{ "uri": "https://www.find-tender.service.gov.uk/api/1.0/ocdsRecordPackages/ocds-h6vhtk-0793af", "publisher": { "name": "Cabinet Office", "scheme": "GB-GOR", "uid": "D2", "uri": "https://www.gov.uk/government/organisations/cabinet-office" }, "publishedDate": "2026-10-29T14:37:18Z", "license": "http://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/", "publicationPolicy": "https://www.gov.uk/government/publications/open-contracting", "version": "1.1", "extensions": [ "https://standard.open-contracting.org/profiles/eu/latest/en/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_amendment_rationale_classifications_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_budget_breakdown_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_contract_completion_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_documentation_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_pagination_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_suitability_extension/master/extension.json", "https://raw.githubusercontent.com/portaledcahn/ocds_Links_extension/main/extension.json", "https://raw.githubusercontent.com/cabinetoffice/ocds_uk_extension/main/extension.json" ], "packages": [ "https://www.find-tender.service.gov.uk/api/1.0/ocdsRecordPackages/ocds-h6vhtk-0793af" ], "records": [ { "ocid": "ocds-h6vhtk-0793af", "releases": [ { "ocid": "ocds-h6vhtk-0793af", "buyerID": [], "id": "102703-2026", "tag": [ "planning" ], "date": "2026-10-29T14:37:17Z", "initiationType": "tender", "parties": [ { "name": "Development Bank of Wales", "id": "GB-PPON-PCWM-6438-QYVP", "identifier": { "scheme": "GB-PPON", "id": "PCWM-6438-QYVP" }, "address": { "streetAddress": "Development Bank of Wales plc", "locality": "Cardiff", "postalCode": "CF10 4BZ", "country": "GB", "countryName": "United Kingdom", "region": "UKL22" }, "contactPoint": { "name": "Leanne Millard", "email": "leanne.millard@developmentbank.wales", "telephone": "+442920801715" }, "roles": [ "buyer" ], "details": { "url": "http://www.developmentbank.wales", "classifications": [ { "scheme": "UK_CA_TYPE", "id": "publicAuthorityCentralGovernment", "description": "Public authority - central government" }, { "scheme": "UK_CA_DEVOLVED_REGULATIONS", "id": "GB-WLS", "description": "Welsh devolved regulations apply" } ] } } ], "buyer": { "id": "GB-PPON-PCWM-6438-QYVP", "name": "Development Bank of Wales" }, "planning": { "milestones": [ { "id": "engagement", "type": "engagement", "description": "For each capability area, suppliers should explain their available functionality and identify whether it is:\n•\tFully supported as standard.\n•\tSupported through configuration.\n•\tSupported through integration.\n•\tSupported through customisation or professional services.\n•\tPartially supported.\n•\tA roadmap item.\n•\tNot supported.\nResponses should also identify relevant dependencies, implementation assumptions, limitations, additional modules, third-party data sources and additional costs.\nResponses must be submitted through [eTenderWales/portal] by 10:00 on Thursday 26 November. Responses received after the deadline may not be considered.\nAny clarification questions must be submitted through the portal by 12:00 on Tuesday 17 November. Suppliers should not contact DBW employees directly regarding this exercise. Clarification questions must be anonymised and must not include the names of any personnel, suppliers or organisations, or any other identifying details. DBW may decline to respond to questions that include such information. DBW may publish clarification questions and responses on an anonymised basis where they are relevant to other participants.\nResponses should be targeted around the supplier’s product offering and should clearly explain how it addresses the capability areas, market evaluation questions, and commercial and delivery information set out in this document. Responses should not exceed 10 pages, excluding appendices containing pricing schedules, technical documentation or supporting evidence.\nResponses will not be formally evaluated, scored or ranked and will not be used to shortlist or select suppliers. They will be reviewed solely to support DBW’s understanding of the market and inform any future procurement approach.\nDBW may invite suppliers to demonstrations, clarification meetings or other follow-up engagement where this would support its understanding of the market. Any such engagement will be conducted on a fair and consistent basis. DBW will take proportionate steps to ensure that participation does not confer an unfair advantage, including making relevant information available in any future procurement and allowing appropriate time for suppliers to prepare tenders.\nMarket evaluation questions\n1. What differentiates the platform from cyber-risk-only monitoring solutions?\n2. Which capabilities are included in the core platform, and which require additional modules, data sources or professional services?