TaxTMI 
TaxTMI 
CBIC Connectivity Partner Protocol
X X X X Extracts X X X X
X X X X Extracts X X X X
....BIC Connectivity Partner Protocol <br>News and Press Release<br>Dated:- 1-11-2022<br><BR>============= Document 1 Central Board of Indirect Taxes and Customs सीमा शà¥à¤²à¥à¤• AND CUSTOMS अपà¥à¤°à¤¤à¥à¤¯à¤•à¥à¤· कर à¤à¤µà¤‚ INDIRECT TAXE सतà¥à¤¯à¤®à¥‡à¤µ जयते à¤à¤¾à¤°à¤¤ सरकार OF INDIA GOVERNMENT O देशसेवारà¥à¤¥ करसंचय Central Board of Indirect taxes and Customs (CBIC) Department of Revenue, Ministry of Finance, Government of India CBIC Connectivity Partner Protocol October 2022 1 Table of Contents 1. Overview........ Central Board of Indirect Taxes and Customs 3 2. Requirements: 3. Important instructions for "CBIC Connectivity Partnersâ€. 6 7 Annexure 1 - Types of Connectivity..... Annexure 2 - Minimum Specifications for Equipment.......... Annexure 3 - Security Agents ......... 9 18 Annexure 4 - Resident Engineer .19 Annexure 5 - Non-Disclosure Agreement (NDA) .20 Annexure ....
X X X X Extracts X X X X
X X X X Extracts X X X X
....6 – Infrastructure Checklist... 24 Annexure 6A - IP request form details .26 Annexure 6B - Details regarding RF link .27 Annexure 7 - Container Scanner Solution 28 Annexure 8 - Unblocking of IPs........ 29 Annexure 9: Single Point of Contact (SPOC) Details....... .30 Restricted Page 2 of 30 Central Board of Indirect Taxes and Customs 1. Overview Reference is invited to CBIC Notification No. 26/2009-Customs(N.T.) dated 17th March 2009 bringing into effect the “Handling of Cargo in Customs Areas Regulations 2009†(referred in short as 'Regulations') and Circulars Nos. 13/2009-Customs dated 23rd March 2009, No. 21/2009-Customs dated 4th August 2009 and Circular No. 4/2011-Customs dated 10th January 2011. The above Regulations/Circular issued by CBIC prescribe, inter-alia, that the networking, communication equipments, Uninterrupted Power Supply System, desktops, servers, printers other computer peripherals and secure connectivity to the CBIC Data Centers as specified by the Directorate General of Systems shall also be provided by the custodians. It has further been provided that these instructions apply to all the Custodians of ports, airpor....
X X X X Extracts X X X X
X X X X Extracts X X X X
....ts, Inland Container Depots (ICDs), Container Freight Stations (CFSs), Integrated Check posts (ICPs), Land Customs Stations (LCSs), the major ports notified under the Major Ports Act 1963 and the airports notified under the Airports Authority of India Act, 1994. Furthermore, Special economic zones have also been deemed to be Ports/ICDs under section 7 of the Customs Act 1962 Here in after, Custodians and other formations for e.g. SEZ, requiring access to CBIC's Data Centers will be referred to as "CBIC Connectivity Partner". This document provides the current technical details for network connectivity and IT infrastructure for “CBIC connectivity Partner". Restricted Page 3 of 30 Central Board of Indirect Taxes and Customs 2. Requirements: 1. The "CBIC Connectivity Partner†would be required to provide MPLS connectivity for access to the Data Centers. M/s BSNL and M/s TCL are the authorized service providers of CBIC for primary connectivity and alternate connectivity respectively as they already have presence at the Data Centers. Refer to Annexure 1 for various options of connectivity to the Data Center and Annexure 9 for details of SPOC of authorized ....
X X X X Extracts X X X X
X X X X Extracts X X X X
....MPLS service providers. 2. It is mandatory for the "CBIC Connectivity Partner†to take Partner MPLS connectivity to the Data Center-Delhi as well as Data Center - Chennai to ensure business continuity in the event of a contingency as well as disaster recovery. 3. In case of MPLS, the last mile connectivity to the site should preferably be through Optical Fiber Cable (OFC) or Radio Frequency(RF). In case of Optical fiber, it is suggested that the underground fiber laid should have proper ducting and the routes taken by the fiber shall avoid digging prone areas thereby ensuring minimum or no disruption to CBIC services. In case of RF, site needs to share Annexure 6 B with the required details. 4. A bandwidth estimate of about 250 kbps per user should be used while calculating the total MPLS bandwidth requirement for the whole site. 5. The "CBIC Connectivity Partner†is responsible for providing all the equipment for IT Infrastructure and connectivity, including Local Area Network (LAN) Infrastructure such as desktops, printers (including Line Printers), UPS, Routers, LAN Switches, file & print servers, air-conditioning, power backup, furniture etc. The Spe....
