NTPC Limited

(A Government of India Enterprise)

EXPRESSION OF INTEREST (EOI)

FROM INDIAN FIRMS

FOR

DEVELOPMENT OF NTPC’S OWN

E-PROCUREMENT SOLUTION

NTPC Limited

Corporate Contracts & Materials

EOC Noida

Ref No. : CS-0011-791E-9

11.06.2020

Expression Of Interest (EOI) From Indian Firms For Development of NTPC’s own E- Procurement Solution.

				TABLE OF CONTENTS
				Part-I
	1.0		DISCLAIMER
	2.0		BACKGROUND
	3.0		PURPOSE OF THE EOI
	4.0		SCOPE OF WORK
	5.0		INFORMATION REQUIRED AS PART OF EOI
	6.0		INSTRUCTIONS TO THE APPLICANTS
	7.0		DEADLINE FOR SUBMISSION OF EOI
	8.0		SIGNATURE AND SUBMISSION
	9.0		RIGHT TO ACCEPT OR REJECT APPLICATION
				Part-II
PROFORMA				LETTER OF APPLICANT
ANNEXURE I				Company Profile
ANNEXURE II				Financial Information
ANNEXURE III				Implementation Methodology
ANNEXURE IV				Quality Assurance System/Certification
ANNEXURE V				Additional Information
ANNEXURE VI				Details Of Available Technical Manpower
ANNEXURE VII				Past Experience
ANNEXURE VIII				Acceptance of Fraud Prevention Policy

NTPC Limited

Corporate Contracts & Materials

EOC Noida

Ref No. : CS-0011-791E-9

11.06.2020

Expression Of Interest (EOI) From Indian Firms For Development of NTPC’s own E- Procurement Solution.

1.0DISCLAIMER

1.1NTPC, reserves the right not to proceed further, to change the process or procedure to be applied. It also reserves the right to decline to discuss further with any party expressing interest.

1.2No reimbursement of cost of any type will be paid to persons, entities, or consortiums expressing interest.

2.0BACKGROUND

NTPC is India’s largest power utility with an installed capacity of 62,110 MW (including JVs) comprising 24 coal based, 7 gas based, 1 Hydro 1 Wind 11 Solar and 1 Small hydro plant, plans to become a 130 GW company by 2032. Established in 1975, NTPC aims to be the world’s largest and best power major. NTPC has taken various digital initiatives which interalia includes implementation of SAP ERP, paperless office and e tendering mainly through SRM, GePNIC (Government E procurement NIC) and ETS portal for faster exchange of information, uniform business process, better control of operation, decision etc.

3.0PURPOSE OF THE EOI

3.1NTPC presently carrying out e tendering through GePNIC (Government E procurement NIC) portal for simple and low value tenders and SRM portal for large and complex tenders. In order to obviate the need of separate portals to deal with different requirement of tendering processes, NTPC desires to explore the possibility of developing comprehensive portal catering to the requirements of complete procurement cycle of both simple and complex packages from issuance of NIT to completion of Reverse/ forward Auction (wherever applicable) and its forward and backward integration with existing SAP ERP system of NTPC.

3.2NTPC invites ‘Expression of Interest’ (EOI) from all reputed Indian firms who have experience of successful design/ develop/customize/ implement e-tendering solutions or similar features type of software applications for industrial/Services /government sector. The details received in EOI shall be used to set the qualification criteria for agencies, Subsequently competitive bidding shall be carried out for selection of agency for development of NTPC’s own e procurement solution.

4.0SCOPE OF WORK

4.1 The e procurement portal should be able to cater following types of tenders:

NTPC Limited

Corporate Contracts & Materials

EOC Noida

Ref No. : CS-0011-791E-9

11.06.2020

Expression Of Interest (EOI) From Indian Firms For Development of NTPC’s own E- Procurement Solution.

(i)Single tender/Limited tender/Open Tender

Domestic Competitive Bidding/International Competitive Bidding

(ii)Tender in both Indian Rupees and Multiple currencies

(iii)Single Stage Single Envelope/ Single Stage Two Envelope/Two Stage Bidding

(iv)Reverse Auction /Forward Auction.

(v)Tenders of Rate Contract.

(vi)Tenders for Enlistment of agencies

4.2The e-procurement system shall be integrated with existing SAP-ERP system of NTPC to exchange various information related to tendering as forward and backward linkage.

4.3The retention of documents on portal shall be for a period of 15 years

4.4The system shall be designed for uploading of tender/bid upto 500 MB size.

4.5The e procurement portal should handle approx. 18 to 20 thousand tenders per annum

4.6The e-procurement system should cater the requirements of complete procurement cycle from issuance of NIT to completion of Reverse/ forward Auction along with bucket filling, dynamic/ static loading as applicable.

4.7It should have functionality for payment of Tender fee, Bid Security (ie Earnest Money Deposit) as per instructions of the Buyer, either online at the time of online bid‐submission (subject to the payment limits of the Payment Gateway), or payable offline parallel to the online bid‐submission before the bid‐submission deadline.

4.8It should have functionality for recording important milestones of Contract Execution which would include submission of Performance Security by the successful bidder(s).

4.9NTPC in future may also allow other organizations to use this e procurement portal for tendering. According, the portal should have system provisions to enable tendering by users of other organizations.

4.10The e-Procurement/ e-tendering solution to be designed/ developed and implemented for NTPC Limited should be fully compliant with DeitY- Guidelines dated 31-08-2011. In order to conform to the quality requirements of e-procurement solution, bidder shall get the e-procurement system audited & certified by STQC & obtain STQC Compliance certificate.

NTPC Limited

Corporate Contracts & Materials

EOC Noida

Ref No. : CS-0011-791E-9

11.06.2020

Expression Of Interest (EOI) From Indian Firms For Development of NTPC’s own E- Procurement Solution.

Salient features based on DeitY-Guidelines are as follows: (Applicants may refer the Deity Guidelines for details):

i)Fully Compliant with IT Act 2000 (and its Amendment 2008) and CVC Guidelines.

ii)Implementation of Bid Encryption at Client End (i.e. Bidder’s Computer) using symmetric key or asymmetric key (PKI based).

iii)Bids before transmission from Bidder’s computer should be protected with SSL Encryption.

iv)E-procurement system should deploy PKI based technologies for authenticating the bids & opening electronic tender box. Secure methodology for decrypting the bids should be deployed corresponding to encryption methodology deployed (viz. Symmetric or PKI based asymmetric).

v)E-procurement Application should have audit trail facilities.

vi)E-procurement system should not provide read access to password to the Administrator. E-procurement system further should not have “forgot password” feature which provides administrator generated or system generated temporary password. Once password is forgotten, a new password may be allotted following a set of processes needed for allotment of password.

vii)E procurement application should have provisions of ensuring validation of PKI signature through Certificate revocation list and validity of certificate.

viii)Time stamping facility should be there in the e-procurement application for time stamping of all important events like – creation of tender notice, approval of tender notice/tender documents, submission of bids & supplementary bids.

ix)Opening of the bids in the simultaneous online presence of the bidders with proper online attendance record of the authorized representatives of the bidders. Merely opening bids online, and then subsequently displaying some results to the bidders does not fulfil the requirements of a transparent Online Public Tender Opening Event. While bidders should be welcome to be present physically during the TOE, it should not be mandatory for them to do so. All the above should be achieved online in a user friendly manner.

x)Security Checks to assure bidders of non‐tampering of their bids, et al during the online TOE itself.

xi)One‐by‐one opening of the sealed bids in the simultaneous online presence of the bidders.

xii)Online verification of the digital signatures of bidders affixed to their

NTPC Limited

Corporate Contracts & Materials

EOC Noida

Ref No. : CS-0011-791E-9

11.06.2020

Expression Of Interest (EOI) From Indian Firms For Development of NTPC’s own E- Procurement Solution.

respective bids

xiii)The audit for certification of the entire e-procurement solution shall be undertaken from STQC after its deployment & prior to its usage .

4.11Scope of IT Infrastructure

1.The scope involves supply , installation , commissioning , monitoring and maintenance of all IT hardware and software necessary for the solution.

2.The Infrastructure can be provided in two options

Option 1

i)All the hardware needed but not limited to Servers, Storage, Network equipments, Load balancer, backup devices etc shall be supplied, installed, commissioned and maintained in both DC and DR .

ii)All the software and software licenses needed but not limited to Operating System, application software, databases, backup, replication, load balancer etc shall be supplied, installed, commissioned and maintained in both DC and DR.

iii)Data replication for all databases will be done between DC and DR and necessary tools for replication and monitoring shall be supplied,installed , commissioned and maintained .The RPO will be 15 minutes and RTO 6 hours

iv)There will be no single point of failure in the solution .

v)The infrastructure will be supplied , installed, commissioned and maintained with a warranty for a period of 6 years.

vi)The bidder to carry out the sizing of the hardware and software required for the solution.

vii)The complete system will be maintained with 99.5 % availability throughout the period of the contract.

Option 2

i)All the hardware needed but not limited to Servers, Storage , Network equipments , Load balancer, backup devices etc shall be supplied, installed, commissioned and maintained in a private cloud

ii)All the software licenses needed but not limited to Operating System , application software, databases , backup ,replication , load balancer etc shall be supplied ,installed, commissioned and maintained in a private cloud.

NTPC Limited

Corporate Contracts & Materials

EOC Noida

Ref No. : CS-0011-791E-9

11.06.2020

Expression Of Interest (EOI) From Indian Firms For Development of NTPC’s own E- Procurement Solution.

iii)The bidder shall be responsible for the tie up with the cloud service provide for a period of at least 6 years. The cloud service provider shall be MEITY certified with data centre in India.

iv)There will be no single point of failure in the solution.

v)The bidder will carry out the sizing of the hardware and software required for the solution to be hosted in the private cloud

vi) The complete system will be maintained with 99.5 % availability throughout the period of the contract.

vii)All the necessary steps to ensure security of data will be carried out by the bidder.

viii)The bidder shall provide the details of the back to back agreement of the tie up with cloud service provider.

ix)The bidder shall clearly provide the exit plan from the cloud service provider. The bidder will be responsible for migration, installation and commissioning of the system, in case of change of service provider, to the new cloud service provider.

5 INFORMATION REQUIRED AS PART OF EOI

5.1Prospective parties are required to submit the information as mentioned below along with their EOI in the attached Formats:

•Company profile

•Annual Report including Balance sheets for last five years.

•Past Experience details.

•Implementation methodology

•Financial Capability

•Quality Assurance System/Certification

•Qualification and Experience of Technical & skilled manpower

•Any other relevant information in this regard.

