NOTICE OF PROPOSED PROCUREMENT (NPP)For TASK BASED INFORMATICS PROFESSIONAL SERVICES (TBIPS)GSIN: D302A ADP SYSTEM DEVELOPMENT SERVICESReference Number:87055-15-0173Solicitation Number:87055-15-0173Organization Name:Canadian Nuclear Safety CommissionSolicitation Date:2015-10-22Closing Date:2015-11-06 02:00 PM Eastern Standard Time (EST)Anticipated Start Date:1 to 2 months from closing dateEstimated Delivery Date:Estimate Level of Effort:74 daysContract Duration:The contract period will be for 74 days from the date of contractSolicitation Method:CompetitiveApplicable Trade Agreements:WTO-AGP, NAFTA, AITComprehensive Land Claim Agreement Applies:NoNumber of Contracts:1Requirement DetailsTendering Procedure: Selective TenderingThis requirement is open only to those TBIPS Supply Arrangement Holders who qualified under Tier 1 for services in the National Capital Region for the following category:One (1) Level 3, C.1 Strategic IT Security Planning and Protection ConsultantThe following SA Holders have been invited to submit a proposal:2Keys CorporationAdirondack Information Management Inc., Amita Corporation, Artemp Personnel Services Inc., The AIM Group Inc.,in JOINT VENTUREAvaleris Inc.Conoscenti Technologies Inc.Davidson Violette & Associates Inc.DWP Solutions Inc.EmerionKPMG LLPPhirelight Security Solutions Inc.PrecisionIT Inc,IDS Systems Consultants Inc., PrecisionERP Incorporated, in JOINT VENTURESamson & Associés CPA/Consultation IncSomos Consulting Group Ltd.TEKSYSTEMS CANADA INC./SOCIETY TEKSYSTEMS CANADA INC.Thales Canada Inc.Turtle Technologies Inc.However, should an uninvited SA Holder wish to be invited, it may contact the Contracting Authority in writing to request an invitation at any time prior to five days before the published bid closing date, and an invitation will be made to that SA Holder. To ensure efficient operation of the procurement system, the Contracting Authority will invite no more than the first 10 SA Holders that request an invitation. In no circumstance will such an invitation require Canada to extend a bid closing date.Description of Work:1.0 ObjectivesThe objectives of this project are to review the current state of the cyber/IT security program at CNSC and develop an action plan and roadmap to address identified gaps in meeting the organization’s strategic objectives, risk profile, compliance requirements and leading practices.2.0 Scope of WorkThe scope of the project will include all major components of CNSC’s cyber/IT security program, aimed at answering various foundational questions as follows:Assessment of Governance and compliance: This area includes a review of governance committees, roles and responsibilities and reporting relationships related to cyber/IT security across CNSC and with Shared Services Canada and other related organizations. It also includes compliance management processes, as well as performance measurement and reporting.Planning and Architecture: This area includes the process to define the action plan and architecture for IT Security. It also includes the supporting risk management and performance processes.Cyber/IT Security Processes: This area includes review of cyber/IT security processes such as Incident Management; Configuration and patch management; Risk Management, Vulnerability Management; Cyber Threat Intelligence/Management; Cyber Resiliency; Monitoring and Advanced Persistent Threat (APT) detection and Change Management (focused on how IT security is embedded within the process)3.0 Tasks to be PerformedCyber/IT Security Program Current State ReviewKey Tasks:Project planningHold kick-off meeting to introduce the project, and confirm approach and methodology. Identify potential interviewees and preliminary list of documents to reviewFinalize work plan with timelinesBuild framework for the review:Through an initial set of 2-3 interviews, confirm cyber/IT security business and compliance requirementsBuild review framework using compliance requirements identified and leading industry and federal government practicesDevelop questionnaires, based on relevant requirements for each intervieweeDocument the current state of the cyber/IT security program against the framework.Conduct approximately 12 interviews (and potentially workshops for areas with multiple owners/stakeholders), and review additional documentation to understand current cyber/IT security practices and document them in the frameworkDocument the current Cyber/IT Security Program against the business and Treasury Board compliance requirements and leading practices documented in the frameworkPhase 2: Defining the desired end state/Objectives of the cyber programKey Tasks:Perform an environmental scan for cyber security as it relates to CNSC, including meeting with 2-3 other like organizations to discuss their cyber strategy and objectivesReview the organization business and IT strategies and plans and derive preliminary cyber security program objectivesPerform a work shop with business representatives to help refine the desired end/state and objectives of the cyber programPhase 3: Develop Action Plan & RoadmapKey Tasks:Prioritize activitiesBased on the desired end state, develop criteria to rank the activities/recommendationsConduct a workshop to discuss the prioritizationDefine steps to evolve the IT security programDefine steps on establishing systematic IT Security risk management processes that align with the approach recommended by CSE (ITSG-33, Annex 1).Strategy and RoadmapIssue draft action plan and roadmap based on the results of the workshopAddress comments on the draft and issue final action plan and roadmapPresent Action Plan and RoadmapDevelop presentation deck for the strategy and roadmapPresent findings and recommendations to senior managementIncumbent:The work has not been performed by a contracted resource in the last 12 months.Security Requirement: Common PS SRCL #19 appliesMinimum Corporate Security Required: Facility Security Clearance (FSC)Minimum Resource Security Required: Secret ClearanceContract AuthorityName: Dan SimardPhone Number: 613-996-6784Email Address: d••••••••@••••••.caInquiriesInquiries regarding this RFP requirement must be submitted to the Contracting Authority named above. Request for Proposal (RFP) documents will be e-mailed directly from the Contracting Authority to the Qualified Supply Arrangement Holders who are being invited to bid on this requirement. BIDDERS ARE ADVISED THAT “BUYANDSELL.GC.CA” IS NOT RESPONSIBLE FOR THE DISTRIBUTION OF SOLICITATION DOCUMENTS. The Crown retains the right to negotiate with any supplier on any procurement. Documents may be submitted in either official language.NOTE: Task‐Based Informatics Professional Services (TBIPS) Method of Supply is refreshed three (3) times per year.If you wish to find out how you can be a “Qualified SA Holder”, please contact RCNMDAI.‐N••••••@•••••.••.ca
