Request For Information: Risk Management Software

The Purpose Of This Information Request Is To Clarify Questions And Price Estimates Related To Risk Management Software. The Goal Of The Request For Information Is To Obtain Comprehensive Information About The Risk Management Software, So That A Possible Tender Can Be Carried Out In The Most Appropriate Way. This Document Is Not A Procurement Announcement Or A Request For Tender, But A Detailed Market Survey, I.E. A Request For Information. The Procurement Unit Does Not Undertake To Carry Out The Procurement Of Risk Management Software. Decisions On Starting A Possible Procurement Process Are Made After A Market Survey. Procurement Information: The Goal Of The Government Office Is To Survey The Risk Management Software Available On The Market, Which Enable The Description Of The Security Operating Environment, Risk Assessment (Including Risk Identification, Risk Analysis And Risk Significance Assessment), Risk Handling, Recording And Reporting Of Risks, Monitoring And Viewing Of Risks, As Well As Related Communication And Information Exchange. The Level Of Risk Assessment Is At The Operational Level, Not At The Strategic Level. In Addition To Risk Assessment, The Software Must Be Able To Handle Security And Information Security Deviations. The Risk Management Software Must Be Able To Carry Out The Entire Risk Management Process, From Threat Assessment To Risk Identification, Risk Analysis, Risk Significance Assessment, Risk Handling, Risk Recording And Reporting, Risk Monitoring And Viewing, As Well As Related Communication And Information Exchange. The Risk Management Software Must Be Able To Make A Residual Risk Decision. The Risk Management Software Must Enable Risk Assessment Of At Least The Following Of Risk Types: Facility Security Risks, Event Security Risks, Information Security Risks, Occupational Safety Risks, Financial Risks And Data Protection Risks. Deviation Management Includes Creating And Receiving Notification Of Deviations, Entering The Notifiers Information And Adding Evidence, Checking The Notification Of Deviations And Categorizing Deviations, Prioritizing And Evaluating Deviations, Defining Corrective Measures And Monitoring Measures. You Must Be Able To Add Subject Identifiers To Deviations, Such As The Type, Time And Place Of The Deviation. In Addition, The Notifier And The Recipient Must Be Able To Update The Notification, And The Recipient Must Be Able To Decide On The Handling Of The Deviation And Give Feedback On The Notification Given. You Must Be Able To Create A Report And Analytics For Deviations, E.G. In Terms Of Categories Or Severity. All Stakeholders Must Be Able To Report Deviations, E.G. Personnel Of All Ministries (Approx. 6,000 People), Guests And Subcontractors. Risk Management Software Can Be A Saas Solution Or An On-Prem Solution. The Data Processing Environment Of The Risk Management Software Must Meet The Requirements For Security Class Iv Processing. The Risk Management Software Must Be Accessible Through An Internet Browser. The Data Must Be Located In The Eu/Eea Area. The Risk Management Software Must Be Able To Be Integrated Into The Organizations Ad Environment As Part Of The Management Of Identification And Access Rights. The Main Users Of The Government Office Must Be Able To Manage User Rights And Must Be Able To Grant Them Per Risk Management Target. In Addition, The Main Users Of The Prime Ministers Office Must Be Able To Create, Edit And Manage Risk Management Objects Themselves, Which Can Be, For Example, A Single Information System Or Office Space. In Addition To Organization-Specific Main Users, The Software Can Also Be Used By Users Below The Main User Level, Who Can Only Have Access To Individual Risk Management Objects. If The Solution Is Modular, It Should Also Be Possible To Limit Usage Rights By Module. If After The Market Survey We Proceed To The Acquisition Phase, The New Risk Management Software Will Be In Use As Planned On March 1, 2026. The Acquisition Will Consist Of The Following Areas: 1) Risk Management Software That Works Via An Internet Browser, Which Can Be Used To Process As Mentioned Above. Facility Security Risks, Event Security Risks, Information Security Risks, Occupational Safety Risks, Financial Risks, Data Protection Risks.B. Security And Information Security Deviations. Information Request: We Are Asking For Your Views On The Following Issues: 1. Which Of You Would Be The Best Way To Make The Purchase? We Ask You To Present Your Views On The Procurement Implementation Options. 2. Individualize Your Possible Services In More Detail. You Can Attach Your Service Descriptions, If Possible. 3. What Kind Of Pricing Model Would You Be Interested In Offering Services With? What Is Your Preliminary Price Estimate For Your Proposed Implementation? How Is The Price Of The Service Determined? How Much Do You Estimate The Start-Up Costs And Workload Estimate? Is The Pricing License-Based? Is A License Obtained For Each User? What Kind Of Price Effect Does The Scope Of Customer Support Have? 4. If The Solution You Offer Is A Saas Service, Where Is The Data Located? 5. Has Your Organization Been Awarded Any Industry Quality Certificate? 6. What Is The Timetable Estimate For The Completion Of The Implementation? Does The Schedule Have Pricing Effects, And If So, What Kind? 7. Before Implementation, The Customer Can Perform A Security Audit Of The Object To Be Acquired. What Do You Think About This? If Not, Can You Justify Your Answer. 8. Describe Your Companys Experience In Providing The Services In Question. We Ask You To Indicate How Many References/What Kind Of References You Have For Providing Services Corresponding To The Object Of Procurement. 9. In Which Languages ​​Do You Offer Risk Management Software? What About The Related Customer Support? 10. What Kind Of Contract Options Do You Offer? In Your Opinion, How Long A Contract Period Would Be Appropriate? In Addition To This Information, We Ask For Your Free-Form Views On Points That Should Be Taken Into Account When Making A Request For An Offer.