Security Culture Programme

The contract timeline is as follows:

• Contract start date: December 1, 2026.
• Contract end date: November 30, 2027, with an option for the client to extend for an additional one year.
• Total duration: The initial duration is one year, with a potential extension of one additional year, totaling up to two years.

Key milestones and phases:

• Deadline for submitting questions regarding the tender documentation: September 25, 2026, at 12:00.
• Deadline for submitting offers: October 5, 2026, at 12:00.
• Offer opening: October 5, 2026, at 12:30.
• Evaluation period: Weeks 40-42.
• Supplier selection and notification: October 16, 2026.
• Expiry of the waiting period (karensperiode): October 26, 2026.
• Contract signing: Week 44.
• Offer validity period: Until December 31, 2026, at 23:59.
• The solution must be implemented, tested, and ready for use no later than three months after contract signing.
• There will be a plan for the establishment phase (Bilag 3).

The core scope of work for this tender involves providing tools and implementation of phishing test(s) to raise awareness and train approximately 2900 employees, both internally and at state administrator offices, to identify fake emails.

The key deliverables and responsibilities include:

• Developing and delivering a service described by the supplier, based on the customer's requirements specification.
• Creating a plan for the establishment phase.
• Providing a Service Level Agreement (SLA) for the service.
• Implementing, testing, and making the solution ready for use within three months of contract signing.
• Assisting with the necessary establishment and configuration of the service.
• Conducting required training for 1-2 administrators/superusers.
• Ensuring the technical solution and its operation meet specific requirements, including administrator and end-user interfaces functioning in Microsoft Edge, operating without security filter exceptions, supporting role-based access control, protecting data during transfer and storage, logging security and administrator events, and having documented processes for vulnerability management, security updates, and incident handling.
• Notifying the client of any security incidents affecting data or the service.
• Deleting the client's data according to their instructions upon the agreement's termination.
• Providing detailed pricing for licenses, operation, user support, establishment, integration costs, and training.

The contract duration is from December 1, 2026, to November 30, 2027, with an option for a one-year extension.