Endpoint and Data Protection Solution

Trade Agreement: NAFTA/AIT/Canada FTAs with Peru/Colombia/Panama Tendering Procedures: Attachment: None Non-Competitive Procurement Strategy: Exclusive Rights Comprehensive Land Claim Agreement: No Vendor Name and Address: Advanced Chippewa Technologies Inc. 84 Valley Ridge Ottawa Ontario Canada K2E7W3 Nature of Requirements: Endpoint and Data Protection Solution 19402-130152 Lessard, Peter Telephone No. - (819) 956-5846 Fax No. - (819) 953-3703

REQUIREMENT

The Department of Justice Canada has a requirement for the provision of goods as specified under "Background" below. The purpose of this Advance Contract Award Notice (ACAN) is to signal the government's intention to award a contract for these goods to ACT Inc., the Supply Arrangement holder for McAfee software. Before awarding a contract, however, the government would like to provide other suppliers with the opportunity to demonstrate that they are capable of satisfying the requirements set out in this Notice, by submitting a statement of capabilities during the 15 calendar day posting period.

If other potential suppliers submit a statement of capabilities during the 15 calendar day posting period that meet the requirements set out in the ACAN, the government will proceed to a full tendering process on either the government's electronic tendering service or through traditional means, in order to award the contract.

If no other supplier submits, on or before the closing date, a statement of capabilities meeting the requirements set out in the ACAN, a contract will be awarded to the pre-selected supplier.

BACKGROUND

Department of Justice Canada is seeking to enhance its Network Security, specifically in regards to endpoint protection and data control. The Department of Justice believes the most efficient way to provide the protection is with a centrally management software solution.

Public Works and Government Services Canada, on behalf of its Client, Department of Justice Canada, intends to enter into a sole source contract with McAfee Limited for the purpose of procurement of the following:

Initial Requirement

1) 100 - McAfee Endpoint Protection Suite 2) 100 - Host Data Loss Prevention Software 3) 24 - McAfee Change Control for Servers 4) 16 - McAfee Database Activity Monitoring

MINIMUM ESSENTIAL REQUIREMENTS

Any interested supplier must demonstrate by way of a statement of capabilities that it meets all of the mandatory requirements at Annex A

JUSTIFICATION FOR THE PRE-SELECTED SUPPLIER

The reasons for single tendering are described at Annex A.

Section 6 of the Government Contract Regulations is being invoked in this procurement as only one person or firm is capable of performing the contract.

Articles 506.12(a) and 506.12(b) of AIT are applicable on the basis of limited tendering due to compatibility with existing products, to recognize exclusive rights, such as exclusive licenses, copyright and patent rights, or to maintain specialized products that must be maintained by the manufacturer or its representative, and when there is an absence of competition for technical reasons and the goods or services can be supplied only by a particular supplier and no alternative or substitute exists.

Articles 1016.2(b) and 1016.2(d) of NAFTA are applicable on the basis of limited tendering due to reasons where, for works of art, or for reasons connected with the protection of patents, copyrights or other exclusive rights, or proprietary information or where there is an absence of competition for technical reasons, the goods or services can be supplied only by a particular supplier and no reasonable alternative or substitute exists, for additional deliveries by the original supplier that are intended either as replacement parts or continuing services for existing supplies, services or installations, or as the extension of existing supplies, services or installations, where a change of supplier would compel the entity to procure equipment or services not meeting requirements of inter changeability with already existing equipment or services, including software to the extent that the initial procurement of the software was covered by this Chapter.

PERIOD OF CONTRACT

The proposed contract is for the purchase of McAfee Software and associated maintenance and support services for a period of one (1) year from date of Contract Award.

The solution will be delivered within 10 days of any resulting contract.

ANNEX A

The reasons for sole source procurement of the required security software are listed below. The Department of Justice Canada requires the solution to be compliant with the following functionalities:

General Technical Requirements

1. All four software products must use a single, common security management and reporting tool. All aspects of the software must be completely manageable and configurable through one security management console. The console must be a console that provides security situational awareness and risk posturing by interacting with the endpoint security elements.

2. The software must have the ability to gradually deploy in a development or early production environment without breaking applications or environment.

3. The solution must not be appliance based.

Data Loss Prevention Endpoint Technical Requirements

1. The software must meet Treasury Board requirements to ensure that sensitive data is protected from loss, including financial loss, brand damage, national security risks, loss of credibility, and noncompliance penalties that come with accidental disclosure or data theft by insiders and hackers.

