Denmark – Software package and information systems – Hardware and Software for NemLog-in CA component

The Contracting Authority, the Danish Agency for Digital Government (Digitaliseringsstyrelsen), operates on behalf of the Danish State a national qualified and non-qualified trust service under Regulation (EU) No 910/2014 as amended by Regulation (EU) 2024/1183 (eIDAS2). As part of continuing the existing trust service, the Contracting Authority is undertaking procurement of three separate lots/contracts for the software and hardware components required. The procurement comprises three individual lots/contracts: Lot 1 for Contract for CA and OSCP Software, Lot 2 for Contract for Utimaco HSMs for CA operation, and Lot 3 for Contract TSA Software. Full details of the individual contracts and the associated requirements are contained in the procurement documents.

Lots Lot 1 — Contract for CA and OCSP Software (estimated 20000000): The Contracting Authority operates on behalf of the Danish State a national qualified and non-qualified trust service under Regulation (EU) No 910/2014 as amended by Regulation (EU) 2024/1183 (eIDAS2). As part of continuing the existing trust service on a new software platform, the Contracting Authority is procuring Certification Authority (CA) Software to be installed and operated on-premise in the Contracting Authority's data centres (currently two). The Contract covers the delivery of Standard Software, including Licences, Documentation and support necessary to operate CA and Validation Authority (VA) functionality as part of the Contracting Authority's trust services. The Software must integrate with the Contracting Authority's existing infrastructure, including HSMs, registration authority components, signing services, directory services and monitoring infrastructure, and must support the migration of the existing EJBCA-based CA environment while preserving certificate, revocation and audit-log integrity. The Supplier's principal obligations comprise: (a) the Delivery of Standard Software for development, test, staging and production environments, including the required software-only configuration for development and test; (b) Ongoing Services, including support and maintenance of the Standard Software and security patching; (c) Ordered Services, comprising Time-Based Services (services for installation, configuration, key ceremonies, and similar tasks); and (d) Cross-cutting Services, comprising Documentation and security, provided as an integral part of the Ongoing Services and Ordered Services throughout the term of the Contract. Lot 2 — Contract for Utimaco HSM's for CA operation (estimated 15000000): The Contracting Authority operates on behalf of the Danish State a national qualified and non-qualified trust service under Regulation (EU) No 910/2014 as amended by Regulation (EU) 2024/1183 (eIDAS2). As part of continuing the existing trust service on a new software platform, the Contracting Authority is procuring Hardware Security Modules (HSMs) for CA operation to be installed and operated on-premise in the Contracting Authority's data centres (currently two). The lot covers the delivery of HSM, including the required client software, HSM simulator, smartcards, Documentation and support necessary to operate root CA and legacy issuing CA functionality as part of the Contracting Authority's trust services. The HSMs must integrate with the Contracting Authority's existing infrastructure, including KeyFactor EJBCA, monitoring infrastructure and associated operational processes, and must support the secure migration of the existing root CA and legacy issuing CA signing keys at cryptographic-module level while preserving the certification status and verifiability of the key material. The Supplier's principal obligations comprise: (a) the Delivery of Hardware, including associated client software, sized and configured for operation across two data centres in an active/active configuration, together with deployment in the Contracting Authority's production, staging, and test environments; (b) Ongoing Services, including support and maintenance of the Hardware, security patching, and technology refresh of Hardware during the term of the Contract to maintain valid certifications; (c) Ordered Services, comprising Time-Based Services (services for installation, configuration, key ceremonies, and similar tasks) and Options and (d) Cross-cutting Services, comprising Documentation and security, provided as an integral part of the Ongoing Services and Ordered Services throughout the term of the Contract. Lot 3 — Contract for TSA Software (estimated 5000000): The Contracting Authority operates on behalf of the Danish State a national qualified and non-qualified trust service under Regulation (EU) No 910/2014 as amended by Regulation (EU) 2024/1183 (eIDAS2). As part of continuing the existing trust service on a new software platform, the Contracting Authority is procuring Timestamping Authority (TSA) Software to be installed and operated on-premise in the Contracting Authority's data centres (currently two). The lot covers the delivery of Standard Software, including Licences, Documentation and support and maintenance services necessary to operate TSA functionality as part of the Contracting Authority's trust services. The Software must integrate with the Contracting Authority's existing infrastructure, including HSMs, signing services and monitoring infrastructure, and must support the migration of the existing TSA service while preserving the qualified status and verifiability of historical timestamping records. The Supplier's principal obligations comprise: (a) the Delivery of Standard Software for development, test, staging and production environments, including the required software-only configuration for development and test; (b) Ongoing Services, including support and maintenance of the Standard Software and security patching; (c) Ordered Services, comprising Time-Based Services (services for installation, configuration, key ceremonies, and similar tasks); and (d) Cross-cutting Services, comprising Documentation and security, provided as an integral part of the Ongoing Services and Ordered Services throughout the term of the Contract.

Buyer: Digitaliseringsstyrelsen

Buyer country: DNK

Procedure: open

CPV code: 48000000

Full notice, tender documents and how to bid are on the official TED page (link above).