{
    "tag": [
        "compiled"
    ],
    "id": "ocds-h6vhtk-0793af-2026-10-29T14:37:17Z",
    "date": "2026-10-29T14:37:17Z",
    "ocid": "ocds-h6vhtk-0793af",
    "initiationType": "tender",
    "parties": [
        {
            "id": "GB-PPON-PCWM-6438-QYVP",
            "name": "Development Bank of Wales",
            "identifier": {
                "scheme": "GB-PPON",
                "id": "PCWM-6438-QYVP"
            },
            "address": {
                "streetAddress": "Development Bank of Wales plc",
                "locality": "Cardiff",
                "postalCode": "CF10 4BZ",
                "country": "GB",
                "countryName": "United Kingdom",
                "region": "UKL22"
            },
            "contactPoint": {
                "name": "Leanne Millard",
                "email": "leanne.millard@developmentbank.wales",
                "telephone": "+442920801715"
            },
            "roles": [
                "buyer"
            ],
            "details": {
                "url": "http://www.developmentbank.wales",
                "classifications": [
                    {
                        "scheme": "UK_CA_TYPE",
                        "id": "publicAuthorityCentralGovernment",
                        "description": "Public authority - central government"
                    },
                    {
                        "scheme": "UK_CA_DEVOLVED_REGULATIONS",
                        "id": "GB-WLS",
                        "description": "Welsh devolved regulations apply"
                    }
                ]
            }
        }
    ],
    "buyer": {
        "id": "GB-PPON-PCWM-6438-QYVP",
        "name": "Development Bank of Wales"
    },
    "planning": {
        "milestones": [
            {
                "id": "engagement",
                "type": "engagement",
                "description": "For each capability area, suppliers should explain their available functionality and identify whether it is: * Fully supported as standard. * Supported through configuration. * Supported through integration. * Supported through customisation or professional services. * Partially supported. * A roadmap item. * Not supported. Responses should also identify relevant dependencies, implementation assumptions, limitations, additional modules, third-party data sources and additional costs. Responses must be submitted through [eTenderWales/portal] by 10:00 on Thursday 26 November. Responses received after the deadline may not be considered. Any clarification questions must be submitted through the portal by 12:00 on Tuesday 17 November. Suppliers should not contact DBW employees directly regarding this exercise. Clarification questions must be anonymised and must not include the names of any personnel, suppliers or organisations, or any other identifying details. DBW may decline to respond to questions that include such information. DBW may publish clarification questions and responses on an anonymised basis where they are relevant to other participants. Responses should be targeted around the supplier's product offering and should clearly explain how it addresses the capability areas, market evaluation questions, and commercial and delivery information set out in this document. Responses should not exceed 10 pages, excluding appendices containing pricing schedules, technical documentation or supporting evidence. Responses will not be formally evaluated, scored or ranked and will not be used to shortlist or select suppliers. They will be reviewed solely to support DBW's understanding of the market and inform any future procurement approach. DBW may invite suppliers to demonstrations, clarification meetings or other follow-up engagement where this would support its understanding of the market. Any such engagement will be conducted on a fair and consistent basis. DBW will take proportionate steps to ensure that participation does not confer an unfair advantage, including making relevant information available in any future procurement and allowing appropriate time for suppliers to prepare tenders. Market evaluation questions 1. What differentiates the platform from cyber-risk-only monitoring solutions? 2. Which capabilities are included in the core platform, and which require additional modules, data sources or professional services? 3. How does the platform combine externally observed intelligence with supplier-declared information and assurance evidence? 4. How can the platform coexist or integrate with a separate supplier and contract management solution? 5. How does the platform address financial crime, reputational risk and supplier sustainability? 6. How are asset attribution, false positives and shared infrastructure handled? 7. What implementation approach is recommended for an organisation transitioning from cyber monitoring to broader TPRM? 8. Which relevant capabilities are roadmap items rather than generally available?",
                "dueDate": "2026-11-26T23:59:59+00:00",
                "status": "scheduled"
            }
        ],
        "documents": [
            {
                "id": "102703-2026",
                "documentType": "marketEngagementNotice",
                "noticeType": "UK2",
                "description": "Preliminary market engagement notice on Find a Tender",