X X X X Extracts X X X X
X X X X Extracts X X X X
....cifications of equipment deployed by CBIC at its locations are detailed in Annexure 2 for reference. The infrastructure procured by "CBIC Connectivity Partner" must have equivalent or higher specifications. The annual maintenance and proper upkeep of these equipments would also be the responsibility of the "CBIC Connectivity Partner". 6. To maintain secure access to CBIC's Data Center, the IT setup deployed at the site would have to integrate with CBIC's security agents provided in Annexure 3. 7. The "CBIC Connectivity Partner" would be required to provision Resident Engineers (R.E.) as per their working hours who would be responsible for day-to- day support and maintenance of the Local IT Infrastructure. Minimum qualification of R.E.s (as deployed by CBIC) is provided in Annexure 4. The "CBIC Connectivity Partner" through their resident engineers would have to ensure and monitor that virus definition of antivirus is updated to latest version, DLP Agent should be online and APT Sensor is up and running fine. 8. The "CBIC Connectivity Partner†should ensure that CBIC LAN is segregated for security and not connected to their local LAN. 9. "CBIC Connectivity Part....
X X X X Extracts X X X X
X X X X Extracts X X X X
....ner" would be required to sign a Non-Disclosure Agreement (NDA) on a stamp paper. The NDA has to be countersigned by the Jurisdictional Principal Commissioner/Commissioner of Customs. The format of this agreement is enclosed at Annexure 5. Once the infrastructure is ready, the "CBIC Connectivity Partner" is required to fill up the Infrastructure checklist enclosed at Annexure 6 & 6A, and have it verified and signed by the concerned customs officer located at the site. The Non-Disclosure Agreement and Restricted Page 4 of 30 Central Board of Indirect Taxes and Customs Infrastructure checklist in original is required to be submitted to the Jurisdictional Principal Commissioner/Commissioner of Customs. 10. The above stated documents have to be shared by Concerned Nodal Officer/System Manager over email to CBIC ([email protected]) for issue of LAN IP pool. Restricted Page 5 of 30 Central Board of Indirect Taxes and Customs 3. Important instructions for "CBIC Connectivity Partners" 1. All "CBIC Connectivity Partners†must ensure that the infrastructure at their locations is compliant with the latest guidelines as shared by CBIC under the Partner Conne....
X X X X Extracts X X X X
X X X X Extracts X X X X
....ctivity Document. 2. In request for additional LAN IPS/ new LAN IPs, the "CBIC Connectivity Partner" should re-share the infrastructure checklist to highlight the compliance with CBIC requirements. For all additional IPs a mapping of additional users with systems needs to be shared beforehand by the respective Systems Manager/ Alternate Systems Manager 3. The "CBIC Connectivity Partner" understand and agree that the LAN IPS allotted to the site may be blocked in scenarios where in security concerns are observed for the site. Refer Annexure - 8 for details of the process for unblocking IPs. 4. In case there is any issue which is related to WAN connectivity, they need to contact their local service providers and get it resolved. Also, all LAN related issues and configurations will be site's responsibility. 5. If the "CBIC Connectivity Partner†is looking to set up a container scanner, they have to procure their own infrastructure. Kindly refer to Annexure 7 for details. 6. Audit for the security practices, implementation of security policy and vulnerability assessment can be conducted by a 3rd party appointed by CBIC as and when it is required. The report of t....
X X X X Extracts X X X X
X X X X Extracts X X X X
....he 3rd party auditors should rate the security implementation in three grades viz. Satisfactory, Requires Improvement and Unsatisfactory. The report of findings should be submitted to CBIC with copy to concerned “CBIC Connectivity Partner" for consideration. CBIC will randomly select few sites for security audit. For any deviation found from the policy as per the audit report, the rectification will have to be borne by the "CBIC Connectivity Partnerâ€. It is to be noted that the cost of the audit shall be borne by the "CBIC Connectivity Partner" at the prescribed rate by CBIC. Restricted Page 6 of 30 Central Board of Indirect Taxes and Customs Annexure 1 - Types of Connectivity A. Connectivity Options to the CBIC Data Centers a) Access through the MPLS Cloud: The "CBIC Connectivity Partner†can connect to CBIC Data Center - Delhi and CBIC Data Center - Chennai with the partner MPLS Cloud primarily through M/s BSNL and alternatively through M/s TCL. (VPN Client is not required in case of MPLS connectivity). b) VPN over BroadBand through BSNL (VPNoBB): In case MPLS network is not available, the site can connect to Data Center by procuring VPN over ....
X X X X Extracts X X X X
X X X X Extracts X X X X
....Broadband connection through M/s BSNL with "CBIC" domain (VPN Client is not required in case of this connectivity). c) VPN over Internet (VPNol): VPN over internet can also be taken by procuring internet connectivity through any ISP and getting VPN IDs created for users through Saksham Seva Helpdesk. For VPN ID Creation/Modification, Users can fill the required templates (enclosed in annexure ) and reach out to Saksham Seva through their Nodal Officers/System Managers (VPN client is required in this case and the link for installation of the same are provided by Saksham Seva to the user). Note: 1) The VPNOBB and VPNol connectivity should only be procured by sites with less than 5 users or as an alternate to the MPLS connectivity to ensure business continuity in case of frequent disruptions. 2) All the Network Switches and Routers at the location accessing CBIC's Data Centers must support 802.1x to enable integration with CBIC's Network Access Control (NAC). B. Connectivity of stakeholders authorized by CBIC for Message Exchange Stakeholders having voluminous and time-sensitive message exchange has an option to build point to point links between the Stakeholder's Da....
