kingdom of saudi arabia - web viewcurrently the employees and contractors of mofa are required to...

لمشروع والمواصفات الشروط كراسةمعلومات لتسجيل االلكتروني النظام تطوير

االلكترونية والبطاقات واالنصراف الحضورالذكية

Request for ProposalBiometric Attendance and Smart Card System

[Intentionally blank]

الذكية االلكترونية والبطاقات واالنصراف الحضور معلومات لتسجيل االلكتروني النظام تطوير of 17

Commercial in Confidence

TABLE OF CONTENTS

1 INTRODUCTION..............................................................................................................................4Purpose..........................................................................................................................................4

Disclaimer.......................................................................................................................................4

Confidentiality.................................................................................................................................4

Structure and Related Documents..................................................................................................5

2 BACKGROUND AND CONTEXT....................................................................................................5Overview of the current business...................................................................................................5

Definitions.......................................................................................................................................5

Site Visit..........................................................................................................................................6

3 SCOPE OF SERVICES REQUIRED...............................................................................................6High Level Description of Services Required.................................................................................6

I. Biometric Attendance Platform...............................................................................................6

II. Smart Card System.................................................................................................................9

Statement of Requirements..........................................................................................................12

4 CONTRACTING APPROACH.......................................................................................................12Contract Details............................................................................................................................12

Pricing...........................................................................................................................................12

Payment........................................................................................................................................13

Reporting......................................................................................................................................13

Draft Contract...............................................................................................................................13

5 INSTRUCTIONS FOR COMPLETION OF REQUEST FOR PROPOSAL RESPONSE...............13Language......................................................................................................................................13

Format of Response.....................................................................................................................13

Deadline........................................................................................................................................14

Clarifications.................................................................................................................................14

Next Steps in the Procurement Process.......................................................................................14

6 SOLUTION COMPLIANCE AND PROPOSAL.............................................................................14Pre-Qualification Conditions.........................................................................................................14

Response Template......................................................................................................................14



1 Introduction

Purpose

This document is the Request for Proposal (RFP) for a Biometric Attendance and Smart Card System to the Ministry of Foreign Affairs (MoFA) of the Kingdom of Saudi Arabia (KSA).

The Ministry of Foreign Affairs in KSA is looking to deploy a Biometric Attendance and Smart Card System that will help in facing the challenge of managing attendance and both logical and physical access control for its employees and contractors at the headquarters and ministry branches in KSA, as well as the embassies and consulates worldwide.

The purpose of the RFP process is for MoFA to set out requirements and for bidders to propose their solutions which will then be evaluated by MoFA.

Disclaimer

1. The information in this document has been prepared in good faith to assist bidders in developing their solutions to Kingdom of Saudi Arabia Ministry of Foreign Affairs’ (MoFA’s) requirements based on the best available information. Investment decisions remain the responsibility of bidders and MoFA accepts no liability or responsibility for its accuracy, adequacy or completeness. No representation or warranty, express or implied, with respect to the information contained in it will be made by MoFA, and any liability is therefore expressly disclaimed.

2. MoFA reserves the right, without prior notice, to terminate the procurement without awarding a contract, to change the basis, the procedures, or time scale for the procurement process, or to reject any proposal for the whole or part of the requirement and to terminate discussions and negotiations with any bidder at any time.

3. Bidders are responsible for all the costs that they incur in connection with the entire bidding process. MoFA will not be liable for any compensation with respect to bidders whose tenders have not been accepted, nor will it be so liable in the event of deciding not to award the tender.

Confidentiality

1. The information contained within this Request for Tenders is sensitive and is made available to bidders by MoFA on the condition that it is used solely in connection with this procurement with individuals within your organisation or your proposed subcontractors.

2. A condition of receipt of this document was your completion of a confidentiality, non-disclosure and non-collusion agreement.

3. Failure to maintain confidentiality will lead to bidders being excluded from further participation in the procurement process and possible legal action.

4. MoFA will not assign a contract to bidders/and their subcontractors, who are subject to a conflict of interest during the procurement process.