\n3. How does the platform combine externally observed intelligence with supplier-declared information and assurance evidence?\n4. How can the platform coexist or integrate with a separate supplier and contract management solution?\n5. How does the platform address financial crime, reputational risk and supplier sustainability?\n6. How are asset attribution, false positives and shared infrastructure handled?\n7. What implementation approach is recommended for an organisation transitioning from cyber monitoring to broader TPRM?\n8. Which relevant capabilities are roadmap items rather than generally available?", "dueDate": "2026-11-26T23:59:59+00:00", "status": "scheduled" } ], "documents": [ { "id": "102703-2026", "documentType": "marketEngagementNotice", "noticeType": "UK2", "description": "Preliminary market engagement notice on Find a Tender", "url": "https://www.find-tender.service.gov.uk/Notice/102703-2026", "datePublished": "2026-10-29T14:37:17Z", "format": "text/html" } ] }, "tender": { "id": "DBW00229.00", "legalBasis": { "id": "2023/54", "scheme": "UKPGA", "uri": "https://www.legislation.gov.uk/ukpga/2023/54/contents" }, "title": "Preliminary Market Engagement – Third-Party Risk Management (TPRM) Platform", "description": "Development Bank of Wales is undertaking a Preliminary Market Engagement exercise to better understand the market for Third-Party Risk Management (TPRM) platforms.\nThe purpose of this exercise is to engage with potential suppliers and gather information on available solutions, functionality, delivery and implementation approaches, integration capabilities and indicative commercial models.\nDevelopment Bank of Wales is particularly interested in understanding the capabilities of solutions across third-party risk management and monitoring, including how platforms differentiate themselves from solutions focused primarily on cyber-risk monitoring.\nSuppliers are invited to provide information regarding their proposed solution and to indicate whether relevant functionality is available as standard, through configuration, integration or customisation, or is included within the supplier's product roadmap. Suppliers should also identify any relevant dependencies, limitations, additional modules, third-party data sources and associated costs.\nThis Preliminary Market Engagement exercise is being undertaken to inform Development Bank of Wales' understanding of the market and its consideration of potential future requirements and procurement options.\nParticipation in this exercise does not constitute a formal tender process and does not guarantee that a subsequent procurement exercise will be undertaken. Any future procurement opportunity will be advertised separately in accordance with the applicable procurement requirements.\nSuppliers wishing to participate should access the Preliminary Market Engagement exercise through the eTenderWales eTendering Portal and submit their response in accordance with the instructions provided. \nPQQ_33940 - Preliminary Market Engagement – Third-Party Risk Management (TPRM) Platform\nDeadline for responses: 10:00 on 26 November 2026.\nBackground and purpose\nDevelopment Bank of Wales (DBW) is seeking to understand the market for Third-Party Risk Management (TPRM) platforms. The primary driver is the planned replacement of DBW’s existing third-party cyber risk monitoring capability. Rather than undertake a like-for-like replacement, DBW wishes to explore whether a broader TPRM platform could provide additional value across Information Security, Risk, Compliance, Procurement and Operational Resilience.\nThis market evaluation is intended to:\n•\tUnderstand current market capabilities and solution approaches.\n•\tAssess platform maturity, functionality and delivery models.\n•\tIdentify which capabilities are included as standard and which require additional modules or services.\n•\tInform budget planning and the development of a future procurement specification.\nTarget outcomes\n•\tImproved visibility of third-party risk.\n•\tA proportionate, risk-based approach to supplier oversight.\n•\tReduced duplication of assurance activity across DBW functions.\n•\tCentralised, auditable reporting and evidence.\n•\tBetter collaboration between Security, Risk, Compliance and Procurement.\n•\tActionable supplier risk intelligence and remediation tracking.\nCapability areas\nThird-Party Cyber Risk Intelligence\nMANDATORY - DBW requires an effective replacement for its existing third-party cyber risk monitoring capability.\n•\tContinuous monitoring of supplier external attack surfaces and internet-facing assets.\n•\tDiscovery and transparent attribution of supplier-owned assets.\n•\tIdentification of vulnerabilities, misconfigurations and exposed services.\n•\tMonitoring of publicly disclosed breaches, leaked data and credential exposure.\n•\tSupplier cyber risk ratings, trends and material change notifications.\n•\tEvidence-based findings that distinguish confirmed and inferred risks.