                "url": "https://www.find-tender.service.gov.uk/Notice/102703-2026",
                "datePublished": "2026-10-29T14:37:17Z",
                "format": "text/html"
            }
        ]
    },
    "tender": {
        "id": "DBW00229.00",
        "legalBasis": {
            "id": "2023/54",
            "scheme": "UKPGA",
            "uri": "https://www.legislation.gov.uk/ukpga/2023/54/contents"
        },
        "title": "Preliminary Market Engagement - Third-Party Risk Management (TPRM) Platform",
        "description": "Development Bank of Wales is undertaking a Preliminary Market Engagement exercise to better understand the market for Third-Party Risk Management (TPRM) platforms. The purpose of this exercise is to engage with potential suppliers and gather information on available solutions, functionality, delivery and implementation approaches, integration capabilities and indicative commercial models. Development Bank of Wales is particularly interested in understanding the capabilities of solutions across third-party risk management and monitoring, including how platforms differentiate themselves from solutions focused primarily on cyber-risk monitoring. Suppliers are invited to provide information regarding their proposed solution and to indicate whether relevant functionality is available as standard, through configuration, integration or customisation, or is included within the supplier's product roadmap. Suppliers should also identify any relevant dependencies, limitations, additional modules, third-party data sources and associated costs. This Preliminary Market Engagement exercise is being undertaken to inform Development Bank of Wales' understanding of the market and its consideration of potential future requirements and procurement options. Participation in this exercise does not constitute a formal tender process and does not guarantee that a subsequent procurement exercise will be undertaken. Any future procurement opportunity will be advertised separately in accordance with the applicable procurement requirements. Suppliers wishing to participate should access the Preliminary Market Engagement exercise through the eTenderWales eTendering Portal and submit their response in accordance with the instructions provided. PQQ_33940 - Preliminary Market Engagement - Third-Party Risk Management (TPRM) Platform Deadline for responses: 10:00 on 26 November 2026. Background and purpose Development Bank of Wales (DBW) is seeking to understand the market for Third-Party Risk Management (TPRM) platforms. The primary driver is the planned replacement of DBW's existing third-party cyber risk monitoring capability. Rather than undertake a like-for-like replacement, DBW wishes to explore whether a broader TPRM platform could provide additional value across Information Security, Risk, Compliance, Procurement and Operational Resilience. This market evaluation is intended to: * Understand current market capabilities and solution approaches. * Assess platform maturity, functionality and delivery models. * Identify which capabilities are included as standard and which require additional modules or services. * Inform budget planning and the development of a future procurement specification. Target outcomes * Improved visibility of third-party risk. * A proportionate, risk-based approach to supplier oversight. * Reduced duplication of assurance activity across DBW functions. * Centralised, auditable reporting and evidence. * Better collaboration between Security, Risk, Compliance and Procurement. * Actionable supplier risk intelligence and remediation tracking. Capability areas Third-Party Cyber Risk Intelligence MANDATORY - DBW requires an effective replacement for its existing third-party cyber risk monitoring capability. * Continuous monitoring of supplier external attack surfaces and internet-facing assets. * Discovery and transparent attribution of supplier-owned assets. * Identification of vulnerabilities, misconfigurations and exposed services. * Monitoring of publicly disclosed breaches, leaked data and credential exposure. * Supplier cyber risk ratings, trends and material change notifications. * Evidence-based findings that distinguish confirmed and inferred risks. * Management of disputed findings, false positives and shared infrastructure noise. Supplier Due Diligence and Assessment DESIRABLE - DBW wishes to understand how platforms support proportionate supplier assurance. * Configurable questionnaires and assessment workflows. * Collection and retention of evidence, documents and attestations. * Assessment history, approvals, exceptions and accepted risks. * Scheduled and event-driven reassessments. * Secure supplier engagement and response management. Supplier Inventory and Tiering DESIRABLE - DBW wishes to understand how platforms enable risk-based supplier management. * Supplier inventory or integration with an authoritative supplier register. * Risk, criticality and business-impact tiering. * Identification of critical suppliers and links to important business services. * Differentiated monitoring, due diligence and reassessment by supplier tier. * Ability to reassess and reclassify suppliers when risk or criticality changes. Risk, Compliance and Operational Resilience MANDATORY - DBW requires cross-functional assurance, governance