WIXLIB

RFP No. IBEF/DM/2021/02/01RFP for Vulnerability Assessment and PenetrationTesting (VAPT)Request for Proposal [RFP]India Brand Equity Foundation16th Floor, Dr Gopal Das Bhawan28, Barakhamba RoadNew Delhi – 110001Important DatesDate of issue of RFPFebruary 9, 2021Queries submissionFebruary 9-16, 2021Date of Posting Response to QueriesFebruary 17, 2021Last Date of SubmissionFebruary 23, 2021[Total Number of Pages including this page of the RFP: 23]

SECTION 1: INSTRUCTIONS TO AGENCIES1.1 Introduction1.1.1 The India Brand Equity Foundation (IBEF) is a Trust established by Department of Commerce, Ministryof Commerce & Industry, Government of India. IBEF’s primary objective is to promote and create internationalawareness of the Made in India label in markets overseas and to facilitate dissemination of knowledge of Indianproducts and services. Towards this objective, IBEF works closely with stakeholders across government andindustry to promote Brand India.1.1.2. IBEF proposes to appoint an agency for the Vulnerability Assessment and Penetration Testing (VAPT)for its website www.ibef.org to identify vulnerabilities, misconfiguration and other issues that could beleveraged by an external or internal entity (or user) to impact the confidentiality, integrity and availability ofIBEF systems or exploit it for personal gains, either from internet or from IBEF’s internal network. The IBEFwebsite is one of the best information providers about the Indian economy including the various sectors andstates.The aim of the RFP is to solicit proposals from qualified bidders for undertaking above detailed assignments.Interested eligible bidders may download the RFP from IBEF website https://www.ibef.org/partner-withibef.aspx or from Govt. of India website https://eprocure.gov.in/eprocure/app.1.1.3 The purpose of this RFP is to invite bids from Private/Public Ltd Companies/Public undertaking/partnership Vendors, for Vulnerability Assessment and Penetration Testing and select the suitable vendor toprovide all the services as outlined in scope of work this document based on:o Minimum Eligibility Criteriao Technical bido Financial bid1.1.4. The Agency would be appointed for a period of one year, further renewable for a period of one yeardepending on the performance of the agency.1.1.5. Interested Agencies are invited to submit their proposals for the assignment, which must include thefollowing, as detailed subsequently in this document:a.b.c.Eligibility ProposalTechnical ProposalFinancial Proposal1.1.6. It may be noted that(i) The costs of preparing the proposal are not reimbursable and(ii) IBEF is not bound to accept any of the proposals submitted.(iii) By participating in this RFP, the bidder confirms that he is in agreement with all the terms and conditions ofthis RFP.1.1.7. The Agencies are required to provide professional, objective, and impartial service and at all times hold

the IBEF’s interests paramount, without any consideration for future work, and strictly avoid conflicts withother assignments or their own corporate interests.1.1.8. Agencies have an obligation to disclose any situation of actual or potential conflict that impacts theircapacity to serve the best interest of IBEF, or that may be reasonably perceived as having this effect. Failure todisclose such situations by the Agency may lead to disqualification of the Agency or termination of the contract.1.1.9. Agencies must observe the highest standards of ethics during the selection and execution of the contract.IBEF may reject a proposal at any stage if it is found that the firm recommended for award has indulged incorrupt or fraudulent activities in competing for the contract in question, and may also declare a firm ineligibleor blacklist the firm, either indefinitely or for a stated period of time, if at any time it is found that the firm hasengaged in corrupt or fraudulent practices in competing for, or in executing, the contract.1.1.10. The family members/ blood relations of employees and/or full-time consultants (i.e. consultants workingexclusively with IBEF on retainership basis) of IBEF shall not be eligible to participate in the RFP process. Anyproposal submitted by them may be summarily rejected. In case, IBEF comes to know of the relationshipsubsequent of the award of contract, the contract shall be liable to be cancelled and IBEF shall be entitled toclaim damages apart from engaging any other consultant/ vendor at the cost and risk of defaulting consultant. Itis clarified that the term full time consultants of IBEF does not refer to agencies/people, which may have beenshortlisted for an assignment/project of IBEF through an RFP process.1.2 Minimum Eligibility Criteria1.2.1. The bidder should be registered as a company in India as per Company Act 1956/2013 or a partnershipfirm registered under LLP act, 2008. The Agency should have operation for a period of at least 3 years as ondate of RFP.1.2.2. The agency should have a turnover of a minimum of INR 1 crore each in 2019-20, 2018-19 and 2017-18respectively. An original CA certificate should be enclosed for the same for 2019-20, 2018-19 and 2017-18.Copies of audited financial statements should also be enclosed. Format of CA certificate enclosed as Annexure4.1.2.3 The participating firm should not be currently blacklisted by any Central Govt. /State Govt. / Semi Govt.Organization / Autonomous Bodies or PSUs. Format of Undertaking(s) enclosed as Annexure 5 and 6.1.2.4 The Agency should have registered office in India1.2.5 The Agency must be CERT-In empanelled vendor for last 3 consecutive years and should continue toremain in panel during the currency of contract1.2.6 In order to avoid conflict of interest, Agency must not be the existing application implementer(s) and / orsolution provider(s) of IBEF website.1.2.7 The Agency should not be in the business of selling IT security products or should not be a partner orshould not have alliance with the business of selling IT security products.1.3 Scope of Work and Deliverables

