PCI QSA

Trade Agreement: WTO-AGP/NAFTA/AIT/Canada FTAs with Peru/Colombia/Panama Tendering Procedures: All interested suppliers may submit a bid Attachment: None Competitive Procurement Strategy: N/A - P&A/LOI Only Comprehensive Land Claim Agreement: No Nature of Requirements: THIS IS NOT A SOLICITATION DOCUMENT THIS IS A REQUEST FOR COMMENTS (RFC) FROM INDUSTRY PCI QSA

The intent of this Request for Comments (RFC) is to solicit feedback on the Draft Request For Proposal (RFP) and related Annexes so as to enable Canada to evaluate the strategy to be taken, if any, regarding further related activities.

More specifically, feedback is sought regarding

The potential level of interest in providing services to address the requirements of the attached Draft Statement of Work; To obtain information and suggestions on other ways of performing similar functionality or improving on what is being presented; and With respect to draft Annex C Information Technology Security Requirements Technical Document, indicate if your organization's implementation of the capability is the same as described for that specific requirement. If it is not, provide a description of how your organization addressed the specific requirement.

SERVICE REQUIREMENTS

The Receiver General (RG) requires a Qualified Security Assessor Company (QSAC) to assist departments in their yearly PCI exercise. While individual requirements will be specified in any resulting Task Authorization (TA), the RG requires qualified resources to provide the following services on an "as and when requested " basis:

conduct departmental PCI compliance assessments; validate and provide input for the SAQ; provide full departmental PCI Report on Compliance (ROC) (i.e Level 1), as deemed necessary by the RG; and conduct quarterly vulnerability scans where required.

These services may be required for a period of five (5) years commencing from date of Contract with an irrevocable option on the part of Canada to extend the period of any resulting Contract by two (2) additional one year periods.

There is a security requirement associated with this requirement. Please refer to the draft Annex C, Security Requirements Checklist (SRCL) and its associated attachments, including the following clause which will form part of any resulting Contract:

DRAFT SECURITY REQUIREMENT CLAUSE

1. The following security requirement (SRCL) and related clauses applies and form part of the Contract:

1. The Contractor must, at all times during the performance of the Contract, hold a valid Facility Security Clearance at the level of SECRET, with approved Document Safeguarding at the level of PROTECTED B, issued by the Canadian Industrial Security Directorate (CISD), Public Works and Government Services Canada (PWGSC).

2. The Contractor personnel requiring access to CLASSIFIED information, assets or sensitive work site(s) must EACH hold a valid personnel security screening at the level of SECRET, granted or approved by the CISD, PWGSC.

3. The Contractor MUST NOT utilize its Information Technology systems to electronically process, produce or store any sensitive CLASSIFIED information until CISD/PWGSC has issued written approval. After approval has been granted, these tasks may be performed at the level of PROTECTED B.

4. Subcontracts which contain security requirements are NOT to be awarded without the prior written permission of CISD/PWGSC.

5. The Contractor must comply with the provisions of the

(a) Security Requirements Check List and security guide (if applicable), attached at Annex C; (b) Industrial Security Manual (Latest Edition).

3.2 Contractor's Site or Premises Requiring Safeguard Measures

The Contractor must diligently maintain up-to-date, the information related to the Contractor's site or premises, where safeguard measures are required in the performance of the Work, for the following addresses:

Address: Street Number / Street Name, Unit / Suite / Apartment Number City, Province, Territory / State Postal Code / Zip Code Country

Potential service providers who currently DO NOT MEET the facility security clearance requirements and (or) personnel security clearance should initiate the security clearance process by requesting sponsorship from the Contracting Authority. For any inquiries concerning any security requirements, suppliers should contact CISD at 1-866-368-4646, or (613) 948-4176 in the National Capital Region (NCR), CISD Website: http://ssi-iss.tpsgc-pwgsc.gc.ca/.

NOTE TO POTENTIAL RESPONDENTS

Responses

The material in this RFC package is for the solicitation of feedback only. Please do not complete the Pricing Schedule at Attachment 1 to Part 3, nor the Basis of Payment at Annex B, during this RFC Process. Responding to this RFC is not a prerequisite to receiving any Request for Proposal for the ABCB requirement. However, all Respondents are encouraged to indicate their level of interest by responding to this RFC with its comments in order to facilitate a better understanding of requirements and Industry perspectives.

The publication of this RFC must not be construed as a commitment on Canada's part to issue a subsequent "Request for Proposal" for ABCB's requirement and no contract or other form of commitment will be entered into with any Respondent based on responses to this RFC. This RFC must in no way be considered as authorization by Canada for Respondents to undertake any work, which would result in costs to Canada.

Canada will not be liable for, nor will it reimburse any Respondents for any costs, fees or expenses which any Respondent incurs in the preparation or submission of its response to this RFC. Canada will not be bound by anything stated herein. Canada reserves the right to change, at any time, any or all parts of the requirement as it renders necessary.

