Agriculture Financial Services Corporation - Request for Proposal - RFP 0696 Penetration Test and Vulnerability Assessment

Date: March 4, 2024 COMPETITIVE BID Issued by: Agriculture Financial Services Corporation COMPETITIVE BIDS FOR: IT Security Consultant to provide Penetration Tests and Vulnerability Assessment for AFSC COMPETITIVE BID #: RFP 0696 CONTRACTED SERVICE: Penetration Test and Vulnerability Assessment Provider CLOSING: March 26, 2024 AFSC BUYER: Kathy Walker TITLE: Buyer, Business Services ADDRESS: AFSC Purchasing Department 5718 56th Avenue Lacombe, Alberta T4L 1B1 E-MAIL: RFP@afsc.ca TABLE OF CONTENTS: TERMS AND CONDITIONS - 1 - 1.0 INTRODUCTION - 1 - 1.1 DEFINITIONS - 1 - 1.2 MANDATORY REQUIREMENTS AND DESIRABLE PROVISIONS - 1 - 1.3 CONFIDENTIALITY AND SECURITY OF INFORMATION - 2 - 1.4 MATERIAL OWNERSHIP - 2 - 1.5 CONFLICT OF INTEREST - 2 - 1.6 INACCURACIES OR MISREPRESENTATIONS - 3 - 1.7 INQUIRIES - 3 - 1.8 BLACKOUT PERIOD - 4 - 1.9 LIABILITY FOR ERRORS - 4 - 1.10 NOTIFICATION OF CHANGES - 4 - 1.11 VENDOR’S EXPENSES - 5 - 1.12 SHORT LISTING - 5 - 1.13 RESOURCE REPLACEMENT - 5 - 1.14 FREEDOM OF INFORMATION AND PROTECTION OF PRIVACY - 5 - 1.15 RESERVATION OF RIGHTS - 6 - 1.16 COMPETITIVE BID ADMINISTRATION - 6 - 1.17 AFSC’S POLICIES AND PROCEDURES FOR SECURITY AND TRAINING ON SITE - 7 - 1.18 VENDOR DEBRIEFING - 7 - 2.0 STATEMENT OF WORK - 8 - 2.1 INTRODUCTION - 8 - 2.2 BACKGROUND - 8 - 2.3 OBJECTIVES - 9 - 2.3.1 PENETRATION TESTING SERVICES - 9 - 2.3.1.1 NETWORK PENETRATION TESTING SERVICES - 10 - 2.3.1.2 APPLICATION PENETRATION TESTING SERVICES - 10 - 2.3.1.3 SOCIAL ENGINEERING TESTING SERVICES - 10 - 2.3.2 VULNERABILITY ASSESSMENT SERVICES - 10 - 2.3.3 WEB APPLICATION PENETRATION TESTING SERVICES - 11 - 2.3.4 RED TEAMING EXERCISE - 11 - 2.3.5 ADDITIONAL SERVICES - 11 - 2.3.6 SECURITY POLICY REVIEW. CONTINUOUS THREAT EXPOSURE MANAGEMENT (CTEM) - 12 - 2.4 DURATION - 12 - 2.5 REQUIREMENTS - 12 - 2.5.1 PREFERRED REQUIREMENTS - 12 - 2.5.2 OPTIONAL REQUIREMENTS - 16 - 2.5.3 TRAINING - 18 - 2.6 CORPORATE CAPABILITIES AND EXECUTIVE SUMMARY - 18 - 2.7 RESOURCES - 18 - 2.8 VALUE ADD - 19 - 2.9 APPROACH - 19 - 2.10 SECURITY - 20 - 2.10.1 DATA CLASSIFICATION - 20 - 2.11 TECHNOLOGY INFORMATION - 20 - 2.12 DOCUMENTATION - 20 - 2.13 ADDITIONAL INFORMATION - 21 - 2.14 DISCLOSURE - 22 - 2.15 PRICING - 22 - 3.0 EVALUATION - 23 - 4.0 CONTRACT REVIEW - 26 - 4.1 NEGOTIATIONS - 27 - 5.0 MASTER SCHEDULE - 27 - 6.0 PROPOSAL SUBMISSION GUIDELINES - 29 - 6.1 PROPOSAL FORMAT - 29 - 6.2 PROPOSAL SUBMISSIONS - 31 - TERMS AND CONDITIONS 1.0 Introduction Agriculture Financial Services Corporation (AFSC) is an Alberta Provincial Crown Corporation under the Ministry of Agriculture and Irrigation. AFSC’s core programs include business risk management programs and services to the agriculture industry as well as lending products and services to farmers’ agribusinesses, value added enterprises and commercial operations. More detailed information about AFSC is available on the website www.afsc.ca. The objective of this Competitive Bid is for AFSC to solicit Proposals from those qualified in providing the specified services described under section 2.0 of this Competitive Bid. 1.1 Definitions The following abbreviations and terminology are used throughout this Competitive Bid: Term Description Personnel Employees, contractors, subcontractors and agents of the Vendor. Vendor Any business that is registered in Canada and is authorized to operate in Alberta, proposing to submit a Proposal to the Competitive Bid. Competitive Bid Competitive Bid (RFP), Request for Quote (RFQ), Value Based Request (VBR), Notice of Proposed Procurement (NPP), Request for Information (RFI), Request for Comment (RFC) Statement of Work The services required by this Competitive Bid as described in section 2.0 of this Competitive Bid. Contract Monitor AFSC representative that will be responsible for the management of the contract that may result from this Competitive Bid. 1.2 Mandatory Requirements and Desirable Provisions Proposals that do not comply with the Competitive Bid requirements will be rejected. “Must”, “shall”, “mandatory” and “will” mean a requirement that must be met in order for the Proposal to receive consideration. For mandatory requirements, the Vendor must provide sufficient information in the Proposals to sustain compliance to the Competitive Bid’s Mandatory requirements. “Should” and “desirable” mean a provision having a significant degree of importance to the objectives of the Competitive Bid. For desirable/optional provisions, the Vendor’s Proposal should provide details of how the desirable/optional provisions are addressed. 1.3 Confidentiality and Security of Information The Vendor and the Vendor’s personnel shall: a) Keep strictly confidential all information concerning AFSC or third parties, or any of the business or activities of AFSC or third parties acquired as result of participation in the Competitive Bid; b) Only use, copy or disclose such information as necessary for the purpose of submitting a Proposal or upon written authorization of AFSC. The Vendor shall maintain security standards, including control of access to data and other information, consistent with the highest standards of business practice in the Vendor’s industry. 