6 INSTRUCTIONS TO THE APPLICANTS

6.1All costs incurred by Applicant for preparing and submitting the EOI, in providing clarification or attending discussion/ meeting or for site visits, stationery, or any other expenses whatsoever shall be borne by Applicant’s themselves.

6.2This Expression of Interest document is not transferable.

6.3The language for submission of document shall be English.

NTPC Limited

Corporate Contracts & Materials

EOC Noida

Ref No. : CS-0011-791E-9

11.06.2020

Expression Of Interest (EOI) From Indian Firms For Development of NTPC’s own E- Procurement Solution.

6.4The enclosed Annexures shall be filled in completely and wherever not applicable it should be written as “Not Applicable”.

6.5The person signing the document submission on behalf of the Applicant shall enclose Power of Attorney duly authorized and notarized for the same. The Power of Attorney shall be backed by copy of the board resolution of Company.

6.6Financial data should be given in Indian Rupees only.

6.7The information furnished with the EOI must be sufficient for processing and assessment.

6.8In case the Applicant intends to give additional information for which specified space in the given format is not sufficient, it can be furnished in enclosed sheets.

6.9All the pages of the EOI and Annexure should be signed and corrections and over writings should be countersigned by the authorized signatory.

6.10NTPC reserves the right to cross check and confirm the information details furnished by the Applicants in the document.

7 Deadline for Submission of EOI

7.1EOI must be submitted through email no later than 15:00 Hrs 02.07.2020. EOI received after aforesaid deadline shall not be entertained.

NTPC may, at its discretion, extend this deadline for submission of EOI in which case all rights and obligations of Employer and applicant will thereafter be subject to the deadline as extended.

8 SIGNATURE AND SUBMISSION

8.1All the Applications must be submitted duly signed by the Applicant under the format for the letter of application which is provided along with this document.

8.2The signed proposal along with all the documentary evidences and with all the Annexures filled and signed must be submitted through email on or before the prescribed date and time as per details given below:

DGM (Contract Services)

NTPC Ltd, Engineering Office Complex,

A-8A, Sector 24, NOIDA

Distt. Gautam Budh Nagar, U. P., PIN: 201 301

Tel.No : 9479496797 , 9650992301

Email: vipinsharma01@ntpc.co.in , abhishekjain02@ntpc.co.in

NTPC Limited

Corporate Contracts & Materials

EOC Noida

Ref No. : CS-0011-791E-9

11.06.2020

Expression Of Interest (EOI) From Indian Firms For Development of NTPC’s own E- Procurement Solution.

8.3NTPC may seek additional information from interested parties who respond to this EOI. However, NTPC reserves the right of not acting upon the EOI or asking for fresh EOI at a later date.

8.4Prospective parties may note that mere submission of EOI and/or submission of additional information do not automatically entitle them to claim for qualification. NTPC at its sole discretion may invite or modify or annul the process without assigning reason whatsoever.

9 RIGHT TO ACCEPT OR REJECT APPLICATION

9.1Not withstanding anything contained in this EOI, NTPC reserves the right to accept or reject any Application and annul the process and reject all Applications at any time without any liability or any obligation for such acceptance, rejection or annulment without any reasons.

(to be submitted by the agency on the Company’s Letter Head)

DGM (Contract Services)

NTPC Ltd, Engineering Office Complex,

A-8A, Sector 24, NOIDA- 201 301

(Applicant to Provide Date and Reference)

Dear Sir,

Sub: LETTER FOR APPLICATION – EXPRESSION OF INTEREST (EOI) FOR ‘DEVELOPMENT OF NTPC’S OWN E-PROCUREMENT SOLUTION

We, the undersigned, express our interest for the subject EOI and declare the following:

(a)We are duly authorized to represent and act on behalf of ________________

(hereinafter the “Applicant”)

(b)We have examined and have no reservations to the EOI Document including Amendment No(s) & Clarification No(s) __________________(if any).

(c)We are attaching with this letter, the documents defining: -

i)the Applicant’s legal status;

ii)its principal place of business; and

iii)its place of incorporation (if Applicants are corporations); or its place of registration (if Applicants are partnerships or individually owned firms).

(d)With reference to your invitation for EOI dated ________, we are furnishing herewith all the required details as per the prescribed formats along with the necessary documentary evidence in support of our Application.

(e)NTPC and/or its authorized representatives are hereby authorized to conduct any inquiries or investigations to verify the statements, documents and information submitted in connection with this application, and to seek clarification from our bankers and clients. This Letter of Application will also serve as an authorization for any individual or authorized representative of any institution referred to in the supporting information, to provide such information deemed necessary and as requested by NTPC.

(f)NTPC and/or its authorized representatives may contact the following nodal persons for further information on any aspects of the Application:

Name	ADDRESS	Telephone	E Mail

(g)This application is made in the full understanding that:

i)EOI process will be subject to verification of all information submitted at the discretion of NTPC.

ii)NTPC reserves the right to reject or accept any or all applications, cancel the EOI process without any obligation to inform the applicant about the grounds of same; and

iii)Mere submission of EOI and/or submission of additional information do not automatically entitle us to claim for qualification/enlistment.

(h)We declare that we have read and abide by the provisions of Fraud Prevention Policy of NTPC and submit the form of Acceptance of Fraud Prevention Policy duly filled in Employer’s format.

(i)We declare that we have not engaged any agent or middleman for this EOI process or any other part of the tendering process arising from it. We have not paid / will not be paying any commissions, gratuities or fees with respect to the ongoing EOI process.

(j)The undersigned declare that the statements made and the information provided in the duly completed application are complete, true, and correct in every detail. We also understand that in the event of any information furnished by us being found later on to be incorrect or any material information having been suppressed, NTPC may delete our name from the list of qualified Applicants:

NAME

In the Capacity of

Signed

Duly authorized to sign the Application for and on behalf of

Date

ANNEXURE -I

PAGE 1 of 2

(COMPANY PROFILE)

Agency’s Name & Address:	To:
	Dy. General Manager (CS),
	NTPC Ltd., Engineering Office Complex,
	6th Floor,A-8A, Sector-24, NOIDA – 201301,
	U.P., INDIA
Dear Sirs,
We are furnishing the company profile, in brief:

1.Name of the company / firm / organization

2.Postal address for communication

3.Contact Person & Designation :

E-mail address	:
Telephone No.	:
Mobile No.	:
Fax No.	:

4.Business Profile of the company (Enclosed)

5.Ownership structure of the company

6.Brief profile of the Board members/ Partners

ANNEXURE -I

PAGE 2 of 2

7.Following certificates as relevant are enclosed:

Certified Photocopy of the Partnership Deed, with upto date amendments (if any) (YES/NO)

Copy of Memorandum and Article of Association of Company duly certified as ‘True Copy’ by Company’s Secretary with Company seal. (YES/NO)

Copy of Firm Registration Certificate issued by the Registrar of Companies Concerned (YES/NO)

Copy of Certificate of Incorporation of the Company. (YES/NO)

Power of Attorney executed by Competent Officer under the common seal of the Company duly authorizing the signee to submit ‘Expression of Interest’ (YES/NO)

Date :	Signature	……………………………
Place:	Name	………………….…………
	Designation	……………………………
	Common Seal ……………………………

ANNEXURE -II

PAGE 1 of 2

(DETAILS OF FINANCIAL STATUS)

Agency’s Name & Address:

To:

Dy. General Manager (CS),

NTPC Ltd., Engineering Office Complex,

6th Floor,A-8A, Sector-24, NOIDA – 201301,

U.P., INDIA

Dear Sirs,

A)Please furnish the following financial figures in Rupees for preceding five financial years:

Item	FY 2019 FY 2018 FY 2017 FY 2016 FY 2015
Gross Turnover
Profit before Tax
Profit after Tax
Net Worth

B)Annual Reports including Balance Sheet and Profit & Loss Account duly Certified by

a Chartered Accountant for the preceding 5 financial years is to be submitted.

Enclosed at Appendix : ----

ANNEXURE -II

PAGE 2 of 2

D)Details of all pending court/arbitration cases of the applicant as on 31.03.2020

1)Number of cases:_________________________

2)Aggregate value of claims/disputed amount on account of such cases (in Rs. Cr.):____________________

Date :	Signature	……………………………
Place:	Name	………………….…………
	Designation	……………………………
	Common Seal ……………………………

*Please specify the foreign exchange rate considered for the conversion purpose.

**If the financial year of accounting for a agency is other than April to March, the facts may accordingly be mentioned based on its accounting year clearly bringing out the period.

Note : Continuation sheets of same size and format may be added

ANNEXURE -III

PAGE 1 of 1

IMPLEMENTATION METHODOLOGY FOR DEVELOPMENT OF E PROCUREMENT SOLUTION

(If required , applicants can be asked for a Presentation / discussion wrt scope of work and past experiences and implementation methodology)

Agency’s Name & Address

To:

Dy. General Manager (CS),

NTPC Ltd., Engineering Office Complex,

6th Floor,A-8A, Sector-24, NOIDA – 201301,

U.P., INDIA

Dear Sirs,

We hereby furnish the following details: (use additional sheets if required)

------------------------------------------------------------------------------------------------------------

Sl	Event	Timeline ( Months)	Details
No.
1	Design
2	Development
3	Testing
4	Rollout
5	STQC certification
6	Any other

Overall

------------------------------------------------------------------------------------------------------------

Date :	Signature	……………………………
Place :	Name	………………….…………
	Designation	……………………………
	Common Seal …………………………..

ANNEXURE -IV

PAGE 1 of 1

(QUALITY ASSURANCE SYSTEM/CERTIFICATION)

Agency’s Name & Address:

To:

Dy. General Manager (CS),

NTPC Ltd., Engineering Office Complex,

6th Floor,A-8A, Sector-24, NOIDA – 201301,

U.P., INDIA

Dear Sirs,

We hereby furnish the following details:

------------------------------------------------------------------------------------------------------------

------------------------------------------------------------------------------------------------------------

Date :	Signature	……………………………
Place :	Name	………………….…………
	Designation	……………………………
	Common Seal …………………………..

ANNEXURE -V

PAGE 1 of 1

(ADDITIONAL INFORMATION SCHEDULE)

Agency’s Name & Address:

To:

Dy. General Manager (CS),

NTPC Ltd., Engineering Office Complex,

6th Floor,A-8A, Sector-24, NOIDA – 201301,

U.P., INDIA

Dear Sirs,

We hereby furnish the following additional information:

------------------------------------------------------------------------------------------------------------

------------------------------------------------------------------------------------------------------------

Date :	Signature	……………………………
Place :	Name	………………….…………
	Designation	……………………………
	Common Seal …………………………..

