Extension of Cyber Incident Response Tool

Trade Agreement: Agreement on Internal Trade (AIT)
Tendering Procedures: Generally only one firm has been invited
to bid
Attachment: None
Non-Competitive Procurement Strategy: Exclusive Rights
Comprehensive Land Claim Agreement: No
Vendor Name and Address: 
Silicium Security inc.
1000 avenue St-Charles
suite 808
Vaudreuil-Dorion Quebec
Canada
J7V8P5
Nature of Requirements: 
Extension of Cyber Incident Response Tool


1.	Explanation of what an Advance Contract Award Notice (ACAN)
is : 

An ACAN is a public notice indicating to the supplier community
that a department or agency intends to award a contract for
goods, services or construction to a pre-identified supplier,
thereby allowing other suppliers to signal their interest in
bidding, by submitting a statement of capabilities. If no
supplier submits a statement of capabilities that meets the
requirements set out in the ACAN, on or before the closing date
stated in the ACAN, the contracting officer may then proceed
with the award.

2.	Definition of Requirements or Expected Results

Considerable effort is currently being put into developing a
process for responding to cyber incidents for DND. The
development of this process requires a cyber incident integrated
response tool to evaluate the feasibility of several proposed
approaches.

In recent years, tools for responding to cyber incidents have
reached the marketplace. A team of scientists from Defence R&D
Canada (DRDC) have evaluated several such tools. They concluded
that no existing tool has all the capabilities necessary to
support the development work for the process.

The development from scratch of an integrated tool to respond to
cyber incidents with all the desired capabilities would require
too much effort for the scope of the project. It is therefore
proposed to extend the capabilities of an existing tool for
responding to cyber incidents by adding additional features.

We work with this supplier, as it is the only supplier that can
meet all of the following mandatory criteria:

1 - 	The supplier must have the rights required to sell and
modify a cyber incident response tool that meets mandatory
criteria 2 to 10 below.
2 - 	The tool must fully function with Windows XP and Windows 7.
The tool must be able to analyze computers equipped with Windows
XP 32-bit, Windows 7 32-bit and Windows 7 64-bit operating
systems.
3 - 	The tool must be capable of remotely checking whether a
computer is compromised using a software agent or other means.
4 - 	The tool must be capable of checking the validity of
computer networks using a centralized management console. All
incident response features must be capable of being operated
from this console. Only the software agent installation process
(or other technique) can be performed using means other than the
centralized management console.
5 - 	The tool must be capable of checking the integrity of a
process in memory, for example by comparing its memory dump to
that on the disk by simulating the module load in Windows.
6 - 	The tool must be capable of verifying the integrity of a
file on the disk, for example by comparing the information
gathered by Windows APIs to that obtained via a direct read of
data using a driver.
7 - 	The tool must be capable of verifying the integrity of the
Windows registry, for example by comparing the information
gathered by the Windows APIs to that obtained via a direct read
of data using a driver.
8 - 	The tool must be capable of detecting floating code.
9 - 	The tool must be capable of remotely extracting the content
of the memory associated with a process. 
10 - 	The tool must have the capability of detecting the
following hooks and identifying the originating process of the
hook:
(i) Service table hooks
(ii) Inline hooks
(iii) IAT/EAT hooks
(iv) IDT hooks
(v) SYSENTER hooks
(vi) DKOM hooks
11 - 	The supplier must be able to provide the services of an
intermediate developer with a minimum of 24 months' experience
in Windows driver development.
12 - 	The supplier must be able to provide the services of an
intermediate developer with a minimum of 24 months' experience
in the development and/or integration of Windows malware
detection techniques.
13 - 	The supplier must be able to provide the services of a
project manager.

3.	Trade Agreements

This requirement is subject to the provisions of the Agreement
on Internal Trade (AIT).
Articles 506 12 (a) and (b) of the Agreement on Internal Trade
are invoked to recognize exclusive rights, such as exclusive
licences, copyright and patent rights; and where there is an
absence of competition for technical reasons and the goods or
services can be supplied only by a particular supplier and no
alternative or substitute exists. 

4.	Government Contracts Regulations Exception

Government Contracts Regulations, subsection 6 (d) "where only
one supplier can do the work" is being invoked for the contract
requirement.

5.	Ownership of Intellectual Property

Ownership of any Foreground Intellectual Property arising out of
the proposed contract will vest in the Contractor.

6.	Period of the Proposed Contract

The period of the Contract is from the date of contract award to
March 31, 2016, inclusive. The Contractor grants to Canada the
irrevocable option to extend the term of the Contract by up to 4
additional 1 year-period(s) under the same terms and conditions.

7.	Estimated Value of the Proposed Contract

The estimated value of the contract is $900,000.00, plus
GST/HST, for the portion of the work done on request via task
authorizations during the initial contract period (from the
start date of the contract until March 31, 2016, inclusive).

The contract will also include a sum (not disclosed) for the
purchase of a maximum of 100,000 additional and optional
licences for the software that include maintenance and support.
The purchase of licences is planned for the period between April
1, 2016, to March 31, 2020.

8.	Name and Address of the Pre-identified Supplier

Silicium Security inc.
1000, avenue St-Charles, suite 808
Vaudreuil-Dorion
Quebec, Quebec
J7V 8P5
Canada

9.	Suppliers' right to submit a statement of capabilities. 

Suppliers who consider themselves fully qualified and available
to provide the services and/or goods described herein, may
submit a statement of capabilities in writing to the contact
person identified in this notice on or before the closing date
of this notice. The statement of capabilities must clearly
demonstrate how the supplier meets the advertised requirements.

10.	Closing Date for a Submission of a Statement of Capabilities

The closing date and time for accepting statements of
capabilities is September 27th, 2012.

11.	Inquiries and Submission of Statements of Capabilities

Suppliers may inquire or send a statement of capabilities to:

Gabriel Piras
Suppy Specialist
Public Works and Government Services Canada
Acquisitions Branch
Quebec Region
601-1550 Avenue D'Estimauville
Québec, Qc, G1J 0C7
CANADA

Telephone:	418-649-2870
Facsimile:	418-648-2209
E-mail address: gabriel.piras@tpsgc-pwgsc.gc.ca

Delivery Date: Above-mentioned

You are hereby notified that the government intends to negotiate
with one firm only as identified above. Should you have any
questions concerning this requirement, contact the contracting
officer identified above.

An Advance Contract Award Notice (ACAN) allows departments and
agencies to post a notice, for no less than fifteen (15)
calendar days, indicating to the supplier community that it
intends to award a good, service or construction contract to a
pre-identified contractor. If no other supplier submits, on or
before the closing date, a Statement of Capabilities that meets
the requirements set out in the ACAN, the contracting authority
may then proceed with the award.  However, should a Statement of
Capabilities be found to meet the requirements set out in the
ACAN, then the contracting authority will proceed to a full
tendering process.

Suppliers who consider themselves fully qualified and available
to provide the services/goods described herein, may submit a
statement of capabilities in writing to the contact person
identified in this Notice on or before the closing date of this
Notice. The statement of capabilities must clearly demonstrate
how the supplier meets the advertised requirements.

The PWGSC file number, the contracting officer's name and the
closing date of the ACAN must appear on the outside of the
envelope in block letters or, in the case of a facsimile
transmission, on the covering page.

The Crown retains the right to negotiate with suppliers on any
procurement.

Documents may be submitted in either official language of Canada.