Public procurement notice: Contract Award Notice
Published: 2023-11-21
Buyer: Danmarks Nationalbank
Country: DK
Contract type: Services
Procedure: Negotiated without a prior call for competition
CPV classification: 72000000 | 79417000
Estimated value: 6000000 DKK
Award criteria: The most economic tender

Technical requirements: Υπηρεσίες τεχνολογίας των πληροφοριών: παροχή συμβουλών, ανάπτυξη λογισμικού, Διαδίκτυο και υποστήριξη
Danmarks Nationalbank and the most important financial institutions have established a Danish intel-led red-team test program for the Danish financial sector. TIBER-DK stands for Threat Intelligence Based Ethical Red-teaming.
The tests will contribute to improve the ability to discover and react to hacker attacks which potentially can affect critical functions in the financial institutions.
This procurement seeks to establish a Framework Agreement with a primary and a secondary supplier of security testing with Tiber DK covering both Threat Intelligence reports and Red Team testing for a period of four years.
The tenderer shall be able to document at least one reference regarding an institution, which is a member of FSOR where the tenderer has delivered a TCT attested Targeted Threat Intelligence (TTI) report and Threat Intelligence Red Team Testing (RT) based on TIBER DK, cf. section III.1.3).
The TI provider shall provide Targeted Threat Intelligence (TTI) reports during the contract period. The TTI reports shall formulate threat scenarios to be mimicked by the Red Team Provider against the flags set in the Detailed Scope document to be provided by the White Team. The TTI report shall be shared with the Red teaming. The TTI report shall be based on the General Threat Landscape (GTL) report provided by the TIBER Cyber Team (TCT).
The Red Team shall provide Red Team Attack planning and execution in accordance with TIBER-DK. Based on the Red Teaming, the Red Team provider shall provide a Red Team Report and plan and facilitate Replay/Purple Teaming workshops as part of closing of the exercises.
The Threat Intelligence Based Ethical Red Team tests shall be conducted on Danmarks Nationalbank during the contract period. The tests shall be conducted in accordance with the Danish implementation of the TIBER framework: TIBER-DK, including the TIBER-DK General Implementation Guide, the TIBER-DK Operational Guide and underlying specific guides. In areas where no general or detailed TIBER-DK guidance exists, the TIBER-EU guidance – if any - shall be followed.
The Supplier shall ensure consultants with knowledge in Danish, as the TI reports and the cooperation with the Customer will be carried out in Danish.
The tenderer shall authorize the Contracting Authority as part of the procurement process to request confirmation on any declared successful conduct of previous TIBER engagement via the TCT (this procedure ensures the anonymity of the references given by the tenderer).
Before the deadline for tenders on 9 February 2023, at 12:00, local time, Danmarks Nationalbank received three tenders. None of the tenders complied fully with the tender documents.
It is stated in the public procurement act, § 80, that a contracting authority may apply negotiated procedure without prior publication when, in connection with open or restricted procedures for works, supplies or services, only tenders which are irrelevant in relation to the contract have been received.
Danmarks Nationalbank has thus decided to annul the existing procurement, cf. contract notice 2023/S 006-012856, and initiated a negotiated  procedure without prior publication with the three tenderers,
Pursuant to the Danish Act on the Complaints Board for Public Procurement, etc. (lov om Klagenævnet for Udbud m.v.) (the Act is available (in Danish) at www.retsinformation.dk), the following deadlines apply to the lodging of complaints:
Complaints for not having been selected must be submitted to the Danish Complaints Board for Public Procurement before the expiry of 20 calendar days, see section 7(1) of the Act, from the day after submission of notification to the candidates concerned of the identity of the successful tenderer where the notification is accompanied by an explanation of the grounds for the decision in accordance with section 2(1), para (1) of the Act and section 171(2) of the Danish Public Procurement Act.


Winner: WithSecure A/S
Award value: 6000000
Number of bids: 2