Solution de protection des données et des points terminaux

Trade Agreement: NAFTA/AIT/Canada FTAs with Peru/Colombia/Panama
Tendering Procedures:
Attachment: None
Non-Competitive Procurement Strategy: Exclusive Rights
Comprehensive Land Claim Agreement: No
Vendor Name and Address:
Advanced Chippewa Technologies Inc.
84 Valley Ridge
Ottawa Ontario
Canada
K2E7W3
Nature of Requirements:
Endpoint and Data Protection Solution
19402-130152
Lessard, Peter
Telephone No. - (819) 956-5846
Fax No. - (819) 953-3703

REQUIREMENT:

The Department of Justice Canada has a requirement for the
provision of goods as specified under "Background" below. The
purpose of this Advance Contract Award Notice (ACAN) is to
signal the government's intention to award a contract for these
goods to ACT Inc., the Supply Arrangement holder for McAfee
software. Before awarding a contract, however, the government
would like to provide other suppliers with the opportunity to
demonstrate that they are capable of satisfying the requirements
set out in this Notice, by submitting a statement of
capabilities during the 15 calendar day posting period.

If other potential suppliers submit a statement of capabilities
during the 15 calendar day posting period that meet the
requirements set out in the ACAN, the government will proceed to
a full tendering process on either the government's electronic
tendering service or through traditional means, in order to
award the contract.

If no other supplier submits, on or before the closing date, a
statement of capabilities meeting the requirements set out in
the ACAN, a contract will be awarded to the pre-selected
supplier.

BACKGROUND:

Department of Justice Canada is seeking to enhance its Network
Security, specifically in regards to endpoint protection and
data control. The Department of Justice believes the most
efficient way to provide the protection is with a centrally
management software solution.

Public Works and Government Services Canada, on behalf of its
Client, Department of Justice Canada, intends to enter into a
sole source contract with McAfee Limited for the purpose of
procurement of the following:

Initial Requirement

1) 100 - McAfee Endpoint Protection Suite
2) 100 - Host Data Loss Prevention Software
3) 24 - McAfee Change Control for Servers
4) 16 - McAfee Database Activity Monitoring

MINIMUM ESSENTIAL REQUIREMENTS

Any interested supplier must demonstrate by way of a statement
of capabilities that it meets all of the mandatory requirements
at Annex A

JUSTIFICATION FOR THE PRE-SELECTED SUPPLIER

The reasons for single tendering are described at Annex A.

Section 6 of the Government Contract Regulations is being
invoked in this procurement as only one person or firm is
capable of performing the contract.

Articles 506.12(a) and 506.12(b) of AIT are applicable on the
basis of limited tendering due to compatibility with existing
products, to recognize exclusive rights, such as exclusive
licenses, copyright and patent rights, or to maintain
specialized products that must be maintained by the manufacturer
or its representative, and when there is an absence of
competition for technical reasons and the goods or services can
be supplied only by a particular supplier and no alternative or
substitute exists.

Articles 1016.2(b) and 1016.2(d) of NAFTA are applicable on the
basis of limited tendering due to reasons where, for works of
art, or for reasons connected with the protection of patents,
copyrights or other exclusive rights, or proprietary information
or where there is an absence of competition for technical
reasons, the goods or services can be supplied only by a
particular supplier and no reasonable alternative or substitute
exists, for additional deliveries by the original supplier that
are intended either as replacement parts or continuing services
for existing supplies, services or installations, or as the
extension of existing supplies, services or installations, where
a change of supplier would compel the entity to procure
equipment or services not meeting requirements of inter
changeability with already existing equipment or services,
including software to the extent that the initial procurement of
the software was covered by this Chapter.

PERIOD OF CONTRACT

The proposed contract is for the purchase of McAfee Software and
associated maintenance and support services for a period of one
(1) year from date of Contract Award.

The solution will be delivered within 10 days of any resulting
contract.

ANNEX A

The reasons for sole source procurement of the required security
software are listed below. The Department of Justice Canada
requires the solution to be compliant with the following
functionalities:

General Technical Requirements

1. All four software products must use a single, common security
management and reporting tool. All aspects of the software must
be completely manageable and configurable through one security
management console. The console must be a console that provides
security situational awareness and risk posturing by interacting
with the endpoint security elements.

2. The software must have the ability to gradually deploy in a
development or early production environment without breaking
applications or environment.

3. The solution must not be appliance based.

Data Loss Prevention Endpoint Technical Requirements

1. The software must meet Treasury Board requirements to ensure
that sensitive data is protected from loss, including financial
loss, brand damage, national security risks, loss of
credibility, and noncompliance penalties that come with
accidental disclosure or data theft by insiders and hackers.