X X X X Extracts X X X X
X X X X Extracts X X X X
....ta Center and Data Centers of CBIC at New Delhi and Chennai. In this case, partner locations will be connected to both Data Center-Delhi & Data Center-Chennai of CBIC on separate Point to Point Links. CBIC will only work as a facilitator and the responsibility for arranging the actual connectivity remains with the partner agency. Secure File Transfer Protocol (SFTP/MFTP) can also be used as Communication Mechanism for Message Transfer with other CBIC partners. With Secure file transfer Protocol, users can pick up and drop files on the dedicated file transfer server in the directories assigned to their respective user ids in a secure manner. It may be noted that plain file transfer protocol (FTP) will not be allowed. a) Details Required for Creation of SFTP/MFTP User ID for Message Exchange Please fill the attached template. SFTP-MFTP Creation Template.xlsx Tab 1 User creation template Restricted Page 7 of 30 Central Board of Indirect Taxes and Customs Tab 2 - Firewall port opening template Team After filling the required template, send a mail to the Icegate shift manager ([email protected]), keeping copy to CBIC Lanwan ([email protected]) a....
X X X X Extracts X X X X
X X X X Extracts X X X X
....nd Saksham Seva ([email protected]). b) Password policy and reset procedure i.User will be provided with a unique user-id and password at the time of user creation. ii.Newly provided password will expire after 60 days. User will start getting the notification to reset the password within 7 days prior to the expiration. iii.User needs to raise an interaction by sending an email to [email protected] with a copy to [email protected]. Password reset request should be routed through the Nodal officer/System Manager or along with their approval on mail. Restricted Page 8 of 30 Central Board of Indirect Taxes and Customs Annexure 2 - Minimum Specifications for Equipment Minimum Specifications for Equipment at “CBIC Connectivity Partner" Locations 1. Specifications for Desktop ITEM Memory Processor Operating System Chipset Display Specifications of equipment deployed by CBIC 8GB DDR4-2133 SODIMM (1x8GB) RAM Intel Core i5-6500 3.2G 6M 2133 4C CPU Windows 10 Pro 64-bit OS Yes (Intel® 100 Series H Chipset) 20-inch or above Peripherals Network interface Network Power supply Bundled software USB Business Slim Keyboard #ACJ, ....
X X X X Extracts X X X X
X X X X Extracts X X X X
....USB Mouse 10/100/1000 Mbit/s Gigabit Ethernet LAN, Broadcom BCM943228Z 802.11n M.2 noBT NIC • TCP/IP with DNS and DHCP wake on LAN • DHCP support for automatic firmware upgrades and unit configuration PPP (PPPOE, PPPTP) 120W External Power Supply • Office productivity suite (with support upgrades) & • Mozilla Firefox (Version 38 or later) • Adobe acrobat reader • flash player Regulatory • JRE 8.0 or above ENERGY STAR Certified Label standards Security TPM 1.2 security chip, hard drive encryption 2. Specifications for 24 Ports Switch Restricted Page 9 of 30 Central Board of Indirect Taxes and Customs 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. S.No. Specifications of equipment deployed by CBIC 24 RJ-45 autosensing 10/100/1000 ports (IEEE 802.3 Type 10BASE-T, IEEE 802.3u Type 100BASE-TX, IEEE 802.3ab Type 1000BASE-T) Mounts in an EIA-standard 19 in. telco rack or equipment cabinet Throughput- up to 95.2 MBPS Routing/Switching capacity- 160 Gbps Non-blocking and distributed forwarding hardware architecture All interfaces provide wire speed forwarding for both OFC and copper modules IP Mult....
X X X X Extracts X X X X
X X X X Extracts X X X X
....icast - RFC 3376 IGMPv3 Switches support 8 hardware queues per port Dynamic Host Configuration Protocol (DHCP) snooping Switch supports LLDP and LLDP-MED capabilities IP source guard & Dynamic ARP Inspection/ Protection Secure Shell (SSH) Protocol and Simple Network Management Protocol Version 3 (SNMPv3) to provide network security by encrypting administrator traffic during Telnet and SNMP sessions. 1 RJ-45 serial console port 1 RJ-45 out-of-band management port Delivers secure encryption of all access methods (CLI, GUI, or MIB) through SSHv2, SSL, and/or SNMPv3 Provides up to 336 Gbps of stacking throughput; each 4-port stacking module can support up to 42 Gbps in each direction per stacking port The Switch supports internal redundant power supply Advanced classifier-based QoS FTP for upgrading the operating System 15. 16. 17. 18. IEEE 802.1x support 19. 20. IEEE 802.3ad Link Aggregation Protocol (LACP) and HPE port trunking Supports management via CLI, Web interface SNMP v1, v2, v3 Manageable through both IPv4 & IPv6 with standard security features of both IPv4 & IPv6 Restricted Page 10 of 30 21. 22. 23. Central Board of Indirect Taxes and Customs....