ANNEXURE -VI

PAGE 1

	(DETAILS OF AVAILABLE TECHNICAL MANPOWER)
Agency’s Name & Address:	To:
	Dy. General Manager (CS),
	NTPC Ltd., Engineering Office Complex,
	6th Floor,A-8A, Sector-24, NOIDA – 201301,
	U.P., INDIA
Dear Sirs,

1.0The details of the technical manpower in different areas on rolls with us are as under:

(a)Total technical manpower on rolls with us (with qualification details) are as under

Technical Manpower	Nos.
Post Graduate/Post Graduate diploma in
Engineering/IT
MCA
Graduate in Engineering/IT
Diploma in Engineering/IT
BCA
Any other specialized degree not covered
above

(b)The experience details of the above technical manpower on rolls with us in different areas are as under:

Sl.	DESCRIPTION		No. of Technical Personnel
No.		Experience 0-5	Experience	Experience	Experience
		Years	>5 to 10	>10 to 15 Years	more than 15
			Years		Years
1	Team Leader/Project Managers (>= 10 years)	-	-

2Other areas (To be mentioned by Bidders)

3

4

5

..

….

….

2.0We confirm that we have appropriate qualified manpower required to undertake the subject work . The details of the individual technical manpower on rolls with us are as under:

Sl.	Qualification	Total	Area of specialization	Any other
No. Name Designation No. of	(Pl. specify Post	Experience in		Information
years	Graduate/Deg./Diplom	years
with the	a or any other degree
current	and name of
company	University)

Note: 1) Use additional sheets with above format, if required.

2) Agency to furnish details of only those personnel who are on the rolls of the company for one or more than one year.

Date :	Signature	……………………..………
Place:	Name	…………………………….
	Designation	……………………………
	Common Seal	…………………………

ANNEXURE VII

Page 1 of 1

Agency's Name & Address:	To,
	DGM (CS)
	NTPC Limited, Engineering Office Complex,
	Plot No. A-8, Sector-24, NOIDA-201301
	Distt. Gautam Budh Nagar (U.P.)

Details of works related to e-procurement solution designed/ developed/customized/executed or similar works during last 10 years is as given below:

Sl.

Name of

Order No. &

Brief

Total

Total

Worked as

Whether

Client

Time

Schedule

Remarks

No.

Package/

Date

Scope of

Value as

Value of

Main

work

Certificate

Date of

Date of

Project/

Work

awarded

work

Contractor

executed

Enclosed

commencement

completion

Owner/Client,

( Rs. in

completed

to the

in-house /

(Yes/No)

Sch.

Act.

Sch.

Act.

name of

lakh) *

as on

Owner/

through

person &

31.03.2020

sub-

sub-

address of

( Rs. in

contractor

contractor

contact

lakh)

(area of

sub-

contracting)

(a)

(b)

(c)

(d)

(e)

(f)

(g)

(h)

(i))

(j)

(k)

(l)

(m) (n)

Note: The work which is completed in the last ten (10) year period specified above even if it has been started earlier, the same may also be considered.

Date	:	(Signature) ………………………………………………….
Place	:	(Print Name of Authorized person having Power of
		Attorney) …………………………………………………….
		(Designation) ……………………………………………….
		(Common Seal of firm) …………………………………….

ANNEXURE -VIII

PAGE 1 of 1

(FORM OF ACCEPTANCE OF FRAUD PREVENTION POLICY)

Agency’s Name & Address:	To:
	Dy. General Manager (CS),
	NTPC Ltd., Engineering Office Complex,
	6th Floor,A-8A, Sector-24, NOIDA – 201301,
	U.P., INDIA

Ladies and / or Gentlemen,

We have read the contents of the Fraud Prevention Policy of NTPC displayed on its tender website http://www.ntpctender.com and undertake that we along with our associate/ collaborator / subcontractors/subvendors/ consultants/service providers shall strictly abide by the provisions of the Fraud Prevention policy of NTPC.

Yours faithfully,

Date :	Signature	……………………………
Place:	Name	………………….…………
	Designation	……………………………
	Common Seal ……………………………

Guidelines for compliance to

Quality requirements of eProcurement Systems

STQC Directorate

Department of Information Technology,

Ministry of Communications & Information Technology,

Electronics Niketan, 6 CGO Complex, Lodhi Road,

New Delhi – 110003

Dt: 31.08.2011

CONTENTS

1.0Introduction

2.0Operating Models of eProcurement System

3.0Specific requirements of eProcurement System

4.0Requirements of Conformity

5.0Testing framework for Quality and Security Characteristics

6.0Evaluation & Certification process

Annexures

Annexure‐I : Risks of eProcurement Systems and related ISO 27001 controls

Annexure‐II : Checklist for eSecurity Compliance (including CVC Guidelines)

Annexure‐III : Checklist for compliance to GOI procurement procedures (GFR)

Annexure‐IV : Checklist for legal compliance (IT Act – Amendment 2008)

Annexure‐V : Definitions and Reference Documents

Reference documents:

1.eTendering Process

2.eTendering Glossary

3.eProcurement Integrity Matrix

4.OWASP (Open Web Application Security Project) Top10 Application Security Risks‐ 2010

5.Business requirements specification‐ cross industry e‐Tendering process (Source CWA 15666)

Forms & Templates:
Template I	: Template for defining Usability Requirements Specifications of
	the Software product
Template II	: Template for Performance Specification
Form I	: Application form for applying for Testing to STQC

2

1.0Introduction

1.1Background

The public sector is one of the biggest purchasers of goods & services in the economy. The Government of India acknowledges that automating procurement process using electronic tools/techniques and enabling opportunities to suppliers fully supports the objective of non‐discrimination, fair & open competition. eProcurement is identified as a mission mode project under national eGovernance plan. The objective is to transform public sector purchase activity from labor intensive paper based to efficient eProcurement process.

Electronic Procurement (eProcurement) is the use of Information and Communication Technology (specially the Internet) by the buyer (in this case Government) in conducting their procurement processes with supplier for the acquisition of goods (supplies), works and services. Use of Information Technology promotes the aims of open, non‐discriminatory and efficient government procurement through transparent procedures.It is the technology‐enabled acquisition of goods and services, required by an organisation, at the best value obtainable in the most efficient manner possible.

The factors driving the adoption of eProcurement are:

∙Reduced purchasing cost and improved efficiency

∙Standardized purchasing processes across the organization

∙Reduced administrative costs with better effectiveness

∙Significant reduction in the procurement cycle

∙Reduced discretion

At the same time the inhibitors to adoption are:

∙Lack of supplier readiness

∙System integration issues (compatibility and interoperability)

∙Confidence on the system (Security, Functionality and Performance)

∙Insufficient skilled staff

eProcurement involves a set of technology solution which concentrate on different key areas of procurement such as

∙e‐Tendering,

∙e‐Auction or Reverse Auction,

∙e‐Catalogue/Purchasing,

∙eMarket Place,

∙e‐Invocing etc.,.

The focus of the current Guidelines is mainly on e‐Tendering, (i.e. tendering with encrypted bids, the equivalent of which in the manual context would be ‘sealed bids’).

This document provides the guideline for compliance to quality requirements of eProcurement systems. The essential quality characteristics of eProcurement system cover Security, Transparency & Functionality.

3

1.2General Requirements of eProcurement System

The basic requirements of any eProcurement system are to achieve the goal of Government procurement, standardisation of procurement processes and information entities in an efficient and transparent way. Hence the key requirements are to:

∙Address the requirement of GFR

For public procurement of goods, services, works (e.g. construction) compliance with GFR rules, processes, roles (purchasing officer, local purchasing committee etc) are mandatory requirements. The GFR rules needs to be applied into the application workflow of e‐tendering process. eProcurement System should be designed as per defined workflow with adequate security measures.

∙Confidentiality and Integrity of Information

The key requirement of procurement in public service organisation is to maintain the confidentiality & integrity of the information in procurement life cycle to protect the interest of buyer & supplier and to encourage the competitiveness in the business. The e‐procurement platform transacts confidential procurement data and is exposed to several security threats. This requires employing a combination of security technologies and security best practices which result in reduced threat of data loss, leakage or manipulation.

∙Address Vigilance Guidelines

The system should meet the requirements of guidelines issued from time to time by Central Vigilance Commission.

∙System Adaptability & customisation

eTendering System need to have templates to offer flexibility in bidding methodologies as prevailing and followed currently in the manual process. Further, system should have templates to adopt bidding methodologies as may be prescribed by respective authorities.

The aim of this document is to provide guidelines that could be followed for designing/developing some critical functionality in an e‐Procurement system as well as the necessary process for monitoring adherence to the security and transparency requirements of an e‐procurement system during the implementation and post implementation by the e‐procurement application developers, service providers and other stakeholders.

1.3Objective

To provide Guidelines for assuring Quality and Security of an e‐Procurement system so that confidence can be provided to its stakeholders that the system is secure, transparent, auditable & compliant with government procurement procedures.

1.4Target Audience

∙Purchase/ Head of Public Service Organization

∙eProcurement Service Provider

∙eProcurement Solution Provider/ Application Developer

∙Third Party Testing and Audit Organization

4

1.5.Approach

To achieve the above objective the following approach is recommended.

∙Evaluation of eProcurement System (including data, software, hardware, network, process) to ensure

−Correct & complete implementation of organisation procurement policies & procedures

−Compliance to GFR rules, CVC guidelines, IT Act (including amendments)

−Assuring Security by Design & Development (ie some critical security and transparency related functionality has to be built into the e‐procurement software application) , Implementation, Deployment & Use

−Security of Data Storage and Communication

−Performance

−Usability

−Interoperability

∙Identification of risks and concerns of e‐procurement system & providing the guidelines for mitigating the identified risks.

2.0Operating Models of eProcurement System

There are four operating models for eProcurement (Reference doc – 1)

i)Dedicated e‐Procurement System: the Government organization wishing to do e‐ Procurement, owns and controls the system infrastructure, and also controls all the procurement activities carried out.

ii)Outsourcing Model‐1 (Partial Outsourcing – Managed Services): The Government organization procures and owns the system, which is managed by service provider with adequate security controls. There is a risk that service providers may get access to vendor data. Issues relating to Official Secrets Act shall be considered for this model.

iii)Outsourcing Model‐2 (Partial Outsourcing – Infrastructure Support): The Government organization uses the eProcurement system of a Service Provider. The Service Provider also owns and controls the infrastructure. There is a risk that service providers may get access to vendor data & service provider start participating in core procurement process, Issues relating to Official Secrets Act shall be considered for this model.

iv)Outsourcing Model‐3 (Full Outsourcing (ASP) Model): Multiple Government organizations can register and themselves use the ASP’s portal for their various e‐tendering/ e‐auction activities with complete control of the all the ‘core tendering activities’ in their hands, without any intervention from the service provider. The registration/ deregistration activities, and the portal infrastructure is managed by the service provider with adequate security controls. In this case, essentially the Service Provider is only a platform‐provider. The powers and responsibility of the tendering process remains in the hands of the duly authorized officers of the government organizations, and does not get transferred to third party service providers as in ‘Outsourcing Model‐2 (Full Outsourcing)’. So while there is some outsourcing in respect of infrastructure, there is no outsourcing of the actual tendering/ procurement activities by the concerned user‐Government organizations.

