Tender for a Framework Agreement on the delivery of TIBER-DK related services

Description

Danmarks Nationalbank and the most important financial institutions have established a Danish intel-led red-team test program for the Danish financial sector. TIBER-DK stands for Threat Intelligence Based Ethical Red-teaming. The tests will contribute to improve the ability to discover and react to hacker attacks which potentially can affect critical functions in the financial institutions. TIBER-DK is based on a common European framework developed by the ECB. This procurement seeks to establish a Framework Agreement with a primary and a secondary supplier of security testing with Tiber DK covering both Threat Intelligence reports and Red Team testing for a period of four years. The tenderer shall be able to document at least one reference regarding an institution, which is a member of FSOR where the tenderer has delivered a TCT attested Targeted Threat Intelligence (TTI) report and Threat Intelligence Red Team Testing (RT) based on TIBER DK, cf. section III.1.3). Lot 1: The TI provider shall provide Targeted Threat Intelligence (TTI) reports during the contract period. The TTI reports shall formulate threat scenarios to be mimicked by the Red Team Provider against the flags set in the Detailed Scope document to be provided by the White Team. The TTI report shall be shared with the Red teaming. The TTI report shall be based on the General Threat Landscape (GTL) report provided by the TIBER Cyber Team (TCT). The Red Team shall provide Red Team Attack planning and execution in accordance with TIBER-DK. Based on the Red Teaming, the Red Team provider shall provide a Red Team Report and plan and facilitate Replay/Purple Teaming workshops as part of closing of the exercises. The Threat Intelligence Based Ethical Red Team tests shall be conducted on Danmarks Nationalbank during the contract period. The tests shall be conducted in accordance with the Danish implementation of the TIBER framework: TIBER-DK, including the TIBER-DK General Implementation Guide, the TIBER-DK Operational Guide and underlying specific guides. In areas where no general or detailed TIBER-DK guidance exists, the TIBER-EU guidance – if any - shall be followed. The Supplier shall ensure consultants with knowledge in Danish, as the TI reports and the cooperation with the Customer will be carried out in Danish. The tenderer shall authorize the Contracting Authority as part of the procurement process to request confirmation on any declared successful conduct of previous TIBER engagement via the TCT (this procedure ensures the anonymity of the references given by the tenderer).