Querie Page 23 of 49

24 Reference() (ection and clarification() background verification of peronnel deployed from vendor ide regularly and ubmit the report a and when needed by LIC; 81. Right to audit a per RFP Requet notice period of 30 day. Requet uch audit to be conducted during normal buine hour and not more than once every financial year, Requet Wipro' internal cot record and enitive financial information to be excluded from the cope of uch udit. Requet audit to be conducted at LIC' cot. Reply to Querie No change. 82. Debarring to debar the bidder from bidding and take any other action a may be deemed neceary propectively for a period to be decided by LIC if it i found at any future point of time that the bidder had made a tatement which i factually incorrect 83. Bid Rejection Criteria Bid not confirming to the requirement, term and condition mentioned in thi RFP document. Requet auditor to enter into the appropriate confidentiality obligation before conducting the audit to debar the bidder from bidding and take any other action a may be deemed neceary propectively for a period to be decided by LIC if it i found at any future point of time that the bidder had made a tatement which i factually incorrect Bid not confirming to the requirement, term and condition mentioned in thi RFP document. Subject to Deviation ubmitted No change. Bid not confirming to the requirement, term and condition mentioned in thi RFP document. Will be rejected. Page 24 of 49

25 Reference() (ection and 84. Submiion of Bid 85. Payment to invoice 86. Excluion of Implied warrantie clarification() We offer to ubmit our bid a per the term and condition pelt out in the RFP. We offer to ubmit our bid a per the term and condition pelt out in the RFP read together with our deviation to the ame. Cutomer hall pay invoice within fifteen (15) day from the date of receipt of invoice, except for thoe portion of any invoice that the Cutomer dipute in good faith. Delayed payment hall incur interet at the rate of 1.5% per month.if whole or any part of the fee and other payment remain outtanding for 90 day after the ame have become due, Wipro hall at it ole dicretion, be entitled to dicontinue the proviion of ervice. EXCEPT FOR THE FOREGOING WARRANTIES, WIPRO EXCLUDES AND DISCLAIMS ALL WARRANTIES, CONDITIONS OR STATEMENTS, WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OR CONDITIONS OF MERCHANTIBILITY AND / OR FITNESS FOR ANY PARTICULAR PURPOSE 87. SNR Claue not preent in RFP Cutomer hereby agree to make the ite ready a per the agreed pecification, within the agreed timeline. Cutomer agree that Wipro hall not be in any manner be liable for any delay ariing out of Cutomer' failure to make the ite ready within the tipulated period, including but not limited to levy of liquidated damage for any delay in performance of Service under the term of Reply to Querie Bid not confirming to the requirement, term and condition mentioned in thi RFP document will be rejected. No deviation are allowed. A per tem and condition of RFP applie. Not relevant. Bidder will not be held accountable for lape attributable to LIC. Page 25 of 49

26 Reference() (ection and clarification() thi Agreement. In cae the SITE i not ready for a continiou period of 30 day, miletone payment related to intallation will be releaed to vendor baed on the SNR report, alo if there i any additional warranty cot due to continiou ite not readine for 30 day, ame will be borne by the cutomer 88. Rik and Title Claue not preent in RFP Notwithtanding anything to the contrary contained elewhere in the contract, The rik, title and ownerhip of the product hall be tranferred to the cutomer upon delivery of uch product to the cutomer 89. Deemed Acceptance 90. Pa Through Warranty Claue not preent in RFP Claue not preent in RFP Product/Service and/or deliverable hall be deemed to be fully and finally accepted by Cutomer in the event when Cutomer ha not ubmitted it acceptance or rejection repone in writing to Wipro within 15 day from the date of intallation/commiioning or when Cutomer ue the Deliverable in it buine, whichever occur earlier. Partie agree that Wipro hall have 15 day time to correct in cae of any rejection by Cutomer. Wipro hall pa-through any and all warrantie and indemnitie received from the manufacturer or licenor of the product and, to the extent, granted by uch manufacturer or licenor, the Cutomer hall be the beneficiary Reply to Querie Not relevant. part of Technical Bid. All acceptance will be a per the term and condition of RFP. Not relevant. Page 26 of 49