Structure and Related Documents

The RFP consists of one main document that includes a statement of requirements document, a compliance matrix sheet and a bill of quantities and pricing sheet. The document is structured into multiple sections. Section 1 contains the introduction and Section 2 provides high level information about current MoFA’s business. Section 3 describes the scope of work and requirements by embedding a statement of requirements document that lists the requirements corresponding to the different business modules. The bidders are required to indicate their level of compliance to each listed requirement using the embedded compliance matrix and describe how they will fulfil the requirements in their responses. Section 4 and 5 present the contracting approach and instructions for completion of the request for proposal response, respectively. Section 6 contains the proposal structure.

2 Background and Context

Overview of the current business

The Ministry of Foreign Affairs is the main government entity that handles all the foreign affairs matters for the Saudi Arabian government in addition to issuing visas. The organization consists of the main Headquarters building in Riyadh, multiple ministry branches and 125 Embassies and Consulates across the globe. MoFA has a total of 7500 employees and contractors worldwide.

Currently the employees and contractors of MoFA are required to register their entries through biometric attendance and access control systems utilizing three separate systems, two systems at the Saudi headquarters and branches and another system at the worldwide embassies and consulates. MoFA monitors the attendance of its staff through the reports generated at headquarters from these biometric attendance and access control systems. The system employed at the embassies and consulates has been experiencing several issues that range from losing entry logs of some of the employees; inability to generate some useful business attendance reports; missing local time zone and daylight savings conversions; or limitations on integrating the entry logs with other MoFA systems, which is mainly due to the proprietary closed architecture of the attendance and access control system technology. Furthermore, the existing biometric readers show tendency to break easily and require extensive efforts to be replaced. Thus, the first objective of this RFP is to identify a vendor to replace the existing Biometric Attendance system at the headquarters and branches, the embassies and consulates. MoFA’s vision is to standardize the biometric attendance and access control systems (logical and physical) at all its locations in KSA and worldwide (headquarters, branches, embassies and consulates).

The second objective of this RFP is for the vendor to identify a suitable Smart Card System that will properly integrate with the Biometric Attendance and Access Control system. Currently the employees and contractors of MoFA are provided with 2 separate cards. The first is the MoFA ID card which contains the photo, some employee information and expiration date. The second card is a contactless smart card that contains the employee’s biometrics. The first card is used for visual checks at entry points, while the second one is used for the biometric time and attendance system. The new Smart Card System shall unify these cards described above in one, and add the logical access capability as a new feature. This means that the new card will be used for visual checks, physical access and logical access.



Definitions

Throughout the RFP, the system is referred to as Biometric Attendance and Smart Card System. For the purpose of this RFP, the word “biometric” will refer to fingerprints and photo. This is the main requirement from the system. However, it should be kept in mind that the solution should account for the possibility of adding other biometric features in the future, such as the iris technology.

The solution for the local MoFA offices in Saudi Arabia (headquarters and branches) will include biometric attendance, access control and smart card system.

The embassies and consulates worldwide will utilize the biometric attendance and smart card system, with the access control functionality as optional.

Site Visit

Currently, MoFA has an existing biometric attendance and access control system where employees are using 2 types of cards. There are multiple doors throughout the ministry for employees and contractors in order to access the facility. The solution proposed shall be compatible with the physical access door system already present at MoFA. For that reason, all the bidders shall perform a survey of the current system through a site visit. This will allow them to see the current physical access system and assess its compatibility and compliance with their solutions. The site visit will also help bidders estimate the size of the work required. The site visit shall be coordinated with MoFA after the submission of the proposals.

Bidders should take all the tools and equipment necessary to survey the existing systems during their site visit and not to rely or assume that MoFA will provide any of the equipment or tools for this purpose. As a result of the site visit, bidders are requested to provide recommendations for the amendment of the bill of quantities as necessary within the technical offer, and the Ministry of Foreign Affairs keeps the right of taking these recommendations into consideration or not.

3 Scope of services required

High Level Description of Services Required

The solution requested in this RFP is basically composed of 2 main systems that are required to interface seamlessly. The solution shall take in consideration the low bandwidth at certain MoFA locations worldwide. This has to be considered when designing the system. The 2 main systems in the solution are the following:

I. Biometric Attendance PlatformII. Smart Card System

In the following sections, these 2 systems will be described in more details.