The overall scope of work of the bidder(s) would be as follows:1. IBEF has developed a website with its URL as www.ibef.org and it consists of about 24,000 numbers ofdynamic pages with PHP version 5.4, Codeignitor Version is 2.1.3 & HTML 4.The website is Englishlanguage and has been hosted on Indian Data centre.2. VAPT is essential with frequency at least bi-annually or whenever significant changes have been made inIBEF’s website IT Infrastructure.3. The Information Security Auditors/SI is expected to carry out an assessment of the vulnerabilities, threatsand risks that may exist in the above website through Internet Vulnerability Assessment and PenetrationTesting which includes identifying remedial solutions and implementation of the same to mitigate allidentified risks, with the objective of enhancing the security of the website.4. The SI should provide the Web Security Audit certificate from the empanelled agency under IndianComputer Emergency Response Team (CERT-In) under the Department of Information Technology,Government of India.5. The website audit should be done by using Industry Standards and as per the Open Web ApplicationSecurity Project (OWASP) methodology6. The audit of the website should be conducted in conformity with Cert-In guidelines. After successfulsecurity audit of the website, the security audit report from the auditor should clearly state that all webpages along with respective linked data files (in pdf / doc / xls etc. formats), all scripts and image files arefree from any vulnerability or malicious code, which could be exploited to compromise and gainunauthorized access with escalated privileges into the webserver system hosting the said website.7. Vulnerability Assessment & Penetration Testing - Black Box testing, entire Information System (detailedlist of setups to be provided at the time of commencement of VAPT).8. Vulnerability Assessment and Penetration Testing should cover IBEF’s website completely.9. Selected bidder should carry out an assessment of threat & vulnerabilities and assess the risks in IBEF’swebsite. This will include identifying existing threats if any and suggest remedial solutions andrecommendations of the same to mitigate all identified risks, with the objective of enhancing the securityof the website.10. The Penetration testing services should combine both manual and automated techniques to ensure IBEF’swebsite is properly protected and that compliance requirements are being met. The vulnerabilities andrisks to IBEF by performing a real-world attack and recommendations should be delivered for remediationwith a detailed report depicting a complete view of ICT systems in place for the website. The selectedbidder is expected to develop a detailed plan, to perform the test and provide a full report, and also thebidder should have expertise to help to improve IBEF’s security posture with best industry standards andpractices.

11. Bidder is expected to perform a re-assessment after remediation phase is over and all the identifiedvulnerability is fixed. Also, bidder is expected to submit detailed report on the status of identifiedvulnerabilities being resolved.12. Audit Environment: - Audit can be done on-site or off-site.The Required resources will be provided in IBEF-DC for upload the website on temporary staging servers.To ensure that the IBEF website is free from the vulnerabilities, the audit exercise will need to undertakethe following activities: Identify the security vulnerabilities, which may be discovered during the security audit includingCross-site Scripting, Broken Links/ Weak Session Management, Buffer Overflows, Forcefulbrowsing, Form/hidden field manipulation, Command Injection, Insecure use of cryptography,Cookie posting, SQL injection, Server miss- configuration, well known platform vulnerabilities,errors triggering sensitive information, leak etc.Password PolicyLog Review, incident response and forensic auditingIntegrity ChecksVirus DetectionIdentification and prioritization of various risks to the IBEF websiteIdentify remedial solutions for making the IBEF website secure & safe.Any other issues.13. Responsibilities of Selected Information Security Auditor/SI The Selected Information Security Auditor/SI will conduct website security Audit for the IBEFwebsite as under: Verify possible vulnerable services, only with explicit written permission from the auditee. Notify the auditee whenever there is any change in auditing plan / source test venue / high riskfindings or any occurrence of testing problem. Responsible for documentation and reporting requirements for the audit. Task-1: Web Security Audit/Assessment. Task-2: Re-audit based on recommendation report of Task-1. The auditor will submit the vulnerability report to the auditee. The concerned division of IBEFwill not provide any resource/manpower to be auditor/bidder to remove vulnerabilities/Bugs ifany, which are identified by the auditor. The auditor/bidder has to make his own arrangement formitigation of all the security vulnerabilities, which may be discovered during the security audit. On successful security audit, furnish certificate form the empaneled agency of Indian ComputerEmergency Response Team (CERT-In) under the Department of Information Technology,Government of India.14. Audit report The Auditor shall submit a report indicating about the vulnerabilities as per VAPT, OWASP andrecommendations for action after completion of Task-1. The final formal IT security Audit Reportshould be submitted by the Auditor after the completion of all the tasks of Audit. The reports shouldcontain: