Request for Proposal (RFP) for ADSIC (Ver 2.0) & ISO/IEC 27001:2005 Compliance - Consulting Services. Bid issue date: September 11, 2013

Transcription

1 Request for Proposal (RFP) Tender no.: 28/S/HAAD/PT/2013 for ADSIC (Ver 2.0) & ISO/IEC 27001:2005 Compliance - Consulting Services Bid issue date: September 11, 2013 Deadline of Submission of Proposal: October 07, 2013

2 TABLE OF CONTENTS 1. INSTRUCTIONS TO BIDDERS TIMETABLE / DEADLINES PACKING AND LABELING OF PROPOSALS SUBMISSION OF PROPOSALS PROPOSAL CONTENTS... 7 A. TECHNICAL OFFER... 7 B. FINANCIAL OFFER BID BOND RFP TERMS AND CONDITIONS VALIDITY OF PROPOSAL INCOMPLETE AND LATE OFFERS INQUIRIES ALTERATION OF PROPOSALS ELIGIBLE BIDDER COSTS FOR PREPARING PROPOSALS CLARIFICATION EVALUATION OF PROPOSALS A. TECHNICAL EVALUATION OF BIDS B. FINANCIAL EVALUATION OF BIDS AMENDMENTS CONFIDENTIALITY OWNERSHIP OF PROPOSALS BID CANCELLATION BIDDER S RESPONSIBILITIES AWARD TERMS OF REFERENCE GENERAL BACKGROUND OF HAAD ORGANIZATION CHART RESULTS TO BE ACHIEVED BY THE VENDOR / CONSULTANT / SERVICE PROVIDER PROJECT OVERVIEW INTRODUCTION Project Objectives Background Project Constraints and Assumptions Project Duration REQUIREMENTS AND SCOPE Project Scope Detailed Requirements Architecture and Standards Methodologies Security User Training PROJECT MANAGEMENT Responsible Body Personnel /Key experts DRAFT CONTRACT AGREEMENT AND CONDITIONS Page 2 of 33

3 1- SUBJECT STRUCTURE OF THE CONTRACT CONTRACT VALUE COMMENCEMENT DATE PERIOD OF EXECUTION PERSONNEL INFORMATION TO BE PROVIDED TO THE VENDOR REPORTING PAYMENTS CONTRACT PRICE CONTACT ADDRESSES PERFORMANCE BOND INTELLECTUAL PROPERTY NON-ASSIGNMENT AND NON-SUBCONTRACTING VENDOR S OBLIGATION CONFIDENTIALITY PENALTIES TAXES TERMINATION GOVERNING LAW AND LANGUAGE ENTIRE AGREEMENT DISPUTE SETTLEMENT ANNEX II TECHNICAL EVALUATION CRITERIA ANNEX III FINANCIAL EVALUATION TEMPLATE ANNEX IV- VENDOR RISK ASSESSMENT QUESTIONNAIRE Page 3 of 33

4 The complete Request for Proposal shall include the following: Section A: Instructions to Bidders Section B: a. Terms of Reference (Technical requirements/ specifications) Section C: Draft Contract Agreement and Conditions Annexes: Annex I: Business Reference template Annex II: Technical Evaluation Criteria Annex III: Financial Evaluation Template Page 4 of 33

5 Definitions and Abbreviations: For the purpose of this RFP, the terms used herein this RFP and the subsequent contract shall have the following meanings: Government Contracting Authority/ HAAD ToR RFP Bidder Days /months/years Service/ project Consultant / Vendor N/A HQ Consultancy ISMS ADSIC Government of Abu Dhabi. Health Authority- Abu Dhabi Terms of Reference Request for Proposal A legal entity entitled to submit proposal in respond to this bid Calendar days/months/years The specified Scope specified herein Section B of this RfP The awarded bidder selected to perform the project s scope of work Not Applicable Head Quarter Bidder s effort in delivering all requirements, as part of this RFP Information Security Management System Abu Dhabi Systems and Information Center ADSIC Standard(s) ADSIC Information Security Standard - Version 2.0 ISO or ISO/IEC 27001:2005 Standard Page 5 of 33

6 1. Instructions to Bidders In submitting proposals, bidders must respect all instructions, forms, terms of reference, contract provisions and specifications contained in this bidding document. Failure to submit a proposal containing all the required information and documentation within the deadline specified will lead to the rejection of the proposal Timetable / Deadlines Subject Deadline for requesting any clarifications / inquiries from the Contracting Authority Site visit (if any) Clarification meeting (if any) Last date on which clarifications are issued by the Contracting Authority Date September 26,2013 N/A N/A September 30,2013 Deadline for submission of proposals October 07, 2013 Public Bid opening of technical proposals to all participated Bidders in the Tender Terms for attending the Public Bid opening Session: The bidder s representative who wishes to attend the Public Bid opening should hold authorization letter stating his ID no. (Passport no.) Signed and stamped by the authorized person in his Company. Date: October 08, 2013 Time: 10:00 am Venue: Meeting room 2nd floor HAAD building (address stated below in Article 3/Section A) 1.2. Packing and Labeling of Proposals Each submitted proposal must comprise a Technical offer and a Financial offer, each of which must be submitted separately (see clause 03). Each technical offer and financial offer must contain one original, clearly marked "Original", and 2 copies, each marked "Copy". Failure to respect the requirements in clauses 03 and 04 will constitute a formal error and will result in the rejection of the proposal Submission of Proposals Proposals must be submitted either by recorded delivery (official postal service) or hand delivery directly to the Contracting Authority in return for a signed and dated receipt to the following address: Mr. Sultan Al Marzouqi Section Head of Procurement Health Authority Abu Dhabi Page 6 of 33

7 P.O. Box nd floor Procurement Section Proposals submitted by any other means (i.e. facsimile or ) will be rejected. Proposals must be submitted using the double envelope system, i.e., in an outer envelope containing two separate, sealed envelopes, one marked "Envelope A - Technical offer" and the other "Envelope B - Financial offer". All parts of the proposal other than the financial offer must be submitted in Envelope A. Abiding from these rules (e.g., unsealed envelopes or references to price in the technical offer) is to be considered a breach of the rules, and will lead to rejection of the proposal. The outer envelope should carry the following information; a) The address for submission of proposal indicated above; b) The reference code of the bid to which the bidder is responding (28/S/HAAD/PT/2013) c) The name of the bidder. The pages of the Technical and Financial offers must be numbered Proposal Contents A. Technical offer The Technical offer must include the following documents: Ser. Document submission title and description 1 *Letter of Submission on the bidder s company letterhead signed and stamped by the person in charge in the company acknowledging accepting of the terms and conditions of this RFP and certifying that all information offered in the submitted proposal are true, accurate, and complete. 2 Table of Contents, including page numbers. 4 Filled template Annex IV - Vendor Risk Assessment Questionnaire 3 9 *Management summary This section should contain a summary of the bidder s proposal written for non-technical personnel. The summary should define: the approach/strategy,, deliverables, and associated services explain how the proposal is geared to address HAAD s business requirements and objectives Cover all the requirements requested in Section B - Terms of Reference (Technical requirements/ specifications) *Proposed services This section should contain a detailed description of the proposed services. The following should also be included: Approach/strategy and implementation phases Deliverables Annual Maintenance and Support plan with SLA terms 5 A power of attorney empowering the person signing the tender and all related Page 7 of 33

8 documentation 6 Copy of bidder s UAE valid trade license and Chamber of Commerce Certificate and all relevant Legal registration documents. 7 Business references (ref. article 3.1.3) that show that the bidder has a satisfactory performance record in performing projects of similar nature, in providing consulting service for ISO/IEC 27001:2005 and ADSIC Standards Version 1.0 Compliance/Certification for government entities. References can be either copies of Agreements (i.e., pages that shows the agreement and scope of work) or letter of references to demonstrate the bidder s capability of meeting the project s requirements. Bidder is required to include details of points of contact (name, address, telephone number, etc.) for such references. Bidders are requested to complete Annex I and to provide, ideally, three (3) reference sites, which can be contacted or visited for reference purposes. Preferably, the Bidder should have provided similar services for at least two (2) of their existing customers in UAE. 8 Bidder s company profile This section should contain a profile of the Bidder s organization. The following should also be included: completed Bidder profile questionnaire contained in Appendix A; annual report/financial statements for a copy of the latest annual report or company brochure of the Bidder(s) involved; brief profile of the Bidder s experience in providing the services in organizations similar to Health Authority. 10 Manpower Resources (CVs) Bidder must provide a resume for each proposed team member in this proposal. The Proposer shall provide information regarding the length of employment at current and prior employers, qualifications, titles, years of experience, certifications and training, including relevant continuing professional education, for the specific staff to be assigned to this project. Include a description of all comparable projects on which each proposed team member has worked, their role in the project, their time spent on the project, and at least two (2) reference contacts for each proposed team member. Resumes / CV s of the Bidder s proposed team members must be based in UAE who are on the full time payroll of the Bidder s organization. 11 *Unconditional Bid Bond issued from one of the UAE banks 12 Soft copy of the technical proposal ( Un priced) IMPORTANT NOTES TO BIDDERS * Note: After the bid opening of the TECHNICAL proposals and in case any bidder did not submit the required documents stated above, the proposal will be administratively rejected immediately without further consideration for review or clarifications. REVEALING THE FINANCIAL OFFER IN TECHNICAL OFFER WILL LEAD TO THE REJECTION OF THE PROPOSAL. Failure to submit the bid bond on time of the closing of the tender submission will lead to the rejection of the proposal. Page 8 of 33

9 B. Financial offer The Financial offer must be presented as an amount in U.A.E currency (AED), inclusive of all applicable tariffs and /or taxes and must be submitted using the attached template (Annex III). Bidder has to provide the prices showing the price per item and the total cost. Bidder has to provide the prices using the financial offer template. Payments under this contract will be made in U.A.E currency (AED) Bid Bond The bidder must submit in his proposal a bid bond of an amount of AED 60,000 (Sixty Thousand Dirham) of the financial proposal. The bond shall be unconditional, valid for 120 days starting from the closing date of proposal submission and addressed to the Health Authority Abu Dhabi. The bid bond will be returned to bidders by the completion of awarding and contracting process with the awarded bidder RFP terms and conditions Failure to accept the terms and conditions of the RFP at time of award may result in awarding the contract to other eligible bidder Validity of proposal Proposal must remain valid and open for the acceptance of HAAD for 120 days from the RFP closing date. Proposals specifying shorter acceptance period will be considered nonresponsive proposal Incomplete and Late Offers Incomplete and late proposals will not be accepted. It is the bidder responsibility to ensure that the proposal is submitted complete, on time and in accordance to the RFP terms and conditions. Late proposals shall be returned back unopened Inquiries Bidders may submit questions in writing either through fax or to the following address; Contact name : Ms. Dina Mohsen Procurement Officer Address : Health Authority Abu Dhabi Fax No : dkhaled@haad.ae Page 9 of 33

10 1.10. Alteration of Proposals Any clarification to be issued by the Contracting Authority will be communicated in writing to all the bidders via or fax. as detailed in section 1.1 Timeline table. No further clarifications will be given after this date. All bidders clarification will be published on HAAD website; bidders have to regularly check website during tender submission bidder to be aware with all/any updates might be published. Important Note: Any prospective bidders seeking to arrange individual meetings with the Contracting Authority concerning this contract during the bidding period may be excluded from the bidding procedure Eligible Bidder Bidder considered eligible to submit proposal is defined as the entity /organization that meets the requirements of this RFP; is legally registered to do business, and can provide a valid certificate of legal registration/ trade registration licence Costs for preparing proposals Under no circumstances will HAAD be liable for any costs incurred in connection to the preparation and submission of the proposal even if the Contracting Authority decides to reject all the proposals or cancel the bid Clarification During the evaluation process, HAAD may request additional information from bidders if it is necessary for further clarification in regards to the submitted proposal Evaluation of proposals Evaluation process aims to select the responsible bidder whose proposal is technically superior at reasonable price. The weight of the technical factors = 70 % The weight of the cost = 30 % Only proposals with average scores of at least 70 points in the technical evaluation criteria, qualify for the financial evaluation. A. Technical evaluation of bids Note: All bidders has to comply with 80% of the requirements stated in Annex IV Vendor Risk Assessment form to be eligible for the completion to the technical evaluation stage.. The quality of each technical offer will be evaluated in accordance with the evaluation factors specified in (Annex III) of this bidding document. No other award criteria will be used. The award criteria will be examined in accordance with the requirements indicated in the Terms of Reference. B. Financial evaluation of bids Upon completion of the technical evaluation, the financial offer, for those bidders who passed the technical evaluation stage, will be opened. Page 10 of 33

11 1.15. Amendments During the proposal submission period, if the Contracting Authority decides to modify/ change any requirement/s of the RFP, then the modification(s) shall be released through the issuance of an amendment to the RFP. Amendment will be issued in writing and will be published through the same medium used for RFP publication or will be sent to all bidders. In case of issuing any amendment(s),this will be published on HAAD website, bidders have to regularly check website during tender submission bidder to be aware with all/any updates might be published Confidentiality The entire evaluation procedure is confidential and all proposals are for official use only and may be communicated neither to the bidders nor to any party other than the Contracting Authority Ownership of proposals The Contracting Authority retains ownership of all proposals received under this bidding process. Consequently, bidders have no right to have their proposals returned to them Bid Cancellation HAAD has the right at any stage in the bidding process to cancel the whole bid without the need to give a justified reason to any of the bidders. Bidders will be notified in writing of the cancellation by the Contracting Authority Bidder s Responsibilities It is bidder s responsibility to examine all of the RFP s terms and conditions and to request for clarification from the Contracting Authority s (only to the contacts mentioned in this RFP in writing) for unclear or vague statements, if any. It shall be bidder s responsibility if his proposal is eliminated due to submission of unclear, improper, incomplete or loose proposals Award HAAD reserves the option of contracting only for a portion of the specified project scope or of not awarding a contract to any bidder. Final approval to enter into a contract, contract terms and conditions and the scope of services to be provided pursuant to the contract, rests with the HAAD. HAAD reserves the right at its own discretion not to select the lowest quoted financial offer. If it appears that the selection of the bidder s proposal might affect HAAD s interest and appears to cause conflict of interest, HAAD might exclude this proposal and inform the Supplier accordingly. The successful bidder will be notified in writing of the Award. An award can be withdrawn by HAAD at any time prior to entering into definitive contract. The bidder has to and within one week of notification of Award to send his authorized representative/s for signing the contract. Issuing notification of Award is not a request to commence executing the services, only Project execution shall start following signature of the contract with HAAD. Page 11 of 33

12 2. Terms of Reference 2.1. General Background of HAAD The Health Authority - Abu Dhabi (HAAD) is a local governmental entity established by Law (01/2007); the main function of HAAD is to regulate the Healthcare Sector within the Emirate of Abu Dhabi, both Public and Private, through Policies, Laws, Regulations, Inspections and Audits. The corporate office of HAAD is located in the capital of UAE, Abu Dhabi. HAAD is responsible for licensing, quality control and in regulating all of the health care facilities and health professionals in the Emirate of Abu Dhabi, with the vision in developing health communities, and to monitor healthcare facilities so that it delivers high quality healthcare services in accordance with the best international practices and quality standards to its population. HAAD does not itself provide healthcare services or health insurance. For more information on the company please visit: Organization Chart Page 12 of 33

13 2.3. Results to be achieved by the Vendor / Consultant / Service Provider By the end of the Project HAAD should have: 1. Effective ISMS Framework, in compliance with ADSIC and ISO/IEC 27001:2005 Standards and its implementation for the selected services as described in the Scope of Work, in Section 3.2.1, of this document. 2. ISO Certification for the Business Functions, as described in Scope of Work, with respect to ISO/IEC 27001:2005 Standard, and Security Authorization for the services operated by the defined Business Functions, against ADSIC Information Security Standard. 3. Continual Improvement framework for management and ongoing monitoring of the risks pertaining to information security aspects. Page 13 of 33

14 3. Project Overview 3.1. Introduction This Request for Proposal (RFP) is issued to gather information and quotation for the consultancy of ISO/IEC 27001:2005 Standard compliance/certification and ADSIC Information Security Standard Version 2.0 Compliance for HAAD. The current scope of HAAD s ISO/IEC 27001:2005 Certification includes Administration & Finance Division and Strategy Division. With this project HAAD desires to engage the services of renowned specialist firms, who have demonstrable experience and considerable consulting strengths in ADSIC Information Security and ISO/IEC 27001:2005 Standards or ISMS consulting projects, to provide proposals for the development, implementation, review and maintenance of an Information Security Management System (ISMS), to meet the Information Security requirements of HAAD, in compliance with ADSIC Standards and ISO/IEC 27001:2005 standards Project Objectives The objective of this engagement is to enable HAAD, to objectively expand its current scope of ISMS to cover rest of the Organization; to demonstrate compliance against the requirements of ADSIC Standards Version 2.0 and ISO/IEC 27001:2005; to be certified against the provision of ISO/IEC 27001:2005 Standards and ADSIC Standards Version Background HAAD relies heavily on Information & IT Systems, to deliver its services to all its customers, and operates highly visible & sensitive systems. HAAD believes in establishing and operating a secure environment, and has invested in applying industry best practices and standards. HAAD has established an Information Security Management System (ISMS) framework, covering Administration & Finance Division and Strategy Division, aligned with Strategic objectives of the Organization. The ISMS Framework of HAAD has been granted a Certificate of Approval, in compliance with the requirements of ISO/IEC 27001:2005 Information Security Standard. Page 14 of 33

15 Project Constraints and Assumptions HAAD expects the bidder to bring in industry best practices and valid experience of implementing ADSIC (version 1.0) and ISMS processes, for at least one of the esteemed Government entities in the Emirates of Abu Dhabi. HAAD expects the bidder to provide appropriate details on the efforts that will be required from HAAD side, and exhibited by the consultants on this project. HAAD assumes the bidder to be aware of the requirements of ADSIC Information Security Standards Version 2.0, and the mandatory documentation required as part of ADSIC Standards implementation Project Duration All bidders, participating in this proposal response shall explicitly provide details on the timeframe that will be required by their proposed team to complete the engagement. The project shall be executed in three phases, addressing the allowed provisions for a 3 rd party to execute on an ADSIC Standards implementation project. The bidder shall consider the execution of project between year 2013 and 2015, addressing requirements and ensuring compliance with Abu Dhabi Government entities objectives and deliverables, concerning ADSIC s Information Security programme. Any deviations in the delivery of project deliverables, beyond the defined timelines, penalties might be imposed Requirements and Scope HAAD intends to identify and select an Information Security Service Provider to assist HAAD in implementing a certifiable Information Security Management System (ISMS), complying with the requirements of ADSIC Information Security Standards and ISO/IEC 27001:2005 Standards. The successful bidder shall engage with HAAD s Information Security team members in defining and implementing the ISMS and assist HAAD in achieving the desired objectives as defined in this RFP. Key requirements of this consulting engagement are: Review and modification of existing process documentations Introduction of new processes, when desired Compliance with internal policies and ADSIC Standards Increase the level of confidentiality, integrity and availability of services and information systems Page 15 of 33

16 Strategize and operate, for getting the level of risk to an acceptable level, as defined by HAAD. Identification of legal requirements and defining its applicability Establish effective framework to ensure governance and management of compliance requirement Operate structured, coherent approach towards achieving compliance requirements Establish foundation for ingrained security culture within HAAD Environment The complete project shall be delivered in three phases, and the bidder shall quote separately for the execution of each phase Project Scope The scope of the assignment is to obtain ISO/IEC 27001:2005 certification and achieve compliance with the provisions of ADSIC Standards. The ISO/IEC 27001:2005 certification scope is limited to HAAD Head Office (HO), whereas the ADSIC Standards compliance shall be achieved for all business functions, covering all HAAD offices in the Emirate of Abu Dhabi. Bidders shall be aware, that majority of the business functions are operated and managed from the HO. HAAD s current employee strength is approximately employees, and will grow on a yearly basis Detailed Requirements The requirements of different phases focus on objectives and milestones to be achieved during the given year, between 2013 and The following requirements shall be delivered by the Consultant; Phase 1 Requirements for year 2013 i. Establish Information Security Organization and define responsibilities, ensuring Management participation and effective governance ii. Conduct gap assessment of the current environment, documenting the details of current control environment, against the requirements of ADSIC Standards and ISO Standard. 1 variation in numbers shall be anticipated during realization of the project, subject to a maximum of + or 20%. Page 16 of 33

