Public procurement notice: Contract Notice
Published: 2025-09-02
Buyer: Danmarks Nationalbank
Country: DK
Region: DK011
Contract type: Services
Procedure: Restricted procedure
CPV classification: 72500000 | 72600000
Estimated value: 24000000 DKK
Submission deadline: 2025-10-02
Award criteria: price, quality

Technical requirements: This procurement seeks to enter into framework agreements with 3 Suppliers, that are experts within the field of purple teaming testing. Any Statement of Work will be awarded suite of a subsequent re-opening of the competition. 
The purple teaming test (PTT) shall be conducted on Danmarks Nationalbank. The purpose of the purple teaming test is to enhance the Customer’s cybersecurity posture by integrating offensive and defensive security teams to simulate real-world attack scenarios and improve detection and response capabilities. The test shall be conducted as a cooperation between the offensive red team provided by the supplier and the defensive blue team.
The test shall assess how well the Customer is equipped to protect against, detect, respond to and potentially recover from cyber-attacks from threat actors with realistically advanced capabilities and modus operandi. The test shall to the farthest possible extent mimic relevant real actors’ capabilities towards the defensive capabilities at the Customers disposal.
The framework agreement will be awarded to three (3) suppliers.
The candidate must submit the ESPD with the following information:
A list of the 5 most significant comparable services that the candidate has carried out in the latest 3 years before the expiry of the deadline for application.

Only references relating to services carried out at the time of the deadline for application will be given importance in the evaluation of whether the requirements regarding technical and professional capacity have been complied with, see below. Hence, in the case of an ongoing task, only the part of the services already performed at the time of the deadline for application will be included in the evaluation of the reference.
Each reference is requested to include a brief description of the deliveries made. The description of the delivery should include a clear description of the services to which the delivery relates and the  candidate’s role(s) in the performance of the delivery. The reference is furthermore requested to include the financial value of the delivery (amount), the date of delivery and the name of the customer (recipient), if this information is not confidential.
When indicating the date of the delivery, the candidate is requested to indicate the date of commencement and finalisation of the delivery. If this is not possible, for example if the tasks were performed on a continuous basis under a framework agreement, the candidate is asked to indicate how the date is specified.
No more than 5 references may be stated, irrespective of whether the candidate is a single operator, whether the candidate relies on the technical capacity of other entities, or is a group of operators (e.g. a consortium). Where more than 5 references are stated, only the most recent 5 references will be taken into account. Any additional references will be disregarded. If it is not 
possible to decide which references are the most recent 5 references, the references will be selected by drawing lots.
In this procedure, the candidate may rely on the technical capacity of other operators to fulfil the suitability requirements. The operator(s) making its/their technical capacity available to the candidate must sign a letter of commitment, see further in the tender specifications. 
The form is enclosed as an attachment to the tender specifications.
If the candidate relies on the professional experience of other entities for the performance of specific parts of the services comprised by the contract, such specific parts of the services under the contract must be performed by the entity on which the candidate relies.
The ESPD serves as provisional documentation that the candidate fulfils the requirements in respect of technical and professional capacity. Before the award decision is made, the candidate to whom the contracting entity intends to award the contract must submit documentation that the information stated in the ESPD is accurate. No additional documentation of technical and professional capacity will be required from the candidate. However, the contracting entity reserves the 
right to contact the candidate or the customer stated in the reference for verification of the information stated in the reference, including the dates of the reference indicated.

Minimum requirement: as a minimum requirement for participation, the candidate must provide documentation of at least one (1) reference for the delivery of purple teaming test.
Criteria for selection among the suitable candidates. The shortlisting of candidates invited to tender will be based on an evaluation of which candidates have documented the most relevant deliveries, in relation to the main services put up for tender. 
The relevance assessment will be made on the basis of the extent to which the references, combined, document experience in the provision of services that are comparable to the main services put up for tender. 
In the evaluation of which candidates have documented the most relevant services of Purple teaming tests, the contracting entity will award points to the candidates on a scale from 1-5 for each main service, based on the extent to which the references, combined, document relevant experience in providing the main services. On this basis, the candidate will be awarded a total score calculated as the average number of points awarded for the main services.
In the selection, the contracting entity will place particular emphasis on the following main services:

- Demonstrated experience with intelligence-led red team tests within live production it-infrastructure in financial services or similar critical infrastructure industries  
- Demonstrated experience with delivery of threat intelligence deliveries with focus on threat modelling
- Demonstrated experience with delivery of purple teaming test where red team capabilities work closely with the customer’s blue team including collaboration with customer’s third-party vendors
- Demonstrated cooperative and adaptable approach to purple teaming test, including willingness to adhere to specific customer requirements and context
- Demonstrated experience with communication with both technical and non-technical customer resources, and engagement with collaborative activities, such as whiteboard sessions, stand-ups, workshops, etc.  
- Demonstrated experience with customers in various it-environments, ex. Cloud, outsourced, on-prem and in-house developed systems
The contract has incorporated the corporate social responsibility considerations, as appropriate, as 
laid down in the conventions on the basis of which the principles of the UN Global Compact are worded and as laid down in the OECD Guidelines for Multinational Enterprises.