5

All models of e‐procurement system must incorporate functionality, processes and technologies outlined in (Annexure I, II, III and IV), and especially apply countermeasures to mitigate known risks (Annexure‐I)

3.0Specific requirement of eProcurement System

3.1The service provider in consultation with the Purchase Officer shall establish the following process:

∙Business Process Re‐engineering switching from Manual Procurement to eProcurement. (Since Government tendering processes falls within a standard framework, only limited options should be given to the Purchase Officer. The service Provider/ Purchase Officer should not be able to reduce the essential security and transparency aspects of the system on the pretext of re‐engineering and customization]).

∙Implementation of Bid‐ Encryption at client‐end (ie bidder’s computer) using Symmetric Key, or Asymmetric Key (PKI‐based) subject to issues raised in Annexure‐I and II being suitably addressed

∙Bids before transmission from the bidder’s computer should be protected with SSL Encryption.

∙Functionality/ Security/ Transparency related Requirements of a Manual Tendering System and Conformance its Availability in the Offered eProcurement system (functionality requirements of GFR & CVC guidelines)

∙eProcurement System must have templates to offer flexibility in bidding methodology as prevailing and followed currently in the manner of processing. Further, the system should have templates to adopt bidding methodology as may be prescribed by the purchaser, as long as the methodology is a legally acceptable methodology.

∙eProcurement System should deploy PKI based technologies for authenticating the bids, and opening electronic tender box. Secure methodology for decrypting bids should be deployed corresponding to the encryption methodology deployed (viz symmetric, or PKI‐based asymmetric). The entire IT hardware infrastructure of E‐Procurement System which includes application software, hardware, and system software be hardened as relevant. The system must deploy anti‐spyware and anti‐spam with a provision to update regularly. The updation of these software on the E‐Procurement System be done using the offline updation mode. The E‐Procurement System must have software tools to protect the operating system from injection of spyware. The entire infrastructure be protected and secured at the perimeter level by installing firewalls and Intrusion Prevention System. The system be configured properly so as to detect any kind of Intrusion into IT system.

∙eProcurement System can be further secured by installing suitable security incident and event management mechanisms SIEM (Security Incident Event Management).

∙eProcurement application should have audit trail facilities.

∙The PKI Key Management System for authenticating the bids or other purposes must specify the holder of private key and public key. The procedure in this case may be prescribed.

∙eProcurement System should not provide read access to password to the Administrator. E‐Procurement System further should not have “forgot password” feature which provides administrator‐generated or system‐generated temporary password. Once the password is forgotten, a new password may be

6

allotted following a set of processes needed for allotment of password. The forget password request shall be digitally signed.

3.2The Purchase Officer of a Public Service Organisation (Government Department) must to ensure that e‐Procurement system which he intends to use complies with all the applicable requirements listed in Sections 3 and 4.

3.3The Purchase Officer must analyse the risk arising out of establishment of above mentioned processes and apply suitable controls. The annexure I,II,III and IV may be followed

3.4Escrowing of Source Code

The source code of the e‐procurement application software along with the modification/changes/patches which is implemented by the agency from time to time shall be escrowed with the agency nominated by the user organizations or government in case of dedicated portals.

An MOU would be entered between purchase officer/ purchase‐organization and service provider.

4.0Requirements of Conformity

4.1eProcurerement systems must address:

∙E‐procurement application should have provisions of ensuring validation of PKI signature through Certificate revocation list (CRL) and validity of certificate.

∙Shall have mechanism for time synchronisation by using time synchronisation service (TSS) at hosting level, or synchronisation with master‐server at the data‐ centre where the e‐procurement system is hosted

∙Time Stamping [facility should be there in the e‐procurement application for time‐stamping of all important events like – creation of tender notice, approval of tender notice/ tender documents, submission of bids and supplementary bids (like modification, substitution, alternatives), etc]

∙The system must confirm to GFR rules, processes, roles (purchasing officer, local purchasing committee etc.), compliance to CVC guidelines and Information Technology Act (including amendments) and other laws of the land as applicable.

4.2Other Requirements for Quality and Security Evaluation

:

The following conditions shall be agreed in writing by service provider

∙For Dedicated portal and ASP‐Model, the e‐procurement application should have facility for generating audit‐logs, which should be accessible (in downloadable such form) to a specially designated officer of the Purchase organization. For Outsourcing Models 1 and 3, e‐procurement service provider shall submit all the logs of transaction created by the e‐procurement solution including forensic image on quarterly basis or as prescribed by the user organization regularly and as and when demanded by the purchasers. The logs will be duly signed by the administrator of the service provider by his electronic signature.

∙The audit for certification of the entire e‐procurement solution shall be undertaken after its deployment and prior to its usage.

∙The e‐procurement solution including the computer server shall be installed in India. No data as captured/stored in the e‐procurement solution will be taken

7

out of India. However, bidder outside India should be able to quote and download permitted data/information.

∙The audit of the ‘ complete e‐procurement system’ shall be undertaken only on the request of the organization/agency who wish to use/install the system. Software application can be tested based on the request of the developer.

∙The e‐procurement solution shall need to be tested and audited again after it has been significantly modified (addition/ deletion of functions/ modules) or customized for a new organization whether stand alone or shared mode

∙The traffic emanating to and from eProcurement systems will be scanned if required by the authorised body. The traffic (netflow) emanating to and from eProcurement System may be provided to CERT‐IN.

Storage of Electronic Invoices

∙It is assumed that invoices transmitted electronically will be stored electronically. If public service organisation wish to store invoice in the paper form, same shall be provisioned in local purchase procedure approved from competent authority

∙For VAT purpose records must be retained for years as provided in the respective Act.

∙The records may be stored anywhere State Data Centre/PSU own data center. The only requirement is that of security, strategic control and record must be made available to public service organisation on demand within two working days.

8

5.0Testing framework for Quality and Security Characteristics

5.1eProcurement Quality and Security Assurance Model

A eProcurement Quality and Security Assurance Model is depicted below:

The Quality & Security evaluation model consist of four layers namely, Data, Application, Infrastructure and Process. Layer by layer assessment will ensure compliance with applicable requirements such as CVC, IT Act, GFR 2005 and concerns of other stakeholders.

5.2Description of the model

Brief description of the layers (from outermost to inner) is given below.

∙Process‐Layer

ISO 27001 Process Audit #

Verification of the IT security processes to ensure that secure and best practices are followed in operation and maintenance of the e‐Procurement System in line with international standard on Information Security Management System, ISO 27001/27002

To supplement the functionality built into the e‐procurement system, where some requirements of the e‐procurement system and allied processes are being addressed through organizational procedures under ISO 27001/ 27002, these should be explicitly defined with satisfactory explanations. At the time of certification/ audit, such procedures as outlined by the e‐procurement vendor / service provider in response to Annexure‐I , II, III of these Guidelines, shall be reviewed and evaluated.

Monitoring against agreed SLAs #

SLA monitoring shall ensure that the e‐procurement system is adhering to the agreed upon service related (i.e., user centric) as well as system related (i.e.,

9

technology centric) service quality requirements such as availability, performance, problem resolution, etc. While service related SLAs take care of the services delivery issues, the system related SLAs address IT technology (hardware, software and network) used in delivering the services.

∙Infrastructure Layer Architecture Review #

The review of e‐procurement system shall be done to ensure that the defined architecture of the e‐procurement system is adequate and suitable for meeting the various operational and service delivery requirements such as performance, security, availability, etc.

It is also recommended that once the e‐procurement system is deployed, the deployed architecture should be audited to verify its compliance against the defined architecture. The audit should cover logical positioning of various system components such as firewall, IDS/IPS, servers, load balancer, etc. In addition, end‐ to‐end transaction flows should be verified to ensure that they are going through the defined path by using dummy test transactions and analysis of logs at various layers. Certification body shall use standardized checklist for the criteria.

Vulnerability Assessment (Servers & Network Devices) #

System configuration checking or verification of hardening and vulnerability scanning shall be performed to find out weaknesses, vulnerabilities and mis‐configuration in the target hosts (Servers, Routers, Firewalls, Switches etc.) which hosts the e‐ procurement application system. Certification body shall use standardized checklist for the criteria.

Penetration Testing of the System #

Penetration Testing (PT) shall be normally done remotely from public domain (Internet) and also can be done from internal network to find out exploitable vulnerabilities. Series of testing conducted like information gathering from public domain, port scanning, system fingerprinting, service probing, vulnerability scanning, manual testing, password cracking etc. using state‐of‐the‐art tools (commercial and open source) and other techniques shall be used with the objective of unearthing vulnerabilities and weaknesses of the overall e‐procurement system and its underlying IT infrastructure. Certification body shall use standardized checklist for the criteria.

Performance Testing of the System #

Performance testing of the e‐procurement system shall be done to ensure that system is capable of handling defined user as well as transactional load. The performance testing of the e‐procurement system essentially means measuring the response time of the system for defined scenarios. While measuring the response time it is important to record the resource (CPU, Memory, etc.) utilization. The capacity of the e‐procurement system should be checked by systematically increasing the load on the system till performance degradation or system crash is encountered. Also the manner/ trend in which performance changes with load will determine the scalability of the e‐procurement system.

10

∙Application Layer Application Design Review #

(Note: This would be applicable only where ‘customized software development’ is being done for a specific organization. Furthermore, it should be noted that this review would not be a substitute for the review and testing of critical security and functionality outlined in Annexures I, II and III of these Guidelines)

Design review covers the high level design and the low level (detailed) design of the e‐ procurement software application. It will ensure that software has been designed using best practices and design rules. The review will verify that the design has modularity, flexibility, low complexity, structural fan‐in & fan‐out and it is loosely coupled & highly cohesive. The correctness of logics and algorithms used in the detailed design should be verified including any zero day vulnerability in the algorithm.

