TENDER NOTICE NO.15/2007

TENDER NOTICE NO.15/2007 (FOR WEB HOSTING SERVICES)

Sealed Proposals are invited from renowned firms having registration with the Sales Tax and Income Tax Department for “Web Hosting Services”. For further details kindly collect Tender Documents either from the office of undersigned (during working hours) or download from www.ppra.org.pk or www.pral.com.pk from 3rd July, 2007 to 19th July, 2007. Last date for submission of the proposals is 20th July, 2007 on or before 1200 hours. Proposals shall be opened on the same day at 1230 hours in the presence of bidders representatives. Manager (Administration) Room # 4, Ground Floor, CDA Block-II, Melody, Islamabad. Ph:92213 14

Advertisement for daily “The NEWS” on 03/07/2007.

TENDER DOCUMENT PAKISTAN REVENUE AUTOMATION (PVT.) LIMITED Ref. WHS/PRAL/2007 Subject:

July 03, 2007

TENDER NO. 15/2007 DATED 03/07/2007 FOR “WEB HOSTING SERVICES”

1.

Pakistan Revenue Automation (Pvt.) Ltd. (hereinafter called PRAL) again invites sealed Proposals for purpose of “Hiring Web Hosting Services” as per detail described in enclosed Schedule of Requirement “Annexure- A”.

2.

If you have any doubt as to the meaning of any portion of the technical specifications, you may seek clarification of the same from Mr. Ali Hameed, Director Infrastructure & Networks or Mr. Nasir Malik, Senior Infrastructure Engineer on Phone # 0321-5591498, 051-9206777 or 0321-5371151.

3.

PRAL does not take any responsibility for collecting the bids from any agency.

4.

The subject services are initially required for the period of one year (can be extended for the period of an other one year). The Successful bidder may be in a position to commence services immediately after award of the contract.

5.

The service shall be required round-the-clock.

6.

BIDS PRICE Prices must be quoted in Pakistani Currency. The quoted prices must be inclusive of all charges and taxes.

7.

PAYMENT Payment shall be made (after deducting / withholding the taxes) under the law on mutually agreed terms and conditions. However the bidders are free to clearly mention their terms of payment as per their policy.

08.

SEALING AND MARKING OF PROPOSALS The Proposals shall be submitted in sealed envelopes marked as under: Manager, Administration (PRAL) Room # 4, Ground Floor, CDA Block-II, Melody, Islamabad The Envelopes shall also bear the word ““Confidential” and following identifications:Proposals # 15/2007 For the “Web Hosting Services”

09.

DEADLINE FOR SUBMISSION OF BIDS: All Proposals must be delivered in the Office of undersigned on or before the prescribed deadline of 1200 hours on 20/07/2007. PRAL will open the Proposals in the presence of bidder representatives who choose to attend at 1230 hours on 20/07/2007 at Room # 4, Ground Floor, CDA Block-II, Melody Islamabad.

10.

EVALUATION:

10.1.

11.

After opening of the Proposals, PRAL will examine the same for technical evaluation and completeness of the same as per tender requirements. 10.2. Bidder (s) who do not qualify cannot challenge the findings of the evaluation or ask for reasons of disqualification. 10.3 The Successful bidder will sign contract with PRAL for the period of 1 Year along with SLA. 10.4 After Contract Award the successful bidder must implement the services on or before 1st August, 2007 Successful Bidder represents and warrants that they can provide clear and efficient services and in this respect has the necessary labour, skill, expertise and technical know how.

12.

The Bidder (s) represents and warrants that the services to be provided by them are fully guaranteed. Bidder will takes full responsibility to provide the service as per PRAL’s satisfaction.

13.

All Proposals should include: 13.1. 13.2 13.3. 13.4

14.