I. Biometric Attendance Platform

The Biometric Attendance Platform will be deployed in all MoFA locations worldwide (MoFA headquarters in Riyadh, MoFA branches in KSA and MoFA embassies and consulates globally). The solution shall be able to integrate with MoFA’s existing systems such as Oracle Time and Labor,



Microsoft Active Directory, Microsoft SharePoint, RFID employee tracking solution. The Biometric Attendance Platform shall contain at least the following business components as depicted in figure 1:

Biometric Time & Attendance Capture Distributed Management Central Management

Biometric Time & Attendance Recorder

Embassies/Consulates/MoFA Branches MoFA Headquarters (Riyadh)

Central Management

Distributed Management

Biometric Reader and Card Reader with Biometric Matching

DB

Three Tired Solution Server Farms

DB

Web Enabled Business ReportsSystem Monitoring

Reports

Backup Server Farms

Headquarter Systems (ERP, RFID, etc.)

Storage

Smart Card System

Biometric Enrollment

Private/Public Network

Enrollment

Figure 1: Biometric Attendance Platform Business Modules

Biometric Time & Attendance CaptureThe Biometric Time & Attendance Capture business module consists of card and biometric reading, biometric verification, temporary storage, surveillance camera, and a kiosk connecting all the previous equipment. The kiosk shall be a complete biometric capture station which can also include anything that complements the solution (such as hand hygiene dispensers). The solution shall provide multiple design options for the kiosk. The kiosk shall have a professional and elegant look and feel to it and it shall be designed as a plug and play solution. The kiosk’s final design shall be approved by MoFA before it is used. MoFA will be responsible of shipping the kiosks to their locations worldwide.



The card reader will read the employee card to capture the biometrics and biographic data from the smartcard chip, and perform identity verification against the biometrics captured through the biometrics reader to register the employee’s attendance. This business module is expected to connect to the headquarters through a private/public network to transfer the attendance action logs to a central management database. This module also backs up the action logs and video logs into a distributed management database. The requested storage will prevent the registered actions and surveillance videos from being lost if the network connection breaks down, but these logs will be deleted once they have been transmitted to the Central Management module.

The cameras will be used to capture videos to monitor any abuse of the reader devices and ensure that no one is tampering with or damaging them. Hence, the camera position shall be suitable for detecting any action taken at the device. The monitoring shall be done 24/7 and the cameras shall be HD/Megapixel cameras for enhanced video quality.

Distributed ManagementThe Distributed Management business module includes the capability of storing a large volume of entry/exit logs and surveillance videos spanning a configurable period as well as the necessary biometric enrolment devices and applications to be used at the embassies and consulates. As an added measure to protect the action logs and videos, the distributed management will carry an archive of the action logs and videos in its database, and data replication tasks will automatically execute on a periodic basis between the distributed management and central management databases as the network connection preserved with the headquarters. Each embassy or consulate has a technical employee, who is responsible to troubleshoot technical issues encountered with the Biometric Time & Attendance Capture, control the False Acceptance Rate (FAR) thresholds of the biometric verification, or produce attendance reports from the distributed management module.

The biometric enrolment of new employees at embassies, consulates and MoFA branches shall be done at the distributed management. The information of the new employee, including their biographic information, photo and biometrics will be sent to the central management by the distributed management. The printing and

issuance of the employees smart ID cards will be done centrally at MoFA’s headquarters (central management).

Central ManagementThe Central Management module consists of a three tiered solution with a backup solution to be hosted in the headquarters data centres. The central management module shall have an open architecture enabling other systems, such as Microsoft Active Directory, Microsoft SharePoint, Oracle Government Resource Planning (GRP) and Oracle Time and Labor systems to interface with the central database. The central management module shall come with service monitoring and reporting utilities to alert administrators on system outages or connection issues as well as produce service reports. The monitoring shall handle all components related to biometric attendance system, such as the application itself, biometric readers, controllers, gates...etc. The system infrastructure components at the data centres shall be monitored by MoFA’s existing monitoring solutions. The reporting utility shall also generate online business reports for MoFA employees, Human Resources departments, and upper management by gathering data from multiple interfacing systems, such as displaying employee full data in the periodic attendance reports by retrieving employee data from Human Resources Management System (HRMS) and tracking employee total weekly recorded hours including absences and vacations (web reporting capability).