Application Code review *

(Note: This would be applicable only where ‘customized software development’ is being done for a specific organization. Furthermore, it should be noted that this review would not be a substitute for the review and testing of critical security and functionality outlined in Annexures I, II and III of these Guidelines)

The code review (i.e., static analysis) of the software application source code shall be carried out using tool and measure metrics such as lines of Code, Code Complexity, Fan‐in & fan‐out, Application Call Graph, Dead Codes, Rule Violation, Memory leaks etc. It is also recommended to perform walk through of the source code with code developer to verify the logics and algorithms used for correctness and optimization.

Special focus should be given to identify any unwanted functions (not required by the e‐procurement software application), as these ‘not to have functionalities’ can be potential security threats.

Application Functional Testing #

The functional testing of the e‐procurement software application shall be carried out to validate the application meets the specified functional requirements covering the work flows, navigations, and business & data Validation rules for the defined user categories with access rights. The functional testing should be done following black box approach and using end‐to‐end user scenarios.

(Note: Detailed scenarios would be prepared for each application software to be tested. This would include all important steps and scenarios of Government Tendering , as well as, ‘all issues’ outlined in Annexures I, II and III of these Guidelines)

Application Security Testing #

The test is conducted to unearth various application security vulnerabilities, weaknesses and concerns related to Data /Input Validation, Authentication, Authorization /Access Control, Session Management, Error Handling, Use of Cryptography, etc. Typical issues which may be discovered in an application security

11

testing include Cross‐site scripting, Broken ACLs/Weak passwords, Weak session management, Buffer overflows, Forceful browsing, Form/hidden field manipulation, Command injection, SQL injection, Cookie poisoning, Insecure use of cryptography,, Mis‐configurations, Well‐known platform vulnerabilities, Errors triggering sensitive information leak etc. OWASP (Open Web Application Security Project) guidelines are used for the testing.

(Note: Detailed scenarios would be prepared for each application software to be tested. This would tests to cover ‘all’ security related issues outlined in Annexures I, II and III of these Guidelines, especially aspects related to bid‐encryption. In addition, standard security tests, viz – Cert‐In, OWASP, FBI Top 20 (any other?) will be conducted)

Application Usability Testing *

Usability testing usually involves systematic observation under controlled conditions to determine how well people can use the product. e‐procurement system is used by users of different levels of computer knowledge. User expectation varies with different types of user. Usability testing will ensure that the all types of users are comfortable to use the system. This shall be done by using defined international standards which recommend extensive user interaction and analysis of user behaviour for a defined task.

Application Interoperability and Compatibility Testing *

Interoperability Testing shall be done to check if the software can co‐exist and interchange data with other supporting software in the system. Compatibility testing shall check if the software runs on different types of operating systems and other hardware/software/interface according to customer requirements

∙Data Layer

Data Storage Security Audit #

This is to be done to ensure the use of standard and strong cryptography while storing the sensitive data and user credentials in the application or associated data base. It is also verified that the cryptography used is compliant with the Information Technology Act and the CVC guidelines

Data Communication Security Audit#

This is to be done to ensure that secure communication channel like SSL, TLS or equivalent is used for transmission of sensitive data and credentials by the e‐ procurement system. The cryptographic algorithms and the key size implemented by the system should be standard, strong and compliant with the IT ACT and the CVC guidelines.

It is recommended that the complete data transmission to and from the e‐ procurement website should be SSL/ TLS enabled.

6.0Evaluation and Certification Process

6.1The applicant shall submit the request to Testing and auditing agency (like STQC) to get eProcurement System assessed. The application should specify whether testing is required ‘only for the e‐procurement application’, or for ‘the complete e‐

12

procurement system, viz the application along with the server in a specific hosting environment’. Application for the former case can be made by the application software developer or licensor, and will cover only Part‐1 of the two scenarios outlined below. The application for the latter case can be made by the service‐ provider, or the organization which is procuring the system for its dedicated use, and will cover both Part‐1 and 2 of the two scenarios outlined below.

6.2Inputs & access required by Certification Body

[Scenario‐A: Where ‘Customized Software Development’ of an e‐Procurement System is undertaken]

(Part‐1)

∙Inputs required for Application Testing o RFP of the e‐Procurement

o Software Requirements Specification (SRS) addressing functional and non‐functional requirements including business functions and applicable regulations, standards and policies.

o User manual (operational instructions).

o Software application related information such as – Work flows/ Navigations, Business logics/ Rules, Validation Rules, Screen shots and User categories with roles & access rights. Specifically for testing, application related information such as – Work flows/ Navigations for creating comprehensive ‘System Test Cases’ covering various tendering scenarios, User categories with roles & access rights would be required.

o Software Design Document

oSoftware Application Source Code (if the need is to assess to all desirable requirements)

The inputs should be available along with access to the application hosted in a staging environment with test data.

Note: Apart from review of the ‘developmental aspects’, detailed scenarios would be prepared for each application software to be tested. This would cover ‘all’ security related issues outlined in Annexures I, II and III of these Guidelines, especially aspects related to bid‐encryption.

(Part‐2)

∙System Architecture

∙Security Architecture for conducting VA&P

∙ISMS of eProcurement Information System (eSecurity Manual)

∙Access to e‐procurement system/ test site with sample data (preferably field data).

∙Access to hardware, software, Network & IT infrastructure to connect test

tools on to the system, where required.

Non‐disclosure Agreement (NDA) will be signed by STQC to cover the confidentiality of the information submitted by the applicant

[Scenario‐B: Where ‘Ready‐to‐Use’ e‐Procurement Software License is to provided, or e‐Procurement Services are made available through an ASP]

13

Note: The focus Testing/ Certification here is on the ‘Functionality’’, ‘Security’ and ‘Transparency’ related aspects.

(Part‐1)

oUser Manual (operational instructions), or equivalent Guidelines for users provided online on the screens of the application

oSoftware application related information such as – Work flows/ Navigations for creating comprehensive ‘System Test Cases’ covering various tendering scenarios, User categories with roles & access rights.

The inputs should be available along with access to the application hosted in a staging environment with test data

Note: Detailed scenarios would be prepared for each application software to be tested. This would tests to cover ‘all’ security related issues outlined in Annexures I, II and III of these Guidelines, especially aspects related to bid‐encryption.

(Part‐2)

∙System Architecture

∙Security Architecture for conducting VA&PT

∙Access to e‐procurement system/ test site with sample data (preferably field data).

∙Access to hardware, software, Network & IT infrastructure to connect test tools on to the system, where required.

Non‐disclosure Agreement (NDA) will be signed by STQC to cover the confidentiality of the information submitted by the applicant.

6.3Requirements of Compliance for demonstration

Testing and assessment as specified in Section 4.0 shall be carried out.

To demonstrate conformity to the ESSENTIAL Quality and eSecurity assurance requirements and minimum functionality compliance the following shall be complied:

∙Evidence of compliance to implementation of ISO 27001 Information Security Management System with applicable controls in all concerned entities. The Security processes shall be audited as per controls defined in eSecurity Manual provided by the applicant, and/ or in the applicant’s response to Annexure I, II, III, and IV.

∙The risk analysis methodology used by the service provider shall adequately address the concerns raised in this document (Annexure‐I). Mitigation methodology and techniques implemented should ensure eProcurement Information System is secure.

∙While implementing the security controls the service provider shall demonstrate that the requirements of vigilance administration (CVC) (Annexure‐II) are adequately addressed in the Information Security Management System. Also while implementing ISO 27001, the solution provider shall ensure that adequate controls have been implemented to ensure that security at design and operation level are addressed adequately

14

∙The software shall be tested for functionality, workflow and other essential requirements (like Central Vigilance Commission Guidelines, GFR, Information

Technology Act – Annexure I, II, III, and IV).

∙The application hardening shall be assessed for Top 10 vulnerabilities defined by OWASP (Reference doc – 3)

∙Network should be assessed for adequate security through penetration testing

and vulnerability assessment as per NIST 800‐115.To demonstrate that the requirements are implemented and effective, the services of agencies empanelled by CERT‐IN can be used (http://www.cert‐in.org.in).

To demonstrate compliance to the DESIRABLE requirements following shall be complied, where applicable:

∙The software source code shall be evaluated using white box test approach through code review/ inspection process for identifying malicious codes/ Trojan etc.

∙Workflow shall be in line with the requirement of CWA 15666 to standardized Business Processes and Information Entities using UML Version 1.4 and ebXML Core Components Technical Specification for Data Structure (Reference doc ‐ 4). This will attain the objective of Interoperability and Compatibility of various solutions both at buyer and supplier end

∙The solution shall be tested to Usability requirements as per Usability information defined in Template I.

6.4If results are satisfactory and meet the requirements of this document, STQC shall issue a letter indicating Conformity with specified requirements.

15

Scope of Certification

eProcurement life cycle consist of following activities:

∙Purchase to pay

oContract management

oContent management

oSelection/requisition

oWorkflow‐approval

oorder

oreceive

oinvoice

opayment

∙eSourcing

omanagement information

ocollaboration

ospecification/notice

oexpression of interest

oinvitation to tender

oevaluate

onegotiate/reverse auction

oaward

Generally, these activities are covered in different modules e.g.

Supplier Registration

E‐tedenring

eAuction

ePayment

Accounting

Reverse Auction

eCatalogue Management

MIS

Contract Management

The applicant can define any module as a part of scope of certification while the eTendering module is the essential requirement to obtain the certification. Depending on the complexity of the module and the scope identified by the applicant the Certification Body/Test Agency will charge for testing and certification.

Note: For any major change in application (e.g. encryption method, tender opening event,process re‐engineering). The application requires to be completely re‐tested. It is further emphasized the service provider should not have source code and escrowing requirement mentioned earlier should be strictly adhered to.

17

−‘Substitution’ bid

Or ‘Withdrawal’ bid for all his bid‐submissions.

The e‐tendering system must effectively cater to all these possibilities without compromising security and transparency in any manner at any stage, for any bid part (such as Pre‐qualification, Technical, and Financial).

The e‐tendering system need to have templates to offer flexibility in bidding methodologies as prevailing and followed currently in the manual process. Further, system should have templates to adopt bidding methodologies as may be prescribed by respective authorities.