\n•\tManagement of disputed findings, false positives and shared infrastructure noise.\nSupplier Due Diligence and Assessment\nDESIRABLE - DBW wishes to understand how platforms support proportionate supplier assurance.\n•\tConfigurable questionnaires and assessment workflows.\n•\tCollection and retention of evidence, documents and attestations.\n•\tAssessment history, approvals, exceptions and accepted risks.\n•\tScheduled and event-driven reassessments.\n•\tSecure supplier engagement and response management.\nSupplier Inventory and Tiering\nDESIRABLE - DBW wishes to understand how platforms enable risk-based supplier management.\n•\tSupplier inventory or integration with an authoritative supplier register.\n•\tRisk, criticality and business-impact tiering.\n•\tIdentification of critical suppliers and links to important business services.\n•\tDifferentiated monitoring, due diligence and reassessment by supplier tier.\n•\tAbility to reassess and reclassify suppliers when risk or criticality changes.\nRisk, Compliance and Operational Resilience\nMANDATORY - DBW requires cross-functional assurance, governance and auditability.\n•\tA common assurance view combining assessments, evidence, findings, decisions and actions.\n•\tMapping to internal, regulatory and assurance frameworks.\n•\tClear audit trails for assessments, approvals, exceptions and reassessments.\n•\tIdentification of assurance gaps, stale evidence and incomplete information.\n•\tSupport for regulatory compliance and financial crime as mandatory risk domains.\n•\tSupport for operational resilience, data protection and other desirable domains where available.\nWorkflow and Remediation\nMANDATORY - DBW requires clear accountability for supplier risk treatment.\n•\tCreation, assignment and tracking of findings, actions and remediation plans.\n•\tConfigurable approvals, escalation routes, reminders and notifications.\n•\tRecording of accepted, mitigated, transferred or escalated supplier risks.\n•\tReassessment or workflow activity following material changes in risk.\n•\tSupplier collaboration and secure exchange of remediation evidence where available.\nReporting and Assurance\nMANDATORY - DBW requires reporting suitable for operational, executive, audit and assurance use.\n•\tDetailed findings, supporting evidence and supplier-level risk history.\n•\tExecutive and portfolio reporting covering critical and high-risk suppliers.\n•\tReporting of overdue reviews, expired evidence and outstanding actions.\n•\tExportable assessment histories, audit trails and assurance evidence.\n•\tData access suitable for DBW reporting and analytics platforms.\nAdvanced and Future Capabilities\nDESIRABLE - DBW wishes to understand additional value available beyond the core requirement.\n•\tFourth-party and wider supply-chain visibility.\n•\tConcentration risk analysis.\n•\tFinancial health and credit-risk intelligence.\n•\tAI and emerging technology risk assessment.\n•\tReputational risk monitoring and assessment.\n•\tSupplier sustainability information, evidence and reporting relevant to public-sector procurement.\n•\tAdvanced analytics identifying connected or emerging supplier risks.\nIntegrations and data portability\nIntegrations are not assigned a single classification because necessity depends on the integration and the business outcome. Suppliers should describe native connectors, APIs, automated exports, licensing dependencies and implementation effort.\nConfidentiality, information governance and conflicts\nSuppliers should clearly identify information they consider genuinely commercially sensitive and explain the basis for that designation. DBW cannot guarantee that information marked confidential will be withheld where disclosure is required by law, including under applicable freedom of information, transparency or audit obligations. Suppliers should not include unnecessary personal data in their responses.\nSuppliers must disclose any actual or potential conflict of interest connected with this engagement, including any involvement in advising DBW on the requirement or procurement approach. DBW will assess and manage identified conflicts and any risk of unfair advantage in accordance with the Procurement Act 2023.