Company’s profile, list of such projects handled, list of clients with telephone number and address. Copies of Income Tax and Sales Tax registration certificates. Affidavit (on legal paper) to the effect that the firm has never been black- listed by any agency of government/semi government/autonomous or business concern Compliance sheet for each individual item listed in the Hosting Specifications / Annexure “A”

PRAL reserves the right to accept or reject any Proposal and to annul the bidding process and reject all Proposals at any time prior to award of Contract (s) without thereby incurring any liability to the affected Bidder or Bidders or any obligation to inform the affected Bidder or of the grounds for PRAL’s action. (MAJOR ® MASOOD AKHTAR KHAN) Manager (Administration) Room # 4, Ground Floor, CDA Block-II, Melody, Islamabad. Ph: 9221314

ANNEXURE-A SCHEDULE OF REQUIREMENT TENDER # 15/2007 DATED 03/07/2007 Pakistan Revenue Automation (PVT) Ltd plans to launch a Web based application that would be used to facilitate tax-payers in Pakistan. .High-end dedicated servers are required for application hosting, coupled with a secure hosting infrastructure that is: • • • • •

Provider Layer 2-3 security and logging of all traffic with PRAL Network team having Access to Security Logs, including but not limited to all traffic logs relevant to our Application Server. Logs should be available in Raw format in real-time. Logs from IDP/IDS are also required. Provides Layer 4-7 security, logging and load-balancing of incoming traffic as well as added port security Provide an accountable manner by which each submission can be traced with respect to time-stamps, traffic/routed hops, Source IP, Mid-Tier IP, Destination IP. Be able to provide internal and external pulses on system and services uptime. PRAL Network team will have Direct ICMP access to target systems, for this purpose two management IP’s will be nominated by PRAL for security Reasons.

Uptime Requirement & SLA PRAL Requires highest level of Uptime due to criticality of its application with the following Basic Requirements, Vendor is required to quote any Equipment necessary to achieve these Requirements. • System Uptime requirement of 99.99 % During 0700 Hrs to 23:00 Hrs as a whole ( Network & Servers included) • System Uptime Requirement of 99.9 % during remaining Hours. • Downtime will be calculated on the above limit on monthly basis, Service Outage Credits will be granted to PRAL by vendor if the System availability falls below the target as defined above. Hours/Minutes calculated based on this acceptable downtime are exempt from Service Outage Credits. For all Service Outage incidents reported by PRAL, Service Outage Credits will be granted calculated by dividing the charges by time the System is down. For Service Outages in excess of 20 minutes, a minimum Service Outage Credit of one (1) day will be granted, with a maximum cap for the Service Outage Credit equal to the Monthly Access Charge for one month PRAL requires the solution on turnkey basis, Vendor should quote services based on the above mention SLA and Business/Application requirements mentioned below. The details of Platform mentioned below cannot be changed and the equipment mentioned is bare minimum requirement. Any additional equipment needed to full fill the SLA requirements should be quoted, with justifications of its inclusion.

Technology & Platform Oracle® 10g & MS SQL Server 2005 Enterprise Edition (duly licensed for the number of processors or users and the number of servers) 1. Web-based multi-tiered enterprise application accessible can be implemented (Web Server/ Application Server - Database Server) 2. The server components of the hosted application must run on Windows 2003 Servers. Security 1. Due to the sensitive nature of the information being submitted PRAL requires security at the system functional level and in performing data retrieval, network traversal and manipulation 2. Data Retrieval and Manipulation security requires that only those users who have rights to read or write data within the primary system database or other data marts are allowed the particular defined access – logging of such users and accesses must be maintained at debug levels at all times. 3. PRAL will implement the must use of Secure Sockets Layer (SSL) to secure data being transmitted using the Internet on standard Port 443 and 3DES security for VPN users using ( Cisco, Nortel or windows VPN Clients) 4. PRAL also reserves the right to arbitrarily assign a port (that is not of a common services) to be implemented in its Client-Server application and that the default communication would be done on this customizable port 5. The CV/HP submission must be designed such that critical and vulnerable components and/or layers of the application (database, business logic), can deployed on hardware that is secured behind a firewall and/or DMZ, while allowing users to access it from an unsecured network or the internet. 6. Secure replication services will be required for the databases with PRAL’s in-house databases. Reliability, Recoverability & Availability 1. The Client-Server models of PRAL should avoid single points of failure. If any single component fails or is taken offline, the system should not render inoperable. “It is the responsibility of Vendor to employ hardware for Servers/Storage/SAN/Network to ensure that they meet the SLA requirements mentioned above, if this entails deploying, load balancing, failover servers then vendor should quote these”. 2. Primary database server (Manual “warm failover” process will cause secondary DB to become the active primary) 3. On the Standalone model functionality to backup to a network drive must be provided 4. The Storage Area Network (SAN) provides the shared storage required for the Database server nodes and the Document / Multimedia file storage nodes. It is connected to all the server nodes via Fiber Channel Interconnects for high input/output (I/O) performance. The SAN should have multiple disks providing multiple physical spindles to optimally allocate database files for higher performance. The SAN should also be configured for RAID operation to improve reliability, availability and performance