and auditability. * A common assurance view combining assessments, evidence, findings, decisions and actions. * Mapping to internal, regulatory and assurance frameworks. * Clear audit trails for assessments, approvals, exceptions and reassessments. * Identification of assurance gaps, stale evidence and incomplete information. * Support for regulatory compliance and financial crime as mandatory risk domains. * Support for operational resilience, data protection and other desirable domains where available. Workflow and Remediation MANDATORY - DBW requires clear accountability for supplier risk treatment. * Creation, assignment and tracking of findings, actions and remediation plans. * Configurable approvals, escalation routes, reminders and notifications. * Recording of accepted, mitigated, transferred or escalated supplier risks. * Reassessment or workflow activity following material changes in risk. * Supplier collaboration and secure exchange of remediation evidence where available. Reporting and Assurance MANDATORY - DBW requires reporting suitable for operational, executive, audit and assurance use. * Detailed findings, supporting evidence and supplier-level risk history. * Executive and portfolio reporting covering critical and high-risk suppliers. * Reporting of overdue reviews, expired evidence and outstanding actions. * Exportable assessment histories, audit trails and assurance evidence. * Data access suitable for DBW reporting and analytics platforms. Advanced and Future Capabilities DESIRABLE - DBW wishes to understand additional value available beyond the core requirement. * Fourth-party and wider supply-chain visibility. * Concentration risk analysis. * Financial health and credit-risk intelligence. * AI and emerging technology risk assessment. * Reputational risk monitoring and assessment. * Supplier sustainability information, evidence and reporting relevant to public-sector procurement. * Advanced analytics identifying connected or emerging supplier risks. Integrations and data portability Integrations are not assigned a single classification because necessity depends on the integration and the business outcome. Suppliers should describe native connectors, APIs, automated exports, licensing dependencies and implementation effort. Confidentiality, information governance and conflicts Suppliers should clearly identify information they consider genuinely commercially sensitive and explain the basis for that designation. DBW cannot guarantee that information marked confidential will be withheld where disclosure is required by law, including under applicable freedom of information, transparency or audit obligations. Suppliers should not include unnecessary personal data in their responses. Suppliers must disclose any actual or potential conflict of interest connected with this engagement, including any involvement in advising DBW on the requirement or procurement approach. DBW will assess and manage identified conflicts and any risk of unfair advantage in accordance with the Procurement Act 2023. DBW welcomes responses from small and medium-sized enterprises and other suppliers who can contribute relevant market insight. Suppliers may provide equivalent evidence, alternative delivery approaches or proportionate examples where these demonstrate the relevant capability. Nothing in this market engagement is intended to create an unnecessary barrier to participation.",
        "items": [
            {
                "id": "1",
                "additionalClassifications": [
                    {
                        "scheme": "CPV",
                        "id": "48170000",
                        "description": "Compliance software package"
                    },
                    {
                        "scheme": "CPV",
                        "id": "48000000",
                        "description": "Software package and information systems"
                    },
                    {
                        "scheme": "CPV",
                        "id": "72000000",
                        "description": "IT services: consulting, software development, Internet and support"
                    }
                ],
                "deliveryAddresses": [
                    {
                        "region": "UK",
                        "country": "GB",
                        "countryName": "United Kingdom"
                    }
                ],
                "relatedLot": "1"
            }
        ],
        "value": {
            "amountGross": 1.2,
            "amount": 1,
            "currency": "GBP"
        },
        "mainProcurementCategory": "services",
        "aboveThreshold": true,
        "lots": [
            {
                "id": "1",
                "suitability": {
                    "sme": true
                },
                "contractPeriod": {
                    "startDate": "2027-04-01T00:00:00+01:00",
                    "endDate": "2028-03-31T23:59:59+01:00",
                    "maxExtentDate": "2035-03-31T23:59:59+01:00"
                },
                "hasRenewal": true,
                "status": "planning"
            }
        ],
        "communication": {
            "futureNoticeDate": "2027-01-18T23:59:59+00:00"
        },
        "status": "planning"
    },
    "language": "en"
}