706287-2023 - ResultDenmark-Copenhagen: IT services: consulting, software development, Internet and support
OJ S 224/2023 21/11/2023
Contract award notice
Services
Legal Basis:
Directive 2014/24/EU

Section I: Contracting authority

I.1.
Name and addresses
Official name: Danmarks Nationalbank
National registration number: 61092919
Postal address: Langelinie Allé 47
Town: København Ø
NUTS code: DK011 Byen København
Postal code: 2100
Country: Denmark
Contact person: DN - Jeanett Brurås
E-mail: jtb@nationalbanken.dk
Telephone: +45 33636069
Internet address(es):
Main address: https://www.nationalbanken.dk/en
I.4.
Type of the contracting authority
Body governed by public law
I.5.
Main activity
Economic and financial affairs

Section II: Object

II.1.
Scope of the procurement
II.1.1.
Title
Tender for a Framework Agreement on the delivery of TIBER-DK related services
Reference number: TS-213476
II.1.2.
Main CPV code
72000000 IT services: consulting, software development, Internet and support
II.1.3.
Type of contract
Services
II.1.4.
Short description
Danmarks Nationalbank and the most important financial institutions have established a Danish intel-led red-team test program for the Danish financial sector. TIBER-DK stands for Threat Intelligence Based Ethical Red-teaming.
The tests will contribute to improve the ability to discover and react to hacker attacks which potentially can affect critical functions in the financial institutions.
TIBER-DK is based on a common European framework developed by the ECB.
This procurement seeks to establish a Framework Agreement with a primary and a secondary supplier of security testing with Tiber DK covering both Threat Intelligence reports and Red Team testing for a period of four years.
The tenderer shall be able to document at least one reference regarding an institution, which is a member of FSOR where the tenderer has delivered a TCT attested Targeted Threat Intelligence (TTI) report and Threat Intelligence Red Team Testing (RT) based on TIBER DK, cf. section III.1.3).
II.1.6.
Information about lots
This contract is divided into lots: no
II.1.7.
Total value of the procurement
Value excluding VAT: 6 000 000,00 DKK
II.2.
Description
II.2.2.
Additional CPV code(s)
79417000 Safety consultancy services
II.2.3.
Place of performance
NUTS code: DK011 Byen København
Main site or place of performance: København Ø
II.2.4.
Description of the procurement
The TI provider shall provide Targeted Threat Intelligence (TTI) reports during the contract period. The TTI reports shall formulate threat scenarios to be mimicked by the Red Team Provider against the flags set in the Detailed Scope document to be provided by the White Team. The TTI report shall be shared with the Red teaming. The TTI report shall be based on the General Threat Landscape (GTL) report provided by the TIBER Cyber Team (TCT).
The Red Team shall provide Red Team Attack planning and execution in accordance with TIBER-DK. Based on the Red Teaming, the Red Team provider shall provide a Red Team Report and plan and facilitate Replay/Purple Teaming workshops as part of closing of the exercises.
The Threat Intelligence Based Ethical Red Team tests shall be conducted on Danmarks Nationalbank during the contract period. The tests shall be conducted in accordance with the Danish implementation of the TIBER framework: TIBER-DK, including the TIBER-DK General Implementation Guide, the TIBER-DK Operational Guide and underlying specific guides. In areas where no general or detailed TIBER-DK guidance exists, the TIBER-EU guidance – if any - shall be followed.
The Supplier shall ensure consultants with knowledge in Danish, as the TI reports and the cooperation with the Customer will be carried out in Danish.
The tenderer shall authorize the Contracting Authority as part of the procurement process to request confirmation on any declared successful conduct of previous TIBER engagement via the TCT (this procedure ensures the anonymity of the references given by the tenderer).
II.2.5.
Award criteria
Quality criterion - Name: Team / Weighting: 30%
Quality criterion - Name: Methodology and work modalities / Weighting: 20%
Quality criterion - Name: Risk mangement and information security / Weighting: 20%
Price - Weighting: 30%
II.2.11.
Information about options
Options: no
II.2.13.
Information about European Union funds
The procurement is related to a project and/or programme financed by European Union funds: no
II.2.14.
Additional information

Section IV: Procedure

IV.1.
Description
IV.1.1.
Type of procedure
Award of a contract without prior publication of a call for competition in the Official Journal of the European Union in the cases listed below
  • No tenders or no suitable tenders/requests to participate in response to open procedure
Explanation:
Before the deadline for tenders on 9 February 2023, at 12:00, local time, Danmarks Nationalbank received three tenders. None of the tenders complied fully with the tender documents.
It is stated in the public procurement act, § 80, that a contracting authority may apply negotiated procedure without prior publication when, in connection with open or restricted procedures for works, supplies or services, only tenders which are irrelevant in relation to the contract have been received.
Danmarks Nationalbank has thus decided to annul the existing procurement, cf. contract notice 2023/S 006-012856, and initiated a negotiated procedure without prior publication with the three tenderers,
IV.1.3.
Information about a framework agreement or a dynamic purchasing system
The procurement involves the establishment of a framework agreement
IV.1.8.
Information about the Government Procurement Agreement (GPA)
The procurement is covered by the Government Procurement Agreement: yes
IV.2.
Administrative information
IV.2.1.
Previous publication concerning this procedure
Notice number in the OJ S: 2023/S 006-012856
IV.2.8.
Information about termination of dynamic purchasing system
IV.2.9.
Information about termination of call for competition in the form of a prior information notice