MoFA employees at MoFA’s headquarters will enrol at the Central Management, while others will enrol at the Distributed Management at the branches, embassies and consulates. The Distributed Management modules will send the new employee information (biographic, biometric and picture) to the Central Management. Then, the Central Management will save this information locally and it will interface with the Smart Card System (CMS and CPS) in order for the new smart ID cards to be printed and issued centrally. MoFA will ship the smart cards of the requests that came from the distributed management to the proper branches, embassies or consulates.

The Central Management module should also have the capability to play surveillance videos and link them to certain actions. For example, if the Administrator of the system wants to see only the part of the surveillance video showing a certain employee while that employee is verifying their biometric data on a certain date, he should be able to do so by specifying the employee and the date in the surveillance reporting tool.

The above business components were defined as separate modules to facilitate to the bidder comprehending the expected Biometric Attendance Platform functionalities; however, the Biometric Time & Attendance Capture and Distributed Management business modules can be coupled into one system installed at each embassy or consulate. The objective here is for the bidder to provide detailed description on the solution modules that support the above functionalities.

The Time and Attendance platform at the central management shall be responsible of providing detailed reporting for an employee’s time sheet, entry and exit points, times and dates, locations visited during a working day...etc. In order to produce these reports, the Time and Attendance platform shall be capable to integrate or interface with some of MoFA’s existing systems:

Oracle Time and Labor Microsoft Active Directory Microsoft SharePoint RFID Employee Tracking System Physical Access System

The RFID tracking system is an existing solution at MoFA that uses active tags used to track an employee’s movements between specified zones within MoFA. The system will record the zones that the employee visits and which time they were visited. The Time and Attendance solution shall be able to interface with the RFID system and pull the necessary data in order to include the employee’s tracking information within the reports produced.

Each of the systems below might have their own database(s). The Time and Attendance platform shall have its own database to which it can pull all the information needed from these databases and produce time and attendance views and reports.

II. Smart Card System

The Smart Card System shall be composed of the following:

Card Management System (CMS) Card Printing System (CPS) Smart Cards

The figure below (Figure 2) describes the environment that the Smart Card System will be part of. The items highlighted in green are in scope for this RFP. The other items are the ones that the Smart Card System will need to integrate with. These are listed below:

Active Directory Physical Access Control Systems



Biometric Attendance Platform GRP/HRMS

The Smart Card System will be used for the logical access to MoFA machines and programs (onsite and remotely through Windows login), physical access in order to get inside the buildings and as an ID card which can be used for visual checks by security personnel at entry points or inside the Ministry and Embassies.

Employee Operator

Logical access

Physical access

Card Management System

Badging

Biometric Enroll.

Active Directory Certification Authority Card Printing System Access Control

Encryption/Authentication

Certificate

Web-Based Service

Biometric Attendance Platform GRP, RFID, etc...

Figure 2: Smart Card System Environment

Description of the Smart Card System ComponentsThe Smart Card System will be composed of multiple components. A description of each component is below. The technical requirements will be listed in the Technical Requirements document attached in the Statement of Requirements section.

1. Card Management System (CMS):The Card Management System will be the system responsible of managing the smart cards throughout their lifecycle. The CMS shall provide a complete, flexible and configurable solution that will issue, maintain and terminate smart cards. The CMS shall also provide MoFA with a way to manage their smart cards and the digital credentials present on the cards. The CMS shall also support SSO if needed.



The CMS should help MoFA save time and cost with the deployment of smart cards to its employees worldwide. The system shall be a highly scalable platform for managing smart cards with multiple functions (logical access, physical access and ID).

As described in the figure above, the CMS should be able to integrate with a variety of systems, such as active directory, access control readers and biometric attendance platform. The CMS shall include customizable workflows and policies that can interface and integrate with such systems and environments.

The system shall provide a centralized tool to define policies and monitor card policies and access rights as well as auditing. The system administrators shall have a single interface to manage and define user policies, as well as defining smart card templates and processes.

The CMS shall provide a web-based service capability for administrators in order to manage the smart cards, check on their lifecycle and manage the card’s data (such as certificates). It shall also integrate with the GRP and other related systems at MoFA to add/remove and update employee information. An automatic update to the cards information is also required when the employee uses the card to log on to the system. Administrators shall have the capability of hard or soft blocking the cards and also add/remove and update the employee information.