\nDBW welcomes responses from small and medium-sized enterprises and other suppliers who can contribute relevant market insight. Suppliers may provide equivalent evidence, alternative delivery approaches or proportionate examples where these demonstrate the relevant capability. Nothing in this market engagement is intended to create an unnecessary barrier to participation.", "items": [ { "id": "1", "additionalClassifications": [ { "scheme": "CPV", "id": "48170000", "description": "Compliance software package" }, { "scheme": "CPV", "id": "48000000", "description": "Software package and information systems" }, { "scheme": "CPV", "id": "72000000", "description": "IT services: consulting, software development, Internet and support" } ], "deliveryAddresses": [ { "region": "UK", "country": "GB", "countryName": "United Kingdom" } ], "relatedLot": "1" } ], "value": { "amountGross": 1.2, "amount": 1, "currency": "GBP" }, "mainProcurementCategory": "services", "aboveThreshold": true, "lots": [ { "id": "1", "suitability": { "sme": true }, "contractPeriod": { "startDate": "2027-04-01T00:00:00+01:00", "endDate": "2028-03-31T23:59:59+01:00", "maxExtentDate": "2035-03-31T23:59:59+01:00" }, "hasRenewal": true, "description": null, "status": "planning" } ], "communication": { "futureNoticeDate": "2027-01-18T23:59:59+00:00" }, "status": "planning" }, "language": "en", "extensions": [ "https://standard.open-contracting.org/profiles/eu/latest/en/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_amendment_rationale_classifications_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_budget_breakdown_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_contract_completion_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_documentation_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_pagination_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_performance_failures_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_suitability_extension/master/extension.json", "https://raw.githubusercontent.com/portaledcahn/ocds_Links_extension/main/extension.json", "https://raw.githubusercontent.com/cabinetoffice/ocds_uk_extension/main/extension.json" ] } ], "compiledRelease": { "tag": [ "compiled" ], "id": "ocds-h6vhtk-0793af-2026-10-29T14:37:17Z", "date": "2026-10-29T14:37:17Z", "ocid": "ocds-h6vhtk-0793af", "initiationType": "tender", "parties": [ { "id": "GB-PPON-PCWM-6438-QYVP", "name": "Development Bank of Wales", "identifier": { "scheme": "GB-PPON", "id": "PCWM-6438-QYVP" }, "address": { "streetAddress": "Development Bank of Wales plc", "locality": "Cardiff", "postalCode": "CF10 4BZ", "country": "GB", "countryName": "United Kingdom", "region": "UKL22" }, "contactPoint": { "name": "Leanne Millard", "email": "leanne.millard@developmentbank.wales", "telephone": "+442920801715" }, "roles": [ "buyer" ], "details": { "url": "http://www.developmentbank.wales", "classifications": [ { "scheme": "UK_CA_TYPE", "id": "publicAuthorityCentralGovernment", "description": "Public authority - central government" }, { "scheme": "UK_CA_DEVOLVED_REGULATIONS", "id": "GB-WLS", "description": "Welsh devolved regulations apply" } ] } } ], "buyer": { "id": "GB-PPON-PCWM-6438-QYVP", "name": "Development Bank of Wales" }, "planning": { "milestones": [ { "id": "engagement", "type": "engagement", "description": "For each capability area, suppliers should explain their available functionality and identify whether it is:\n•\tFully supported as standard.\n•\tSupported through configuration.\n•\tSupported through integration.\n•\tSupported through customisation or professional services.\n•\tPartially supported.\n•\tA roadmap item.\n•\tNot supported.\nResponses should also identify relevant dependencies, implementation assumptions, limitations, additional modules, third-party data sources and additional costs.\nResponses must be submitted through [eTenderWales/portal] by 10:00 on Thursday 26 November. Responses received after the deadline may not be considered.\nAny clarification questions must be submitted through the portal by 12:00 on Tuesday 17 November. Suppliers should not contact DBW employees directly regarding this exercise. Clarification questions must be anonymised and must not include the names of any personnel, suppliers or organisations, or any other identifying details. DBW may decline to respond to questions that include such information. DBW may publish clarification questions and responses on an anonymised basis where they are relevant to other participants.\nResponses should be targeted around the supplier’s product offering and should clearly explain how it addresses the capability areas, market evaluation questions, and commercial and delivery information set out in this document. Responses should not exceed 10 pages, excluding appendices containing pricing schedules, technical documentation or supporting evidence.\nResponses will not be formally evaluated, scored or ranked and will not be used to shortlist or select suppliers. They will be reviewed solely to support DBW’s understanding of the market and inform any future procurement approach.\nDBW may invite suppliers to demonstrations, clarification meetings or other follow-up engagement where this would support its understanding of the market. Any such engagement will be conducted on a fair and consistent basis. DBW will take proportionate steps to ensure that participation does not confer an unfair advantage, including making relevant information available in any future procurement and allowing appropriate time for suppliers to prepare tenders.\nMarket evaluation questions\n1. What differentiates the platform from cyber-risk-only monitoring solutions?