If the contract is awarded to a group of operators (such as a consortium), the participants of the group must undertake joint and several liability and appoint a joint representative.
Pursuant to the Danish Act on the Complaints Board for Public Procurement, etc. (lov om Klagenævnet for Udbud m.v.) (the Act is available (in Danish) at  ww.retsinformation.dk), the following deadlines apply to the lodging of complaints:
Complaints of not having been selected must be submitted to the Danish Complaints Board for Public 
Procurement before the expiry of 20 calendar days, see section 7(1) of the Act, from the day after submission of notification to the candidates concerned of the identity of the successful tenderer where the notification is accompanied by an explanation of the grounds for the decision in accordance with section 2(1), para (1) of the Act and section 171(2) of the Danish Public Procurement Act.

In other situations, complaints of award procedures, see section 7(2) of the Act, must be lodged with the Danish Complaints Board for Public Procurement before the expiry of:
1) 45 calendar days after the contracting entity has published a notice in the Official Journal of the European Union that the contracting entity has entered into a contract. The deadline is calculated from the day after the day when the notice was published.
2) 30 calendar days calculated from the day after the day when the contracting entity has notified the candidates concerned that a contract based on a framework agreement with reopening of competition or a dynamic purchasing system has been entered into if the notification has included an explanation of the relevant grounds for the decision.
3) 6 months after the contracting entity entered into a framework agreement calculated from the day after the day when the contracting entity notified the candidates and tenderers concerned, see section 2(2) of the Act and section 171(4) of the Danish Public Procurement Act.
4) 20 calendar days calculated from the day after the contracting entity has submitted notification of its decision, see section 185(2) of the Danish Public Procurement Act.
Not later than at the time of lodging a complaint with the Danish Complaints Board for Public Procurement, the complainant must notify the contracting entity in writing that a complaint has been lodged with the Danish Complaints Board for Public Procurement and whether the complaint was lodged during the standstill period, see section 6(4) of the Act. In cases where the complaint was not lodged within the standstill period, the complainant must furthermore indicate whether a suspensory effect of the complaint has been requested, see section 12(1) of the Act.
The e-mail address of the Complaints Board for Public Procurement is klfu@naevneneshus.dk. The Complaints Board’s own complaints procedure is available at https://naevneneshus.dk/startdin-klage/klagenaevnet-for-udbud/vejledning/.

Eligibility requirements: The candidate must submit the ESPD with the following information:
A list of the 5 most significant comparable services that the candidate has carried out in the latest 3 years before the expiry of the deadline for application.

Only references relating to services carried out at the time of the deadline for application will be given importance in the evaluation of whether the requirements regarding technical and professional capacity have been complied with, see below. Hence, in the case of an ongoing task, only the part of the services already performed at the time of the deadline for application will be included in the evaluation of the reference.
Each reference is requested to include a brief description of the deliveries made. The description of the delivery should include a clear description of the services to which the delivery relates and the  candidate’s role(s) in the performance of the delivery. The reference is furthermore requested to include the financial value of the delivery (amount), the date of delivery and the name of the customer (recipient), if this information is not confidential.
When indicating the date of the delivery, the candidate is requested to indicate the date of commencement and finalisation of the delivery. If this is not possible, for example if the tasks were performed on a continuous basis under a framework agreement, the candidate is asked to indicate how the date is specified.
No more than 5 references may be stated, irrespective of whether the candidate is a single operator, whether the candidate relies on the technical capacity of other entities, or is a group of operators (e.g. a consortium). Where more than 5 references are stated, only the most recent 5 references will be taken into account. Any additional references will be disregarded. If it is not 
possible to decide which references are the most recent 5 references, the references will be selected by drawing lots.
In this procedure, the candidate may rely on the technical capacity of other operators to fulfil the suitability requirements. The operator(s) making its/their technical capacity available to the candidate must sign a letter of commitment, see further in the tender specifications. 
The form is enclosed as an attachment to the tender specifications.
If the candidate relies on the professional experience of other entities for the performance of specific parts of the services comprised by the contract, such specific parts of the services under the contract must be performed by the entity on which the candidate relies.
The ESPD serves as provisional documentation that the candidate fulfils the requirements in respect of technical and professional capacity. Before the award decision is made, the candidate to whom the contracting entity intends to award the contract must submit documentation that the information stated in the ESPD is accurate. No additional documentation of technical and professional capacity will be required from the candidate. However, the contracting entity reserves the 
right to contact the candidate or the customer stated in the reference for verification of the information stated in the reference, including the dates of the reference indicated.