2. The software must safeguard all layers of the infrastructure
and ensure that confidential information is protected throughout
the network on servers, in databases, and across all endpoints.

3. The software must control data transfer and ensure that the
department monitors and controls the transfer of sensitive
information to removable storage devices or email even when the
data is disguised.

4. The software must support comprehensive Device Definitions
and ensure that protection mechanisms are in place to protect
sensitive data, even when data is modified, copied, pasted, or
compressed. All protection mechanisms must include the
following device definitions: USB, SCSI, PCMCIA, PCI bus,
IDE/SATA, Firewire, Bluetooth, MP3, CDs, DVDs, iPods and smart
phones with storage.

5. The software must offer granular control over USB devices and
provide protection methods for USB based devices like memory
sticks, can be controlled (Blocked, Monitored, Alerted) based
on granular criteria such as Vendor ID, USB Serial Number, as
well as the domain name of the user. The proposed solution must
be capable of creating flexible role based policies to control
the usage of removable devices and what data can be written to
them.

6. The software must be managed by a security management console.

7. The software must be able to scan for sensitive data residing
on local hard drives. Sensitive data scanning policies must be
granular enough to filter by user and/or Active Directory group.
Resulting scan results must be stored within the security
management console in such a way that it can be used to and
build a profile of how corporate data is used. Resulting scan
results must also be available for the purpose of compiling an
inventory of corporate data for use in cases such as legal
discovery.

8. The software must be able to prevent data loss by blocking
prohibited actions in real time whether the endpoint is
connected to the corporate network, or disconnect from the
corporate network. When a blocking action occurs off the
corporate network, event data must be securely stored on the
laptop and sent to the security management console when the
endpoint re-connects to the corporate network.

9. The software must offer granular security policies and
support the creation of granular reaction rules. Reaction rules
must be able to define actions that can be taken to enforce DLP
and Device Control policies, for example, block, monitor, alert,
quarantine, report, or encrypt.

10. The software must provide critical usage data, such as
device name, time stamp, and data evidence is captured. The
software must be able to produce regulatory compliance and
forensic reports to prove to auditors that internal and
regulatory compliance measures are in place.

Database Activity Monitoring Technical Requirements

1. For audit purposes the proposed software must be able to log
database access including complete transaction details. The
software must be able to track user name, date/time, and what
data fields were modified.

2. The software must use a small footprint sensor for the
purposes of monitoring all database activity. The sensor must be
a standalone process that runs on the host server and not on
each database instance thereby ensuring minimal impact to the
databases.

3. A single Database Activity Monitoring (DAM) console must be
used regardless of the number of DAM sensors in use on different
databases. The solution must be able to scale to encompass
hundreds of databases. The console must be the same console
which manages all of the other required components in this ACAN.

4. The software must provide granular monitoring of all database
transactions, including, queries, database objects, stored
procedures, and supports real-time alerting capability to
prevent breaches.

5. The proposed software must provide immediate protection
against newly discovered database vulnerabilities while
maintaining zero Database Management System downtime.

6. The proposed software must have the ability to apply missing
patches and fix misconfigurations found by the Database Activity
Monitoring software.

Change Control White Listing Technical Requirements

1. The proposed software must be able to block all known malware
and unknown malware by preventing any unauthorized software from
running on the endpoint. The solution must be able to define
what authorized software is and provide a means to modify the
authorized software library.

2. The proposed software must not require any sort of signature
file, script or update of any kind in order to continue
protecting the endpoint.

3. The software must protect the endpoint on or off the
corporate network.

4. The proposed software must be able to protect Random Access
Memory (RAM) to ensure that buffer overflow attacks will not
compromise the system.

5. The software must be able to capture all applications in use
on the endpoint and auto classify the applications as good/bad
or unknown. The software must also provide the functionality
for customization of the inventory classification.

6. The proposed software must accommodate change to authorized
programs through a variety of mechanisms, including application
certificates, trusted user, trusted file location, time of day,
and trusted updater. These mechanisms must be accessible and
customizable via a management console.

7. The proposed software must provide the option to allow end
users to install software for operational purposes, while being
tracked by the software management console. Post installation
must have the ability to reject or accept these exceptions based
on policy.

Endpoint Protection Suite Technical Requirements

1. The proposed software must provide anti-virus protection,
desktop firewall protection, web protection and web filter for
endpoints, be able to stop known and unknown malware, viruses,
adware, spyware, rootkits, key-loggers while achieving over 99%
detection rates.