The vendor shall provide a full migration plan from the current CMS at MoFA. Full Arabic and English support shall be required from the system. The CMS solution shall integrate with the existing systems at MoFA and their databases if needed (GRP, HRMS, Biometric Attendance…etc).

2. Card Printing System (CPS)The Card Printing System will be responsible for printing the smart cards with the proper information defined in the smart card section below. The CPS should be compatible with the CMS and should be able to print ID cards in a reasonable amount of time.

The system shall provide card printing capability and provide the printer itself with the associated system to allow the operator to perform employee card printing from a single interface. The Card Printing System will be located at MoFA’s headquarters in Saudi Arabia. The printers employed in the CPS shall use laser engraving technology for printing the smart ID cards.

3. Smart CardsThe Smart Cards required for this project shall support multiple security mechanisms:

a. Photo ID badge for physical identification b. Physical Access c. Logical Access

The Smart Cards shall enable secure storage for credentials (passwords, certificates, biometrics...etc). They shall support remote access capabilities and provide strong authentication of users. The smart cards shall also be tamper resistant to protect the sensitive data stored on them. Also, the smart cards shall provide multiple levels of security in order to prevent fraud. The different security uses of the cards are described below:

a. Photo ID badge for physical identification The smart cards shall provide the required biographic information needed for visual verifications by security personnel in order to identify the employee/contractor. The information



printed/engraved on the card shall be durable and lasts at least 5 years. Such information could include the following, but not limited to:

- Facial Photo- Name- Job Title- Department- Card Validity (issuance and expiration date)- Employee Identification Number

b. Physical AccessThe smart cards shall have the required features to enable physical access. The cards shall contain a contactless electronic chip that will be used for storing their biometrics/information and allow them access to MoFA. The security gates at MoFA will be equipped with contactless card readers and fingerprint readers. The employees and contractors will use the cards and their fingerprints in order to be granted access.

c. Logical Access The required smart cards shall support logical access. They shall include an electronic chip in order to allow employee to use the card at their PCs and workstations for authentication before accessing the Windows Operating System.

The card shall support out of the box integration with Microsoft Windows Login Authentication (Windows 7). The solution shall provide any software or middleware necessary to interact with the smart card and perform the logical access to the OS or other required applications. The card shall provide secure and reliable cryptographic operations including both symmetric and asymmetric algorithms to enhance application security.

The logical access shall support PKI technology for authentication.

Statement of Requirements

MoFA has developed a Statement of Requirements which sets out the range of services required from the vendors. These requirements consist of functional, technical and personnel and subcontractor requirements that are sought by MoFA in this RFP.The format of response is linked to each of these requirement sets and requires bidders to explain how they propose to deliver the desired services in a way that meets MoFA’s objectives.

Requirements are not optional and bidders will be penalised in the evaluation for noncompliance of or changing the requirements. In The attachment No. 1 is the complete statement of requirements:

Bidders shall respond and state the level of compliance of their solution using the attachment No. 2 of the compliance matrix:



4 Contracting Approach

Contract Details

The bidders are requested to describe their offered solutions and the pricing in the proposals and MoFA will award the contract to the best economical solution. The Ministry of Foreign Affairs is expecting to have the new biometric attendance and smart card system operational at MoFA headquarters and branches in KSA within 6 months from contract signature. The embassies and consulates worldwide shall be operational in the following 6 months (1 year for total completion) with a phased approach that the vendor shall propose. The Ministry of Foreign Affairs is expecting to issue one contract for all the services described in this document. An additional 2 years for support starting from project go live date bring the contract to a total of 3 years.

Pricing

MoFA requires compiling for each bidder their own pricing sheet covering the costs for devices/hardware, software, and recourses required to implement and rollout the biometric attendance and smart card system. The software licenses should also be included. Bidders shall use the attachment No. 3 of the pricing sheet to provide this information:

Payment

Payments will be by results and suppliers will only be compensated for successfully completed deployment. Supplier will bear the costs of unsuccessful deployment or failure to submit the required deliverables.

Reporting

MoFA expects suppliers to minimise the management burden of MoFA by putting in place reporting systems that alert MoFA to performance failures and make clear the consequences and mitigation actions to be taken to prevent recurrence.