5. The System should have the ability to recover from failure. Database Server Specifications The general requirement mentioned below constitutes a “minimum” requirements and CV/HP who quote anything above the minimum should highlight this in their quote • • • • • • • • • • • • •

Branded Server Quad Intel Xeon 3.6GHz Architecture Minimum: 16 GB ECC DDR RAM 146 GB x 4 SCSI HDD RAID Level 5 Implementation The hard drives must be hot-pluggable and hot-swappable Dual NIC 10/100/1000 Auto-sensing Dual Power Supplies that are hot-pluggable and hot-swappable Microsoft Windows 2003 Enterprise Edition with Full Service Packs Standard Rack mount Configuration Next-Day Warranty for Service &/or Replacement by OEM Enterprise Level Client Agent installed for Antivirus & Worm Protection) Enterprise Level Client Agent installed for Daily, Weekly and Schedule Backups based on incremental and/or whole backup values

MS SQL® Cluster Specifications The Cluster for Microsoft SQL 2005 Enterprise should consist of the minimum of two servers (as mentioned in the Server Specification). The following are the general requirements for the Microsoft SQL 2005 Enterprise Cluster: • The cluster should be a minimum of two nodes. • The Server Cluster must be based on the server specifications as listed above in the “Server Specification” Section. • The OS on all the Nodes must be Microsoft Windows 2003 Enterprise Server License (25 CALs) to be include in an SPLA environment • The OS portioning should be on a three level approach: C:\OS, D:\Applicaiton, E:\LOGS • The physical storage of the cluster should be a SAN (See “SAN Specification”) Oracle® Cluster Specifications The Cluster for Oracle® 10g should consist of the a minimum of two servers (as mentioned in the Server Specification). The following are the general requirements for the Oracle® 10g Cluster: • The cluster should be a minimum of two nodes. • The Server Cluster must be based on the server specifications as listed above in the “Server Specification” Section. • The OS on all the Nodes must be Microsoft Windows 2003 Enterprise Server License (25 CALs) to be include in an SPLA environment • The OS portioning should be on a three level approach: C:\OS, D:\Applicaiton, E:\LOGS • The physical storage of the cluster should be a SAN (See “SAN Specification”) Application Server Specifications The general requirement mentioned below constitutes a “minimum” requirements and CV/HP who quote anything above the minimum should highlight this in their quote

• • • • • • • • • • • •

Branded Server Dual Intel Xeon 3.6 GHz Architecture Minimum: 8GB ECC DDR RAM 146 GB x 4 SCSI HDD RAID Level 5 Implementation The hard drives must be hot-pluggable and hot-swappable Dual NIC 10/100/1000 Auto-sensing Dual Power Supplies that are hot-pluggable and hot-swappable Microsoft Windows 2003 Enterprise Edition with Full Service Packs Standard Rack mount Configuration Enterprise Level Client Agent installed for Antivirus & Worm Protection) Enterprise Level Client Agent installed for Daily, Weekly and Schedule Backups based on incremental and/or whole backup values