2.0Concerns relating to Implementation of e‐procurement systems using PKI based Bid‐ Encryption

2.1	A system in which Public Key of a Tender‐	Cryptographic	A 12.3
	Opening Officer or of any other officer of the	controls	Objective: To protect
	purchase department, or of any person from	Regulation of	the confidentiality,
			authenticity or
	the service provider’s organization is used for	cryptographic
			integrity of
	bid‐encryption, and corresponding Private‐Key	controls	information by
	used for Decryption		cryptographic means.
	Many time bids are encrypted at the bidder’s		A.12.3.1 : “A policy on
			the use of
	computer with public‐key as mentioned		cryptographic
			controls for
	above, and the encrypted bids, with additional
			protection of
	SSL encryption, reach the e‐tendering server		information shall be
	through file‐upload and/ or filling of online‐		developed and
			implemented”.
	forms.
			A.12.3.2 : “Key
	There are risks related to integrity of persons		management shall be
			in place to support
	in (a) purchase (buyer) organization & (b) e‐
			the organization’s use
	Tendering Service Providers organization. As		of cryptographic
	Typical implementation practices include		techniques”.
	∙ Private Key with which decryption is done,		A 15.1.6
			“Cryptographic
	is available with the concerned officer		controls shall be used
	before the Public Tender Opening Event		in compliance with all
	∙ Public Key with which bid‐encryption is		relevant
			agreements, laws,
	done is available publicly.		and regulations”.

∙Public Key algorithms are slow.

∙Copy of the decryption‐key (ie private key of the encryption‐certificate issued by a CA) is generally available (ie backed up) with the CA. Duplicate can generally be requested in case of loss, however, this can also be misused.

Guidance and recommended practices‐ Use of PKI technique

If the e‐procurement system uses PKI for bid‐encryption, it has to satisfactorily address the above issues and consequent concerns (Ref 2.2 below) through suitable functionality built into the e‐procurement application. Where, in addition, some issues are being further addressed through organizational procedures under ISO 27001, these should be explicitly defined with satisfactory explanations, otherwise certification process will become subjective. While doing this, the following can be kept in view:

19

Various techniques are available in market for improving implementation of PKI based encryption such as escrowing, splitting and repeated encryption to further strengthening the security of information and implementation.

	If the e‐procurement system uses any of the above techniques, it will have to be
	explained how the related concerns (Ref 2.2 below) have been addressed.
	Furthermore, practical procedures will have to be put in place which can be
	implemented at the field level in diverse locations in the country in a user friendly
	manner.
2.2	(i) While all efforts must be made to ensure								Control of	A 12.6.1
	that no spyware is put in the server which								technical	“Timely information about
	can	make clandestine			copies	of a	file	or	vulnerabilities	technical vulnerabilities of
										information
	data being uploaded to the server, and then
										systems being used shall
	sending		this clandestine copy to a				secret		Protection	be obtained, the
	destination, the possibility of such spyware								against	organization's exposure
										to such vulnerabilities
	being planted in the web‐server cannot be								malicious and
										evaluated, and
	totally		ruled	out.	This	undesirable			mobile code	appropriate measures
	eventuality could occur due to connivance									taken to
									OS Access	address the associated
	of the administrators of the Service
										risk”.
	Provider, or even through remote injection.								Control
	For secure & transparent functioning of the								Log monitoring	A 10.4
	e‐tendering system, it cannot be assumed									A.10.4.1
	that there will never be such a possibility of									“Detection, prevention,
	the	spyware		being	planted	in	the	e‐		and recovery controls to
										protect against
	tendering server.
										malicious code and
										appropriate user
	(ii) If the spyware is planted at the kernel									awareness procedures
										shall be
	level, there may not be any audit trail.
										implemented”.

(iii) Audit Trails (both application level, and Operating system level) are essentially reports. To that extent it is possible to fudge these. Also, other than application‐ level audit trail reports, the other audit trail reports can be quite complex and impractical to analyze for ongoing operations of this nature. In spite of this, audit trail‐reports are useful and should be there as supporting evidence. However, in a sensitive application of this nature, audit trails cannot be depended upon as the sole protection against any mala‐fide act.

substantiate the claimed identity of a user.

A.11.5.3

Systems for managing passwords shall be interactive and shall ensure quality passwords.

A.11.5.4

The use of utility programs that might be capable of overriding

system and application controls shall be restricted and tightly

controlled.

A.11.5.5

Inactive sessions shall shut down after a defined period of inactivity.

A.11.5.6

Restrictions on connection times shall be used to provide additional security for high‐risk applications.

A10.10

A.10.10.1

Audit logs recording user activities, exceptions, and information

security events shall be produced and kept for an agreed period to

assist in future investigations and access control monitoring.

A.10.10.2

Procedures for monitoring use of information processing facilities shall be established and the results of the monitoring activities reviewed regularly.

A.10.10.3

Logging facilities and log information shall be protected against tampering and unauthorized access.

A.10.10.4

System administrator and system operator activities shall be logged.

A.10.10.5

Faults shall be logged, analyzed, and appropriate action taken.

21

A.10.10.6

The clocks of all relevant information processing systems within an organization or security domain shall be synchronized with an agreed accurate time source

Guidance and recommended practices‐ Spyware/Trojan/BOTS

It is important that even if a clandestine copy is made and stolen as above, the bid‐ encryption methodology should be such that it should not be possible to decrypt the bids in connivance with any officer of the Buyer organization or the Service Provider organization. While this issue becomes irrelevant if bid encryption is done at bidder‐ end with bidder created symmetric pass‐phrase, in case PKI‐based bid encryption is done, the software functionality has to be suitably augmented to mitigate this security threat. This threat has also been explicitly mentioned in CVC guidelines (refer security check‐point No. 14 of Annexure‐II)

a)The controls should be placed to guard against the possibility of injecting spyware for making clandestine copies of a submitted bid and then sending this clandestine copy to a secret destination.

The spyware are the malicious software codes which can be injected in to the system remotely. To protect the system from injection of spyware, the system needs to be secured. The system need to be secured and protected in the following manner;

∙Hardening of hardware and software of the entire Information Technology infrastructure (which include computer system, software, router etc.)

∙Installation of anti spyware, anti spam and antivirus software.

∙Installation of software tools to protect the operating system from injection of spyware. These software need to be upgraded on a continuous basis.

The entire infrastructure needs to be secured at the perimeter level by installing Firewalls and intrusion Prevention System.

After installation of software and protecting by devices as the entire IT infrastructure needs to be audited by the Information Technology Auditors. Indian Computer Emergency Response Team (CERT‐IN), Department of Information Technology has empanelled auditors for auditing systems from the point of view of cyber security. It is always recommended that system should be audited at least once in a year and as and when the infrastructure (i.e hardware and software) is augmented by additions of new hardware and software.

Further people operating these systems need to be trained in monitoring and detecting any intrusion in the system and network.

b)The kernel of the operating system in the IT infrastructure should be secured first by hardening the operating system and installation of software which protects it from inject of spyware or any kind of intrusion.

c)The e‐procurement system should have audit trail facilities. These audit trails are complex but dependable. The audit trails reports provide useful information about the instructions which take place in the system both at operating system and

22

	application software. This information is necessary to analyze nature of intrusion,
	vulnerabilities exploited and to track the perpetrators. It also helps in taking steps in
	preventing future intrusion.
	The analysis of audit trail requires appropriate expertise both in respect of
	application and operating system. Such expertise is available in the country at many
	places. CERT‐In also facilitates the user organization in analyzing the audit trails.
2.3	Private Key with which decryption is done,	Cryptographic	A 12.3
	is available with the concerned officer	controls	A.12.3.1
	before the Public Tender Opening Event
		Segregation	“A policy on the use of
	a) If a clandestine copy of a bid is made as	of duties	cryptographic controls for
			protection of
	described above before the ‘tender opening
			information shall be
	event (TOE)’, and if the concerned tender‐		developed and
	opening officer (TOE‐officer) connives in		implemented.”
	decrypting the bid before the TOE, the		A.12.3.2
	confidentiality of the bid is compromised.		“Key management shall be in
			place to support the
	b) The above concern with the difference		organization’s use
			of cryptographic techniques”
	that the copy of the bid is made with the
	connivance of the Database Administrator		A 10.1.3
	(DBA).		“Duties and areas of
			responsibility shall be
	c) If the concerned TOE‐officer(s) is/ are		segregated to reduce
			opportunities for
	absent during the TOE, how the bids will be		unauthorized or
	decrypted especially keeping in view that		unintentional modification or
			misuse of the organization’s
	the private‐keys should not be handed over
			assets.”
	to anybody else.
	Guidance and recommended practices
	Note: While some guidance is provided below, it is the responsibility of the individual
	vendors to design and develop their applications in a manner that addresses the
	outlined concerns. They should first convincingly demonstrate the full methodology
	to DIT, and then DIT will transparently put this methodology on its website, so that
	bidders who use such e‐procurement systems in future are fully assured against
	breach of confidentiality of their bid‐data.
	A process needs to be established and followed in respect of key management of
	encryption keys particularly the key with which the bid would be decrypted at the
	time of opening of the bids. Such process should avoid compromising confidentiality
	and possibility of decrypting clandestine copy of the bid. In this regard the following
	three approaches may be adopted with proper checks while keeping in view the
	legality of the process for end‐users. Furthermore, practical procedures will have to
	be put in place which can be implemented at the field level in diverse locations in the
	country in a user friendly manner.
	∙ Splitting of Keys:
	A bidder would submit the bid document after encrypting it with the public key
	of the tendering organization, so that the contents are encrypted and are
	decrypted by the authorized officials at the tendering organization. To minimize
	the risks associated with “person of dubious integrity” or collusion, private key
	decryption should be split into `M’ parts with the requirement of minimum `N’
			23

splits being required for its use. (`N’ should be more than 1 and less than or equal

to M). `N’ and `M’ will be decided by the tendering organization and suitably

configured on the system.

∙ Multiple encryption

of the

bid

document with multiple public keys and

decryption of document with the multiple corresponding private keys of the

tendering organization.

Application of multiple encryption of the bid document could be prescribed in a

predefined order by authorized officials of the tendering organization. Decryption

will have to be carried out in the reverse order. The multiple decryption keys (i.e.

private) may be held by different officials of the tender organization. Encrypting the

bid document first with public key of the bidder and then by the public key of

tendering organization. The bid document may then be decrypted by the private key

of the authorized official of tendering organization and then by the private key of

bidder. It may be noted that the decryption keys are applied in reverse order in

application of encryption keys.

The implementation of this system, however, would require physical presence of the

bidder who encrypted the bid at the time of submission of bid. Preferably the

person of bidding organization should be same who has signed the bid by digital

signature. There are logistic issues with this approach.

2.4

Public Key with which bid‐encryption is

Cryptographic

A 12.3

done

is available

publicly.

The easy

controls

A.12.3.1

availability of the

public

key makes

the

A policy on the use of

data

encrypted

with

it

vulnerable

to

Regulation of

cryptographic controls for

protection of

‘Chosen Plaintext Attack’

cryptographic

information shall be

controls

developed and implemented.