17 iii. iv. Identify, document, and maintain (through the lifecycle of project execution) a detailed inventory of information assets. Classify information assets. v. Develop service inventory workbook and categorize services. vi. Review, modify and introduce new policy/procedures/guideline/standards that complement organizational compliance requirements and applicable legislations/regulations Phase 2 Requirements for year 2014 i. Implement controls as required by defined policies and ADSIC Standards ii. iii. iv. Define methodologies and monitor effectiveness of control implementation Brief HAAD Management, on defined period on the status and progress of control implementation. Conduct Information Security awareness campaigns. v. Prepare documentation, as required by ADSIC Information Security programme and ISO Standards/certification requirements. vi. Plan and coordinate ISO certification audit, for the specified scope Phase 2 Requirements for year 2015 i. Conduct self-assessment of control environments. ii. iii. iv. Develop report on identified gaps. Recommend and follow-up with responsible stakeholder, and ensure closure of identified gaps. Ensure compliance with all applicable provisions of ADSIC Standards Architecture and Standards The IT Department s Manager should be consulted regarding information technology standards and guidelines, to ensure that those stated in the RFP are appropriate, current and are in compliance withadsic Standard. The IT Architecture & Standards (IT A&S) developed by Page 17 of 33

18 ADSIC is a comprehensive IT reference for Abu Dhabi Government entities, which can be accessed at ADSIC website ( Methodologies The bidder shall detail the Project Management methodologies and approaches used by the bidder to complete the requirements of this RFP. The bidder shall detail the requirements in phases and the outcome of each phase shall be documented. As part of bidder s response, the bidder shall break down all the requirements of this RFP and document their prior experience in similar assignments in the following manner; RFP Ref. No: RFP Requirement Prior Experienc e (Yes / No) Brief on Prior Execution (when status is Yes ) Phase 1 - Requirements for year 2013 Phase 2 - Requirements for year 2014 Phase 2 - Requirements for year Security The information acquired, gathered or received during the project shall strictly remain within the boundaries of HAAD and shall not be transferred/copied/disseminated/uploaded outside HAAD boundaries, without explicit approval from concerned Information Owners, even after the closure/end of the project or contract agreement. The raw data or information acquired during the process of assessment exercise, with the help of various tools, shall be submitted to HAAD officials and must be destroyed from the custody of consultants working on the project. The security solutions or tools used shall not, at any point in time, transfer/copy/upload HAAD information or content to a cloud based environment or an environment outside HAAD User Training The bidder shall consider, as part of the requirement, training on the methodologies developed and used, in the form of workshops and classroom sessions. Page 18 of 33

19 The bidder shall consider, as part of the requirement, end user awareness trainings defined and delivered in a creative and professional manner to enhance effective application of Information Security practices during day to day operations/needs Project Management The project management responsibility will rest upon the Information Security Function and appointed CISO will manage the entire project. All deliverable will be approved and signed-off by the Project Steering Committee as mentioned in the below Project Organization Structure: Project Steering Committee (HAAD Senior Management Representative) Sign-Off of the project Monthly Meetings. Project Manager (HAAD + Vendor) Weekly and Monthly Meetings. Project Execution Team (HAAD + Vendor) Responsible Body From HAAD, the responsible body for the project will be Project Steering Committee, to be formed within HAAD. It is expected from the vendor, to provide a project organization chart defining the roles of each member involved in the project Personnel /Key experts Vendors should have appropriate and capable staff with qualifications and experience as follows: The qualifications, skills and expertise of the core team should cover the current requirements of HAAD s project and should have significant knowledge on ADSIC Information Security Standard. The core team selected for executing this engagement is desired to have a minimum of three years of experience in the field of Information Security with extensive knowledge and experience in performing Security Gap-Assessment exercise, Network Security Architecture Page 19 of 33

20 Review, Penetration testing, Vulnerability assessment, Risk Assessment and Treatment w.r.to Information Security risks and Application Security audits. All the members of the core project team should have participated in projects that involved Information Security risk management and ISO certification projects. The members shall have outstanding oratory and documentation skills. The desired profiles of Key Project s staff should contain at least three of the following, as minimum requirements: Certified Information Systems Auditor (CISA) / Certified Information Security Manager (CISM) / Certified Information Systems Security Professional (CISSP) ISO 27001:2005 Lead Auditor / Implementation Certified Ethical Hacker (CEH) / ITIL Foundation Certified Performed Information Security Risk Management exercise for one of Abu Dhabi Government entities or Conducted ISO 27001:2005 consulting for one of Abu Dhabi Government entities. Page 20 of 33

21 Draft Contract Agreement and Conditions This Contract ( Contract ) is entered into by and between the Health Authority - Abu Dhabi (the Contracting Authority) having its principal place of business at - P.O Box: 5674 Abu Dhabi United Arab Emirates, and ( the Vendor ) having its / their principal place of business located at The Contracting Authority issued a request for proposal number (the RFP ) where it invited qualified, experienced and capable vendors to perform the services under the RFP; The Vendor submitted a proposal dated --- representing to have experience, skilled personnel, and know-how offering to perform the RFP services; Accordingly, the Contracting Authority awarded the RFP to the Vendor on the terms and conditions of this Contract. Now therefore the Parties to this Contract hereby agree as follows: 1- Subject The subject of this Contract is , with identification number: Structure of the contract The Vendor will carry out the services on the terms and conditions set out in this contract, which comprises, in order of precedence, the special conditions ("Special Conditions") defined in this document and the following annexes: Annex I: Annex II: Annex III: Annex VI: Request for Proposal Vendor s proposal Personnel Correspondences between both parties The above Contract documents are intended primarily to be explanatory and complement each other. In case of any contradiction between the above documents, their provisions shall be applied according to the above order of precedence to the extent necessary to remove the contradiction. 3- Contract Value The contract value is AED 4- Commencement Date The date for commencing the contract performance shall be the date of signature of this contract. Page 21 of 33

22 5- Period of Execution The period of execution of the complete service is date months from the Commencement 6- Personnel 1. The Personnel specified in the Staffing Plan set out in Annex III (the Personnel ) shall carry out the Services indicated therein. 2. In the event that any of the Personnel specified in Annex III is, in the opinion of the Contracting Authority, incompetent in discharging his/her assigned duties; the Contracting Authority may request the Vendor, to immediately provide as a replacement, a person with qualifications and experience acceptable to the Contracting Authority without any additional cost. The Vendor shall submit to the Contracting Authority the names and curricula vitae (to include details of all qualifications) of any proposed substitute and shall permit the Contracting Authority to interview any substitute. The Contracting Authority may in its absolute discretion refuse to accept any proposed substitute and in such case the Vendor shall submit to the Contracting Authority further names and curricula vitae of proposed substitute personnel. The fees for the Services as set out below in Article 9 will not be changed by the replacement of Vendor's personnel as requested by the Contracting Authority. 3. The Vendor shall make no change to the personnel specified in Annex III without the prior approval of the Contracting Authority. If the Contracting Authority shall approve a change in the Personnel, the Vendor shall submit to the Contracting Authority the names and curricula vitae (to include details of all qualifications and experience) of any proposed substitute and shall permit the Contracting Authority to interview any substitute. The Contracting Authority may in its absolute discretion refuse to accept any proposed substitute and in such a case the Vendor shall submit to the Contracting Authority further names and curricula vitae of proposed substitute personnel. Without prejudice to the foregoing, if the Contracting Authority so requests, the Vendor will provide the Contracting Authority with the names of proposed substitutes to enable the Contracting Authority to approve a substitute in accordance with the terms hereof in advance of any specific requirement by the Contracting Authority. The Contracting Authority shall promptly give or refuse its approval. 7- Information to be provided to the Vendor The Authority shall supply free of charge all available data and information, and shall give such assistance to the Vendor at its request and as may be reasonably required for carrying out his duties under this Agreement. 8- Reporting The Vendor shall provide HAAD with the required technical reports as specified in the Terms of reference. Page 22 of 33

23 9- Payments Payment shall be within 30 days from the date of receiving the invoice from the Vendor. The submitted invoice should be signed and stamped by the Vendor and include the following information: Contract no. Contact person in the firm The service provided Bank details (i.e., branch details, account number etc. ) Payments will be made after the technical committee assigned by HAAD verifies and accepts the output of the Vendor. The payments shall be made according to the following schedule: < An example > Payment No. Name of Milestone (or Deliverable) Percentage 1. Phase 1 30% 2. Phase 2 30% 3. Phase 3 40% 10- Contract Price The contract Price shall be fixed and not subject to change, inclusive of all applicable taxes, charges and any costs as may be occurred. This contract price may be reduced by the penalty amounts provided for herein, if applied. 11- Contact Addresses Any written communication relating to this Contract between the Contracting Authority and the Vendor must state the Contract title and identification number, and must be sent by post, fax, or by hand to the addresses identified herein this contract. 12- Performance Bond The Vendor shall be required to secure a performance bond in an amount equal to 10% of the total award price within 10 days from signing the contract and to be in effect for the duration of the performance period. The performance bond may be liquidated in case of lack of delivery and/or loss incurred in the event of the Vendor s failure to deliver or perform according to the requirements of the contract. No payments will be made until an acceptable performance bond has been provided to the Contracting Authority. Page 23 of 33

