ComReg T21616 - IT Security Consultancy Services

AI-generated analysis of the documents. Check the official notice and any amendments for current submission details.

1. At a glance

2. Scope of Work

The tender involves providing IT Security Consultancy Services to ComReg. The contractor will assist ComReg in enhancing its IT security posture. The scope includes:

• Security Assessments: Conduct regular security assessments and audits to identify vulnerabilities within ComReg's IT infrastructure.
• Compliance Support: Ensure compliance with ISO 27001, NIS2, and CIS Controls or equivalent security frameworks.
• Incident Response: Develop and implement incident response strategies and procedures.
• Risk Management: Identify, assess, and mitigate IT security risks.
• Policy Development: Assist in the development and updating of IT security policies and procedures.
• Training and Awareness: Provide training sessions to ComReg staff on IT security best practices.
• Reporting: Prepare detailed reports on security assessments, incidents, and compliance status.
• Consultation: Offer expert advice on IT security matters as required by ComReg.

The contractor will work closely with ComReg's internal IT team and may be required to engage with external stakeholders. The services are expected to be delivered primarily at ComReg's premises, with some remote work possible.

3. Background & buyer context

ComReg is procuring IT Security Consultancy Services to bolster its cybersecurity framework in response to evolving threats and regulatory requirements. This procurement aligns with ComReg's strategic objective to maintain robust IT security measures. The initiative is part of a broader effort to ensure compliance with national and EU regulations, including the General Data Protection Regulation (GDPR). The incumbent provider, if any, is not named in the tender documents. The procurement reflects ComReg's commitment to safeguarding its IT infrastructure and data integrity.

4. Eligibility & selection criteria

• Turnover requirement: Minimum annual turnover of €800,000 for each of the last 3 financial years.
• Insurance:
• Public Liability: €6,500,000 per claim.
• Employer's Liability: €13,000,000 per claim.
• Professional Indemnity: €1,000,000 per claim.
• Cyber Liability: €5,000,000 per occurrence.
• Certifications: ISO 27001 certification required.
• Past experience: Not specified for this tender.
• Personnel: Not specified for this tender.
• Geographic / facility constraints: Not specified for this tender.

5. Award criteria & scoring

The evaluation follows the Most Economically Advantageous Tender (MEAT) approach, with a 70/30 quality/price split.

6. Submission requirements

• Method statement / response document: No named template, no page limits specified.
• CVs: Not specified for named roles.
• Pricing schedule: Appendix 2 format.
• Case studies: Not specified.
• Declarations: ESPD, Tax clearance, Conflict of Interest.
• Mandatory site visit: Not specified.
• Submission portal: eTenders, with specific format rules (single ZIP file, max 500MB).

7. Key dates & process

8. Contract terms that matter

The contract is for 1 year, with the possibility of two 12-month extensions. Payment terms require settlement within 15 days of invoice receipt. Key performance indicators (KPIs) and service level agreements (SLAs) are not detailed. Liquidated damages or penalty regimes are not specified. Intellectual property rights remain with ComReg. Sub-contracting is allowed, but changes post-award require ComReg's approval. No parent-company guarantee or bond is required.

9. Risks, red flags & unusuals

The tender specifies a high turnover requirement relative to the estimated contract value, potentially limiting the bidder pool. The requirement for ISO 27001 certification may exclude smaller firms lacking this accreditation. The absence of detailed KPIs and SLAs could lead to ambiguity in performance expectations. The contract's dependency on compliance with evolving EU regulations introduces potential scope changes.

10. SME fit assessment

This tender is suitable for medium-sized enterprises with a strong IT security focus and ISO 27001 certification. Smaller firms may find the turnover and certification requirements challenging. Consortium bids are allowed, offering opportunities for SMEs to partner with larger firms. Bid preparation is likely to require several days, given the need for detailed compliance documentation. The presence of an incumbent is not confirmed, but the high turnover requirement suggests a competitive environment.

11. Where to dig deeper

• Source RFT filename: "Request For Tender - IT Security Consultancy Service (Non-Framework).pdf"
• eTenders CFT ID: Not specified
• Contact email or clarification portal: eTenders messaging facility
• Important attachments:
• Appendix 1 — Requirements and Specifications
• Appendix 2 — Pricing Schedule
• Appendix 4 — European Single Procurement Document (eESPD)