2. The software must minimize data loss and downtimes caused by
zero-day threats; and minimize anti-virus signatures by using
cloud based threat intelligence. The cloud based threat
intelligence must work within the context of all threat vectors
including file, web, message, and network.

3. The software must be able to proactively block spyware and
other potentially unwanted programs from the endpoint.

4. The endpoint protection software must protect the endpoint
from spam and malware.

5. The proposed software must support an integrated web security
solution to prevent users from accessing malicious websites
thereby avoiding web-based threats. The solution must support
active website ratings to educate users of the dangers of
accessing the target website. These integrated security
solutions must warn and optionally block users from accessing
sites that harbor spyware, phishing scams, or spamming agents,
or optionally can block users based on a website categorization
policy.

6. The proposed software must use multiple protection engines
that work in concert to protect the endpoint; architecturally
this means the department can deploy only the components
required and on an as required basis as opposed to a single
monolithic package of all components. Components to be based on
Active Directory user groups, products (engines) and must be
deployable via the software management console.

7. The proposed anti-virus software must support a persistent
cache feature such that cached scan data remains intact even
after a reboot.

8. The proposed anti-malware software must protect a broad range
of operating systems including various Windows desktop and
server platforms, as well as Macintosh and Linux platforms.

9. The proposed software must support a location based,
connection-aware desktop firewall. This gives users connecting
via the corporate network one set of firewall rules (fairly
unrestricted access); however, when off the network (i.e. in a
coffee shop or hotel) a more restrictive firewall policy must be
used, for example only granting access to a corporate VPN IP
address.

10. The proposed endpoint firewall must be able to prevent the
endpoint from establishing two concurrent connections to two
different networks. For example, it must prevent an Ethernet
connection to the corporate network from being established while
an attempt is made at the same time to an external network using
the wireless adapter. The software must disable/block the
wireless connection for the above scenario.

11. The proposed solution must be able to support roaming users
by facilitating the use a DMZ based interface that will allow
the single security management console to interact with mobile,
externally managed systems.

12. The proposed software must be fully capable of operating
within a virtual environment, thereby affording the same malware
protection as it would a physical endpoint. Management of
virtual endpoints must be identical to the management of
physical endpoints.

CLOSING DATE AND TIME FOR WRITTEN SUPPLIER RESPONSES CHALLENGING
THIS REQUIREMENT IS 2:00 p.m. EST, November 15, 2013.

You are hereby notified that the Government intends to solicit a
bid and negotiate with one firm only as identified above.

If you wish to submit a written response showing that you are
capable of meeting this requirement, it must be done not later
than the specified closing date and time. The file number,
contracting officer's name, and the closing date of the ACAN
must appear on the outside of the envelope in block letters or,
in the case of a facsimile transmission, on the covering page.
As it is intended to proceed in a timely manner, responses
received after the closing date will not be considered.

Responses received on or before the closing date will be
considered solely for the purpose of deciding whether or not to
conduct a competitive procurement. Information provided will be
used by the Crown for technical evaluation purposes only and is
not to be construed as a competitive solicitation. Your written
response must provide sufficient evidence (e.g. specifications,
technical data, drawings, or any other proof) that clearly
demonstrates that your product or service is capable of
fulfilling this requirement.
Suppliers that have submitted a response will be notified in
writing of PWGSC's decision to continue with the non-competitive
procurement or compete the requirement.

Delivery Date: Above-mentioned

You are hereby notified that the government intends to negotiate
with one firm only as identified above. Should you have any
questions concerning this requirement, contact the contracting
officer identified above.

An Advance Contract Award Notice (ACAN) allows departments and
agencies to post a notice, for no less than fifteen (15)
calendar days, indicating to the supplier community that it
intends to award a good, service or construction contract to a
pre-identified contractor. If no other supplier submits, on or
before the closing date, a Statement of Capabilities that meets
the requirements set out in the ACAN, the contracting authority
may then proceed with the award. However, should a Statement of
Capabilities be found to meet the requirements set out in the
ACAN, then the contracting authority will proceed to a full
tendering process.

Suppliers who consider themselves fully qualified and available
to provide the services/goods described herein, may submit a
statement of capabilities in writing to the contact person
identified in this Notice on or before the closing date of this
Notice. The statement of capabilities must clearly demonstrate
how the supplier meets the advertised requirements.

The PWGSC file number, the contracting officer's name and the
closing date of the ACAN must appear on the outside of the
envelope in block letters or, in the case of a facsimile
transmission, on the covering page.

The Crown retains the right to negotiate with suppliers on any
procurement.

Documents may be submitted in either official language of Canada.