Cyber Security Testing Services (CSTS)

EirGrid plc

Driven by the ongoing development of our information security framework and business transformation programmes, EirGrid’s Information Security function has established a security testing and a security risk assessments reporting regime. The aim of the reporting regime is to provide EirGrid with the following:
1) Vulnerability assessment with the associated exposures inherent within their current infrastructure;
2) Comprehensive risk analysis and recommendations, including a remediation plan;
3) Security audit, security reviews and test details, including applied methodology.
In keeping with its position in the industry EirGrid maintains a modern IT infrastructure comprising the following technologies:
— Servers: physical and virtua, Linux, Unix, Windows,
— desktop: Workstation and Laptop, Windows,
— databases: oracle and MSQL,
— network: routers, switches, firewalls, load balancers and gateways,
— cloud services.

Deadline

The time limit for receipt of tenders was 2019-03-04. The procurement was published on 2019-01-28.

Suppliers

The following suppliers are mentioned in award decisions or other procurement documents:

• Ernst and Young

Who?

• EirGrid plc

What?

• Information systems or technology strategic review and planning services › Information technology services

Where?

• Eastern and Midland › Dublin
• Northern Ireland › Belfast

Procurement history

Date	Document
2019-01-28	Contract notice
2020-04-23	Contract award notice

Contract notice (2019-01-28)
Object
Scope of the procurement
Title: Information technology services
Reference number: ENQEIR653
Short description:

Driven by the ongoing development of our information security framework and business transformation programmes, EirGrid’s Information Security function has established a security testing and a security risk assessments reporting regime. The aim of the reporting regime is to provide EirGrid with the following: 1) Vulnerability assessment with the associated exposures inherent within their current infrastructure; 2) Comprehensive risk analysis and recommendations, including a remediation plan; 3) Security audit, security reviews and test details, including applied methodology. In keeping with its position in the industry EirGrid maintains a modern IT infrastructure comprising the following technologies: — Servers: physical and virtua, Linux, Unix, Windows, — desktop: Workstation and Laptop, Windows, — databases: oracle and MSQL, — network: routers, switches, firewalls, load balancers and gateways, — cloud services.

Notice metadata
Original language: English 🗣️
Document type: Contract notice
Nature of contract: Services
Regulation: European Union, with participation of GPA countries
Common procurement vocabulary (CPV)
Code: Information technology services 📦
Additional CPV: Information technology services 📦
Place of performance
NUTS region: Belfast 🏙️

Procedure
Procedure type: Negotiated procedure
Type of bid: Submission for all lots
Award criteria
The most economic tender

Contracting authority
Identity
Country: Ireland 🇮🇪
Awarding authority type: Utilities entity
Awarding authority name: EirGrid plc
Postal address: Block 2 — The Oval, 160 Shelbourne Road
Postal code: Dublin 4
Postal town: Ballsbridge
Contact
Internet address: http://www.eirgrid.com 🌏
E-mail: paul.valentine@eirgrid.com 📧
Phone: +353 12370200 📞
URL for documents: http://irl.eu-supply.com/app/rfq/rwlentrance_s.asp?PID=141234&B=ETENDERS_SIMPLE 🌏
URL for participation: http://irl.eu-supply.com/app/rfq/rwlentrance_s.asp?PID=141234&B=ETENDERS_SIMPLE 🌏

Reference
Dates
Date dispatched: 2019-01-28 📅
Submission deadline: 2019-03-04 📅
Publication date: 2019-01-31 📅
Identifiers
Notice number: 2019/S 022-048945
OJ-S issue: 22
Additional information

1) Interested parties must register their interest on the eTenders website (www.etenders.gov.ie) in order to be included on the mailing list for clarifications. All information relating to attachments, including clarifications and changes, will be published on the Irish Government Procurement Opportunities Portal (www.etenders.gov.ie) only. Registration is free of charge. The Contracting Authority will not accept responsibility for information relayed (or not relayed) via third parties. 2) This is the sole call for competition for this service. 3) The Contracting Authority will not be responsible for any costs, charges or expenses incurred by candidates or tenderers. 4) Contract award will be subject to the approval of the competent authorities. 5) It will be a condition of award that candidates are tax compliant and are in a position to produce a valid tax clearance certificate or eTax Clearance from the Revenue Commissioners when requested. 6) If for any reason it is not possible to award the contract one or more of the tenderers invited following the conclusion of this competitive process, the contracting authority reserves the right to award the contract to the next ranked tenderer as appropriate. 7) At its absolute discretion, the contracting authority may elect to terminate this procurement process or any contract awarded. 8) Please note in relation to all documents, that where reference is made to a particular standard, make, source, process, trademark, type or patent, that this is not to be regarded as a de facto requirement. In all such cases it should be understood that such indications are to be treated strictly and solely for reference purposes only, to which the words “or equivalent” will always be appended. 9) Without prejudice to the principle of equal treatment, the Contracting Authority is not obliged to engage in a clarification process in respect of questionnaires with missing or incomplete information. Therefore, candidates are advised to ensure that they return fully completed questionnaires in order to avoid the risk of elimination from the competition.

