ASSISTANCE TO THE DANISH FINANCIAL SUPERVISORY AUTHORITY IN CONDUCTING CYBER STRESS TESTING

Description

The DFSA initiates a new programme for strengthened operational resilience in the financial sector. In the programme, the consequences of an extensive ICT disruption will be analysed by means of cyber stress testing. This tender is for consultancy services to assist the DFSA in the design and implementation of the initial cyber stress project. The price for the contract cannot exceed 4.500.000 DKK including VAT, all fees and travels expenses included. The tendered contract has not been divided into lots, as it is the contracting authority’s assessment that this will give the most beneficial and economically sound contract. Lot 1: The DFSA launches a new programme for strengthened operational resilience in the financial sector. In the programme, the consequences of an extensive ICT disruption will be analysed by means of cyber stress testing. The initial project, for which the DFSA is seeking to procure consultancy services, will be an analysis of the consequences of an extensive ICT disruption via cyber stress testing at enterprise level. The starting point is a scenario where a systemically important ICT service provider (and/or financial institution) experiences an extensive ICT disruption. The financial institutions, which participate in the test, must map the operational consequences of the disruption step-by-step. E.g. mapping which business processes will be affected, describing the institutions’ business continuity plans in place, including approval processes for important decisions, and the extent to which these plans will enable the institution to continue its processes until normal ICT operations have been restored, and how. Further, the disaster recovery plans, that the service provider or financial institution has in place, must be described and documented, including how fast normal ICT operations can be restored. Based on the detailed mapping of the operational consequences, the institutions must assess the financial, legal and reputational consequences of the disruption at various stages up until normal operations can be restored and provide supporting evidence. Finally, depending on the results of the analyses, it will be assessed whether there is a need for additional measures/investments in the individual institutions and/or at sector level.