Public procurement notice: Contract Notice
Published: 2023-01-09
Buyer: Danmarks Nationalbank
Country: DK
Contract type: Services
Procedure: Open procedure
CPV classification: 72000000 | 79417000
Estimated value: 5000000 DKK
Submission deadline: 2023-02-09
Award criteria: The most economic tender

Technical requirements: Υπηρεσίες τεχνολογίας των πληροφοριών: παροχή συμβουλών, ανάπτυξη λογισμικού, Διαδίκτυο και υποστήριξη
Danmarks Nationalbank and the most important financial institutions have established a Danish intel-led red-team test program for the Danish financial sector. TIBER-DK stands for Threat Intelligence Based Ethical Red-teaming.
The tests will contribute to improve the ability to discover and react to hacker attacks which potentially can affect critical functions in the financial institutions.
This procurement seeks to establish a Framework Agreement with a primary and a secondary supplier of security testing with Tiber DK covering both Threat Intelligence reports and Red Team testing for a period of four years.
The tenderer shall be able to document at least one reference regarding an institution, which is a member of FSOR where the tenderer has delivered a TCT attested Targeted Threat Intelligence (TTI) report and Threat Intelligence Red Team Testing (RT) based on TIBER DK, cf. section III.1.3).
The TI provider shall provide Targeted Threat Intelligence (TTI) reports during the contract period. The TTI reports shall formulate threat scenarios to be mimicked by the Red Team Provider against the flags set in the Detailed Scope document to be provided by the White Team. The TTI report shall be shared with the Red teaming. The TTI report shall be based on the General Threat Landscape (GTL) report provided by the TIBER Cyber Team (TCT).
The Red Team shall provide Red Team Attack planning and execution in accordance with TIBER-DK. Based on the Red Teaming, the Red Team provider shall provide a Red Team Report and plan and facilitate Replay/Purple Teaming workshops as part of closing of the exercises.
The Threat Intelligence Based Ethical Red Team tests shall be conducted on Danmarks Nationalbank during the contract period. The tests shall be conducted in accordance with the Danish implementation of the TIBER framework: TIBER-DK, including the TIBER-DK General Implementation Guide, the TIBER-DK Operational Guide and underlying specific guides. In areas where no general or detailed TIBER-DK guidance exists, the TIBER-EU guidance – if any - shall be followed.
The Supplier shall ensure consultants with knowledge in Danish, as the TI reports and the cooperation with the Customer will be carried out in Danish.
The tenderer shall authorize the Contracting Authority as part of the procurement process to request confirmation on any declared successful conduct of previous TIBER engagement via the TCT (this procedure ensures the anonymity of the references given by the tenderer).
A list of up to the 5 most significant comparable services, see sections II.1.4) and II.2.4), that the tenderer has carried out in the latest 3 years before the expiry of the deadline for submission of tender.
Only references relating to services carried out at the time of submission of tender will be given importance in the evaluation of whether the minimum requirements regarding technical and professional capacity have been complied with, see below. Hence, in the case of an ongoing task, only the part of the ser-vices already performed at the time of submission of tender will be included in the evaluation of the reference.
Each reference is requested to include a brief description of the deliveries made. The description of the delivery should include a clear description of the services set out in sections II.1.4) and II.2.4) to which the delivery related and the tenderer's role(s) in the performance of the delivery. The reference is furthermore requested to include the financial value of the delivery (amount), the date of delivery and the name of the customer (recipient).
When indicating the date of the delivery, the tenderer is requested to indicate the date of commencement and finalisation of the delivery. If this is not possible, for example if the tasks were performed on a continuous basis under a framework agreement, the tenderer is asked to indicate how the date is specified.
No more than 5 references may be stated, irrespective of whether the tenderer is a single operator, whether the tenderer relies on the technical capacity of other entities, or is a group of operators (e.g. a consortium). Where more than five references are stated, only the most recent five references will be taken into account. Any additional references will be disregarded. If it is not possible to decide which references are the most recent five references, the references will be selected by drawing lots.


Award value: 5000000