Sikkerhetskulturprogram

The contract starts on December 1, 2026. The initial duration of the agreement is two years, extending until November 30, 2028. There is an option for the client to extend the contract by one year, twice (1+1 year), making the total potential duration four years.

Key milestones include:

• The solution must be implemented, tested, and ready for use no later than three months after the contract is signed.
• A plan for the establishment phase, which includes roles, responsibilities, and a progress schedule, should be prepared by the supplier in cooperation with the client and is to be included in Annex 3.

The core scope of work for this tender involves the provision of a tool or implementation for phishing tests. The primary objective is to raise awareness and provide training to approximately 2900 employees across internal departments and state administrative offices, enabling them to identify fake emails.

A summary of the Statement of Work and core deliverables includes:

• Phishing Test and Awareness Program: Delivering a tool or implementing phishing tests, coupled with a consciousness-raising and training program to help employees identify fraudulent emails.
• Implementation and Readiness: The solution must be fully implemented, tested, and operational within three months of the contract signing.
• Establishment and Configuration Support: The supplier is required to assist with the necessary setup and configuration of the service.
• Administrator Training: Provision of training for 1-2 administrators or superusers.
• Service Level Agreement (SLA): A standard Service Level Agreement, including standardized compensations, must be provided by the supplier.
• Technical Solution and Operation: The administrator and end-user interfaces must function with Microsoft Edge, and the solution must operate without requiring exceptions in security filters.
• Information Security: The solution must support role-based access control, ensure data protection during transfer and storage, log relevant security and administrator events, and adhere to documented processes for vulnerability management, security updates, and incident handling. The supplier must notify the client of security incidents. Client data must be deleted upon agreement termination as per client instructions.
• Test Environment: The supplier should ideally make a test environment available for evaluating key functionalities.
• Third-Party Deliveries: If the service includes third-party components, the terms and conditions for the client's access and use must be disclosed. This includes outlining client obligations, liability limitations, details on error correction, and applicable guarantees or SLA requirements from the third party.