Public procurement notice: Contract Award Notice
Published: 2021-08-02
Buyer: Health Service Executive (HSE)
Country: IE
Contract type: Services
Procedure: Negotiated without a prior call for competition
CPV classification: 72130000 | 72150000 | 72220000: Systems and technical consultancy services | 72600000
Estimated value: 278041 EUR
Award criteria: Lowest price

Technical requirements: To support the Operations & Recovery Workstream, the following resources were  initially required from Accenture :
This increased in Week 2 and was reviewed on a weekly basis. Partner Consultants were scaled back, in consultation with HSE,in order to meet evolving HSE requirements and as deliverables were completed and approved by relevant HSE Workstream Leads.
To support the Operations & Recovery Workstream, the following resources were  initially required from Accenture :
This increased in Week 2 and was reviewed on a weekly basis. Partner Consultants were scaled back, in consultation with HSE,in order to meet evolving HSE requirements and as deliverables were completed and approved by relevant HSE Workstream Leads.
The HSE became aware of a major cyber-attack which severely impacted ICT services across the HSE, voluntary hospitals and other organisations which rely on HSE infrastructure such as Tusla. The HSE’s ICT systems were impacted through the criminal infiltration of these systems using Conti Ransomware. As a result, all HSE ICT systems were shut down before 8am on Fri 14th May. This event was thought to be the most serious cyber-attack on the country’s critical infrastructure and a major incident response was triggered by HSE.
Given the seriousness of this attack and the impact it had on those people who are dependent on health services, the Board of the HSE immediately began work on putting in place an effective cyber-security incident-response team (CSIRT). Clear roles and responsibility were established which enabled internal coordination and fostered a united approach. The CSIRT acted as the recognised point for external coordination. The process was designed with a focus on damage-limitation to the HSE’s services, its data assets, its network, and its application infrastructure.
To support the effort, the HSE required external assistance in a number of areas - technology (including applications and data), cybersecurity, incident response, digital forensics, and legal and regulatory.  In selecting a company to provide assistance, the appointed members of existing Framework Agreements were considered.
Over the course of the weekend of 14th May, the HSE CIO (Fran Thompson) and COO (Michael Redmond) held a number of workshops with the HSE’s established strategic partners including Accenture in the Operations & Recovery Workstream and Accenture worked closely with HSE and other supporting third parties to provide incident response and security investigation services to determine the nature of the security incident and recommend mitigation strategies and countermeasures.
HSE used the negotiated procedure without prior publication in accordance with Article 32(2)(c) of Directive 2014/24/EU to award this contract. The HSE is satisfied the tests permitting use of the negotiated procedure without prior publication (Article 32(2)(c)) were met, as set out below.
The Authority was responding to the Cyber-attack immediately because of public health risks presenting a genuine emergency.
The extent of the Conti Ransomware attack is thought to be the most serious cyber-attack on the country’s critical infrastructure. The level of impairment on hospitals, and other health institutions to provide treatment, could, certainly, not be foreseen and planned in advance, and thus constitute an unforeseeable event for the contracting authorities.
It cannot be doubted that the immediate needs of the hospitals and health institutions to have their ICT systems effectively restored had to be met with all possible speed. It was judged to be a situation of extreme urgency making compliance with general deadlines impossible. Procurement following the usual timescales under Directive 2014/24/EU, including accelerated options, was impossible in this case as these timescales would not meet the public health needs and would put lives at risk.


Winner: Accenture Limited
Award value: 278041
Number of bids: 1