27 Reference() (ection and clarification() of uch manufacturer or licenor warrantie and indemnitie. Further, it i clarified that Wipro hall not provide any additional warrantie and indemnitie with repect uch product. 91. ERV Claue not preent in RFP It i agreed that the price quoted i arrived at baed on the exchange rate of 1 USD = INR ( Bae Exchange Rate ). In the event the Bae Exchange Rate either increae or decreae by percentage point greater than two per cent [2%], the price hall be charged a per the then current exchange rate. 92. Non Hire Claue Claue not preent in RFP Cutomer acknowledge that peronnel to be provided by Wipro repreent a ignificant invetment in recruitment and training, the lo of which would be detrimental to Wipro buine. In conideration of the foregoing, Cutomer agree that for the term of thi Agreement and for a period of one year thereafter, Cutomer will not directly or indirectly, recruit, hire, employ, engage, or dicu employment with any Wipro employee, or induce any uch individual to leave the employ of Wipro. For purpoe of thi claue, a Wipro employee mean any employee or peron who ha who ha been involved in providing ervice under thi Agreement. Reply to Querie Not relevant to thi RFP. part of Technical Bid. Page 27 of 49

28 Reference() (ection and clarification() 93. Saving Claue Claue not preent in RFP Wipro failure to perform it contractual reponibilitie, to perform the ervice, or to meet agreed ervice level hall be excued if and to the extent Wipro performance i effected, delayed or caue non-performance due to Cutomer' omiion or action whatoever. 94. Change Order Claue not preent in RFP Either party may requet a change order ( Change Order ) in the event of actual or anticipated change() to the agreed cope, Service, Deliverable, chedule, or any other apect of the Statement of Work/Purchae Order. Wipro will prepare a Change Order reflecting the propoed change, including the impact on the Deliverable, chedule, and fee. In the abence of a igned Change Order, Wipro hall not be bound to perform any additional ervice. 95. Termination for default Claue not preent in RFP Either Party hall have the right to terminate thi Agreement at any time in the event that the other party commit a material breach of the Agreement and fail to cure uch default to the non-defaulting party reaonable atifaction within thirty (30) day. In the event of termination Cutomer hall pay Wipro for good delivered and ervice rendered till the date Reply to Querie Reponded above. Activitie will be performed by the ucceful bidder on the term and condition of RFP. part of Technical Bid. Page 28 of 49

29 Reference() (ection and clarification() of termination. 96. Additional Hardware Claue not preent in RFP Notwithtanding anything to the contrary in the RFP, any requirement by Purchaer of any additional Hardware under the Agreement hall be provided by the Succeful Bidder at an additional cot to Purchaer and the ame hall be done through a Change Order. 97. Upgrade/En hancement Claue not preent in RFP Notwithtanding anything to the contrary in the RFP, any requirement by Purchaer of any upgrade/enhancement hall be provided by the Succeful Bidder at an additional cot to Purchaer and the ame hall be done through a Change Order. 98. Penalty Cap Claue not preent in RFP Nothing withtanding anything contained here, including annexure etc, the maximum aggregate penalty againt the bidder for all claim, by which ever name o called, hall be limited to 3% of the repective SOW/PO and hall be in lieu of all available remedie. Alo, Wipro doe not agree to any form of rik purchae. 99. Intellectual Protection Claue not preent in RFP No intellectual property right of any nature hall be tranferred from one party to the other in the coure of performing any obligation or otherwie under thi agreement. For the avoidance of doubt, Bidder may ue certain tool, procee or Reply to Querie part of Technical Bid. part of Technical Bid. part of Technical Bid. Page 29 of 49

30 Reference() (ection and 100. Stamp Duty/Franking Charge 101. Cutomer Credit Rating 102. Taxation tructure 103. Section: Activity Schedule, Page no. 3 clarification() Lat date & time for ubmiion of bid Monday, 27th November 2017, latet by 3.30 pm methodologie of it own in performing the Service. Ownerhip of all intellectual property right and any other right in thee hall vet with Bidder, and no right hall be deemed to have accrued to the Cutomer.. What the taxation tructure? Pleae clarify on both central and tate taxe w.r.t the variou item involved under SOW Hardware, oftware, ervice, etc. 2. Ha the tructure & the rate been dicued with the cutomer and alo the internal operation team? The overall material planning (purchae location, billing location, vendor taxation tructure) need to be carefully evaluated while providing repone to the query. 3. Pleae provide confirmation from op w.r.t point 2 above. Two date are mentioned for lat date of bid ubmiion i.e. 20-Nov 2017 (On cover #1) and 27-Nov-2017 (On Activity Schedule #3). We undertand that lat bid ubmiion date i 27- Reply to Querie Not Part of thi RFP. Not Part of thi RFP. A applicable a per variou rule and regulation applicable. Pl ee above. Page 30 of 49