Draft Contract

Draft terms and conditions are attached. MoFA does not intend to negotiate on the overall contractual approach but bidders are invited to identify specific problematic clauses by marking up electronically a copy of this document.



5 Instructions for completion of Request for Proposal response

Language

The response should be completed in English.

Format of Response

The response should be provided in the template described in this document:

using Arial Font 11, maintaining the word limit (words beyond the limit will not be marked) excluding reasonable attached diagrams, Including diagrams and attachments as either inserted images or embedded files in MS Office or .pdf format

Naming the response file in the format “BASCS1 RFP response for [Company name]”

Saved as Word 2003 format on a CD-Rom and an additional printed copy of the response file to be included as well

Accompanied by a single bound, dated and signed copy and sent in a sealed envelope to:

Attention: Director of ProcurementMinistry of Foreign Affairs

P. O Box 5593711544 Riyadh

Kingdom of Saudi Arabia

Deadline

Bids should arrive by the date set by the purchasing department at MoFA for this RFP

Bids submitted or received after that date shall not be accepted

Clarifications

Clarification questions should be sent by email to [[email protected]]three weeks prior to the submission date set by the purchasing department

Questions and responses will be made anonymous and shared with all bidders

Next Steps in the Procurement Process

Sealed-bids shall be opened by the Sealed-bids Opening Committee on the date set by the purchasing department at MoFA, and bid prices shall be announced to tenderers present or their representatives.

In line with the commercial and evaluation approach, short listed bidders will then be invited to conduct focused negotiations.

6 Solution Compliance and Proposal



The bidders are requested to submit a proposal that shall follow the structure described in this paragraph. MoFA will only open response envelopes of those respondents, whose RFP Response is in order. The respondents will be assessed starting on the pre-qualification conditions.

The respondents should clearly indicate, giving explicit documentary evidence with respect to the conditions, in absence of which, the response would be rejected at pre-qualification stage.

Pre-Qualification Conditions

Minimum five years' experience implementing Biometric Attendance Platforms and Smart Cards for government agencies or commercial organizations at the global level and shall list supplying contact information of these clients for experience verification

Response Template

The bidders in their responses shall be adherent to the following schema. The response shall not exceed 80 pages.

1. Prequalification condition responses

[Provide all the required documentation that proofs the compliance to pre-qualification criteria.]

2. Organizational information

[Provide a brief description of the background and organization of your company/ entity and each associate company for this assignment. Also provide a brief description on the ownership details, date and place of incorporation of the company, objectives of the company etc.]

3. Selected past experiences

[Provide a summary of selected relevant past project experiences in implementations of Biometric Attendance platforms and Smart Card solutions. The response should include an overview of selected past project experiences on Biometric Attendance technologies, including, but not necessarily limited to: Client name, Project start-end dates, Business challenges, Solution description, Volumes of Users].

4. Executive summary

[This section should be a succinct statement and executive summary by the Bidder highlighting the key aspects of solution proposal.]

5. Solution proposed for MoFA

[The solution proposal must address the requirements section and must show how the general aims and objectives of MoFA can be achieved. The bidder must provide a clear description of their understanding of the requirements. The solution shall clearly identify all the required



information in terms of Devices, SW, HW, platform deployment, associated configuration, and system integrations. The solution shall address all the Requirements]

6. Project management plan

[Bidders’ should propose the main activities of the project, duration, phasing and interrelations, milestones and delivery dates. The proposed work plan should be consistent with the technical approach and methodology, showing understanding of MoFA requirements and ability to translate them into a feasible working plan. A list of the final documents, including reports, specifications, etc… to be delivered as final output, should be included.]

7. Organization & staffing

[Number of people proposed for delivering the solution as required in the RFP. Level of skills & relevant experience of the individuals proposed. Organization chart and responsibility of proposed resources]

8. Quality assurance, maintenance & support

[Bidders are required to propose their Quality Assurance framework and testing plans. This section should also present Bidder’s detailed maintenance and support plan for the MoFA solution including detailed information on these plans. ]

9. Compliance matrix

[Bidders are required to describe the compliance to the MoFA Requirement, providing the compiled Compliance matrix to MoFA.]

In a separate envelope shall be included the financial response:

[Bidders are required to compile the financial response, clearly describing the costs for all the components. The items included shall be clearly identified].



[Intentionally blank]