2. The software must safeguard all layers of the infrastructure and ensure that confidential information is protected throughout the network on servers, in databases, and across all endpoints.

3. The software must control data transfer and ensure that the department monitors and controls the transfer of sensitive information to removable storage devices or email even when the data is disguised.

4. The software must support comprehensive Device Definitions and ensure that protection mechanisms are in place to protect sensitive data, even when data is modified, copied, pasted, or compressed. All protection mechanisms must include the following device definitions: USB, SCSI, PCMCIA, PCI bus, IDE/SATA, Firewire, Bluetooth, MP3, CDs, DVDs, iPods and smart phones with storage.

5. The software must offer granular control over USB devices and provide protection methods for USB based devices like memory sticks, can be controlled (Blocked, Monitored, Alerted) based on granular criteria such as Vendor ID, USB Serial Number, as well as the domain name of the user. The proposed solution must be capable of creating flexible role based policies to control the usage of removable devices and what data can be written to them.

6. The software must be managed by a security management console.

7. The software must be able to scan for sensitive data residing on local hard drives. Sensitive data scanning policies must be granular enough to filter by user and/or Active Directory group. Resulting scan results must be stored within the security management console in such a way that it can be used to and build a profile of how corporate data is used. Resulting scan results must also be available for the purpose of compiling an inventory of corporate data for use in cases such as legal discovery.

8. The software must be able to prevent data loss by blocking prohibited actions in real time whether the endpoint is connected to the corporate network, or disconnect from the corporate network. When a blocking action occurs off the corporate network, event data must be securely stored on the laptop and sent to the security management console when the endpoint re-connects to the corporate network.

9. The software must offer granular security policies and support the creation of granular reaction rules. Reaction rules must be able to define actions that can be taken to enforce DLP and Device Control policies, for example, block, monitor, alert, quarantine, report, or encrypt.

10. The software must provide critical usage data, such as device name, time stamp, and data evidence is captured. The software must be able to produce regulatory compliance and forensic reports to prove to auditors that internal and regulatory compliance measures are in place.

Database Activity Monitoring Technical Requirements

1. For audit purposes the proposed software must be able to log database access including complete transaction details. The software must be able to track user name, date/time, and what data fields were modified.

2. The software must use a small footprint sensor for the purposes of monitoring all database activity. The sensor must be a standalone process that runs on the host server and not on each database instance thereby ensuring minimal impact to the databases.

3. A single Database Activity Monitoring (DAM) console must be used regardless of the number of DAM sensors in use on different databases. The solution must be able to scale to encompass hundreds of databases. The console must be the same console which manages all of the other required components in this ACAN.

4. The software must provide granular monitoring of all database transactions, including, queries, database objects, stored procedures, and supports real-time alerting capability to prevent breaches.

5. The proposed software must provide immediate protection against newly discovered database vulnerabilities while maintaining zero Database Management System downtime.

6. The proposed software must have the ability to apply missing patches and fix misconfigurations found by the Database Activity Monitoring software.

Change Control White Listing Technical Requirements

1. The proposed software must be able to block all known malware and unknown malware by preventing any unauthorized software from running on the endpoint. The solution must be able to define what authorized software is and provide a means to modify the authorized software library.

2. The proposed software must not require any sort of signature file, script or update of any kind in order to continue protecting the endpoint.

3. The software must protect the endpoint on or off the corporate network.

4. The proposed software must be able to protect Random Access Memory (RAM) to ensure that buffer overflow attacks will not compromise the system.

5. The software must be able to capture all applications in use on the endpoint and auto classify the applications as good/bad or unknown. The software must also provide the functionality for customization of the inventory classification.

6. The proposed software must accommodate change to authorized programs through a variety of mechanisms, including application certificates, trusted user, trusted file location, time of day, and trusted updater. These mechanisms must be accessible and customizable via a management console.

7. The proposed software must provide the option to allow end users to install software for operational purposes, while being tracked by the software management console. Post installation must have the ability to reject or accept these exceptions based on policy.

Endpoint Protection Suite Technical Requirements

1. The proposed software must provide anti-virus protection, desktop firewall protection, web protection and web filter for endpoints, be able to stop known and unknown malware, viruses, adware, spyware, rootkits, key-loggers while achieving over 99% detection rates.

