Managed Services for National Public Key Infrastructure (PKI)

AI-generated analysis of the documents. Check the official notice and any amendments for current submission details.

1. At a glance

2. Scope of Work

The procurement seeks a managed service provider to support a national Public Key Infrastructure (PKI). This includes the supply of project resources, High Security Module (HSM) hardware and support, PKI software, and PKI software support. The service will also encompass expertise and per diem rates for implementing new functionality within the PKI infrastructure and connected Department of Justice, Home Affairs and Migration systems. A critical element is the requirement for a dedicated physical presence in Dublin to meet stringent incident management service levels.

The managed service contract is structured into two phases:

• Phase 1 – Implementation and Modernisation: This phase involves upgrading the existing PKI solution to ensure its continued operation, security, and supportability. Activities include infrastructure modernisation, replacement of end-of-life components, integration of the PKI infrastructure with desktop-deployed business applications and client software, and deployment to end-users. The upgraded solution must support existing issued cards for a period of 6 years and maintain business continuity during the transition. The incumbent provider's PKI solution is to be taken over within 4 months of contract signing. The PKI integration project is anticipated to be completed between March 2027 and July 2027.

• Phase 2 – Managed Services: This phase covers the ongoing maintenance and management of the PKI Infrastructure solution for the contract duration. Key activities include:

• Monthly liaison with third parties for certificate signing requests and certificates.

• Monthly application of certificates to prevent expiration.

• Incident Management, including physical data centre and office visits for problem resolution.

• Proactive monthly patching and testing of the solution to maintain currency.

• Root cause analysis of incidents.

• Availability management, including backups, restore tests, and disaster recovery tests.

• Maintenance of a roadmap for all PKI Infrastructure components and provision of Statements of Work for necessary changes.

• Maintenance of support contracts for all PKI Infrastructure elements, including timely invoicing to the Contracting Authority.

• Provision of resources on a per diem basis for PKI-related projects under agreed Statements of Work.

• Optional provision of 24x7 on-call incident response for out-of-hours incidents.

3. Background & buyer context

The Department of Justice, Home Affairs and Migration is procuring these managed services to support Ireland's national Public Key Infrastructure (PKI). This PKI is essential for verifying electronic Residence Permits (eRPs) in compliance with European legislation. In 2024, approximately 340,000 eRPs were processed, with a similar volume of 320,000 in 2025. The procurement is being conducted via a competitive procedure with negotiation, indicating a desire for detailed discussion and potential refinement of proposals. The Department's mission is to make Ireland a safe, fair, and inclusive place to live and work, and this service is critical to that objective. The incumbent provider's PKI solution is to be transitioned within four months of contract signing.

4. Eligibility & selection criteria

• Turnover requirement: Applicants must demonstrate that their turnover exceeded €800,000 per annum in each of the last three financial years, or pro-rata if more recently established.
• Insurance:
• Public Liability: €6.5 Million limit for any one claim or series of claims arising out of a single occurrence.
• Product Liability: €6.5 Million limit for any one claim or series of claims arising out of a single occurrence.
• Professional Indemnity: €1.0 Million limit for any one claim or series of claims arising out of a single occurrence.
• Cyber Insurance (including loss of data): €1 million limit for any one claim or series of claims arising out of a single occurrence.
• Employer's Liability: €12.7 Million limit for any one claim or series of claims arising out of a single occurrence.
• Certifications: Applicants must provide information on measures in place to ensure the delivery of a quality service, for example, by way of an externally certified system (e.g., ISO).
• Past experience: Applicants must refer to instances within the previous five years demonstrating successful delivery of services of a comparable nature (PKI) with a value greater than €50,000, detailing how the nature and complexity were addressed.
• Personnel: Applicants must demonstrate access to at least the minimum numbers of skilled personnel stated in Appendix B.
• Geographic / facility constraints: The successful tenderer must maintain a dedicated physical presence in Dublin to enable a maximum incident response time of one hour and a maximum incident resolution time of four hours. The PKI solution from the incumbent provider must be taken over within 4 months of contract signing.
• Company Existence: The firm must have been in existence for at least 6 months.

5. Award criteria & scoring

Criterion Weight (%) Sub-criteria