NRK 2026 - 41 SOC services

Eignungskriterien

• Tenderers shall be registered in a company register, professional register or a commerce register in the country where the tenderer is established. Documentation requirement

  • •Norwegian companies: Company Registration Certificate
  • •Foreign companies: Verification that the tenderer is registered in a company register, professional register or a commerce register in the country where the tenderer is established.

• Tenderers must have sufficient economic and financial capacity to be able to fulfil the contract. Documentation requirement

  • •The tenderer's Annual Financial Statements from the last two years, including notes, the Board's Annual Reports and Audit Reports, as well as any other and new information of relevance to the tenderer's financial situation and fiscal figures.
  • •In addition for foreign companies: A credit rating based on the last known accounting figures. The rating shall be carried out by a credit rating company with licence to conduct this service. This assessment must not be more than three months old from the tender deadline and be based on the last approved accounts, and it should provide information on credit worthiness and the degree of bankruptcy risk (bankruptcy prediction).]
  • •The contracting authority reserves the right to obtain a credit/solidity assessment of the tenderer from a certified credit rating company.
  • •If the tenderer has a justifiable reason for not submitting the requested documentation, alternative documentation can instead be submitted that sufficiently substantiates that the requirement for economic and financial capacity is fulfilled.
  • •The contracting authority will assess whether the documentation is suitable for the requirement ́s purpose and the documentation ́s content and reliability. It is the tenderer ́s responsibility to demonstrate that the alternative documentation provides a sufficient basis for evaluation.
  • •The alternative documentation must be issued by or pertaining to the tenderer himself. See point 6.5 for support from other entities.

• Tenderers shall have documented experience with the delivery of SOC and event handling services in complex environments with high requirements for security and availability. Documentation requirement

  • •Describe the 3 most important relevant assignments carried out in the last 3 years (max. 1 A4 page per reference. The descriptions shall document the assignments ́ transferable value to NRK, with particular emphasis on:
  • •Operative complexity: Experience with hybrid environments (cloud and on-prem) and organisations with critical needs for 24 hour operation (24/7/365).
  • •Regulated security level: Experience with customers who have critical social functions or operate under statutory security requirements (e.g. the Security Act or the Digital Security Act).
  • •The scope of the delivery: Technical details such as number of log sources, end points and monitoring regime (detection logic).
  • •NRK reserves the right to contact the stated references.

• Tenderers shall document that the company and service delivery comply with recognised national or international quality standards for information security and SOC operations. Documentation requirement

  • •Valid certificate or certificate (or documentation of equivalent level) for the following:
  • •Company certification: ISO/IEC 27001 (information security), SOC 2 Type II (covering the SOC delivery), or equivalent national/international schemes.
  • •Operative framework: Documentation that the SOC function and methodology for event management comply with recognised industry standards (e.g. FIRST or NBIM ́s quality scheme).

• Tenderers shall have established systems for systematic security management and quality assurance, including routines for identifying and managing risks connected to their own sub-suppliers and value chains. Documentation requirement

  • •An account of the tenderer ́s methods for:
  • •Security management: How information security is integrated into the company's management system
  • •Supplier chain control: Processes for risk assessment, follow-up and audit of sub-suppliers with access to infrastructure and data. This includes handling of vulnerabilities in third-party components and software.
  • •Service quality and SLA: Routines for handling deviations, continual improvements to detection capability and ensuring agreed service quality.

• Tenderers shall have an established environmental management system to ensure continual improvement of their environmental performance in relation to the delivery. Documentation requirement

  • •Certificate from third party certified systems such as Miljøfyrtårn, ISO 14001, EMAS or equivalent.
  • •Suppliers without certification can document fulfilment by describing their internal environmental management routines, including concrete routines for energy efficiency and environmentally friendly handling of IT equipment.