\n2. Which capabilities are included in the core platform, and which require additional modules, data sources or professional services?\n3. How does the platform combine externally observed intelligence with supplier-declared information and assurance evidence?\n4. How can the platform coexist or integrate with a separate supplier and contract management solution?\n5. How does the platform address financial crime, reputational risk and supplier sustainability?\n6. How are asset attribution, false positives and shared infrastructure handled?\n7. What implementation approach is recommended for an organisation transitioning from cyber monitoring to broader TPRM?\n8. Which relevant capabilities are roadmap items rather than generally available?", "dueDate": "2026-11-26T23:59:59+00:00", "status": "scheduled" } ], "documents": [ { "id": "102703-2026", "documentType": "marketEngagementNotice", "noticeType": "UK2", "description": "Preliminary market engagement notice on Find a Tender", "url": "https://www.find-tender.service.gov.uk/Notice/102703-2026", "datePublished": "2026-10-29T14:37:17Z", "format": "text/html" } ] }, "tender": { "id": "DBW00229.00", "legalBasis": { "id": "2023/54", "scheme": "UKPGA", "uri": "https://www.legislation.gov.uk/ukpga/2023/54/contents" }, "title": "Preliminary Market Engagement – Third-Party Risk Management (TPRM) Platform", "description": "Development Bank of Wales is undertaking a Preliminary Market Engagement exercise to better understand the market for Third-Party Risk Management (TPRM) platforms.\nThe purpose of this exercise is to engage with potential suppliers and gather information on available solutions, functionality, delivery and implementation approaches, integration capabilities and indicative commercial models.\nDevelopment Bank of Wales is particularly interested in understanding the capabilities of solutions across third-party risk management and monitoring, including how platforms differentiate themselves from solutions focused primarily on cyber-risk monitoring.\nSuppliers are invited to provide information regarding their proposed solution and to indicate whether relevant functionality is available as standard, through configuration, integration or customisation, or is included within the supplier's product roadmap. Suppliers should also identify any relevant dependencies, limitations, additional modules, third-party data sources and associated costs.\nThis Preliminary Market Engagement exercise is being undertaken to inform Development Bank of Wales' understanding of the market and its consideration of potential future requirements and procurement options.\nParticipation in this exercise does not constitute a formal tender process and does not guarantee that a subsequent procurement exercise will be undertaken. Any future procurement opportunity will be advertised separately in accordance with the applicable procurement requirements.\nSuppliers wishing to participate should access the Preliminary Market Engagement exercise through the eTenderWales eTendering Portal and submit their response in accordance with the instructions provided. \nPQQ_33940 - Preliminary Market Engagement – Third-Party Risk Management (TPRM) Platform\nDeadline for responses: 10:00 on 26 November 2026.\nBackground and purpose\nDevelopment Bank of Wales (DBW) is seeking to understand the market for Third-Party Risk Management (TPRM) platforms. The primary driver is the planned replacement of DBW’s existing third-party cyber risk monitoring capability. Rather than undertake a like-for-like replacement, DBW wishes to explore whether a broader TPRM platform could provide additional value across Information Security, Risk, Compliance, Procurement and Operational Resilience.\nThis market evaluation is intended to:\n•\tUnderstand current market capabilities and solution approaches.\n•\tAssess platform maturity, functionality and delivery models.\n•\tIdentify which capabilities are included as standard and which require additional modules or services.\n•\tInform budget planning and the development of a future procurement specification.\nTarget outcomes\n•\tImproved visibility of third-party risk.\n•\tA proportionate, risk-based approach to supplier oversight.\n•\tReduced duplication of assurance activity across DBW functions.\n•\tCentralised, auditable reporting and evidence.\n•\tBetter collaboration between Security, Risk, Compliance and Procurement.\n•\tActionable supplier risk intelligence and remediation tracking.\nCapability areas\nThird-Party Cyber Risk Intelligence\nMANDATORY - DBW requires an effective replacement for its existing third-party cyber risk monitoring capability.\n•\tContinuous monitoring of supplier external attack surfaces and internet-facing assets.\n•\tDiscovery and transparent attribution of supplier-owned assets.\n•\tIdentification of vulnerabilities, misconfigurations and exposed services.\n•\tMonitoring of publicly disclosed breaches, leaked data and credential exposure.