Planning

Ask AI about this notice

Summarise, research or assess it with AI

View Markdown

Share this notice

Send this contract to a colleague

Preliminary Market Engagement - Third-Party Risk Management (TPRM) Platform

Development Bank of Wales

This public procurement record has 1 release in its history.

Planning

29 Oct 2026 at 14:37

UK2 - Preliminary Market Engagement Notice
Summary of the contracting process

Development Bank of Wales is exploring third-party risk management (TPRM) platforms to replace its existing supplier cyber-risk monitoring capability. The aim is to assess whether a broader platform could support Information Security, Risk, Compliance, Procurement and Operational Resilience. The service covers ongoing monitoring of suppliers’ internet-facing assets and cyber threats, supplier assessments and evidence, supplier inventory and risk tiering, cross-functional assurance, remediation workflows, reporting and integrations. The buyer also wants to understand potential capabilities for fourth-party visibility, concentration risk, financial health, AI and technology risk, reputational risk and supplier sustainability. The work is for use across the Development Bank of Wales; the stated delivery location is the United Kingdom. This is a market engagement to inform possible future requirements and procurement options, rather than a tender for a platform at this stage.

The process is at planning: the bank is gathering market information, not inviting tenders or selecting suppliers. Suppliers are asked to submit information on functionality, delivery and implementation, integrations and indicative commercial models. Responses were expected by 10:00 on 26 November 2026; clarification questions were due by noon on 17 November 2026. The bank expected a further notice on 18 January 2027. Any later contract is indicated to run from 1 April 2027 to 31 March 2028, with a possible extension to 31 March 2035. The published estimated value is £1, excluding VAT (£1.20 including VAT), and should not be treated as a reliable budget for a future procurement. The current plan is a single lot. The engagement responses will not be scored or used to shortlist suppliers.

This market exercise is relevant to TPRM platform vendors with demonstrable supplier cyber-risk monitoring, particularly continuous external attack-surface monitoring, asset attribution, vulnerability and breach intelligence, and evidence-based risk findings. The bank marks cross-functional assurance, regulatory compliance and financial-crime support, workflow and remediation, and operational, executive and audit reporting as mandatory capability areas. Suppliers able to combine these with configurable due diligence, supplier inventory and tiering, secure supplier engagement, and integration with supplier or contract management systems may also be well placed. Further strengths include fourth-party visibility, concentration analysis, financial-health intelligence, AI and technology risk, reputational monitoring and sustainability reporting. The bank welcomes SMEs and equivalent evidence or proportionate examples; participation is intended to inform market understanding, not to confer a selection advantage. Suppliers should explain dependencies, limitations, delivery assumptions and additional costs.」}permits? Wait JSON valid. Has quote curly? final includes malformed ending? notice fields word count; maybe details contains inaccurate deadline response wording

How relevant is this notice?

