REQUEST FOR PROPOSAL (RFP) FOR SELECTION ... …

1 Document Type: Public Page 1 of 103 IT security Cell, Risk Management Dept., Baroda Corporate Centre, bank of Baroda Mumbai RFP for SELECTION of IT security Systems integrator for security Operations Centre RFP Ref No: BCC:CISO:RFP:104/01 Date : 15 March 2012 REQUEST FOR PROPOSAL (RFP) FOR SELECTION OF IT security SYSTEMS integrator FOR security OPERATIONS CENTRE RFP Reference No. BCC: CISO: RFP:104/01 Date : 15 March 2012 bank of Baroda, Baroda Corporate Centre, C-26, G Block, Bandra Kurla Complex Bandra (East), Mumbai - 400 051. Document Type: Public Page 2 of 103 IT security Cell, Risk Management Dept., Baroda Corporate Centre, bank of Baroda Mumbai RFP for SELECTION of IT security Systems integrator for security Operations Centre RFP Ref No: BCC:CISO:RFP:104/01 Date : 15 March 2012 Important Dates: Sr. No. Particulars Dates and Timelines 1 Issuance of RFP document by the bank 00:00 hours on 15th March 2012 2 Last date of submission of any queries and Last date for reporting any error, omissions or faults in the RFP document 17:00 hours on 26th March 2012 3 Pre-bid Meeting date/venue 15:00 hours on 03rd April 2012.

2 bank Of Baroda, Baroda Corporate Centre, C-26, G-Block, Bandra Kurla Complex, Mumbai 400 051 4 Last Date of submission of RFP response 15:00 hours on 17th April 2012 5 Technical bid opening date / time / venue 16:00 hours 17th April 2012 bank Of Baroda, Baroda Corporate Centre, C-26, G-Block, Bandra Kurla Complex, Mumbai 400 051 All times shown above are Indian Standard Time Important Clarifications: Following terms are used in the document interchangeably to mean: bank means bank of Baroda (including domestic operations, overseas operations, Overseas & Indian subsidiaries & Associate Banks) BCC means Baroda Corporate Centre . BST means Baroda Sun Tower . security Systems integrator (SSI), Recipient, Respondent, Bidder and Vendor generally means Respondent to the RFP document unless context specifies otherwise. SIEM means security Information and Event Management DAM means Database Activity Monitoring VA/VM means Vulnerability Assessment/Vulnerability Management EPS means Events per second DC means bank s Data centre at Mumbai.

3 DR, DRS means bank s Disaster Recovery centre at Hyderabad. RFP means this RFP document Document Type: Public Page 3 of 103 IT security Cell, Risk Management Dept., Baroda Corporate Centre, bank of Baroda Mumbai RFP for SELECTION of IT security Systems integrator for security Operations Centre RFP Ref No: BCC:CISO:RFP:104/01 Date : 15 March 2012 TABLE OF CONTENTS SECTION I .. 5 INTRODUCTION AND DISCLAIMER .. 5 INORMATION PROVIDED .. 5 FOR RESPONDENT ONLY .. 5 CONFIDENTIALITY .. 5 DISCLAIMER .. 6 ELIGIBILITY CRITERIA.. 6 COSTS BORNE BY RESPONDENTS .. 6 NO LEGAL RELATIONSHIP .. 7 RECIPENT OBLIGATION TO INFORM ITSELF .. 7 EVALUATION OF BIDS .. 7 ERRORS AND OMISSIONS .. 7 ACCEPTANCE OF TERMS .. 8 RFP RESPONSE TERMS .. 8 NOTIFICATIONS .. 13 13 ERASINGS OR ALTERATIONS .. 13 RIGHT TO REJECT BIDS .. 13 PROCESS & TIMEFRAME .. 14 OTHER TERMS AND CONDITIONS .. 15 SECTION 16 bank OF BARODA-INTRODUCTION .. 16 PROJECT OBJECTIVE.

4 16 PROJECT SCOPE .. 17 DELIVERABLES .. 23 SERVICE LEVEL AGREEMENT .. 24 DEPLOYMENT ARCHITECTURE .. 26 PROJECT TIMELINES .. 27 DETAILS OF INFRASTRUCTURE AT bank S DC/DR .. 28 SECTION III .. 29 GENERAL TERMS AND CONDITIONS .. 29 SECTION IV .. 39 ANNEXURE-A : ELIGIBILITY 39 ANNEXURE-B : security system integrator S SELECTION / EVALUATI-ON PROCESS .. 42 ANNEXURE-C : COMPLIANCE CERTIFICATE .. 46 ANNEXURE-D : TECHNICAL BID FORMAT .. 47 ANNEXURE-E : SOC SOLUTIONS SPECIFICATIONS .. 51 ANNEXURE-F : PROFILE OF ONSITE MANPOWER AT DC & DR .. 85 Document Type: Public Page 4 of 103 IT security Cell, Risk Management Dept., Baroda Corporate Centre, bank of Baroda Mumbai RFP for SELECTION of IT security Systems integrator for security Operations Centre RFP Ref No: BCC:CISO:RFP:104/01 Date : 15 March 2012 ANNEXURE-G : EXPERIENCE DETAILS .. 88 ANNEXURE-H : PROPOSED TEAM PROFILE .. 89 ANNEXURE-I : ESTIMATED EFFORT AND ELAPLSED TIME .. 90 ANNEXURE-J : OEM DETAILS.