A.12.3.2

Key management shall be in

place to support the

organization’s use

of cryptographic techniques

A 15.1.6

Cryptographic controls shall

be used in compliance with

all relevant

agreements, laws, and

regulations.

Guidance and recommended practices

Note: While some guidance is provided below, it is the responsibility of the individual

vendors to design and develop their applications in a manner that addresses the

outlined concerns. They should first convincingly demonstrate the full methodology

to DIT, and then DIT will transparently put this methodology on its website, so that

bidders who use such e‐procurement systems in future are fully assured against

breach of confidentiality of their bid‐data.

2.5

Public Key algorithms are slow. As a result

Capacity

A 10.3.1

many e‐tendering systems which use PKI for

management

The use of resources shall

bid‐encryption,

use

mainly

an

encrypted

be monitored, tuned, and

projections

online‐form for bid submission, and do not

made of future capacity

have facility for an encrypted detailed bid (eg

requirements to ensure

detailed technical bid as a file), along with the

the required system

performance.

online form. As a result, the detailed bid is

either

not submitted,

or it is

submitted

in

24

unencrypted form.

Guidance and recommended practices

Note: While some guidance is provided below, it is the responsibility of the individual vendors to design and develop their applications in a manner that addresses the outlined concerns. They should first convincingly demonstrate the full methodology to DIT, and then DIT will transparently put this methodology on its website, so that bidders who use such e‐procurement systems in future are fully assured against breach of confidentiality of their bid‐data.

2.6A system in which Public Key of a bidder’s representative is used for bid‐encryption at bidder’s office, and where decryption will be done by the bidder’s representative himself using his private key during the Online Public TOE.

Concerns:

a)Concerns outlined in 2.4 and 2.5 outlined above are applicable here also, and should be suitably addressed.

b)How would the bids be opened if the bidder’s representative with whose key bids have been encrypted is not available during the Online Public TOE ? The non‐availability could be due to leave, termination or any other reason.

c)Copy of the decryption‐key (ie private key of the encryption‐certificate issued by a CA) is generally available (ie backed up) with the CA. Duplicate can generally be requested in case of loss, however, this can also be misused.

Note: Private key cannot be transmitted by the bidder over the internet. Furthermore, during the Online Public TOE, bids cannot be allowed to be downloaded from the server to the bidder’s computer. This would tantamount to the bids being taken away from the tender‐box back to the bidder’s office for opening. This cannot be allowed. Therefore the bidder will have to be physically present during the Public TOE, and such a system will never be able to have a proper Online Public TOE. This would immediately remove one of the biggest benefits of e‐procurement. Assuming that all other concerns are satisfactorily addressed, this would at best be a PARTIAL e‐ procurement system.

3. Concerns relating to situations where bids before being transmitted from the bidder’s

25

computer are protected with only SSL Encryption and Database level Encryption is done before the bid is stored in the Database Server

3.1	i) For secure and transparent functioning of									Cryptographic	A 12.3
	the e‐tendering system, it cannot								be	controls	A.12.3.1
	assumed	that	there will			never		be	any		A policy on the use of
	“persons	of	dubious		integrity”			in	the	Regulation of	cryptographic controls for
											protection of
	Purchase organization									cryptographic
											information shall be
	ii) For secure and transparent functioning of									controls	developed and
	the e‐tendering system, it cannot							be			implemented.
											A.12.3.2
	assumed that there will never be any
											Key management shall be in
	“persons	of dubious		integrity”			in the e‐				place to support the
	tendering Service Provider’s organization										organization’s use
											of cryptographic techniques
	iii) While all efforts must be made to ensure
											A 15.1.6
	that no spyware is put in the server							which			Cryptographic controls shall
	can make clandestine copies of a file or data										be used in compliance with
	being uploaded to the					server,			and		all relevant
											agreements, laws, and
	then sending this clandestine copy to a
											regulations.
	secret destination, the possibility of such
	spyware being planted in the web‐server
	cannot be totally			ruled		out.			This
	undesirable eventuality could occur due to
	connivance of the administrators of the
	Service Provider, or even through remote
	injection.	For	secure		and		transparent
	functioning of the e‐tendering system, it
	cannot be	assumed that there will never
	be such a possibility of the spyware being
	planted in the e‐tendering server.
	iv) If the spyware is planted at the kernel
	level, there may not be any audit trail.
	v) Audit Trails (both application level and
	Operating system level) are					essentially
	reports. To that extent it is possible to fudge
	these. Also, other than application‐ level
	audit trail reports, the other audit trail
	reports can be quite complex and
	impractical to analyze for ongoing
	operations of this nature. In spite of this,
	audit trail‐reports are useful and should be
	there as supporting evidence. However, in a
	sensitive application of this nature, audit
	trails cannot be depended upon as the sole
	protection against any malafide act.

Guidance and recommended practices

Secure submission of bid from bidder’s computer to the server should be done after the bid file/ data is encrypted (with symmetric or asymmetric encryption) at the bidder’s computer and further submitted to the e‐procurement server through SSL encryption. Only the encrypted file submitted by the bidder should be stored and should be decrypted at the Tender Opening Event (TOE).

3.2	Assuming that ‘only SSL encryption’ is applied	Cryptographic	A 12.3
	to a bid while it is being transmitted from the	controls	A.12.3.1
	bidder’s computer to the server, it is a fact the		A policy on the use of
			26

	role	of	SSL	encryption		is	limited	to	the	Regulation of	cryptographic
	transmission			phase (ie transportation to the						cryptographic	controls for
											protection of
	server), and that on reaching the server the									controls
											information shall be
	SSL	encryption is			removed. The bid			is	now		developed and
	presumably			encrypted		again with		PKI or			implemented.
											A.12.3.2
	Symmetric Key. Albeit small, there is an
											Key management
	‘interim		period’ before the				bid is encrypted				shall be in place to
	again. In the interim period the bid is actually										support the
											organization’s use
	in an unencrypted state and to that extent
											of cryptographic
	vulnerable.										techniques
	Irrespective of whether PKI or Symmetric Key										A 15.1.6
	is used for encryption at Database‐level, the
	encrypting key is available/ accessible to some										Cryptographic
											controls shall be used
	officer of the purchase organization, or an
											in compliance with all
	administrator			of	the	e‐tendering		Service			relevant
	Provider, or the DBA.										agreements, laws,
											and regulations.

The above issues exist irrespective of whether only select data is encrypted, or the entire database is encrypted.

If a clandestine copy of a bid is made as described above in the interim period which would be before the ‘tender opening event (TOE)’, and if the administrator connives, the confidentiality of the bid is compromised.

1b. The above concern with the difference that the copy of the bid is made with the connivance of the Database Administrator (DBA) and decryption done in connivance with the person holding the decryption key.

Guidance and recommended practices

Secure submission of bid from bidder’s computer to the server should be done after the bid file is encrypted (with symmetric or asymmetric encryption) at the bidder’s computer and further submitted to the e‐procurement server through SSL encryption. Only the encrypted file submitted by the bidder should be stored and should be decrypted at the Tender Opening Event (TOE).

The two‐way process as suggested may be followed strictly. This will address the concerns raised. The information on reaching the server where e‐procurement software is deployed through SSL mode will remain encrypted even after the SSL encryption is removed. Information will lie encrypted in the system hosting e‐ procurement software. Data Base Administrator (DBA) will not be able to decrypt the information as he will not be having the decryption keys. It may be mentioned here that at no point of time the System Administrator or Data Base Administrator should be authorized to hold the private (decryption) key. The organization shall have a procedure which can include three different approaches to address three different scenarios.

4. Concern about Symmetric key based Bid‐Encryption done at the Bidder’s computer

4.1	a) While	bidders’ representatives should be	Cryptographic	A 12.3
	welcome	during Online Public TOE, it should	controls	A.12.3.1

27

28

fledged virtual office to the officers, but to provide adequate facilities within the application for multiple officers of multiple departments to carry out their respective tendering related activities with proper security and full accountability. Roles relating to various tendering activities within each department, and which could vary from tender to tender, would inter alia include – deciding methodology and rules pertaining to a particular tender, creation of tender notice, approval/ rejection of tender notice, creation of corrigendum, approval of corrigendum, creation tender document forms, approval of tender document forms, overall approval/ rejection of tender documents, providing responses to clarification of tender documents, uploading minutes of pre‐bid meeting, one or more officers conducting public online tender opening event (TOE), approving minutes of the public online TOE, short‐listing responsive bidders for the next stage (where applicable), managing roles of various personnel, and assigning alternative personnel in case the original assignees are absent, etc.

b)The offered e‐tendering system has facility, such that roles with conflict of interest can be offered to different persons within the organization, so that conflict of interest is avoided.

c)There should be one authorized person as an overall coordinator and representative of that organization in the e‐tendering system, with powers to delegate different roles to different users from time to time, and all such role‐changes must be audit‐ trailed in the application. The credentials of this overall coordinator must be verified.

d)There should be provision for having separate authorized user (at the corporate level of each Buyer organization, i.e. external to its tendering departments) who can access the application‐level audit‐trail (ie audit‐log) reports. Other users of the organization should not have access to these reports.

e)Under no circumstances will it be required for any officer to hand over his/ her

29

private‐key (used for digital‐signing, or bid‐ decryption if applicable in the offered system) to anyone else – within the organization, or to anyone in the service provider’s organization, or to anybody else.

f)There could be occasions when an authorized officer of a Purchase/Buyer organization is on leave, gets transferred, resigns or his/ her services are terminated. One example where such an eventuality may arise is if the public key of the tender opening officer is used for bid encryption, and his private key required for bid decryption during the online tender opening event. There should no limitation in the e‐tendering system which may necessitate that the private key of such an officer be handed over to anybody else for the scheduled tendering processes to continue uninterrupted.

Note: The above is necessary for compliance with s‐42(1) of the IT Act 2000.

Guidance and recommended practices

The e‐procurement system should have the features to address above. Under the IT Act, 2000 any holder of a Digital Signature, who’s Digital Signature Certificate has been issued by a licensed CA, is responsible for protecting the corresponding private key. Unless the certificate validity has expired or the certificate has been revoked by the issuing CA, any digital signature will be legally valid and will be attributed to the person listed in the Digital Signature Certificate. Similar mechanism measures should be evolved for encryption key pair as well.

Handing over of private (decryption) key by one officer to another officer both in case of digital signature as well as in case of encryption should not be allowed

In case of digital signature, private key should be one of the two factor authentication method which must be implemented. The other could be Personal Identification Number (PIN) or biometric etc., so that nobody else can use the private key for signing the document.