Notice Information

Notice Title

Preliminary Market Engagement - Third-Party Risk Management (TPRM) Platform

Notice Description

Development Bank of Wales is undertaking a Preliminary Market Engagement exercise to better understand the market for Third-Party Risk Management (TPRM) platforms. The purpose of this exercise is to engage with potential suppliers and gather information on available solutions, functionality, delivery and implementation approaches, integration capabilities and indicative commercial models. Development Bank of Wales is particularly interested in understanding the capabilities of solutions across third-party risk management and monitoring, including how platforms differentiate themselves from solutions focused primarily on cyber-risk monitoring. Suppliers are invited to provide information regarding their proposed solution and to indicate whether relevant functionality is available as standard, through configuration, integration or customisation, or is included within the supplier's product roadmap. Suppliers should also identify any relevant dependencies, limitations, additional modules, third-party data sources and associated costs. This Preliminary Market Engagement exercise is being undertaken to inform Development Bank of Wales' understanding of the market and its consideration of potential future requirements and procurement options. Participation in this exercise does not constitute a formal tender process and does not guarantee that a subsequent procurement exercise will be undertaken. Any future procurement opportunity will be advertised separately in accordance with the applicable procurement requirements. Suppliers wishing to participate should access the Preliminary Market Engagement exercise through the eTenderWales eTendering Portal and submit their response in accordance with the instructions provided. PQQ_33940 - Preliminary Market Engagement - Third-Party Risk Management (TPRM) Platform Deadline for responses: 10:00 on 26 November 2026. Background and purpose Development Bank of Wales (DBW) is seeking to understand the market for Third-Party Risk Management (TPRM) platforms. The primary driver is the planned replacement of DBW's existing third-party cyber risk monitoring capability. Rather than undertake a like-for-like replacement, DBW wishes to explore whether a broader TPRM platform could provide additional value across Information Security, Risk, Compliance, Procurement and Operational Resilience. This market evaluation is intended to: * Understand current market capabilities and solution approaches. * Assess platform maturity, functionality and delivery models. * Identify which capabilities are included as standard and which require additional modules or services. * Inform budget planning and the development of a future procurement specification. Target outcomes * Improved visibility of third-party risk. * A proportionate, risk-based approach to supplier oversight. * Reduced duplication of assurance activity across DBW functions. * Centralised, auditable reporting and evidence. * Better collaboration between Security, Risk, Compliance and Procurement. * Actionable supplier risk intelligence and remediation tracking. Capability areas Third-Party Cyber Risk Intelligence MANDATORY - DBW requires an effective replacement for its existing third-party cyber risk monitoring capability. * Continuous monitoring of supplier external attack surfaces and internet-facing assets. * Discovery and transparent attribution of supplier-owned assets. * Identification of vulnerabilities, misconfigurations and exposed services. * Monitoring of publicly disclosed breaches, leaked data and credential exposure. * Supplier cyber risk ratings, trends and material change notifications. * Evidence-based findings that distinguish confirmed and inferred risks. * Management of disputed findings, false positives and shared infrastructure noise. Supplier Due Diligence and Assessment DESIRABLE - DBW wishes to understand how platforms support proportionate supplier assurance. * Configurable questionnaires and assessment workflows. * Collection and retention of evidence, documents and attestations. * Assessment history, approvals, exceptions and accepted risks. * Scheduled and event-driven reassessments. * Secure supplier engagement and response management. Supplier Inventory and Tiering DESIRABLE - DBW wishes to understand how platforms enable risk-based supplier management. * Supplier inventory or integration with an authoritative supplier register. * Risk, criticality and business-impact tiering. * Identification of critical suppliers and links to important business services. * Differentiated monitoring, due diligence and reassessment by supplier tier. * Ability to reassess and reclassify suppliers when risk or criticality changes. Risk, Compliance and Operational Resilience MANDATORY - DBW requires cross-functional assurance, governance and auditability. * A common assurance view combining assessments, evidence, findings, decisions and actions. * Mapping to internal, regulatory and assurance frameworks. * Clear audit trails for assessments, approvals, exceptions and reassessments. * Identification of assurance gaps, stale evidence and incomplete information. * Support for regulatory compliance and financial crime as mandatory risk domains. * Support for operational resilience, data protection and other desirable domains where available. Workflow and Remediation MANDATORY - DBW requires clear accountability for supplier risk treatment. * Creation, assignment and tracking of findings, actions and remediation plans. * Configurable approvals, escalation routes, reminders and notifications. * Recording of accepted, mitigated, transferred or escalated supplier risks. * Reassessment or workflow activity following material changes in risk. * Supplier collaboration and secure exchange of remediation evidence where available. Reporting and Assurance MANDATORY - DBW requires reporting suitable for operational, executive, audit and assurance use. * Detailed findings, supporting evidence and supplier-level risk history. * Executive and portfolio reporting covering critical and high-risk suppliers. * Reporting of overdue reviews, expired evidence and outstanding actions. * Exportable assessment histories, audit trails and assurance evidence. * Data access suitable for DBW reporting and analytics platforms. Advanced and Future Capabilities DESIRABLE - DBW wishes to understand additional value available beyond the core requirement. * Fourth-party and wider supply-chain visibility. * Concentration risk analysis. * Financial health and credit-risk intelligence. * AI and emerging technology risk assessment. * Reputational risk monitoring and assessment. * Supplier sustainability information, evidence and reporting relevant to public-sector procurement. * Advanced analytics identifying connected or emerging supplier risks. Integrations and data portability Integrations are not assigned a single classification because necessity depends on the integration and the business outcome. Suppliers should describe native connectors, APIs, automated exports, licensing dependencies and implementation effort. Confidentiality, information governance and conflicts Suppliers should clearly identify information they consider genuinely commercially sensitive and explain the basis for that designation. DBW cannot guarantee that information marked confidential will be withheld where disclosure is required by law, including under applicable freedom of information, transparency or audit obligations. Suppliers should not include unnecessary personal data in their responses. Suppliers must disclose any actual or potential conflict of interest connected with this engagement, including any involvement in advising DBW on the requirement or procurement approach. DBW will assess and manage identified conflicts and any risk of unfair advantage in accordance with the Procurement Act 2023. DBW welcomes responses from small and medium-sized enterprises and other suppliers who can contribute relevant market insight. Suppliers may provide equivalent evidence, alternative delivery approaches or proportionate examples where these demonstrate the relevant capability. Nothing in this market engagement is intended to create an unnecessary barrier to participation.

