Request for Tender for the Provision of Chief Information Security Officer (CISO) as a Service and Associated Cyber Security Advisory and Specialist Support Services

AI-generated analysis of the documents. Check the official notice and any amendments for current submission details.

1. At a glance

2. Scope of Work

The contract requires the provision of Chief Information Security Officer (CISO) advisory services, alongside associated cyber security advisory and specialist support services for Coimisiún na Meán. The services are divided into two primary components.

Part 1 focuses on CISO advisory services and ICT-focused cyber security advisory support for Coimisiún na Meán's ICT team. This includes expert guidance, advice, and support concerning information security governance, cyber security risk management, and ICT policies, procedures, processes, and technical controls. The successful tenderer will assist Coimisiún na Meán in aligning its ICT environment, information security arrangements, and cyber security practices with applicable public sector requirements, industry best practices, and standards such as ISO/IEC 27001. Annual expenditure for Part 1 is capped at €50,000 excluding VAT.

Part 2 involves specialist cyber security advisory and support services for business units outside of core ICT operational activities. These services aim to support Coimisiún na Meán in meeting broader statutory, regulatory, and operational obligations across its functions and regulatory remit. These services are optional and will be procured on a drawdown basis as required. Annual expenditure for Part 2 is not expected to exceed €50,000 excluding VAT.

The contract will commence upon execution and has an initial term of three years. Coimisiún na Meán reserves the right to extend the contract for up to two additional 12-month periods, bringing the maximum possible duration to five years. The estimated maximum value of the contract is €500,000 excluding VAT over the entire term.

3. Background & buyer context

Coimisiún na Meán was established as an independent regulator to oversee and enforce new and updated regulatory frameworks for demand-driven audiovisual media services and online safety, as set out in the Online Safety and Media Regulation Act. The Commission plays a key role in the development and funding of the wider media sector, including devising and implementing a Media Fund. It also advises the Minister on the creation of a European Works Levy and supports equality, diversity, inclusion, and sustainability within the media sector. The Commission is structured as a multi-person body, initially led by three Commissioners and an Executive Chairperson. This procurement is driven by the significantly expanded regulatory framework and the need for robust information security governance and cyber security support to fulfil its mandate.

4. Eligibility & selection criteria

Bidders must meet the following minimum requirements to be considered:

• Turnover requirement: Tenderers must have achieved a minimum average annual turnover of €2,500,000 over the previous three financial years. If established for a shorter period, this requirement must be met for each year of trading.
• Insurance:
• Employers Liability Insurance: €13 million
• Public Liability Insurance: €6.5 million
• Professional Indemnity Insurance: €1 million Evidence of these insurances, or the ability to put them in place, is required.
• Certifications: Tenderers must hold valid certification to ISO 27001 or an equivalent independently certified information security management standard.
• Past experience: Tenderers must have successfully completed at least three contracts of a similar nature, scale, and complexity within the previous five years. These contracts should involve cyber security advisory, governance, assurance, CISO advisory services, or related specialist cyber security support delivered to public sector bodies, regulated entities, or similarly complex organisations.
• Personnel: The proposed Technical Liaison / Lead CISO resource must have a minimum of 10 years' relevant experience. Specific roles mentioned with minimum experience requirements include:
• Security Auditor / Compliance Specialist: Minimum 5 years' relevant experience.
• Penetration Tester: Minimum 5 years' relevant experience and relevant CREST, CHECK, or equivalent certification.
• Digital Forensics Specialist: Minimum 5 years' relevant experience.
• Governance, Risk and Compliance Specialist: Minimum 5 years' relevant experience.
• Data Protection Officer: Minimum 5 years' relevant experience.
• Security Architect: Minimum 5 years' relevant experience. CVs demonstrating expertise for proposed roles are mandatory.
• Geographic / facility constraints: While not a strict geographic constraint, the tender requires confirmation of the ability to attend in-person meetings in Ireland. Support services are expected between 08:00 and 18:00 Monday to Friday, with escalation support available outside these hours.

5. Award criteria & scoring

The contract will be awarded to the Tenderer submitting the Most Economically Advantageous Tender (MEAT). The evaluation will consider the tenderer's understanding of the requirements, proposed methodology, service delivery model, resources, relevant experience, governance arrangements, pricing structure, and approach to environmental, social, and sustainability considerations.

Criterion Weight (%) Minimum score required Sub-criteria