Public procurement notice: Contract Award Notice
Published: 2021-08-02
Buyer: Health Service Executive (HSE)
Country: IE
Contract type: Supplies
Procedure: Negotiated without a prior call for competition
CPV classification: 30231300 | 30231310 | 30237110 | 30237133 | 30237460
Estimated value: 697312 EUR
Award criteria: Lowest price

Technical requirements: During the Cyber attack, the war room was moved to the City West Hotel - the building needed to be kitted out with office and IT equipment and furniture as well as staffing and other IT equipment required to carry out the recovery work.
The HSE became aware of a major cyber-attack which severely impacted ICT services.The HSE’s ICT systems were impacted through the criminal infiltration of these systems using Conti Ransomware. As a result, all HSE ICT systems were shut down before 8am on Fri 14th May and a major incident response was triggered by HSE.  The Board of the HSE immediately began work on putting in place an effective cyber-security incident-response team (CSIRT). The process was designed with a focus on damage-limitation to the HSE’s services, its data assets, its network, and its application infrastructure. A war room was established in the Citywest Hotel and Conference Centre, which was originally leased by the HSE as part of the Covid-19 response. The assistance of the Irish Defence Forces, a Situation Centre (SitCen) was established and all workstreams developed their operations at the Citywest site. Daily morning briefings were scheduled, and a comprehensive reporting rhythm was implemented. The building needed to be kitted out with office and IT equipment and furniture. The following was also necessary:
o	Planning and set up of site requirements (120 Workstations; 6 Breakout Rooms; AV; VC; Security; Facilities; HSE Secure Suite)
HSE used the negotiated procedure without prior publication in accordance with Article 32(2)(c) of Directive 2014/24/EU to award this contract. The HSE is satisfied the tests permitting use of the negotiated procedure without prior publication (Article 32(2)(c)) were met, as set out below.
The Authority was responding to the Cyber-attack immediately because of public health risks presenting a genuine emergency.
The extent of the Conti Ransomware attack is thought to be the most serious cyber-attack on the country’s critical infrastructure. The level of impairment on hospitals, and other health institutions to provide treatment, could, certainly, not be foreseen and planned in advance, and thus constitute an unforeseeable event for the contracting authorities.
It cannot be doubted that the immediate needs of the hospitals and health institutions to have their ICT systems effectively restored had to be met with all possible speed. It was judged to be a situation of extreme urgency making compliance with general deadlines impossible. Procurement following the usual timescales under Directive 2014/24/EU, including accelerated options, was impossible in this case as these timescales would not meet the public health needs and would put lives at risk.
As documented above, the Conti Ransomware attack is the most serious cyber-attack on the country’s critical infrastructure and presented a serious risk to human life. The HSE acted proportionately and without delay in its response to this most serious cyber-attack.


Winner: Vodafone Ireland Ltd
Award value: 697312
Number of bids: 1