Section V: Award of contract

Contract No: 1
Title:
Tender for a Framework Agreement on TIBER-DK related services - supplier 1
A contract/lot is awarded: yes
V.2.
Award of contract
V.2.1.
Date of conclusion of the contract
27/04/2023
V.2.2.
Information about tenders
Number of tenders received: 2
Number of tenders received by electronic means: 2
The contract has been awarded to a group of economic operators: no
V.2.3.
Name and address of the contractor
Official name: WithSecure A/S
National registration number: 32559409
Postal address: Rued Langgaardsvej 8
Town: København S
NUTS code: DK011 Byen København
Postal code: 2300
Country: Denmark
Telephone: +45 70207525
The contractor is an SME: yes
V.2.4.
Information on value of the contract/lot
Initial estimated total value of the contract/lot: 5 000 000,00 DKK
Total value of the contract/lot: 6 000 000,00 DKK
V.2.5.
Information about subcontracting

Section V: Award of contract

Contract No: 2
Title:
Tender for a Framework Agreement on TIBER-DK related services - supplier 2
A contract/lot is awarded: yes
V.2.
Award of contract
V.2.1.
Date of conclusion of the contract
06/11/2023
V.2.2.
Information about tenders
Number of tenders received: 2
Number of tenders received by electronic means: 2
The contract has been awarded to a group of economic operators: no
V.2.3.
Name and address of the contractor
Official name: NCC Group A/S
National registration number: 26373549
Postal address: Svanevej 12
Town: København NV
NUTS code: DK011 Byen København
Postal code: 2400
Country: Denmark
The contractor is an SME: yes
V.2.4.
Information on value of the contract/lot
Initial estimated total value of the contract/lot: 5 000 000,00 DKK
Total value of the contract/lot: 6 000 000,00 DKK
V.2.5.
Information about subcontracting

Section VI: Complementary information

VI.3.
Additional information
VI.4.
Procedures for review
VI.4.1.
Review body
Official name: Klagenævnet for Udbud
Postal address: Nævnenes Hus, Toldboden 2
Town: Viborg
Postal code: 8800
Country: Denmark
E-mail: klfu@naevneneshus.dk
Telephone: +45 72405600
Internet address: https://klfu.naevneneshus.dk/
VI.4.2.
Body responsible for mediation procedures
Official name: There is no such body
Town: København
Country: Denmark
VI.4.3.
Review procedure
Precise information on deadline(s) for review procedures:
Pursuant to the Danish Act on the Complaints Board for Public Procurement, etc. (lov om Klagenævnet for Udbud m.v.) (the Act is available (in Danish) at www.retsinformation.dk), the following deadlines apply to the lodging of complaints:
Complaints for not having been selected must be submitted to the Danish Complaints Board for Public Procurement before the expiry of 20 calendar days, see section 7(1) of the Act, from the day after submission of notification to the candidates concerned of the identity of the successful tenderer where the notification is accompanied by an explanation of the grounds for the decision in accordance with section 2(1), para (1) of the Act and section 171(2) of the Danish Public Procurement Act.
In other situations, complaints of award procedures, see section 7(2) of the Act, must be lodged with the Danish Complaints Board for Public Procurement before the expiry of:
1) 45 calendar days after the contracting entity has published a notice in the Official Journal of the European Union that the contracting entity has entered into a contract. The deadline is calculated from the day after the day when the notice was published.
2) 30 calendar days calculated from the day after the day when the contracting entity has notified the candidates concerned that a contract based on a framework agreement with reopening of competition or a dynamic purchasing system has been entered into where the notification has included an explanation of the relevant grounds for the decision.
3) 6 months after the contracting entity entered into a framework agreement calculated from the day after the day when the contracting entity notified the candidates and tenderers concerned, see section 2(2) of the Act and section 171(4) of the Danish Public Procurement Act.
4) 20 calendar days calculated from the day after the contracting entity has submitted notification of its decision, see section 185(2) of the Danish Public Procurement Act.
Not later than at the time of lodging a complaint with the Danish Complaints Board for Public Procurement, the complainant must notify the contracting entity in writing that a complaint has been lodged with the Danish Complaints Board for Public Procurement and whether the appeal was lodged during the standstill period, see section 6(4) of the Act. In cases where the complaint was not lodged within the standstill period, the complainant must furthermore indicate whether a suspensory effect of the complaint has been requested, see section 12(1) of the Act.
The e-mail address of the Complaints Board for Public Procurement is set out in section VI.4.1.
The Complaints Board’s own complaints procedure is available at https://naevneneshus.dk/start-din-klage/klagenaevnet-for-udbud/vejledning/
VI.4.4.
Service from which information about the review procedure may be obtained
Official name: Konkurrence- og Forbrugerstyrelsen
Postal address: Carl Jacobsens Vej 35
Town: Valby
Postal code: 2500
Country: Denmark
E-mail: kfst@kfst.dk
Telephone: +45 41715000
Internet address: http://www.kfst.dk
VI.5.
Date of dispatch of this notice
16/11/2023