Anonymous CRA internal fraud and misuse reporting lines

This bid solicitation cancels and supersedes previous bid solicitation number 1000318737 dated September 15, 2014 with a closing of October 29, 2014 at 2 pm. 

The Bidder must complete and sign the front page (page 1) of the RFP and return it with their submitted proposal.  The Bidder’s complete legal name must be properly set out on the front page.

DESCRIPTION OF REQUIREMENT

THIS REQUIREMENT CONTAINS SECURITY REQUIREMENTS.

Bidders must hold an approved facility clearance for Document Safeguarding at the Protected B level prior to contract award.  

OVERVIEW

The CRA requires the services of an independently managed anonymous toll-free hotline and an online (website) services that are available to approximately 40,000 CRA employees, 24 hours a day, 7 days a week, in support of its Internal Fraud Control Program.

The Contractor must:
-  Make the services available to CRA employees located across Canada including urban, rural and isolated locations;
-  Ensure that all services are available in English or French as per the Sources and CRA Authorized Reviewer’s language of choice;
-  Maintain all information gathered through the initiative in a secure location (physical and/or electronic) inside Canada at all times, ensuring that the data remains confidential and anonymous (NO cloud computing/storing);
-  Ensure the anonymity of the Source at all times (the Contractor must not record the Sources name at any time, even if provided);
-  Provide access to a maximum of six (6) CRA authorized reviewer profiles per year;
-  Immediately alert the CRA authorized reviewers by automatic e-mail notification of the receipt of any newly submitted or updated allegation;
-  Provide anonymous follow up capabilities: 
    -  Provide all Sources with a secure username and password, and an allegation number that will allow them to provide additional information on their allegation via online or phone; and 
    -  Ensure that the CRA authorized reviewers have the ability to communicate anonymously with the Source if additional information is required (i.e. CRA authorized reviewers can post a question under an allegation number and the Source can log in using the username and password provided to provide additional information).

The facility layout must have a Reception Zone accessed directly from the Public Access Zone, where visitors wait for service of wait for permission to proceed to a more restricted area. At the boundary between Public-Access Zones and Restricted Zones and at the Public-Access side of the Reception Zone, the wall and ceiling must not permit access over the wall by simply lifting ceiling tiles. The ceiling on the public side is to be fixed or the wall to extend to the underside to the structure above.

The Contractor must have the necessary equipment and services to destroy material and IT media at the Protected B level.

The CRA follows the IT Security Risk Management: A Lifecycle Approach (ITSG-33).  The security requirements and controls set out below are derived from the ITSG-33.  The Contractor’s solution must meet all stated security controls as specified throughout the life of the Contract including any option period if exercised.  For additional details and guidance on each specified requirement, refer to Annex 3 - Security Control Catalogue (https://www.cse-cst.gc.ca/en/publication/itsg-33)


MANDATORY CRITERIA

Three of five mandatory criteria include the following:

1. The Bidder must clearly provide a description of how the Bidder will manage all data input, processing, storage, accessing and electronic back-ups exclusively in Canada.

2. The Bidder must demonstrate they have sufficient Information Technology (IT) systems capability and capacity to accommodate the CRA IT Security requirements as described in Annex A - Statement of Work.

3. The Bidder’s must include a detailed description of two (2) distinct clients/customers which demonstrates that the Bidder has provided an anonymous reporting line services to organizations of a similar* size and scope to the CRA requirement.

*An anonymous reporting lines service that is similar in size and scope to the CRA requirement described at Annex A-1: Business Requirements, is defined as a requirement that: 
•	Is an organization of more than 10,000 employees;
•	Has a national scope (i.e. accepts allegations across Canada); 
•	Collects and processes allegations via phone, and online;
•	Provides services in both English and French; and 
•	Provides 24 hours/day, 7 days/week service.

BASIS OF PAYMENT

The Contractor will be paid a firm all-inclusive monthly rate for the services.  

CONTRACT AND OPTIONS PERIODS

	The period of the contract is from March 1, 2015 to March 31, 2017 inclusive, with three irrevocable options to extend the contract period for up to three additional years, to be exercised in 1-year increments. 

CONTRACTOR SELECTION METHODOLOGY

The Bidder must meet all mandatory criteria applicable to this solicitation.  Only the bids meeting the mandatory criteria will be evaluated and scored in accordance with the point rated evaluation criteria.  Any proposal that does not achieve the minimum score of 51 points out of 85 will be considered non-compliant and will receive no further consideration.

To determine an overall score for each proposal, technical and price will each be given a rating value; in this case, 60% for technical and 40% for price, and then combined to derive a total combined rating.

The Bidder recommended for award of the Contract will be the compliant Bidder achieving the highest combined rating.

All enquiries regarding this Request for Proposal must be directed in WRITING (see email address below) to:

CONTRACTING Authority:

Phuong Ly
Supply/Business Analyst
Contracting Division
Canada Revenue Agency
Tel. Number: (613) 957-3291
Email Address:  Phuong.Ly@cra-arc.gc.ca