X X X X Extracts X X X X
X X X X Extracts X X X X
.... The stacking on the Switch provides the functionality to configure multiple switches in a single switching unit. Each unit/stack has the capability to be managed using a single IP address. Layer 3 Switch with following features like static IP routing OSPF, OSPFV3, RIP and policy based routing. - IPv6 host -Dual stack (IPv4 and IPv6) -MLD snooping - IPv6 ACL/QoS - IPv6 routing -6in4 tunneling 3. Specifications for 48 ports Switch S.No. 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. Restricted Specifications of equipment deployed by CBIC 48 RJ-45 autosensing 10/100/1000 ports (IEEE 802.3 Type 10BASE-T, IEEE 802.3u Type 100BASE-TX, IEEE 802.3ab Type 1000BASE-T) Mounts in an EIA-standard 19 in. telco rack or equipment cabinet Throughput-up to 190.5 MBPS Routing/Switching capacity- 320 Gbps Non-blocking and distributed forwarding hardware architecture All interfaces provide wire speed forwarding for both OFC and copper modules IP Multicast - RFC 3376 IGMPv3 Switches support 8 hardware queues per port Dynamic Host Configuration Protocol (DHCP) snooping Switch supports LLDP and LLDP-MED capabilities IP source guard & Dynamic ARP Inspection/ Protection Sec....
X X X X Extracts X X X X
X X X X Extracts X X X X
....ure Shell (SSH) Protocol and Simple Network Management Protocol Version 3 (SNMPv3) to provide network security by encrypting administrator traffic during Telnet and SNMP sessions. 1 RJ-45 serial console port 1 RJ-45 out-of-band management port Page 11 of 30 Central Board of Indirect Taxes and Customs 13. Delivers secure encryption of all access methods (CLI, GUI, or MIB) through SSHV2, SSL, and/or SNMPv3 14. Provides up to 336 Gbps of stacking throughput; each 4-port stacking module can support up to 42 Gbps in each direction per stacking port 15. 16. 17. 18. 19. 20. 21. 22. 23. The Switch supports internal redundant power supply Advanced classifier-based QoS FTP for upgrading the operating System IEEE 802.1x support IEEE 802.3ad Link Aggregation Protocol (LACP) and HPE port trunking Supports management via CLI, Web interface SNMP v1, v2, v3 Manageable through both IPv4 & IPv6 with standard security features of both IPv4 & IPv6 The stacking on the Switch provides the functionality to configure multiple switches in a single switching unit. Each unit/stack has the capability to be managed using a single IP address. Layer 3 Switch with following featur....
X X X X Extracts X X X X
X X X X Extracts X X X X
....es like static IP routing OSPF, OSPFV3, RIP and policy based routing. - IPv6 host -Dual stack (IPv4 and IPv6) -MLD snooping - IPv6 ACL/QoS - IPv6 routing -6in4 tunneling 4. Specification for Print/File Server SI Item Specifications of equipment deployed by CBIC No. 1 Chassis 5U Rack Mountable or Tower 2 CPU Two numbers of latest generation Intel E5-2630v4 processor Restricted Page 12 of 30 Central Board of Indirect Taxes and Customs 3 CPU L3 CACHE 25MB L3 cache Memory 4 Motherboard 5 Memory 6 Memory Protection Intel® C610 Series Chipset 8 GB RAM Advanced ECC with multi-bit error protection and memory online spare mode 8 HDD bays scalable up to 48 SFF max, HDD/SSD. DVD-RW Drive 7 HDD Bays 8 Optical drive Bay 9 Hard disk drive 2 x 300GB 10K SFF SAS drive. 10 Controller 11 Networking features PCIe 3.0 based 12Gb/s SAS Raid Controller with RAID 0/1/1+0/5/50/6/60/1 Advanced Data Mirroring/10 Advanced Data Mirroring with 2GB Flash backed write cache 1Gb 4-port network adaptor supporting advanced features such as Large Send offload capability, TCP checksum and segmentation, VLAN tagging, MSI-X, Jumbo frames, IEEE 1588, and vi....
X X X X Extracts X X X X
X X X X Extracts X X X X
....rtualization features such as VMware NetQueue and Microsoft VMQ. Serial 12 Interfaces 1 Micro SD slot 1 USB 2.0 Ports 5 (2 front, 2 rear, 1 internal) USB 3.0 3 (2 rear, 1 internal) 13 Bus Slots Nine PCI-Express 3.0 slots, atleast three x16 slots 14 Power Supply 15 Fans 16 Graphics Redundant platinum Power Supplies Redundant hot-plug system fans 16 bit color: maximum resolution of 1600 x 1200 Integrated Matrox G200 video standard 32 bit color: maximum resolution of 1280 x 1024 16 MB Flash 256 MB DDR3 17 Industry ACPI 2.0b Compliant Standard PCle 3.0 Compliant Compliance PXE Support WOL Support Novell Certified Restricted Page 13 of 30 18 Central Board of Indirect Taxes and Customs IPMI 2.0, SMASH CLP, DCMI 1.0 compliant Microsoft® USB SMBIOS ASHRAE Logo 3.0 certifications Support 2.7.1 A3/A4 Embedded system management Energy Star Supports monitoring ongoing management, service alerting, reporting and remote management with embedded Gigabit out of band management port Server supports configuring and booting securely with industry standard Unified Extensible Firmware System supports RESTful ΑΡΙ integra....
