Ramavtal avseende konsulttjänster inom it-säkerhetsgranskning

The contract is a framework agreement with a planned start date of March 2027. It will initially be valid for one year. The agreement can be automatically extended three times, for one year each time, resulting in a maximum total duration of four years.

Key procurement milestones leading up to the contract include:

• Announcement: 2026-10-13
• Last day for questions: 2026-11-02
• Last day for tenders: 2026-11-12
• Review and evaluation: Week 47-49
• Award decision: Week 49-50
• Tenders are binding until 2027-04-30.

After the contract commences, an initial kick-off meeting is planned, and at least one follow-up meeting will be held per contract year.

The core scope of work for this tender involves a framework agreement for consulting services in IT security, specifically focusing on a security review for a new web-based HR system. The security review encompasses both source code review and penetration testing.

The Statement of Work summary requires the awarded consultant to describe, plan, conduct, and report on the assignment. Key aspects to be covered include:

• Planning, Implementation, and Reporting: How the assignment is planned, prioritized, delimited, executed, and reported, detailing proposed methods and working approaches.
• Competence and Quality Assurance: How the supplier ensures the availability of appropriate expertise and maintains the quality of the delivered services.
• Collaboration and Risk Management: The approach to collaboration with Riksdagsförvaltningen throughout the assignment phases, and how risks and critical vulnerabilities are managed and communicated.
• Tools, Automation, and AI Support: Identification of tools and potential AI support used for security review, analysis, documentation, and reporting, including how they contribute to the assignment's execution and how any AI-generated results are quality-assured.

The assignment scenario specifies a new web-based HR system handling sensitive information, consisting of over one million lines of source code. The allocated time for the entire assignment, including planning, execution, documentation, and reporting, is 80 hours. The overall goal is to provide an effective, quality-assured, and appropriate security review that identifies relevant security flaws, enables risk prioritization, and furnishes a well-founded decision basis for subsequent security improvements.