DAST solution (Dynamic Application Security Testing)

Lyhyt kuvaus

Veikkaus is about to purchase a DAST solution (Dynamic Application Security Testing) for increasing secure software development capabilities. The DAST solution to be procured is a dynamic application security testing platform that identifies security weaknesses by interacting with running applications over HTTP/HTTPS and other supported protocols. The solution is expected to operate primarily against Veikkaus’ test and pre production environments, with the possibility to extend to production environments where appropriate and safe.

At a high level, the DAST service must provide:
1) Dynamic security testing of applications
2) Periodic and on demand scanning
3) Integration and automation
4) Findings management and reporting.

This RFP alongside its attachments describes the subject of the procurement.

Lisätietoja

The Agreement enters into force on the Effective Date. The initial Subscription Term shall be twenty-four (24) months from the Effective Date. The Agreement shall automatically renew for successive twelve (12)-month periods on the same terms, unless either Party provides written notice of non-renewal.

Menettelyn tärkeimmät piirteet

1. GENERAL

The legislation concerning the public procurement is applied to the procurement. Type of
procedure is open procedure.

2. CONTRACT NOTICE

A contract notice has been published on the website www.hankintailmoitukset.fi and
http://ted.europa.eu. The contract award notice shall be published after the award decision.

3. SUBMITTING THE TENDER AS A GROUP OF ECONOMIC OPERATORS AND
SUBCONTRACTING

A tender may be submitted by a group of economic operators (a consortium or group). If awarded the contract, all group members must sign the contract and will be jointly liable for its performance. The composition of the group may not change during the procurement process or the contract period.

The group, as well as a supplier with subcontractors, must possess the necessary technical, economic, financial, and other capacities to deliver the goods and services in accordance with the contract for its entire duration. During the tender process and throughout the contract period, the contracting authority may request proof of commitments and agreements with declared subcontractors that could impact the supplier’s ability to fulfill the contract obligations. Similarly, the group may be required to provide evidence of the arrangements governing relationships among its members.

If a tenderer engages subcontractors, it remains fully responsible for their work as if it were its own. A tenderer submitting an independent bid while relying on subcontractors must specify in the Subcontractors Form how each subcontractor contributes to service delivery.

During the contract period, subcontractors may only be replaced with the contracting authority’s approval, provided such changes do not lead to significant or material modifications of the contract.

4. USING RESOURCES OF OTHER ENTITIES

A tenderer or a group of economic operators may rely on the resources of other entities to meet the requirements of the invitation to tender, regardless of the legal nature of their relationship. However, these resources must be available to the tenderer or group throughout the procurement process and the contract period.

Such resources may include, for example:

Professional experience – Relying on the expertise of another economic entity, such as a company within the same corporate group, provided that the entity is named in the tender as a subcontractor and actively participates in delivering the service.

Personnel – Using employees from another company to meet professional qualification requirements, provided that these individuals actively contribute to service delivery.

Economic and financial standing – Leveraging the financial capacity of another entity.

Technical capabilities – Utilizing another entity’s technical resources, provided they are genuinely used to meet the procurement requirements.

In these instances, the entity being relied on must be appropriately indicated the subcontractors annex.

5. PROCESSING OF TENDERS

5.1 SUITABILITY OF TENDERS

Before the tenders are processed it shall be assessed whether the tenderers meet the
technical, professional and economic and financial requirements presented in clause/form
"Exclusion and suitability (ESPD)". The tenderer’s suitability shall be examined using the
information provided in the tender, other financial statements (if separately requested) and
the information available from risk rating reports.

Tenderers who do not meet the minimum requirements set in the Call for Tenders shall be
excluded from the tender competition.

A tenderer who has been convicted of or in which any person with powers of
representation, decision making or control has been convicted of an offence as referred in
EU Public Procurement Directive 57 article, section 1 or to extortionate work discrimination
as stated in the Criminal Code of Finland, chapter 47 section 3(a) shall also be excluded
from the tender competition. A tenderer to whom a criterion for exclusion as referred to in
Public Procurement Act may also be excluded from the tender competition.

5.2 COMPLIANCE WITH THE CALL FOR TENDERS

The goods and services offered must fully comply with the requirements outlined in the Call for Tenders and its annexes. All requested information and required annexes must be submitted as part of the tender. Compliance will be assessed based on the tender’s overall content.

Tenders that do not meet the requirements of the Call for Tenders or fail to adhere to the conditions of the tendering procedure will be disqualified from the competition.

5.3 EVALUATION OF TENDERS

The evaluation of the tenders shall be made according to chapter "Grounds for decision".

5.4 AWARD DECISION AND ITS NOTIFICATION

The award decision shall be sent to all tenderers party to the decision via email. The
contract does not enter into force as a result of the notification of the decision, but requires
a separate written contract.

Lisätietoja

The Agreement enters into force on the Effective Date. The initial Subscription Term shall be twenty-four (24) months from the Effective Date. The Agreement shall automatically renew for successive twelve (12)-month periods on the same terms, unless either Party provides written notice of non-renewal.