Provision of One Time Passcode services via API

AI-generated analysis of the documents. Check the official notice and any amendments for current submission details.

1. At a glance

2. Scope of Work

The contract involves providing One Time Passcode (OTP) handling services via API for Multi-Factor Authentication (MFA). The service is intended to enhance security for the Department's digital platforms by integrating OTPs as a secondary authentication factor.

• API Development and Integration: Develop and maintain a RESTful API for OTP generation and validation.
• Message Delivery: Ensure reliable and timely delivery of OTPs to end-users via SMS or other telecommunications channels.
• System Uptime: Maintain a minimum of 99% system uptime over the contract period.
• Volume Handling: Support high-volume message transmission, particularly during peak periods.
• Security Compliance: Implement robust security measures, including data encryption (TLS/SSL) and secure API authentication (OAuth2, API keys).
• Data Management: Adhere to GDPR and Irish data protection laws, including data retention and deletion policies.
• Technical Support: Provide 24/7 customer and technical support, including a ticketing system and defined Service Level Agreements (SLAs).
• Performance Monitoring: Offer tools for monitoring service performance, availability, and delivery success rates.
• Reporting: Supply comprehensive reporting capabilities and dashboards for the Contracting Authority.
• Interoperability: Ensure compatibility with Irish and international mobile networks.

3. Background & buyer context

The Department of Enterprise Tourism and Employment seeks to enhance its digital security infrastructure by integrating OTP services for MFA. This procurement aligns with broader governmental initiatives to bolster cybersecurity across public services. The decision to procure these services now reflects an increasing need for secure authentication methods in response to rising cyber threats. The Department aims to ensure that its digital platforms remain secure and user-friendly, thereby maintaining public trust and compliance with data protection regulations.

4. Eligibility & selection criteria

• Turnover requirement: Minimum annual turnover of €1,500,000 for 2022, 2023, and 2024.
• Insurance:
• Employer’s Liability: €13,000,000
• Public Liability: €6,500,000
• Product Liability: €6,500,000
• Professional Indemnity: €1,300,000
• Cyber Liability: €5,000,000
• Certifications: ISO 27001, ISO 20000
• Past experience: At least 3 comparable contracts in the last 3 years involving OTP handling services via API.
• Personnel: Not specified for this tender.
• Geographic / facility constraints: Not specified for this tender.

5. Award criteria & scoring

The price/quality split follows the Most Economically Advantageous Tender (MEAT) approach.

6. Submission requirements

• Method statement / response document: Follow RFT format, no page limits specified.
• CVs: Not specified for this tender.
• Pricing schedule: Complete Appendix 2, format not specified.
• Case studies: At least 3, involving OTP handling services.
• Declarations: ESPD, Tax clearance, Conflict of Interest.
• Mandatory site visit: Not specified.
• Submission portal: eTenders, with specific format rules.

7. Key dates & process

8. Contract terms that matter

The contract is for 12 months, with the possibility of four 12-month extensions. Payment terms are as per the Services Contract. Key performance indicators include maintaining a minimum 99% system uptime. Liquidated damages or penalties are not specified. Termination clauses allow for 14 days' notice if breaches are not remedied within 30 days. Intellectual property ownership and sub-contracting rules are not specified. No parent-company guarantee or bond requirements are mentioned.

9. Risks, red flags & unusuals

The tender requires a minimum turnover close to the estimated contract value, potentially limiting the bidder pool to larger firms. The geographic constraint is not specified, which could affect service delivery logistics. The contract's reliance on annual extensions may introduce uncertainty regarding long-term financial planning. The requirement for high system uptime and integration with international networks could pose challenges for firms without existing infrastructure.

10. SME fit assessment

This tender is suitable for medium to large firms with experience in telecommunications and API services. SMEs may participate through consortiums or sub-contracting, as encouraged by the Contracting Authority. Bid preparation is likely to require several days, given the need for detailed technical and financial documentation. The presence of an incumbent is not specified, but the high turnover requirement suggests a competitive environment.

11. Where to dig deeper

• Source RFT filename: "OTP Services via API.docx"
• eTenders CFT ID: Not specified
• Contact email or clarification portal: eTenders messaging facility
• Important attachments: "Appendix 1 — Requirements and Specifications", "Appendix 2 — Pricing Schedule", "Appendix 5 — Services Contract"