Procurement of Consultancy Services for Incident Response Retainer PROCUREMENT NOTICES Procurement of Consultancy Services for Incident Response Retainer Bank Negara Malaysia (BNM) invites qualified and experienced suppliers who fulfil the requirements listed below to participate in the above-mentioned tender. 1. Mandatory Requirements Only suppliers who meet the following requirements will be considered for this tender and issued the RFP documents: No. Mandatory requirements Document required (in PDF format) 1. Malaysian registered business Certificate of company registration from the Suruhanjaya Syarikat Malaysia (SSM). 2. The supplier to provide authorisation’s proof from respective products. Letter of Authorisation from ANY Principal (Black Panda, Madiant – Google, Group IB, Kaspersky, Crowdstrike & BAE System) 3. The supplier agrees to maintain strict confidentiality of all information to be received from BNM and submit a letter of undertaking of confidentiality, which is to be signed by the company’s authorised representative(s). Signed Letter of Undertaking on Confidentiality 4. The company, its directors and senior management were not subjected to ongoing or past criminal investigation in the past five years. Signed Statutory Declaration on Criminal / Civil Litigation confirming that there was no criminal investigation instituted against the company or its directors and senior management. 2. Scope of Work Procurement of Consultancy Services for Incident Response Retainer (IRR) covering the following areas (summary and details will be provided in the RFP): Scope of Work Incident response services that will be covered for BNM are as follows: Cyber security incident response support Forensic, log and advance malware analysis Advanced threat actor response support Advance threat/incident remediation assistance Standby external IRR service for digital forensics activities which will be assessed and reviewed by expert of Incident Response Services if any incident occurred at BNM. The supplier shall issue an IRR support certificate (issuance of certification on annual basis) prior to commencement of the services. The current technology deployed in BNM, shall be used to provide the service. There are four parts to a complete service through Enterprise Incident Response (EIR): Investigation Enterprise Scoping (Existing leads, sweeping, analysis, identify incident scope) Iterative Sweeping (Analysis, Live response, reverse engineering, incident management, reporting) Vigilance Analysis, reporting Remediation Planning, posturing, reporting, preparation for remediation event, assisting on-site Post-remediation sweep Review and Lesson learned In the event of no utilisation of the services in full or part thereof by BNM, the supplier shall substitute and provide value added services deemed necessary or as requested by BNM Supplier Capability & Credibility Company’s track record in handling similar project Handling high profile incidents at least for 10 years and at least 200,000 hours in the previous years IR Analyst Skills and Resources Certified Digital Forensic and Incident Response (DFIR) Analyst Certified DFIR Manager 3. Tender Process Milestones A summary of the timeline of the tender process is as follows: Activity Start Date End Date Pre-qualification document submission and assessment 18 October 2024 6:00PM, 25 October 2024, Friday RFP document issuance 28 October 2024 - Tender briefing 30 October 2024 - Tender closing date/time - 6:00PM, 5 November 2024, Tuesday 4. Issuance of Tender Documents The tender document can be downloaded via the eTender URL: https://procurement.bnm.gov.my. Suppliers are required to download the eTender Guide and Multi-Factor Authentication (MFA) Guide to proceed with the registration of eTender. In your indication of interest, please attach the prequalification documents in PDF format no later than 6:00PM (Malaysian time), 25 October 2024 (Friday). BNM will not provide any acknowledgement of receipt in response to indication of interest by the suppliers. BNM disclaims all liability for tender documents that are not received by the supplier. Only suppliers who have been issued the tender document are allowed to participate in the tender exercise. 5. Submission of Completed Tender Document Suppliers are required to submit duly completed proposals online via the eTender system no later than 6:00PM, 5 November 2024 (Tuesday). BNM shall not be responsible for any loss of tender documents or delayed tender submission. Proof of posting shall not be accepted as evidence for the submission of tender. Any enquiries pertaining to this tender shall be submitted to this email address (bnmtender_IT@bnm.gov.my) and quoting the tender title ‘Enquiry: Consultancy Services for Incident Response Retainer’. Disclaimer BNM shall not be responsible for any delay in the submission of any tender proposals nor loss of the related documents should they be submitted through any other means than that stipulated by BNM. Proof of posting shall not be accepted as evidence of the supplier’s submission of proposal. BNM will also not be responsible for any cost incurred by the suppliers in relation to their participation in this tender exercise. BNM reserves the right to only consider quotation/proposal/documents that are fully completed and submitted on or before the date and time as specified above. Late responses will not be entertained. BNM is not bound to accept the lowest bid or any tender and reserves the right to reject all tenders.