Request for Tenders for Managed Public-key Infrastructure (PKI) Services

AI-generated analysis of the documents. Check the official notice and any amendments for current submission details.

1. At a glance

2. Scope of Work

This tender seeks a managed Public-key Infrastructure (PKI) service for the Office of the Revenue Commissioners. The service encompasses the provisioning, support, and maintenance of a PKI solution. The estimated value for the services over the contract term, including potential extensions, is €3,500,000 (excluding VAT). The contract is for an initial term of 7 years, with the possibility of up to three 1-year extensions at the Contracting Authority's request, and further extensions as required.

The scope of work includes, but is not limited to:

• PKI Service Provisioning: Establishing and managing the necessary infrastructure and services for a secure PKI.
• Support and Maintenance: Providing ongoing technical support and maintenance for the PKI system.
• Integration: Ensuring the service integrates into Revenue’s existing ISO27001 Information Security and ISO22301 Business Continuity procedures.
• Availability: The service must be available 24 hours a day, 7 days a week, 365 days a year, enabling users to access tax details and manage liabilities.
• Security Standards: Hardware Security Modules (HSMs) must meet a minimum of FIPS 140-2 Level 3 (or FIPS 140-3 Level 3) or equivalent Common Criteria standard.
• Reporting: Monthly activity and performance reports are required.
• Updates and Patches: The contractor must provide details on patches, CVEs, bug fixes, and version updates supplied over the previous 36 months, and propose future versions for the next 60 months.
• Planned Unavailability: Specific notice periods are required for planned unavailability: a minimum of 14 days prior notice for periods less than 4 hours, and a minimum of 28 days prior notice for periods exceeding 4 hours.
• User Management: The service will support a specified number of users, including frequent users and users at a transition point.

3. Background & buyer context

This procurement is being conducted by the Office of the Revenue Commissioners, the Contracting Authority. The tender is for the supply of a managed Public-key Infrastructure (PKI) service. The estimated expenditure for this service over the contract term, including potential extensions, is €3,500,000 (excluding VAT). The procurement follows an open procedure under EU and Irish regulations. The contract duration is set at 7 years, with options for extensions. The service is critical for enabling taxpayers and businesses to securely access tax details and manage liabilities, operating 24/7/365.

4. Eligibility & selection criteria

• Turnover requirement: Tenderers must demonstrate an average annual turnover of €1,000,000 (Ex VAT) for each of the last three financial years. If the company was established more recently, the turnover must meet this threshold for each year of establishment.
• Insurance: The successful tenderer must hold the following insurances for the term of the Services Contract:
• Employer’s Liability: €12.7 million for any one claim or series of claims arising out of a single occurrence.
• Public Liability: €6.5 million for any one claim or series of claims arising out of a single occurrence.
• Product Liability: €6.5 million for any one occurrence and in aggregate per insurance year.
• Professional Indemnity: €10 million in the aggregate per insurance year.
• Cyber Insurance: €5 million in the aggregate per insurance year.
• Certifications: Tenderers should provide details of relevant EU Specific Legal and Regulatory Compliance/Certifications or Security Certifications and Accreditations, such as ISO 27001, eIDAS compliance, GDPR, and NIS2. ISO 27001, ISO22301, and ISO20000 certifications are specifically mentioned.
• Past experience: Tenderers must demonstrate capability and previous relevant experience by providing details of 3 previous contracts within the last 3 years. These contracts should be of similar nature and scope, with clients of a similar scale to Revenue, and involve similar response requirements for support services. At least one reference must be from a public sector or regulated financial services client.
• Personnel: Not specified for this tender.
• Geographic / facility constraints: Not specified for this tender, beyond the implication that services will be provided within the Republic of Ireland.

5. Award criteria & scoring

The contract will be awarded on the basis of the Most Economically Advantageous Tender (MEAT). While there is no minimum score required at the overall criteria level, minimum scores are required for certain sub-criteria questions, which are clearly marked. Failure to meet these sub-criteria minimum scores will result in elimination from the competition. Costs will only be considered if the tender has met the minimum scoring requirements in the qualitative award criteria.

6. Submission requirements

• Method statement / response document: Tenders must be organised according to the format outlined in Appendix 1. All requests for information must be answered concisely.
• CVs: Not specified for this tender.
• Pricing schedule: All Tenderers must complete the Pricing Schedule at Appendix 2. Prices must be all-inclusive, in Euro, and exclusive of VAT.
• Case studies: Tenderers must provide details of 3 previous contracts within the last 3 years demonstrating capability.
• Declarations:
• European Single Procurement Document (eESPD) must be completed and submitted electronically.
• A scanned, signed copy of the Tenderers’ Statement (Appendix 3) on headed notepaper is required.
• The Declaration as to Personal Circumstances of Tenderer (Appendix 4) must be completed, signed, and witnessed by a practicing Solicitor/Commissioner for Oaths for the successful tenderer.
• Undertakings from entities whose capacity is relied upon for selection criteria.
• Mandatory site visit: Not specified for this tender.
• Submission portal: Tenders must be submitted via the e-tenders electronic on-line tendering facility only.

7. Key dates & process

8. Contract terms that matter

The Services Contract is for an initial term of 7 years, with the possibility of up to three 1-year extensions at the Contracting Authority's request, and further extensions as required. Payments will be made in accordance with the Services Contract (Appendix 5). The service must be available 24/7/365. Specific notice periods are required for planned unavailability. The successful tenderer must hold specified insurances for the contract term. Any currency variations over the contract term are borne by the Tenderer. The contract includes provisions for tax compliance, data protection, and environmental, social, and labour law obligations.

9. Risks, red flags & unusuals

The estimated value of €3,500,000 over a potential 8-year term (7+1) suggests an average annual value of €437,500. This is significantly lower than the €1,000,000 annual turnover requirement, which may indicate a high bar for financial stability relative to the contract's direct value, potentially favouring larger, diversified providers. The requirement for 3 similar contracts within the last 3 years, with at least one from the public sector or regulated financial services, also narrows the field. The long contract term (7 years with extension options) requires a commitment to long-term service provision and stability.

10. SME fit assessment

This tender is likely best suited for established providers of managed PKI services with a proven track record in the public sector or regulated financial services. The minimum annual turnover requirement of €1,000,000 for the last three years, coupled with the need for three comparable contracts within the last three years, presents a significant barrier for smaller, less experienced companies. Consortium bids are permitted, which could allow SMEs to participate by partnering with larger firms to meet the financial and experience criteria. The bid preparation effort is likely substantial, requiring detailed technical proposals, pricing schedules, and extensive documentation. The strong emphasis on financial standing and past experience suggests a potentially high probability of success for incumbent or well-established players in the PKI market.

11. Where to dig deeper

• Source RFT filename: RFT Managed PKI Service 2026.docx
• eTenders CFT ID: Not specified
• Contact email or clarification portal: Via the online messaging function on www.etenders.gov.ie
• Most important attachments:
• Appendix 1 – Requirements and Specifications
• Appendix 2 – Pricing Schedule
• Appendix 5 – Services Contract