24 13- Intellectual Property 1. The Vendor will furnish the Contracting Authority with the HAAD s character, with reports, analyses or other such materials (the "Materials"). 2. The Contracting Authority may furnish the Materials to any Abu Dhabi government entity, its directors, officers, and employees and to its legal counsel, accountants, and investment bankers. 3. The Contracting Authority shall own all right, title, and interest, including, without limitation, all intellectual property rights, in and to the HAAD s Character and the Materials, except that the Vendor retains all right, title and interest, including, without limitation, intellectual property rights, in and to the Vendor s Tools (as defined below). To the extent that the HAAD s Character and the Materials include any Vendor s Tools, the Vendor hereby grants to the Contracting Authority exclusive, transferable, sub-licensable, worldwide, royalty-free, perpetual license to use and copy the Vendor Tools solely for HAAD s use. The Vendor Tools consist of any and all concepts, analyses, know-how, tools, frameworks, models, and industry information and perspectives used by the Vendor in connection with the Services. 14- Non-Assignment and Non-subcontracting 1. The Vendor shall not assign, subcontract or transfer the benefits and obligations of this Contract or any part thereof to any person/company except by the Contracting Authority's prior written approval. 2. In any case of bankruptcy or liquidation of the Vendor, this Agreement shall immediately be terminated without notice. In this case, the official receivers, trustees or liquidators of the Vendor shall not have the right to transfer/ assign or subcontract the benefits or any of the rights under this Agreement or prejudice the rights acquired by the Contracting Authority from the Vendor hereunder. 15- Vendor s Obligation 1. The Vendor warrants that it has the expertise & skilled personnel to handle the obligations hereunder. 2. The Vendor must ensure that its personnel perform the obligations of this Contract without placing unnecessary burden on the Contracting Authority staff. 3. The Vendor must sign an undertaking not to share the outcome and conclusions of its report with any individuals or organizations not authorized by the Contracting Authority in writing 16- Confidentiality It is the long-standing practice of the Vendor to serve multiple clients within industries, including those with potentially opposing interests, as well as counter-parties in merger, acquisition and alliance transactions. The Vendor is committed to maintain the confidentiality of the Contracting Authority s information (generally as described in this Agreement) in all such situations. Page 24 of 33

25 17- Penalties In case the required items are not submitted by the Vendor by the expected delivery date, this will be investigated and the Vendor will be penalized. The penalty for late delivery is set at 2.5% of the total price of test per week and up to four (4) weeks (Maximum penalty is 10% of contract price). 18- Taxes The Vendor shall be liable for all taxes, imposts, duties, withholding taxes, charges or other assessments of whatsoever nature, whether levied by the Government of Abu Dhabi or the UAE, or any other Government elsewhere. 19- Termination The availability of penalties does NOT limit HAAD s right to terminate this contract for the Vendor s lack of performance immediately without notice. The Contracting Authority shall have the right to terminate this Contract upon giving 30 days notice period. 20- Governing Law and Language The contract is subject to and shall be construed according to the applicable laws and regulations of the United Arab Emirates and the Emirate of Abu Dhabi. The contract and all notices pursuant to the provisions of this subcontract shall be in English. 21- Entire Agreement This contract embodies the entire agreement between the Contracting Authority and the Vendor with respect to the Services and supersedes all prior agreements, negotiations, understandings, representations and warranties, whether written, oral or otherwise and in particular any standard terms customarily issued by the Vendor. No changes, amendments or modifications of the terms or conditions of this contract shall be valid unless executed in writing and signed by both parties. 22- Dispute Settlement Any disputes arising out of or relating to this contract which cannot be settled otherwise shall be referred to the competent courts in the Emirates of Abu Dhabi for consideration and settlements in accordance with the applicable law and regulations. Notwithstanding the referral of the disputes as mentioned herein, the Vendor shall continue to perform their duties under this agreement if so requested by the Contracting Authority. Page 25 of 33

26 This contract is written in English in three originals, two originals for the Contracting Authority and one original being for the Vendor. For the Vendor For the Contracting Authority Name: Name: Position Position: Signature: Signature: Date: Date: Page 26 of 33

27 Annex I- Business Reference Customers Include at least three (3) customers, for which your organization has developed similar services requested herein, preferably similar in size and nature to HAAD requirements. References may include local, GCC or internalional clients. Make as many copies of this table as necessary. 1- Name of the Organization: Contact name and title Address/phone Nature of services / deliverables provided Comments Contact name and title Address/phone 2- Name of the Organization: Nature of services / deliverables provided Comments Page 27 of 33

28 Annex II Technical Evaluation Criteria The Technical Evaluation Criteria include the following aspects: 1. General 2. Technical Competence 3. Resources S. No. Technical Aspects Max Score 1. GENERAL 20 a. b. Vendor s background and experience on projects of similar nature at least three years in UAE/GCC market Project Time plan is reasonable and comprehensive of the project requirements 2. TECHNICAL COMPETENCE 70 a. b. c. d. Understanding of the project requirements The suitability of the bidder s proposal, approach and demonstrated evidence to be able to deliver on the requirement, as per HAAD's needs and expectations. Training and transfer of knowledge s approach which indicates the type of training available, duration of the training & training syllabus. Organization level capabilities (Certifications such as Quality and familiarity with IT best practices such as PMI, CMMI, ITIL, COBIT, ISO etc.) 3. RESOURCES 10 a. Availability of qualified personnel with the required qualifications, skills and experience, concerning the nature of the project meeting the requirement in Page 28 of 33