SAN Specifications The general requirements for the SAN are as follows: • Minimum of 1 TB Usable in RAID 5 configuration • Microsoft Windows 2003 Enterprise Edition with Full Service Packs • Standard Rack mount Configuration • Same day Warranty for Service &/or Replacement by OEM • Enterprise Level Client Agent installed for Antivirus & Worm Protection) • Enterprise Level Client Agent installed for Daily, Weekly and Schedule Backups based on incremental and/or whole backup values Network Specifications The general requirements for the network are as follows: • Multiple connectivity with multiple Gigabit Ethernet connectivity to Tier I carriers • Minimum port connectivity to be 100mbps • Full DNS Services (High-Traffic) • Dedicated IP Addresses • 100.00% Network Up-time Guarantee • 99.99% Server Up-time Guarantee • SNMP should be enabled Security Specifications The general requirements for the Security are as follows: • • • • • • • • • •

Minimum port connectivity to be 100mbps IPS (Intrusion Prevention System) be in place Vulnerability scanning to be provided at no additional cost on the network from an external source. VA can be requested as many times during the contract period Mitigation Devices against DoS/DDoS attacks be in place Stateful Inspection Firewall Gateway Level Anti-virus Protection Server Anti-virus Protection SPAM Protection Harmful Attachment Protection Dual In-line Firewall Protection with 100% fail-over mechanism protection (HighAvailability)

• •

IP/Server Specific Firewall Policies Firewall Logging to be enabled for all accesses, PRAL Staff will have real-time access to these logs. • Layer 3 switch filtering • Layer 4-7 Switch filtering • Same Day Warranty for Service &/or Replacement by OEM Managed Services Requirement The general requirements for managed services are: • Provide Level I, Level II and Level III based customer & technical support to PRAL during office hours • Local ticket based support • Dedicated Fully Certified System Administrator • Dedicated Fully Certified Network Administrator • All Level I thru Level III services with respect to IP infrastructure hosting and management to be provided by the CV/HP • Security analysis with respect to SQL injection • Response time for call to be 15 minutes or less based upon when support tickets are opened • 24/7 availability of telephone support to designated personnel • Stress Testing • Load testing Redesign of submission process if applicable.

BIDDING FORM Date:__________

ANNEXURE-A Tender No.15/2007

Pakistan Revenue Automation (Pvt.) Limited, Islamabad. Gentlemen, 1.

Having examined the conditions to Tender and Specifications of Tender No.15/2007 dated 03/07/2007, the receipt of which is hereby acknowledged we, the undersigned, offer to install, supply and deliver in conformity with terms and conditions and specifications mentioned in Tender for the sum of Rs._________________________ (Rupees _____________________________) or such other sums as may be ascertained in accordance with the said Conditions.

2.

If our Bid is accepted we shall deliver the equipment specified in the Tender Documents within ___________ from the date of receipt of your firm Purchase Order.

3.

We agree to abide by the terms and conditions of the Tender for the period of _______ from the date fixed for receiving the same and it shall remain binding upon us and may be accepted at any time before the expiration of that period.

4.

Until a formal Purchase order(s) is placed, this Bid, together with your written acceptance thereof, shall constitute a binding contract between us.

5.

We understand that you are not bound to accept the lowest or any proposal you may receive or to inform us of the rejection of our bid or to give any reasons therefor.

Dated this ______________________ day of ______________________________ 2007___________________. Signature _______________________ in the capacity of ______________________________ duly authorized to sign Tender for and on behalf of ___________________________________________________________________________________________ (NAME OF FIRM IN BLOCK CAPITALS) Complete address:____________________________________________________________________________ Fax No.____________________________ Telephone No.________________________________________ ______________________ ( SIGNATURE ) Witness:1. _______________________ 2.

_______________________