X X X X Extracts X X X X
X X X X Extracts X X X X
....tion System management should support provisioning servers by discovering and deploying 1 to few servers with Provisioning Intelligent System supports embedded remote support to transmit hardware events directly to OEM or an authorized partner for automated phone home support 19 Security Power-on password Setup password Serial Power interface switch control security Administrator's password TPM 1.2 UEFI 20 20 Operating Systems Microsoft Windows Server and Canonical Ubuntu Virtualization Red Hat Enterprise Linux (RHEL) Software SUSE Linux Enterprise Server (SLES) Support VMware Citrix XenServer 21 Secure encryption Supports Encryption of the data on both the internal storage and cache module of the array controllers using encryption keys. 22 22 Warranty Server Warranty includes 3-Year Parts, 3-Year Labor, 3-Year Onsite support with next business day response. Restricted Page 14 of 30 Central Board of Indirect Taxes and Customs 23 23 24 Provisioning Remote Management Essential tools, drivers, agents to setup, deploy and maintain the server embedded inside the server. 1. System remote management should support bro....
X X X X Extracts X X X X
X X X X Extracts X X X X
....wser based graphical remote console along with Virtual Power button, remote boot using USB/CD/DVD Drive. Capable of offering upgrade of software and patches from a remote client using Media/image/folder; It should support server power capping and historical reporting and should have support for multifactor authentication. 2. Server should have dedicated 1Gbps remote management port. Remote management port should have 4GB NAND flash with 1GB available for user access. NAND flash should be used for keeping system logs and downloading firmware from HP website or internal repository 3. Server should support agentless management using the out-of-band remote management port. 4. The server should support monitoring and recording changes in the server hardware and system configuration. It assists in diagnosing problems and delivering rapid resolution when system failures occur. 5. Applications to access the server remotely using popular handheld devices based on Android or Apple IOS be available. should 6. Remote console sharing upto 6 users simultaneously during pre-OS and OS runtime operation, Console replay - Console Replay captures and stores for replay th....
X X X X Extracts X X X X
X X X X Extracts X X X X
....e console video during a server's last major fault or boot sequence. Microsoft Terminal Services Integration, 128 bit SSL encryption and Secure Shell Version 2 support. Should provide support for AES and 3DES on browser. Should provide remote firmware update functionality. Should provide support for Java free graphical remote console. Restricted Page 15 of 30 Central Board of Indirect Taxes and Customs 5. Specifications for Line Printer S.No. Specifications of equipment deployed by CBIC 1. Impact type line printer 2. Minimum printing speed of 2000 LPM 3. Ribbon life of 30 million characters + 10 nos. of additional ribbons of OEM Make with 1 no. default ribbon 4. 5. MTBF of 10,000 Hours Inbuilt Parallel, Serial and add on or built in Ethernet 10/100 MBPS with signal cables of 10 feet length in each category of ports with S/w drivers under UNIX, including LINUX (Redhat & SUSE), Windows 2003 OS etc. Note: This is the specification of the Line Printer Provided by CBIC. However, at sites where heavy duty operations are not involved, any compatible printer may be used. 6. Specifications for Printers other than Line Printer Following guidelines should be tak....
X X X X Extracts X X X X
X X X X Extracts X X X X
....en into consideration while procuring standalone printers: Postscript, PCL5 and PCL6 compatible printers i. ii. Windows 10 compatible printers It is suggested that once a printer model is finalized by the sites, the compatibility of the same should be confirmed from the Citrix team (email: [email protected]) before procuring the printer. 7. Specifications for 4, 8, 12, 16 and 20 KVA UPS WITH 30 Min/1 Hr. BACKUP as per the requirement of the Location ITEM Technology/Design Topology UPS type Redundancy Operation Specifications of equipment deployed by CBIC Redundant N+1, Advance fully Microprocessor with PWM Technology with IGBTs. Double online conversion. The UPS shall utilize modular power protection technology designed to allow internal redundancy, scalability (vertical paralleling) of power and runtime, and fast mean time to repair (MTTR). Online Double conversion Type On line (to act as power conditioner as well as Backup) with Auto start Facility power walking time of 30 ms 1 Parallel N+1 parallel redundancy whereas all the power modules will be active and share the load mode. Restricted Page 16 of 30 Back up desired Upgradeable Central B....
X X X X Extracts X X X X
X X X X Extracts X X X X
....oard of Indirect Taxes and Customs Full load for specific Period of 30 min/1 hr. of the 100% rated capacity. Upgradeable to 1: 1 redundant configuration Restricted Page 17 of 30 Central Board of Indirect Taxes and Customs Annexure 3 - Security Agents List of all software agents required to be installed on Desktops/AIO are tabulated below. The agents which are required to be mandatorily integrated with CBIC's centralized security controls are marked as Mandatory and will be provided to the "CBIC Connectivity Partner†by CBIC. S. No Component 1 End Point Protection (Antivirus)* Mandatory Yes Provided by CBIC 2 Data Leakage Prevention (End Yes CBIC point Agent)* 3 Advanced Persistent Threat (APT) Yes CBIC prevention *DLP Agent, Antivirus and APT sensors port will be opened from data center to get the latest virus definition and Policies by FTP/SFTP/MFTP. Restricted Page 18 of 30 Central Board of Indirect Taxes and Customs Annexure 4 - Resident Engineer Guidelines for minimum qualifications for a resource to be provisioned as a resident engineer are as follows: Minimum Requirements of Resident Engineers The proposed candidate should be a gradu....
