Public procurement notice: Contract Notice
Published: 2019-01-22
Buyer: Verohallinto, The Finnish Tax Administration
Country: FI
Contract type: Services
Procedure: Open procedure
CPV classification: 72222300: Information technology services
Estimated value: 150000 EUR
Submission deadline: 2019-02-20
Award criteria: The most economic tender

Technical requirements: To support and enhance Finnish Tax Administration's IT security on its various public web services, Finnish Tax Administration is acquiring a service provider to handle crowdsourced security testing program. The acquired service must fulfill the requirements for running and developing Tax Administration's multiple Bug Bounty campaigns. The goal for Finnish Tax Administration is to develop its security-testing procedures. As a new operational model, Finnish Tax Administration has started to use crowdsourced security testing. Crowdsourced security testing (Bug Bounty Program) includes several Bug Bounty campaigns and separate security testing events. The goal is to get a better coverage on security testing. With bug bounties, it is possible to get hold of hackers with different set of skills. It is possible to get hackers testing with wide-ranging techniques. The plan is to arrange and maintain bug bounty campaigns against Finnish Tax Administration's different ICT-services.
Finnish Tax Administration is heavily investing on digitalization. There are several development programs ongoing and due to security being one of the main factors, Finnish Tax Administration is constantly developing and improving issues relating to security. One of the targets is to get even better coverage for security testing. A part of fulfilling this target is to execute Bug Bounty campaigns within the program against specified online services of the Finnish Tax Administration. Finnish Tax Administration's aim is to acquire a service provider that can help on our bug bounties to be well handled and tempting targets for the testers. This requires a high-level quality on both the providers and Tax Administration's side. Finnish Tax Administration is looking for a provider that will manage the bug bounties and provide reports from the possible findings to Tax Administration. Therefore, service providers' tasks include, at least creating rules, scope, and bounty value table and consulting the correct bounty values from valid reports together with Finnish Tax Administration. Service providers tasks would then include at least launching the program in the selected platform, handling things related to hackers (for example credentials and communication), identifying findings and reporting them to Finnish Tax Administration.
Tenderer's suitability requirements are described in the ESPD form (European Single Procurement Document).
The Finnish Tax Administration selects one (1) supplier with whom it will enter into an agreement. A draft agreement is attached to this call for tenders as annex 1.
Review of the decision on public contract or other decision made during the award procedure may be sought by requesting correction from the contracting entity in accordance with the Act on Public Contracts and Concession Contracts (the Public Contracts Act, 1397/2016). In those cases where the value of the contract exceeds the threshold amount set out in section 25 and 26 of the Act, appeal may also be made to the Market Court within 14 days after contract award.

Eligibility requirements: Tenderer's suitability requirements are described in the ESPD form (European Single Procurement Document).

Award value: 150000