1.4 Material Ownership Ownership in all materials including copyright, patent, trade secret, industrial design or trademark that are made, prepared, developed, generated, produced or acquired under or in relation to the Competitive Bid and any subsequent contract by the Vendor, the Vendor’s employees, subcontractors or agents belongs to AFSC as they are made, prepared, developed, generated, produced or acquired. Any such materials shall be delivered to AFSC upon completion or termination of the Competitive Bid. The Vendor: a) Irrevocably waives in whole all moral rights. b) Shall ensure that its employees, subcontractors, and agents irrevocably waive in whole all moral rights to the materials made, prepaid, developed, generated produced, or acquired under the Competitive Bid and any subsequent contract and declares that these waivers shall operate in favour of AFSC and AFSC’s assignees and licenses. 1.5 Conflict of Interest Vendor(s) must fully disclose, in writing to AFSC on or before the closing date of the Competitive Bid, the circumstances of any possible conflict of interest or what could be perceived as a possible conflict of interest if the Vendor were to become a contracting party pursuant to the Competitive Bid. AFSC will review any submissions by Vendor(s) under this provision and may reject any Proposals where, in the sole opinion of AFSC, the Vendor could be in a conflict of interest or could be perceived to be in a possible conflict of interest position if the Vendor were to become a contracting party pursuant to the Competitive Bid. 1.6 Inaccuracies or Misrepresentations If, during the Competitive Bidding process, AFSC determines that the Vendor has made a material misstatement or misrepresentation or that materially inaccurate information has been provided to AFSC, the Vendor will be disqualified from the Competitive Bidding process. 1.7 Inquiries All inquiries related to this Competitive Bid must be addressed to the AFSC Buyer on or before the date specified in the Master Schedule and as per the following: a) Inquiries must be sent by e-mail to the AFSC Buyer at RFP@AFSC.ca, utilizing the Q&A template provided. b) No telephone inquiries will be accepted. c) No additional information or clarifications will be provided to inquiries received after the applicable deadline. d) To be considered, all inquiries must provide the following Vendor information: • Name of Primary Contact • Address • Telephone number • E-mail address • Competitive Bid Reference Number. e) All inquiries received will be reviewed by AFSC. f) All inquiries will be compiled and answered in the form of written Addendum(s) issued by AFSC via Alberta Purchasing Connection (APC) to all prospective Vendor(s). g) Vendor(s) are advised that all inquiries answered by AFSC will be provided verbatim in writing to all prospective Vendor(s). h) Inquiries that may contain proprietary or confidential information of a Vendor may be answered exclusively to the submitting Vendor (AFSC will direct the correspondence regarding this inquiry only to the Vendor’s Primary Contact) provided the Addendum does not: • Require a modification to this Competitive Bid; or • Potentially provide an undue advantage in the competitive process. i) If either of the above situations (h) arises, AFSC reserves the right to: • Request the Vendor reword and resubmit the inquiry; or • Decline to provide a response. j) AFSC reserves the right to not disclose information in conjunction with this Competitive Bid on any inquiry that requires releasing information that AFSC, in its sole discretion, regards as confidential to AFSC. k) AFSC reserves the right in any event to decline to provide a Proposal for any reason in its sole discretion. l) It is the Vendor’s responsibility to notify AFSC, in writing, and in advance, of any change in the Vendor(s) Primary Contact Information. m) AFSC assumes no responsibility or liability arising from information obtained in a manner other than as described in this Competitive Bid. 1.8 Blackout Period With respect to the Competitive Bid, AFSC prohibits communications initiated by a Vendor to any AFSC employee, other than the Purchasing Department, for the period of time from the submission date of the Competitive Bid up to and including the date of contract award resulting from this Competitive Bid. Any communication between a Vendor and AFSC during the Blackout Period will be initiated by AFSC, in writing, for the purpose of obtaining information or clarification necessary to ensure a proper and accurate evaluation of the Proposal. Any communication initiated by a Vendor during the Blackout Period may be grounds for disqualifying the