X X X X Extracts X X X X
X X X X Extracts X X X X
....ate Science/ IT. The candidate should have diploma in Networking from an ISO certified institutes Read/Speak/Write in English and Hindi/ Regional Language Should have at least 1 years' experience of providing IT support, preferably as site IT Engineer Shall be trained on support, maintenance, troubleshooting of key component supplied by CBIC in the locations Shall be trained on using Ticketing System (HPSM). Restricted Page 19 of 30 Central Board of Indirect Taxes and Customs Annexure 5 - Non-Disclosure Agreement (NDA) NON-DISCLOSURE AGREEMENT Το The Principal Commissioner/Commissioner of Customs WHEREAS, we the undersigned principal place of business/ registered office at_ hereinafter referred to “CBIC Connectivity Partner†i.e. Custodian having our or FPO or SEZ or any other formation are desirous of establishing connectivity with the Data Centers of CBIC, for the purposes of electronic data interchange (hereinafter called the said 'Connectivity') and, WHEREAS, the "CBIC Connectivity Partner†is aware and confirms that the information, software, hardware, business data, architecture schematics, designs, storage media and other do....
X X X X Extracts X X X X
X X X X Extracts X X X X
....cuments made available by DG (Systems), CBIC during the process of establishing connectivity and thereafter, or otherwise (confidential information for short) is privileged and strictly confidential and/or proprietary to DG (Systems), CBIC. NOW THEREFORE, in consideration of the foregoing, the "CBIC Connectivity Partner†agrees to all of the following conditions, in order to enable DG (Systems) to grant the "CBIC Connectivity Partner†specific access to DG (Systems)'s confidential information, property, information systems, network, databases and other data as may be required in the process of establishing connectivity. a) IT IS HEREBY AGREED AS UNDER: The "CBIC Connectivity Partner" agrees to hold in confidence any confidential information received by the “CBIC CONNECTIVITY PARTNERâ€, as part of the connectivity process or otherwise, and the "CBIC Connectivity Partner" shall maintain strictest of confidence in respect of such confidential information. The "CBIC Connectivity Partner" also agrees: (i) (ii) (iii) (iv) to maintain and use the confidential information only for the purposes of establishing connectivity and only as permitted by ....
X X X X Extracts X X X X
X X X X Extracts X X X X
....DG (Systems), CBIC; to only make copies as specifically authorized by the prior written consent of DG (Systems), CBIC and with the same confidential or proprietary notices as may be printed or displayed on the original; to restrict access and disclosure of confidential information to such of their employees, agents, consultants and representatives (hereinafter 'Authorized Personnel') who strictly have a "need to know", and who agree in writing to maintain confidentiality of the confidential information disclosed to them in accordance with this Agreement; to treat confidential information as confidential unless and until DG (Systems), CBIC_notifies the “CBIC Connectivity Partner†of release of its obligations in relation to the said confidential information; Restricted Page 20 of 30 Central Board of Indirect Taxes and Customs b) c) d) (V) (vi) that "CBIC Connectivity Partner" will not and shall use reasonable endeavors to ensure that its Authorized Personnel do not modify, reverse engineer, de- compile or disassemble any software programs contained in the Confidential Information unless otherwise specified in writing by DG (Systems), CBIC; and to ....
X X X X Extracts X X X X
X X X X Extracts X X X X
....put in place such reasonable methods of control as "CBIC Connectivity Partner" deems necessary to ensure that no person in its employment, except the Authorized Personnel, is able to copy, transfer, or take away Confidential Information at any time unless otherwise agreed in writing by DG (Systems) CBIC. If such person leaves the “CBIC CONNECTIVITY PARTNER" 's employment at any time or for any reason before the expiry of confidentiality obligations mentioned in this Agreement, “CBIC Connectivity Partner" shall ensure that such person is debriefed appropriately. Confidential information does not include information which: (i) (ii) (iii) (iv) (V) the "CBIC Connectivity Partner†knew or had in its possession, prior to disclosure, without limitation on its confidentiality; is independently developed by the "CBIC Connectivity Partner" without breach of conditions under this agreement; information in the public domain as a matter of law; is received from a third party not subject to the obligation of confidentiality with respect to such information provided the third party has not disclosed the information for or on behalf of CBIC or as a third part....