Planning Information

For each capability area, suppliers should explain their available functionality and identify whether it is: • Fully supported as standard. • Supported through configuration. • Supported through integration. • Supported through customisation or professional services. • Partially supported. • A roadmap item. • Not supported. Responses should also identify relevant dependencies, implementation assumptions, limitations, additional modules, third-party data sources and additional costs. Responses must be submitted through [eTenderWales/portal] by 10:00 on Thursday 26 November. Responses received after the deadline may not be considered. Any clarification questions must be submitted through the portal by 12:00 on Tuesday 17 November. Suppliers should not contact DBW employees directly regarding this exercise. Clarification questions must be anonymised and must not include the names of any personnel, suppliers or organisations, or any other identifying details. DBW may decline to respond to questions that include such information. DBW may publish clarification questions and responses on an anonymised basis where they are relevant to other participants. Responses should be targeted around the supplier’s product offering and should clearly explain how it addresses the capability areas, market evaluation questions, and commercial and delivery information set out in this document. Responses should not exceed 10 pages, excluding appendices containing pricing schedules, technical documentation or supporting evidence. Responses will not be formally evaluated, scored or ranked and will not be used to shortlist or select suppliers. They will be reviewed solely to support DBW’s understanding of the market and inform any future procurement approach. DBW may invite suppliers to demonstrations, clarification meetings or other follow-up engagement where this would support its understanding of the market. Any such engagement will be conducted on a fair and consistent basis. DBW will take proportionate steps to ensure that participation does not confer an unfair advantage, including making relevant information available in any future procurement and allowing appropriate time for suppliers to prepare tenders. Market evaluation questions 1. What differentiates the platform from cyber-risk-only monitoring solutions? 2. Which capabilities are included in the core platform, and which require additional modules, data sources or professional services? 3. How does the platform combine externally observed intelligence with supplier-declared information and assurance evidence? 4. How can the platform coexist or integrate with a separate supplier and contract management solution? 5. How does the platform address financial crime, reputational risk and supplier sustainability? 6. How are asset attribution, false positives and shared infrastructure handled? 7. What implementation approach is recommended for an organisation transitioning from cyber monitoring to broader TPRM? 8. Which relevant capabilities are roadmap items rather than generally available?

Notice Details

Publication & Lifecycle

Open Contracting ID
ocds-h6vhtk-0793af
Publication Source
Find A Tender Service
Latest Notice
https://www.find-tender.service.gov.uk/Notice/102703-2026
Current Stage
Planning
All Stages
Planning

Procurement Classification

Notice Type
UK2 - Preliminary Market Engagement Notice
Procurement Type
Standard
Procurement Category
Services
Procurement Method
Not Specified
Procurement Method Details
Not specified
Tender Suitability
SME
Awardee Scale
Not specified

Common Procurement Vocabulary (CPV)

CPV Divisions

48 - Software package and information systems

72 - IT services: consulting, software development, Internet and support

CPV Codes

48000000 - Software package and information systems

48170000 - Compliance software package

72000000 - IT services: consulting, software development, Internet and support

Notice Value(s)

Tender Value
£1
Lots Value
Not specified
Awards Value
Not specified
Contracts Value
Not specified

Notice Dates

Publication Date
29 Oct 20264 days ago
Submission Deadline
Not specified
Future Notice Date
18 Jan 20273 months to go
Award Date
Not specified
Contract Period
1 Apr 2027 - 31 Mar 2028 1-2 years
Recurrence
Not specified

Notice Status

Tender Status
Planning
Lots Status
Planning
Awards Status
Not Specified
Contracts Status
Not Specified

Buyer & Supplier

Contracting Authority (Buyer)

Main Buyer
Development Bank of Wales
Contact Name
Available with D3 Tenders Premium →
Contact Email
Available with D3 Tenders Premium →
Contact Phone
Available with D3 Tenders Premium →

Buyer Location

Locality
CARDIFF
Postcode
CF10 4BZ
Postcode Area
Cardiff
Country
Wales
Major Region (ITL 1)
TLL Wales
Basic Region (ITL 2)
TLL5 South East Wales
Small Region (ITL 3)
TLL52 Cardiff and Vale of Glamorgan
Delivery Location
Not specified
Local Authority
Cardiff
Electoral Ward
Butetown
Westminster Constituency
Cardiff South and Penarth

Further Information

Notice Documents

Open Contracting Data Standard (OCDS)

View full OCDS Record for this contracting process

JSON Markdown

The Open Contracting Data Standard (OCDS) is a framework designed to increase transparency and access to public procurement data in the public sector. It is widely used by governments and organisations worldwide to report on procurement processes and contracts.

Loading OCDS record...