29 1- Project overall all Costs 1)Project Phase* Phase 1 Requirements for year 2013 Phase 2 Requirements for year 2014 Phase 3 - Requirements for year 2015 Project Overall value Annex III Financial Evaluation Template Total Cost in AED** **Total cost inclusive of all /any anticipated costs (travel, accommodation,,,etc), overhead costs and applicable taxes, VAT, tariffs Payments shall be done to the Consultant after the completion and HAAD s acceptance to the deliverables. 2- Breakdown of Costs for each of the Project s phases: 1)Project Phase (for Year 2013_* Cost in AED** A- Establish Information Security Organization and define responsibilities, ensuring Management participation and effective governance B- Conduct gap assessment of the current environment, documenting the details of current control environment, against the requirements of ADSIC Standards and ISO Standard. C- Identify, document, and maintain (through the lifecycle of project execution) a detailed inventory of information assets. D- Classify information assets. E- Develop service inventory workbook and categorize services. F- Review, modify and introduce new Page 29 of 33

30 policy/procedures/guideline/standards that complement organizational compliance requirements and applicable legislations/regulations. Project Overall value Each phase include the completion and submission of the services and deliverables stated in this RfP **Total cost inclusive of all /any anticipated (travel, accommodation,,,etc), overhead costs and applicable taxes, VAT, tariffs Payments shall be done to the Consultant after the completion and HAAD s acceptance to the deliverables. 2- Breakdown of Costs for each of the Project s phases: 1)Project Phase (for Year 2014_* Cost in AED** A. Implement controls as required by defined policies and ADSIC Standards B. Define methodologies and monitor effectiveness of control implementation. C. Brief HAAD Management, on defined period on the status and progress of control implementation. D. Conduct Information Security awareness campaigns. E. Prepare documentation, as required by ADSIC Information Security programme and ISO Standards/certification requirements. F. Plan and coordinate ISO certification audit, for the specified scope Page 30 of 33

31 Project Overall value Each phase include the completion and submission of the services and deliverables stated in this RfP **Total cost inclusive of all /any anticipated (travel, accommodation,,,etc), overhead costs and applicable taxes, VAT, tariffs Payments shall be done to the Consultant after the completion and HAAD s acceptance to the deliverables. 2- Breakdown of Costs for each of the Project s phases: 1)Project Phase (for Year 2015_* Cost in AED** A. Conduct self-assessment of control environments. B. Develop report on identified gaps. C. Recommend and follow-up with responsible stakeholder, and ensure closure of identified gaps. D. Ensure compliance with all applicable provisions of ADSIC Standards. Project Overall value Each phase include the completion and submission of the services and deliverables stated in this RfP **Total cost inclusive of all /any anticipated (travel, accommodation,,,etc), overhead costs and applicable taxes, VAT, tariffs Payments shall be done to the Consultant after the completion and HAAD s acceptance to the deliverables. Page 31 of 33

32 Annex IV- Vendor Risk Assessment Questionnaire Instructions: Please complete the following questionnaire. For any queries or details required, please describe in Justification/Comments Section OR mention at the end of the questionnaire OR attach documentation with the required information. Mention Not Applicable wherever relevant, with appropriate justifications or comments. Select options by marking X in the appropriate box. Note: Vendor has to at least comply with 80 % of the below Mandatory Questionnaire to be eligible to pass the technical evaluation process. Vendor Risk Assessment Questionnaire Mandatory Requirements Risk Assessment Categories Compliance Status Yes No Justification / Comments 1. Does your Organization have Information security (IS) policy, which is approved by your management, published and communicated to all employees? Are IS Policies reviewed on an ongoing basis? 2. Do you sign Confidentiality or non-disclosure agreements with your company employees and/or third party personnel, as employed or engaged by your company? 3. Is security requirements such as background verifications, information security awareness, etc. are addressed for all employees and third party personnel? 4. Are security roles and responsibilities documented and communicated to all employees and third parties through appropriate Information Security awareness training and regular updates? 5. Are responsibilities for the protection of customer information/assets, and Organizational information/assets clearly defined? Desired Requirements 1. Does your Organization comply with the requirements of the ISO/IEC 27001:2005 Standard, and Certified against those requirements? Are you aware of ADSIC Information Security Standard requirements? Page 32 of 33

33 2. Is there an information classification scheme or guideline in place, which will assist in determining how the information is to be handled and protected? Are your employees, sub-contractors & third parties made aware to adhere with such classification schemes? 3. Is there a defined employee exit process, and is the employee exit process includes communication to customers? 4. Are physical identification Badges provided to all employees and third party users working within the Organization premises or at the client sites? 5. Do you follow a formal Change Management Procedure for implementing changes to information processing facilities, assets or services offered to customers? 6. Do you have a procedure for recording audit logs for user actions, exceptions, and information security events? 7. Do you have a formal user registration and deregistration process for granting/revoking access to information systems and services? 8. Do you have a password management requirements defined that enforces various password controls? 9. Do you have a security incident reporting process in place? Are employees aware of the requirements of the process, and are trained to report security weakness or events through defined channels as quickly as possible? 10. Do you have Business Continuity Management (BCM) in place? Does your Business continuity planning address the requirements of ensuring continuity of services to your customers and business stakeholders? Vendor s authorized signatures: Page 33 of 33