2. The software must minimize data loss and downtimes caused by zero-day threats; and minimize anti-virus signatures by using cloud based threat intelligence. The cloud based threat intelligence must work within the context of all threat vectors including file, web, message, and network.

3. The software must be able to proactively block spyware and other potentially unwanted programs from the endpoint.

4. The endpoint protection software must protect the endpoint from spam and malware.

5. The proposed software must support an integrated web security solution to prevent users from accessing malicious websites thereby avoiding web-based threats. The solution must support active website ratings to educate users of the dangers of accessing the target website. These integrated security solutions must warn and optionally block users from accessing sites that harbor spyware, phishing scams, or spamming agents, or optionally can block users based on a website categorization policy.

6. The proposed software must use multiple protection engines that work in concert to protect the endpoint; architecturally this means the department can deploy only the components required and on an as required basis as opposed to a single monolithic package of all components. Components to be based on Active Directory user groups, products (engines) and must be deployable via the software management console.

7. The proposed anti-virus software must support a persistent cache feature such that cached scan data remains intact even after a reboot.

8. The proposed anti-malware software must protect a broad range of operating systems including various Windows desktop and server platforms, as well as Macintosh and Linux platforms.

9. The proposed software must support a location based, connection-aware desktop firewall. This gives users connecting via the corporate network one set of firewall rules (fairly unrestricted access); however, when off the network (i.e. in a coffee shop or hotel) a more restrictive firewall policy must be used, for example only granting access to a corporate VPN IP address.

10. The proposed endpoint firewall must be able to prevent the endpoint from establishing two concurrent connections to two different networks. For example, it must prevent an Ethernet connection to the corporate network from being established while an attempt is made at the same time to an external network using the wireless adapter. The software must disable/block the wireless connection for the above scenario.

11. The proposed solution must be able to support roaming users by facilitating the use a DMZ based interface that will allow the single security management console to interact with mobile, externally managed systems.

12. The proposed software must be fully capable of operating within a virtual environment, thereby affording the same malware protection as it would a physical endpoint. Management of virtual endpoints must be identical to the management of physical endpoints.

CLOSING DATE AND TIME FOR WRITTEN SUPPLIER RESPONSES CHALLENGING THIS REQUIREMENT IS 2:00 p.m. EST, November 15, 2013.

You are hereby notified that the Government intends to solicit a bid and negotiate with one firm only as identified above.

If you wish to submit a written response showing that you are capable of meeting this requirement, it must be done not later than the specified closing date and time. The file number, contracting officer's name, and the closing date of the ACAN must appear on the outside of the envelope in block letters or, in the case of a facsimile transmission, on the covering page. As it is intended to proceed in a timely manner, responses received after the closing date will not be considered.

Responses received on or before the closing date will be considered solely for the purpose of deciding whether or not to conduct a competitive procurement. Information provided will be used by the Crown for technical evaluation purposes only and is not to be construed as a competitive solicitation. Your written response must provide sufficient evidence (e.g. specifications, technical data, drawings, or any other proof) that clearly demonstrates that your product or service is capable of fulfilling this requirement. Suppliers that have submitted a response will be notified in writing of PWGSC's decision to continue with the non-competitive procurement or compete the requirement.

Delivery Date: Above-mentioned

You are hereby notified that the government intends to negotiate with one firm only as identified above. Should you have any questions concerning this requirement, contact the contracting officer identified above.

An Advance Contract Award Notice (ACAN) allows departments and agencies to post a notice, for no less than fifteen (15) calendar days, indicating to the supplier community that it intends to award a good, service or construction contract to a pre-identified contractor. If no other supplier submits, on or before the closing date, a Statement of Capabilities that meets the requirements set out in the ACAN, the contracting authority may then proceed with the award. However, should a Statement of Capabilities be found to meet the requirements set out in the ACAN, then the contracting authority will proceed to a full tendering process.

Suppliers who consider themselves fully qualified and available to provide the services/goods described herein, may submit a statement of capabilities in writing to the contact person identified in this Notice on or before the closing date of this Notice. The statement of capabilities must clearly demonstrate how the supplier meets the advertised requirements.

The PWGSC file number, the contracting officer's name and the closing date of the ACAN must appear on the outside of the envelope in block letters or, in the case of a facsimile transmission, on the covering page.

The Crown retains the right to negotiate with suppliers on any procurement.

Documents may be submitted in either official language of Canada.