X X X X Extracts X X X X
X X X X Extracts X X X X
....y vendor of CBIC; is released from confidentiality with the written consent of DG (Systems), CBIC. The "CBIC Connectivity Partner" shall have the burden of proving hereinabove are applicable to the information in the possession of the "CBIC CONNECTIVITY PARTNER". Notwithstanding the foregoing, the "CBIC Connectivity Partner†acknowledges that the nature of activities to be performed as part of the Connectivity process may require the "CBIC CONNECTIVITY PARTNER" 's personnel to be present on premises of DG (Systems) or may require the “CBIC CONNECTIVITY PARTNER" 's personnel to have access to software, hardware, computer networks, databases and storage media of DG (Systems) while on or off premises of DG (Systems). It is understood that it would be impractical for DG (Systems) to monitor all information made available to the “CBIC CONNECTIVITY PARTNER" 's personnel under such circumstances and to provide notice to the "CBIC Connectivity Partner" of the confidentiality of all such information. Therefore, the "CBIC Connectivity Partner" agrees that any technical or business or other information of DG (Systems) that the “CBIC CONNECTIVITY PARTNER....
X X X X Extracts X X X X
X X X X Extracts X X X X
....€ 's personnel, representatives or agents acquire while on DG (Systems) premises, or through access to DG (Systems) computer systems or databases while on or off DG (Systems) premises, shall be deemed confidential information. Confidential information and any derivatives thereof shall at all times remain the sole and exclusive property of DG (Systems). All confidential information and derivatives thereof shall be returned to DG (Systems) promptly after receipt of request by "CBIC Connectivity Partner†from the DG (systems) in this regard, together with any available copies with "CBIC Connectivity Partner" thereof and “CBIC Connectivity Partner" shall Restricted Page 21 of 30 Central Board of Indirect Taxes and Customs e) f) g) h) i) j) k) not retain any copy of the Confidential Information of DG (systems) with itself except as may be required by law. In the event that the "CBIC Connectivity Partner†hereto becomes legally compelled to disclose any confidential information, the “CBIC Connectivity Partner†shall give sufficient notice to DG (Systems) to enable DG (Systems) to prevent or minimize to the extent possible, such d....
X X X X Extracts X X X X
X X X X Extracts X X X X
....isclosure. "CBIC Connectivity Partner†shall not disclose to a third party any confidential information or the contents of this Tender without the prior written consent of DG (Systems). The obligations of this Clause shall be satisfied by handling Confidential Information with the same degree of care, which the "CBIC Connectivity Partner" applies to its own similar confidential information but in no event less than reasonable care. The obligations herein shall survive the completion or cancellation of the Connectivity process. "CBIC Connectivity Partner†shall not assign or transfer any rights or obligations under this Agreement without the prior written consent of DG (systems). No waiver or amendment of any term or condition of this Agreement will be effective unless made in writing and signed by both parties. "CBIC Connectivity Partner†acknowledges that any unauthorized disclosure or unauthorized use of the Confidential Information by the “CBIC Connectivity Partner†may cause immediate and irreparable harm to DG (systems) for which damages or injury sustained by DG (systems) may be impossible to measure accurately or remedy fully. Th....
X X X X Extracts X X X X
X X X X Extracts X X X X
....erefore, "CBIC Connectivity Partner†acknowledges that in the event of such a breach, DG (Systems) shall have the right to seek injunctive relief without prejudice to its all other legal rights. If any provision of this Agreement is determined to be invalid in whole or in part, the remaining provisions shall continue in full force and effect as if this Agreement had been executed without the invalid provision. This Agreement shall be governed by and construed in accordance with the laws of India, without giving effect to conflict of law rules. The competent courts of New Delhi shall have jurisdiction in connection with any dispute arising under this Agreement. This Agreement shall come into force and effect on Restricted Page 22 of 30 Central Board of Indirect Taxes and Customs SIGNED for and on behalf of the President of India SIGNED for and on behalf of "CBIC CONNECTIVITY PARTNER" By: Signature: Designation: Address: By: Signature: Designation: Address: Witness: Witness: Name: Place: Date: Name: Place: Date: Restricted Page 23 of 30 Central Board of Indirect Taxes and Customs Annexure 6 – Infrastructure Checklist Annexure 6- Infra....
X X X X Extracts X X X X
X X X X Extracts X X X X
....structure Checklist No Su Item 1 Please confirm whether the custom formation is under Customs 2 jurisdiction i.e., not in Free Trade & Warehousing Zones (FTWZ) Connectivity MPLS Connectivity (Enter Bandwidth (in Mbps) in remarks column with name of Service Provider) Connectivity Taken for Both Data Center- Delhi and Data Center - Chennai All the Network Switches and Routers at the location accessing CBIC's Data Centers support 802.1x to enable integration with CBIC's Network Access Control (NAC). Connectivity Media Done (Yes/no) Remarks Critical (to be filled by requestor) (to be filled by requestor) Yes Yes 3 LAN: Yes CBIC LAN must be Insular and isolated from the local "CBIC Connectivity Partner" LAN. The local LAN should be installed with a separate switch. LAN diagram must be provided showing the seating arrangements of the Customs officials and Service Centre operators 4 Service Centre details 5 Whether Service Centre is available infrastructure Service Centre readiness status (includes both structural and IT readiness) Number of Service Centre users and number of nodes provided Service Centre Agency name Whether approval fro....