Additional information

1) Interested parties must register their interest on the eTenders website (www.etenders.gov.ie) in order to be included on the mailing list for clarifications. All information relating to attachments, including clarifications and changes, will be published on the Irish Government Procurement Opportunities Portal (www.etenders.gov.ie) only. Registration is free of charge. The Contracting Authority will not accept responsibility for information relayed (or not relayed) via third parties.

2) This is the sole call for competition for this service.

3) The Contracting Authority will not be responsible for any costs, charges or expenses incurred by candidates or tenderers.

4) Contract award will be subject to the approval of the competent authorities.

5) It will be a condition of award that candidates are tax compliant and are in a position to produce a valid tax clearance certificate or eTax Clearance from the Revenue Commissioners when requested.

6) If for any reason it is not possible to award the contract one or more of the tenderers invited following the conclusion of this competitive process, the contracting authority reserves the right to award the contract to the next ranked tenderer as appropriate.

7) At its absolute discretion, the contracting authority may elect to terminate this procurement process or any contract awarded.

8) Please note in relation to all documents, that where reference is made to a particular standard, make, source, process, trademark, type or patent, that this is not to be regarded as a de facto requirement. In all such cases it should be understood that such indications are to be treated strictly and solely for reference purposes only, to which the words “or equivalent” will always be appended.

9) Without prejudice to the principle of equal treatment, the Contracting Authority is not obliged to engage in a clarification process in respect of questionnaires with missing or incomplete information. Therefore, candidates are advised to ensure that they return fully completed questionnaires in order to avoid the risk of elimination from the competition.

Object
Scope of the procurement
Short description:

1) Vulnerability assessment with the associated exposures inherent within their current infrastructure;

2) Comprehensive risk analysis and recommendations, including a remediation plan;

3) Security audit, security reviews and test details, including applied methodology.

In keeping with its position in the industry EirGrid maintains a modern IT infrastructure comprising the following technologies:

— Servers: physical and virtua, Linux, Unix, Windows,

— desktop: Workstation and Laptop, Windows,

— databases: oracle and MSQL,

— network: routers, switches, firewalls, load balancers and gateways,

— cloud services.

Estimated total value: 640 000 EUR 💰
Short description:

EirGrid intends to establish a single supplier framework. The Framework Agreement period will be for an initial duration of three (3) years with the option to extend yearly for up to five (5) years, subject always to the satisfactory performance of the member.

EirGrid require a security partner to provide the scope of services below. The scope of services is expected to include, but is not limited to:

— Provision of Cyber Security Testing Services (CSTS) across EirGrid’s IT Infrastructure to ensure security, confidentiality and integrity,

— security testing will be primarily targeted at the externally visible infrastructure but some may be required to be internal,

— security testing may be targeted at production and pre-production environments,

— some CSTS may require re-testing to confirm the implementation of the remediation plan,

— each security testing will be subject to individual scoping determined by EirGrid and agreed with the successful supplier, including “rules of engagement” such as:

—— type of security testing,

—— targets,

—— objectives (what can and cannot be done),

—— scope (processes, website options, infrastructure, services that are off limits),

—— progress reporting,

—— entry points.

Estimated value excluding VAT: 640 000 EUR 💰
Duration: 36 months
Description of options:

The initial contract period envisaged is 3 years with the possibility to extend annually up to a further 5 years, subject always to the satisfactory performance of the supplier.

The estimated spend of 640 000 EUR is taking into account the full duration of the contract including the possible extensions.

Place of performance
Main site or place of performance: Dublin, Belfast.

Legal, economic, financial and technical information
Conditions for participation
Suitability to pursue the professional activity: