Invitation to Tender (ITT) for the provision of Darktrace License Renewals and Software Support Services

AI-generated analysis of the documents. Check the official notice and any amendments for current submission details.

1. At a glance

2. Scope of Work

The Commission for Regulation of Utilities (CRU) requires the renewal of Darktrace cybersecurity platform licenses and associated software support services. This contract is essential for maintaining the organization's cybersecurity posture, which is critical given its role in managing sensitive regulatory data. The successful contractor will be responsible for ensuring continuous operation of the Darktrace platform, which has been in use since 2023.

The contractor's day-to-day activities will include:

• Annual License Renewal: Provide annual renewal of Darktrace licenses to prevent any lapse in coverage.
• Vendor Support and Maintenance: Ensure access to vendor support, including patches and updates.
• Operational Support: Assist CRU and its Managed Security Operations Center (SOC) in maintaining operational effectiveness through configuration assurance and service health monitoring.
• Scalability Mechanism: Implement a mechanism for scalable license growth, accommodating an increase from approximately 200 to 265 end users over the contract term, with an estimated growth of 30 additional users per annum.
• Monitoring Coverage: Maintain monitoring across the CRU ICT estate, which includes:
• On-premise network infrastructure and data center workloads.
• Cloud services (e.g., Microsoft 365, Azure).
• Endpoint devices (laptops, desktops, servers).
• Identity systems (e.g., Microsoft Entra ID).
• Remote access pathways (VPN, ZTNA).

The contract will also require the contractor to ensure no lapse in coverage, particularly during the transition to the renewed licenses, and to provide a renewal plan that guarantees continuity.

3. Background & buyer context

The procurement of Darktrace license renewals and software support services is driven by the CRU's need to maintain a robust cybersecurity framework in an increasingly complex threat landscape. The CRU, as Ireland's independent energy and water regulator, is tasked with ensuring safe and sustainable energy and water supplies. The existing Darktrace solution has been integral to the CRU's security operations since its deployment in 2023. The renewal is crucial for the continuity of protection against cyber threats, aligning with the CRU's strategic objectives to enhance its cybersecurity posture.

4. Eligibility & selection criteria

Bidders must meet the following eligibility and selection criteria:

• Turnover requirement: Minimum average annual turnover of €200,000 (excl. VAT) for the last three financial years.
• Insurance:
• Employer's Liability: €13 million
• Public Liability: €6.5 million
• Professional Indemnity: €1 million
• Cyber Insurance: not specified
• Certifications: Must hold ISO 27001 certification (or equivalent).
• Past experience: Must demonstrate successful delivery of at least two Darktrace contracts similar in nature and scale within the last five years.
• Personnel: At least two staff members skilled in supporting the Darktrace solution.
• Geographic / facility constraints: Not specified for this tender.

5. Award criteria & scoring

Bids will be evaluated based on the following criteria:

The overall score will be based on a maximum of 1,000 marks, with a minimum qualifying threshold of 60% of the marks available for each criterion.

6. Submission requirements

Bidders must submit the following documentation:

• Method statement / response document: Complete the Tender Response Document (TRD) as per the provided template.
• CVs: Include CVs for key personnel (maximum 2 pages each).
• Pricing schedule: Provide a detailed pricing schedule using the specified format in the TRD.
• Case studies: Submit evidence of two comparable projects, including contract values.
• Declarations: Include ESPD, Bona Fides, Tax clearance, and Conflict of Interest declarations.
• Mandatory site visit: Not specified for this tender.
• Submission portal: Tenders must be submitted via the electronic post-box on www.etenders.gov.ie, ensuring compliance with file format requirements.

7. Key dates & process

8. Contract terms that matter

Key contract terms include:

• Term and extension: The contract is for a duration of 2 years with an option to extend for an additional 12 months.
• Payment terms: Invoices must be submitted annually, referencing the purchase order number and billing period.
• Service Level Agreements (SLAs): Defined SLAs must ensure consistent delivery of support services, including response times for incidents based on severity levels.
• Termination clauses: The contract may be terminated with 30 days' notice if service levels are not met.
• IP ownership: Not specified for this tender.
• Sub-contracting rules: Not specified for this tender.

9. Risks, red flags & unusuals

Potential risks and concerns include:

• The requirement for a minimum turnover of €200,000 may limit participation from smaller firms.
• The need for ISO 27001 certification could exclude bidders without this accreditation.
• The contract's no-lapse requirement for license coverage may pose challenges during the transition period.
• The specified growth in user numbers (from 200 to 265) may create pressure on the contractor to scale services rapidly without service disruption.

10. SME fit assessment

This tender is suitable for small to medium-sized enterprises (SMEs) that have:

• Experience in providing cybersecurity solutions, specifically with Darktrace.
• The capacity to meet the insurance and turnover requirements.
• A team with the necessary skills to support the Darktrace platform.
• The ability to scale services in response to CRU's growth.

Consortium or subcontracting arrangements are not explicitly mentioned, but firms may consider these options to meet the requirements. Bid preparation is expected to require several days, including time for gathering documentation and preparing the TRD. The presence of an incumbent provider may signal a competitive landscape, but the opportunity remains open for qualified bidders.

11. Where to dig deeper

• Source RFT filename: ITT Non OJEU Darktrace Ref 011-03-635.pdf
• eTenders CFT ID: not specified
• Contact email: Queries must be directed to the messaging facility on www.etenders.gov.ie.
• Important attachments:
• Appendix 1 — Statement of Requirements
• Appendix 2 — Grading Criteria
• Appendix 4 — Terms and Conditions