X X X X Extracts X X X X
X X X X Extracts X X X X
....m the Jurisdictional Principal Commissioner/Commissioner for deployment of service center operators accorded Specifications of Desktop Specifications of Desktops Number of PC's installed for accessing CBIC application Restricted Yes Yes Page 24 of 30 6 Central Board of Indirect Taxes and Customs Conformance to CBIC'S Information Security Policy List of all Desktop Agents installed Printers Specifications of LAN Printer Specifications of File & Print Server Number of Line Printers installed Yes Number of Network Printers installed 7 Local Infrastructure: Yes Suitable office space and Furniture Air-conditioning Specification of LAN Switches Generator back-up UPS to support all IT equipment AMC for all equipments 8 Local Maintenance Engineers: Yes Whether Local IT Engineer available at the location Implementation carried out by the local 9 maintenance engineer Non-disclosure Agreement: Signed with the Jurisdictional Principal Commissioner/Commissioner of Customs Mandatory Signature & Designation of the Person In-Charge of "CBIC Connectivity Partner" Signature & Designation of the Verifying Customs Officer Restricted Page 25 of 30 Centr....
X X X X Extracts X X X X
X X X X Extracts X X X X
....al Board of Indirect Taxes and Customs Annexure 6A - IP request form details Annexure 6A: IP Request Form Details Sl. No. Details Branch Code (If Allotted) 1 /UNLO Code "CBIC Connectivity 2 Partner" Name "CBIC Connectivity 3 Partner" Address 4 City 5 State 6 Bandwidth Service Provider 7 (BSNL/TCL) 8 Site Type (New/Existing) 9 Last Mile (OFC/RF) Connectivity type 10 (Partner MPLS/VPNOBB) LAN IP Pool requested 11 12 13 by site(no. of LAN IPs) WAN IP Remarks (If existing site then LAN IP and WAN IP details) Signature & Designation of the Person In-Charge of "CBIC Connectivity Partner†Signature & Designation of the Verifying Customs Officer Restricted Page 26 of 30 Central Board of Indirect Taxes and Customs Annexure 6B - Details regarding RF link Note: (to be filled only if link is RF) 1. Does the login console has a default username and password? 2. Which Antenna is selected and what are the security measures and password policy followed for the Antenna? 3. Frequency on which the RF would be operating 4. Is the wireless security enabled? if yes what are the security parameters used 5. Architecture and Design document of conn....
X X X X Extracts X X X X
X X X X Extracts X X X X
....ectivity 6. Are the user restrictions defined and ports that are used 7. Details pertaining to Security measures (like AES etc.) 8. RF configuration 9. Router configuration details Signature & Designation of the Person In-Charge of "CBIC Connectivity Partner" Signature & Designation of the Verifying Customs Officer Restricted Page 27 of 30 Central Board of Indirect Taxes and Customs Annexure 7 - Container Scanner Solution Please refer to the guidelines issued by CBIC in reference to the requirements before set up of Container Scanner Systems at Customs location Requirements for implementing this solution at Container Scanner Divisions: 1) "CBIC Connectivity Partner" would procure an L3 manageable network switch. The "CBIC Connectivity Partner†may also opt for switch which supports GRE Tunnel technology in case they want to setup a tunnel based solution. Detailed specification sheet is as under. Before finalizing the switch model, the compatibility of the same should be confirmed from CBIC LANWAN team ([email protected]) before procuring. 2) It is suggested that the "CBIC Connectivity Partner†provides physical connectivity through OFC be....
X X X X Extracts X X X X
X X X X Extracts X X X X
....tween L3 manageable switch and container scanner local server. 3) It may also be noted that it will be Scanner OEM's responsibility to do the script configuration between CBIC server and their server to pull the XML files. Recommended specifications of L3 Mangeable network switch Requirement Switching capacity L3 Manageable switch / L3 manageable switch which supports GRE Tunnel GRE- tunneling protocol that can encapsulate a wide variety of network layer protocols inside virtual point-to- point links over an Internet Protocol network. 16 port (or higher) Multigigabit models with 2x10G uplink Restricted Page 28 of 30 Central Board of Indirect Taxes and Customs Annexure 8 - Unblocking of IPS Pre-requisites: 1. The site needs to ensure that OS used are genuine and are having Windows 10. 2. System have antivirus installed and should have latest virus definitions. Process for unblocking: 1. Contact Saksham seva ([email protected]) and raise a ticket. 2. Antivirus full scan needs to be run on the system and same report need to be shared to [email protected] with a copy to security team ([email protected]) in PDF format. Restricted....
X X X X Extracts X X X X
X X X X Extracts X X X X
.... Page 29 of 30 Central Board of Indirect Taxes and Customs Annexure 9: Single Point of Contact (SPOC) Details Phone Number Email Address MPLS service Name provider BSNL Vinay (Delhi NCR-II Kumar Circle) (for primary connectivity) 9810186870 [email protected] TCL K. Uma Mahesh 9212293732 [email protected] (for alternate connectivity) Saksham Seva Helpdesk for CBIC officers a) Webportal: https://sakshamseva.cbic.gov.in b) Email: [email protected] Restricted Page 30 of 30<BR> News - Press release - PIB....