Respondents are advised that any information submitted to PWGSC in response to this RFC may be used in the development of a subsequent RFP. Respondents will not be bound by any aspect of their response to this RFC. All responses to this RFC will be held by Canada on a confidential basis (subject to applicable legislation), and remain the property of Canada once they have been received and may be used to support further development of internal planning documents and decisions, and possibly an RFP. Note that responses to the RFC will not be returned.

Participation

The RFC is inclusive and flexible and is not intended to pre-qualify Respondents for any stages of the project. An interested Respondent who does not participate in the RFC process is not precluded from participating in any subsequent RFP process.

CLOSING DATE

Responses to this RFC will be accepted until 02:00 PM Eastern Daylight Savings Time (EDT) on September 23, 2013.

Responses are to be submitted only electronically to the Contracting Authority stated below. The information received after that date will be considered only to the extent reasonable, in the sole opinion of Canada, given the progress of the Work at the time of receipt of the said information.

ENQUIRIES

Any questions from Respondents concerning this RFC must be made in writing to the Contracting Authority stated below, via e-mail up to 10 days prior to closing date of this RFC.

Respondents are to assume all responsibility for the successful delivery and receipt of all questions to the Contracting Authority stated below. Questions submitted to any other person but the Contracting Authority, or in any other form, will not be answered. Responses given in any other manner than that which is outlined above will not be binding upon any party.

Canada reserves the right not to respond to questions received after the closing date of this RFC, or to any question not related to this RFC. Enquiries that are of a proprietary nature must be clearly marked "proprietary" at each relevant item. Items identified as "proprietary" will be treated as such except where Canada determines that the enquiry is not of a proprietary nature. Canada may edit the questions or may request that the respondent do so, so that the proprietary nature of the question is eliminated, and the responses will be made publicly available through MERX. Enquiries not submitted in a form that can be distributed to all Respondents may not be answered by Canada. If a question is determined to be proprietary, in Canada's sole discretion, Canada reserves the right to respond only to that party.

CLARIFICATION

PWGSC may require clarification of written responses and/or comments received as a result of the responses to this RFC. If required, any clarification will be requested by the Contracting Authority after the closing date of the RFC. Requests for clarification will be submitted in writing (by email only) and a response will be requested within two (2) working days of transmission of the clarification questions. Canada will not provide any guidance on how to prepare the responses or of any acceptable response strategy.

FORMAT OF RESPONSE

Respondents should review the attached draft documents, respond to the questions in Table 1 and provide comments on the Annexes in Table 2, in the attached solicitation document.

RESPONSES REGARDING THIS REQUIREMENT ARE TO BE SUBMITTED TO THE FOLLOWING PWGSC CONTRACTING AUTHORITY:

Ingrid Harrington, Supply Specialist Public Works and Government Services Canada Acquisitions Branch Professional Services Procurement Directorate Place du Portage, Phase III, 10C1 11 Laurier Street Gatineau, Quebec K1A 0S5

Tel: (819) 956-3201 Fax: (819) 956-2675 Email: ingrid.harrington@tpsgc-pwgsc.gc.ca

FORMAT OF RESPONSE

Suppliers are requested to review the draft Request for Proposal (RFP) and related Annexes and respond to the following questions in the tables below.

Table 1 - Responses to Questions, and Table 2 - Comments on Annexes

TABLE 1 - RESPONSES TO QUESTIONS QUESTIONS RESPONSES 1. Are the requirements as stated in the attached draft Statement of Work (SOW) clear? 2. Please identify any issues that would limit your ability to perform the work outlined in the SOW. 3. What additional information would you need to be able to fully assess the whole project? 4. Is your firm currently registered in the Industrial Security Program (ISP) of PWGSC's Canadian Industrial Security Directorate? If not, would your firm be interested in registering? If so, please send a request for sponsorship to the Contracting Authority. 5. Would your firm be able to submit a responsive bid based on the Mandatory Technical Criteria in Attachment 1 to Part 4? If not, please describe the reason(s) why. 6. Would your firm be able to submit a responsive bid based on the Point Rated Technical Criteria in Attachment 1 to Part 4? 7. Would your firm be able to submit a responsive bid based on the IT security requirements in Annex C? 8. Would you bid on this requirement if it was tendered as described herein? 9. If you would not bid on this requirement, please describe the reason(s) why. 10. Are there any technical evaluation criteria that you think should be added? If yes, please explain what they are and why they should be added? 11. Do you have any other concerns that you would like to address? 12. Are there any changes that Canada should consider to ensure that it obtain best value for money in this procurement?

TABLE 2 - COMMENTS ON DOCUMENTS LIST OF DOCUMENTS COMMENTS Draft RFP Draft Annex A - Statement of Work Draft Draft Annex B - Basis of Payment Draft Annex C - SRCL and attached IT Technical Document Draft Annex D - TA Form Draft Annex E - Sample Periodic Usage Report Draft Annex F - Non-Disclosure Agreement

Delivery Date: Above-mentioned

The Crown retains the right to negotiate with suppliers on any procurement.

Documents may be submitted in either official language of Canada.