31 Reference() (ection and 104. Section: Overview of the RFP, Page no Section: Overview of the RFP, Page no Section: Overview of the RFP, Page no. 4 clarification() Part B- Penetration teting Part B- Forenic on demand Part B- Configuration audit Nov-2017, pleae confirm. Pleae clarify if the PT activity would be intruive/ non-intruive We requet you to pleae clarify what poible type of ervice doe LIC expect the bidder to perform under Forenic on demand. Pleae clarify if configuration audit i limited only to network device or other IT ytem a well Reply to Querie Part of Technical Bid. Part of Technical Bid. Part of Technical Bid Section B - Eligibility bid document, Page no. 8, point no Section B - Eligibility bid document, Page no. 8, point no. 5 The bidder hould have had a minimum average annual turnover of R crore (Rupee five Crore) in India in any of the three financial year immediately preceding the date of publihing of thi RFP. The bidder hould have had a minimum average annual turnover of R crore (Rupee five Crore) in India in any of the three financial year immediately preceding the date of publihing of thi RFP. Conidering the critical nature of the project we requet you to kindly increae the turnover value to atleat 50 crore rupee. Since the financial tatement for FY are under audit proce, we requet you to kindly modify thi claue and conider financial year a FY , FY and FY No change. No change Section B - The bidder hould have executed 1 We requet you to pleae clarify if the project Pl ee above. Page 31 of 49

32 Reference() (ection and Eligibility bid document, Page no. 8, point no Section B - Eligibility bid document, Page no. 8, point no Conidering the critical clarification() (one) order of at leat R. 20 lakh in any of three financial year immediately preceding the date of publihing of thi RFP. The purchae order in point no. 2 of Table-II below hould cover ervice, i.e. ISMS for IT procee (including ISO27001 certification / recertification / renewal), BCMS (including ISO22301 certification / recertification / renewal), Cyber ecurity review, and Information ecurity audit/review. The bidder hould have executed 1 (one) order of at leat R. 10 lakh in any of three financial year immediately preceding the date of publihing of thi RFP. The purchae order in point no. 3 of Table-II below hould cover ervice, i.e. VA & PT and recommendation for mitigation, Application ecurity and ecure code review, Secure network architecture review and pear phihing. The bidder hould have executed 1 (one) order of at leat R. 20 lakh in propoed by the bidder hould have component of each area mentioned in the eligibility criteria. We requet you to pleae clarify if the project propoed by the bidder hould have component of each area mentioned in the eligibility criteria. Conidering the critical nature of the project we Reply to Querie Pl ee above. No Change. Page 32 of 49

33 Reference() (ection and nature of the project we requet you to kindly increae the value of the project to be propoed by the bidder Section B - Eligibility bid document, Page no. 8, point no Section B - Eligibility bid document, Page no. 8, clarification() any of three financial year immediately preceding the date of publihing of thi RFP. The purchae order in point no. 2 of Table-II below hould cover ervice, i.e. ISMS for IT procee (including ISO27001 certification / recertification /renewal), BCMS (including ISO22301 certification / recertification / renewal),cyber ecurity review, and Information ecurity audit/review. The bidder hould have executed 1 (one) order of at leat R. 10 lakh in any of three financial year immediately preceding the date of publihing of thi RFP. The purchae order in point no. 3 of Table-II below hould cover ervice, i.e. VA & PT and recommendation for mitigation, Application ecurity and ecure code review, Secure network architecture review and pear phihing. The Bidder hould have at leat 15 certified employee (poted in India) for Part A a on and their certificate need to be valid on that requet you to kindly increae the value of the project to be propoed by the bidder. Conidering the critical nature of the project we requet you to kindly increae the value of the project to be propoed by the bidder. Conidering the critical nature of the project we requet you to kindly modify the claue a below The Bidder hould have at leat 25 certified Reply to Querie No Change. The Bidder hould have certified employee (poted in India) for Part A and Part-B a on Page 33 of 49