5 91 ANNEXURE-K : MANUFACTURER AUTHORIZATION FORM .. 92 ANNEXURE-L : OEM SIZING CONFIRMATION .. 93 ANNEXURE-M : COMMENTS ON TERMS & CONDITIONS & SERVICES/PRE BID QUERY 94 ANNEXURE-N : COMMERCIAL BID FORMAT .. 95 ANNEXURE-O : BILL OF MATERIAL .. 103 Document Type: Public Page 5 of 103 IT security Cell, Risk Management Dept., Baroda Corporate Centre, bank of Baroda Mumbai RFP for SELECTION of IT security Systems integrator for security Operations Centre RFP Ref No: BCC:CISO:RFP:104/01 Date : 15 March 2012 SECTION I INTRODUCTION AND DISCLAIMER This REQUEST for PROPOSAL document ( RFP ) has been prepared solely to enable bank of Baroda ( bank ) in the SELECTION of security system integrator through tender for setting up and operations of security Operations Centre for the bank , including its branches, subsidiaries, overseas branches etc. The RFP document is not a recommendation, offer or invitation to enter into a contract, agreement or other arrangement in respect of the product and services.

6 The provision of the product and services is subject to observance of SELECTION process and appropriate documentation being agreed between the bank and any successful Bidder as identified after completion of the SELECTION process as detailed in Annexure-B on security system integrator s SELECTION /Evaluation Process. INORMATION PROVIDED The RFP document contains statements derived from information that is believed to be true and reliable at the date obtained but does not purport to provide all of the information that may be necessary or desirable to enable an intending contracting party to determine whether or not to enter into a contract or arrangement with bank in relation to the provision of services. Neither bank nor any of its directors, officers, employees, agents, representative, contractors, or advisers gives any representation or warranty (whether oral or written), express or implied as to the accuracy, updating or completeness of any writings, information or statement given or made in this RFP document.

7 Neither bank nor any of its directors, officers, employees, agents, representative, contractors, or advisers has carried out or will carry out an independent audit or verification or investigation or due diligence exercise in relation to the contents of any part of the RFP document. FOR RESPONDENT ONLY The RFP document is intended solely for the information of the party to whom it is issued ( the Recipient or the Respondent ) Government Organization/PSU/PSE/ limited Company/partnership firm or an autonomous institution approved by GOI/RBI promoted. The RFP document can be downloaded from the bank s corporate website CONFIDENTIALITY This document is meant for the specific use by the Respondents interested to participate in the current tendering process. This document in its Document Type: Public Page 6 of 103 IT security Cell, Risk Management Dept., Baroda Corporate Centre, bank of Baroda Mumbai RFP for SELECTION of IT security Systems integrator for security Operations Centre RFP Ref No: BCC:CISO:RFP:104/01 Date : 15 March 2012 entirety is subject to Copyright laws.

8 bank expects the Bidders or any person acting on behalf of the Bidders to strictly adhere to the instructions given in the document and maintain confidentiality of information shared with them. The Bidders will be held responsible for any misuse of the information contained in the document and liable to be prosecuted by the bank in the event of such a circumstance is brought to the notice of the bank . By downloading the document, the interested party is subject to confidentiality clauses. bank may update or revise the RFP document or any part of it. The Recipient acknowledges that any such revised or amended document shall be received subject to the same confidentiality terms. The Recipient will not disclose or discuss the contents of the RFP document with any officer, employee, consultant, director, agent, or other person associated or affiliated in any way with the bank or any of its customers or suppliers without prior written consent of the bank .

9 DISCLAIMER Subject to any law to the contrary, and to the maximum extent permitted by law, bank and its directors, officers, employees, contractors, representatives, agents, and advisers disclaim all liability from any loss, claim, expense (including, without limitation, any legal fees, costs, charges, demands, actions, liabilities expenses or disbursements incurred therein or incidental thereto) or damage (whether foreseeable or not) ( Losses ) suffered by any person acting on or refraining from acting because of any presumptions or information (whether oral or written and whether express or implied), including forecasts, statements, estimates, or projections contained in this RFP document or conduct ancillary to it whether or not the Losses arises in connection with any ignorance, negligence, inattention, casualness, disregard, omission, default, lack of care, immature information, falsification or misrepresentation on the part of bank or any of its directors, officers, employees, contractors, representatives, agents, or advisers.

10 ELIGIBILITY CRITERIA. SSI who wish to bid should conform to the Eligibility Criteria as per Annexure-A : Eligibility Criteria except for clause nos 3 & 4. For meeting the eligibility criteria, would be considered as the date on which the Bidder should be eligible. COSTS BORNE BY RESPONDENTS All costs and expenses (whether in terms of time or money) incurred by the Recipient / Respondent in any way associated with the development, preparation and submission of responses, including but not limited to attendance at meetings, discussions, demonstrations, presentation etc. and Document Type: Public Page 7 of 103 IT security Cell, Risk Management Dept., Baroda Corporate Centre, bank of Baroda Mumbai RFP for SELECTION of IT security Systems integrator for security Operations Centre RFP Ref No: BCC:CISO:RFP:104/01 Date : 15 March 2012 providing any additional information required by bank , will be borne entirely and exclusively by the Recipient / Respondent.