Minimum requirement: as a minimum requirement for participation, the candidate must provide documentation of at least one (1) reference for the delivery of purple teaming test.
Criteria for selection among the suitable candidates. The shortlisting of candidates invited to tender will be based on an evaluation of which candidates have documented the most relevant deliveries, in relation to the main services put up for tender. 
The relevance assessment will be made on the basis of the extent to which the references, combined, document experience in the provision of services that are comparable to the main services put up for tender. 
In the evaluation of which candidates have documented the most relevant services of Purple teaming tests, the contracting entity will award points to the candidates on a scale from 1-5 for each main service, based on the extent to which the references, combined, document relevant experience in providing the main services. On this basis, the candidate will be awarded a total score calculated as the average number of points awarded for the main services.
In the selection, the contracting entity will place particular emphasis on the following main services:

- Demonstrated experience with intelligence-led red team tests within live production it-infrastructure in financial services or similar critical infrastructure industries  
- Demonstrated experience with delivery of threat intelligence deliveries with focus on threat modelling
- Demonstrated experience with delivery of purple teaming test where red team capabilities work closely with the customer’s blue team including collaboration with customer’s third-party vendors
- Demonstrated cooperative and adaptable approach to purple teaming test, including willingness to adhere to specific customer requirements and context
- Demonstrated experience with communication with both technical and non-technical customer resources, and engagement with collaborative activities, such as whiteboard sessions, stand-ups, workshops, etc.  
- Demonstrated experience with customers in various it-environments, ex. Cloud, outsourced, on-prem and in-house developed systems
The contract has incorporated the corporate social responsibility considerations, as appropriate, as 
laid down in the conventions on the basis of which the principles of the UN Global Compact are worded and as laid down in the OECD Guidelines for Multinational Enterprises.

If the contract is awarded to a group of operators (such as a consortium), the participants of the group must undertake joint and several liability and appoint a joint representative.
We refer to the tender specifications, Appendix A.
Pursuant to the Danish Act on the Complaints Board for Public Procurement, etc. (lov om Klagenævnet for Udbud m.v.) (the Act is available (in Danish) at  ww.retsinformation.dk), the following deadlines apply to the lodging of complaints:
Complaints of not having been selected must be submitted to the Danish Complaints Board for Public 
Procurement before the expiry of 20 calendar days, see section 7(1) of the Act, from the day after submission of notification to the candidates concerned of the identity of the successful tenderer where the notification is accompanied by an explanation of the grounds for the decision in accordance with section 2(1), para (1) of the Act and section 171(2) of the Danish Public Procurement Act.

In other situations, complaints of award procedures, see section 7(2) of the Act, must be lodged with the Danish Complaints Board for Public Procurement before the expiry of:
1) 45 calendar days after the contracting entity has published a notice in the Official Journal of the European Union that the contracting entity has entered into a contract. The deadline is calculated from the day after the day when the notice was published.
2) 30 calendar days calculated from the day after the day when the contracting entity has notified the candidates concerned that a contract based on a framework agreement with reopening of competition or a dynamic purchasing system has been entered into if the notification has included an explanation of the relevant grounds for the decision.
3) 6 months after the contracting entity entered into a framework agreement calculated from the day after the day when the contracting entity notified the candidates and tenderers concerned, see section 2(2) of the Act and section 171(4) of the Danish Public Procurement Act.
4) 20 calendar days calculated from the day after the contracting entity has submitted notification of its decision, see section 185(2) of the Danish Public Procurement Act.
Not later than at the time of lodging a complaint with the Danish Complaints Board for Public Procurement, the complainant must notify the contracting entity in writing that a complaint has been lodged with the Danish Complaints Board for Public Procurement and whether the complaint was lodged during the standstill period, see section 6(4) of the Act. In cases where the complaint was not lodged within the standstill period, the complainant must furthermore indicate whether a suspensory effect of the complaint has been requested, see section 12(1) of the Act.
The e-mail address of the Complaints Board for Public Procurement is klfu@naevneneshus.dk. The Complaints Board’s own complaints procedure is available at https://naevneneshus.dk/startdin-klage/klagenaevnet-for-udbud/vejledning/.
This procurement seeks to enter into framework agreements with 3 Suppliers, that are experts within the field of purple teaming testing. Any Statement of Work will be awarded suite of a subsequent re-opening of the competition. 
The purple teaming test (PTT) shall be conducted on Danmarks Nationalbank. The purpose of the purple teaming test is to enhance the Customer’s cybersecurity posture by integrating offensive and defensive security teams to simulate real-world attack scenarios and improve detection and response capabilities. The test shall be conducted as a cooperation between the offensive red team provided by the supplier and the defensive blue team.
The test shall assess how well the Customer is equipped to protect against, detect, respond to and potentially recover from cyber-attacks from threat actors with realistically advanced capabilities and modus operandi. The test shall to the farthest possible extent mimic relevant real actors’ capabilities towards the defensive capabilities at the Customers disposal.
The framework agreement will be awarded to three (3) suppliers.

Winner: Mercell Holding ASA