	Further, it is the responsibility of the e‐procurement system to reject the Digital
	Signature (except for verification) in case the corresponding Digital Signature
	Certificate has expired. It is suggested that e‐procurement tendering system must
	have signing interface which can keep track of corresponding certificate particularly
	relating to expiry aspect of digital signature. There should also be a clause in the
	tender document stating that tender will not be considered for evaluation if the
	digital signature certificate has expired (except for verification).
5.2	In any large Supplier/ Vendor organization,				Cryptographic	A 12.3
	there can be multiple sales departments				controls	A.12.3.1
	which	can	bid for different	tenders. Also		A policy on the use of
	within	each	such department	there can be	Regulation of	cryptographic
						30

	many	executives		involved		with		different	cryptographic		controls for
	activities		relating to various tenders.						controls		protection of
											information shall be
	A situation should not arise in the e‐tendering
											developed and
	system	where due		to limitation				of the e‐			implemented.
	tendering		system,	these	departments and						A.12.3.2
											Key management
	executives are not able to themselves execute
											shall be in place to
	their duly		assigned	roles	as	in	the manual				support the
	process, and are constrained						to	re‐assign/			organization’s use
											of cryptographic
	abdicate their roles and responsibilities to a
											techniques
	few tech‐savvy technicians or the personnel of
	the service‐provider of the e‐tendering										A 15.1.6
	system.										Cryptographic
											controls shall be used
											in compliance with all
											relevant
											agreements, laws,
											and regulations.
	Guidance and recommended practices
	This has implication on process and technology. There would be scenarios regarding
	multiple tendering within organization. e‐Procurement software must have features
	to address such suggested issues’ viz – multiple sales departments within a bidder/
	supplier organization, multiple executives (each with his own digital signature
	certificate) for performing various e‐procurement related tasks within each such
	department; system for managing roles and authorizations of such executives in case
	of transfer, leave, termination etc; independent executive within each bidder/
	supplier organization for accessing audit trails relating to that organization. Apart
	from from ensuring security within a supplier/ bidder organization, such functionality
	is necessary to ensure that users within a supplier/ bidder organization do not
	handover their private keys to each other for completing an ongoing tendering
	process. If these concerns are not addressed, it would result in violation of s‐42(1) of
	the IT Act.
	Further, it is suggested that organizations implementing e‐procurement system
	should conduct training programmes for persons who have been assigned roles and
	are using the system on functional aspect related to process and technical aspects of
	the system. The training programme should also cover dos and don’ts for using the
	system.
6. Some other functionality/ Security/ Transparency related requirements of a Manual
Tendering System and Conformance its Availability in the offered e‐tendering system
6.1	Concern								Cryptographic	A 12.3
	(Manual System)A Tender Notice is issued								controls	A.12.3.1
	after internal clearance. Once a Tender Notice									A policy on the use of
	is published in a newspaper, it becomes an								Regulation of	cryptographic controls for
										protection of information
	authentic record.								cryptographic
										shall be developed and
									controls	implemented.
	(Electronic System)									A.12.3.2
										Key management shall be
	a) At a higher level, there should be clearance
										in place to support the
	(which is audit‐trailed within the application									organization’s use
	and digitally signed) before a Tender Notice is									of cryptographic
										techniques
	issued.
	b) For authenticity and for assurance that it									A 15.1.6
										Cryptographic controls
	has not been tampered, the electronic Tender									shall be used in
										compliance with all
										31

distributed, these become an authentic record.

(Electronic System)

a)At a higher level, there should be clearance (which is audit‐trailed within the application and digitally signed) before an Addendum is issued.

b)For authenticity and for assurance that it has not been tampered, the electronic Addendum (which is an electronic record), should have an audit‐trail within the application of its approval/ posting. Also, the Addendum should be digitally signed by an authorized officer of the Purchase/ Buyer organization.

Concern (Manual System)

Clarification of Tender Documents. In response to a bidder’s query, an authorized officer of the Purchase/ Buyer organization responds to the querist with a copy to all other prospective bidders who have purchased tender documents (without revealing the identity of the querist). The response is signed by the concerned officer for authenticity.

(Electronic System)

The e‐tendering system should also have such a facility with all the functionality as described in the previous column. For authenticity and for assurance that it has not been tampered, the response from the authorized officer of the Purchase/ Buyer organization should be digitally signed by him.

Concern (Manual System)

Pre‐Bid meeting. The minutes of the Pre‐bid meeting are signed for authenticity by an authorized officer of the Purchaser/ Buyer organization and made available to the prospective bidders.

(Electronic System)

The e‐tendering system should also have such a facility with all the functionality as described in the previous column. For authenticity and for assurance that it has not been tampered, the Minutes should be digitally signed by an authorized officer of the Purchaser/ Buyer

33

	organization.
	Concern
	(Manual System)
	Bid Methodologies/ Formats:
	Depending on the circumstances and nature of
	a tender, one of the many bidding
	methodologies may be prescribed by a Buyer,
	and the bidder would have to respond
	accordingly.
	∙ Single‐stage, single‐ envelope
	∙ Single‐stage, two‐ envelope
	∙ Two stage (with facility for ‘technical
	conformance’, and if required, ‘revised
	tender documents’)
	∙ Two‐stage, two‐ envelope
	∙ Where required, the above may be
	combined with a Pre‐qualification stage
	∙ In some cases, the Purchaser may allow
	submission of one or more Alternative bids
	∙ Each bid part (eg technical, financial) may
	be required to be submitted in a ‘summary
	format’ along with a ‘detailed bid’.	The
	latter could be a large file.
	∙ After having submitted the ‘original’ bid
	for each bid‐part, a bidder has a right to
	submit:
	‘Modification’ bid
	‘Substitution’ bid
	Or ‘Withdrawal’ bid for all his bid‐
	submissions.
	(Electronic System)
	The e‐tendering system should
	support all the bidding methodologies/
	formats as outlined above without
	sacrificing any aspect of
	security and transparency
	including those listed elsewhere in this document.
	Guidance and recommended practices
	CVC Circular No. Office Order No.43/7/04 dated 2nd July 2004 had also required that
	tender documents posted on an e‐tendering/ e‐procurement website should be
	digitally signed by an officer of the tendering organization, and for the assurance of
	the bidder who is viewing or downloading the tender documents, the CVC circular
	required that facility be provided to verify the digital signature to ensure the
	authenticity and integrity of the tender documents.
	The e‐procurement system should have functionality as outlined above under
	‘(Electronic System)’, and the Buyer organization should have related procedures to
	implement this.
6.2	Concern		Cryptographic		A 12.3
				34

	(Manual System)	controls	A.12.3.1
	Signing of each page of each bid part (pre‐		A policy on the use of
	qualification, technical, financial) especially	Regulation of	cryptographic
			controls for
	the ‘summary format’ and the	cryptographic
			protection of
	‘detailed’ bid including modification,	controls	information shall be
	substitution, withdrawal.		developed and
			implemented.
	The sealed bids are deposited securely in a		A.12.3.2
			Key management
	locked tender box, and stored securely till the		shall be in place to
			support the
	box is opened during the public tender
			organization’s use
	opening event.		of cryptographic
			techniques
	(Electronic System)		A 15.1.6
			Cryptographic
	The e‐tendering system should have the
			controls shall be used
	corresponding facilities without sacrificing any		in compliance with all
	aspect of security and transparency including		relevant agreements,
			laws, and regulations.
	those listed elsewhere in these Guidelines.

∙It should not be possible to open the ‘e‐ tender boxes’ till the specified time has occurred or elapsed, and till all the authorized Tender‐Opening Officers have formally instructed the system to do so with PKI‐based Digital Signatures

∙Till the Public Tender Opening Event, security related features should be such that the contents of the bids which are being stored cannot be ‘accessed and decrypted’ by even the authorized officers of the Purchaser/ Buyer or the Administrators of the Service Provider (even if they wish to do so with mala‐fide intentions).

	Guidance and recommended practices
	The e‐procurement system should have features to address the suggestions made in
	this document.
	Any e‐procurement/e‐tendering services must provide the facility of Time Stamping
	which is critical for establishing data and time of document submission and its
	acknowledgement. Time Stamping feature should be built within the application and
	synchronisation of e‐tendering/ e‐procurement server should be done with master‐
	server at the data‐center where the e‐procurement system is hosted (as mentioned
	in section 4.1 of these Guidelines). Alternatively, the e‐procurement service provider
	can take Time Stamping services being provided by licensed CAs.
6.3	(Manual System)	Cryptographic	A 12.3
	Public Tender Opening Event(s) [Public TOEs]	controls	A.12.3.1
			A policy on the use of
	For Transparency, there is an elaborate	Regulation of	cryptographic controls for
			protection of information
	procedure for opening of bids in the presence	cryptographic
			shall be developed and
	of authorized bidders. A few salient aspects of	controls	implemented.
			A.12.3.2
			35

locations electronically with full security procedures. Tender‐Opening Event should be simultaneously viewable by all attendees from their respective locations

The e‐tendering system should support all the salient aspects,viz a, b, c, d, e, f, g, h, i as listed in the previous column without sacrificing any aspect of security and transparency including those listed elsewhere in this matrix/ questionnaire. As soon as a bid is opened, participating bidders should be able to simultaneously download the salient points (ie the summary information) of the opened bid.

For (j) keeping in view the nature of the internet, such bids may be archived unopened.

Note: In addition, in cases where some bidders have bid offline (ie manually), and this has been allowed, then the following should be ensured:

-That the offline bids are opened first and their salient points entered into the system before the online bids are opened. This is all done in the presence of the online bidders who are simultaneously witnessing this exercise.

The compiled/ integrated data of the both the online and offline bidders should be made available in the form of an online comparison chart to all the participants.

Guidance and recommended practices

The GFR requires that tenders be opened in public in the presence of the authorized representatives of the bidders. The Finance Ministry Manual on procurement procedures outlines in details the requirements of a transparently conducted Public Tender Opening Event. CVC Guidelines on security aspects of e‐procurement also stae the requirement of ‘Online Public Tender Opening Event’. Merely opening bids ‘online’, and then separately making them available for display to the bidders subsequently, and/ or from a different location/ screen (ie user interface) without the simultaneous online presence of bidders, does not fulfill the requirements of a proper and transparent online Public TOE. A comprehensive and transparent Public Tender Opening Event is the ‘backbone of transparency and fairness’ of the Public Procurement process, manual or electronic. This has an impact on technical as well as procedural aspects.

It must be ensured that e‐tendering/ e‐procurement has comprehensive functionality for a transparent Public Online Tender Opening Event (Public OTOE). Well established practices of manual tender opening (with legal and transparency related significance) should have corresponding electronic equivalents for transparent e‐tendering/ e‐procurement. Some relevant processes of a fair and transparent online public TOE should include:

37