\n•\tSupplier cyber risk ratings, trends and material change notifications.\n•\tEvidence-based findings that distinguish confirmed and inferred risks.\n•\tManagement of disputed findings, false positives and shared infrastructure noise.\nSupplier Due Diligence and Assessment\nDESIRABLE - DBW wishes to understand how platforms support proportionate supplier assurance.\n•\tConfigurable questionnaires and assessment workflows.\n•\tCollection and retention of evidence, documents and attestations.\n•\tAssessment history, approvals, exceptions and accepted risks.\n•\tScheduled and event-driven reassessments.\n•\tSecure supplier engagement and response management.\nSupplier Inventory and Tiering\nDESIRABLE - DBW wishes to understand how platforms enable risk-based supplier management.\n•\tSupplier inventory or integration with an authoritative supplier register.\n•\tRisk, criticality and business-impact tiering.\n•\tIdentification of critical suppliers and links to important business services.\n•\tDifferentiated monitoring, due diligence and reassessment by supplier tier.\n•\tAbility to reassess and reclassify suppliers when risk or criticality changes.\nRisk, Compliance and Operational Resilience\nMANDATORY - DBW requires cross-functional assurance, governance and auditability.\n•\tA common assurance view combining assessments, evidence, findings, decisions and actions.\n•\tMapping to internal, regulatory and assurance frameworks.\n•\tClear audit trails for assessments, approvals, exceptions and reassessments.\n•\tIdentification of assurance gaps, stale evidence and incomplete information.\n•\tSupport for regulatory compliance and financial crime as mandatory risk domains.\n•\tSupport for operational resilience, data protection and other desirable domains where available.\nWorkflow and Remediation\nMANDATORY - DBW requires clear accountability for supplier risk treatment.\n•\tCreation, assignment and tracking of findings, actions and remediation plans.\n•\tConfigurable approvals, escalation routes, reminders and notifications.\n•\tRecording of accepted, mitigated, transferred or escalated supplier risks.\n•\tReassessment or workflow activity following material changes in risk.\n•\tSupplier collaboration and secure exchange of remediation evidence where available.\nReporting and Assurance\nMANDATORY - DBW requires reporting suitable for operational, executive, audit and assurance use.\n•\tDetailed findings, supporting evidence and supplier-level risk history.\n•\tExecutive and portfolio reporting covering critical and high-risk suppliers.\n•\tReporting of overdue reviews, expired evidence and outstanding actions.\n•\tExportable assessment histories, audit trails and assurance evidence.\n•\tData access suitable for DBW reporting and analytics platforms.\nAdvanced and Future Capabilities\nDESIRABLE - DBW wishes to understand additional value available beyond the core requirement.\n•\tFourth-party and wider supply-chain visibility.\n•\tConcentration risk analysis.\n•\tFinancial health and credit-risk intelligence.\n•\tAI and emerging technology risk assessment.\n•\tReputational risk monitoring and assessment.\n•\tSupplier sustainability information, evidence and reporting relevant to public-sector procurement.\n•\tAdvanced analytics identifying connected or emerging supplier risks.\nIntegrations and data portability\nIntegrations are not assigned a single classification because necessity depends on the integration and the business outcome. Suppliers should describe native connectors, APIs, automated exports, licensing dependencies and implementation effort.\nConfidentiality, information governance and conflicts\nSuppliers should clearly identify information they consider genuinely commercially sensitive and explain the basis for that designation. DBW cannot guarantee that information marked confidential will be withheld where disclosure is required by law, including under applicable freedom of information, transparency or audit obligations. Suppliers should not include unnecessary personal data in their responses.\nSuppliers must disclose any actual or potential conflict of interest connected with this engagement, including any involvement in advising DBW on the requirement or procurement approach. DBW will assess and manage identified conflicts and any risk of unfair advantage in accordance with the Procurement Act 2023.\nDBW welcomes responses from small and medium-sized enterprises and other suppliers who can contribute relevant market insight. Suppliers may provide equivalent evidence, alternative delivery approaches or proportionate examples where these demonstrate the relevant capability. Nothing in this market engagement is intended to create an unnecessary barrier to participation.", "items": [ { "id": "1", "additionalClassifications": [ { "scheme": "CPV", "id": "48170000", "description": "Compliance software package" }, { "scheme": "CPV", "id": "48000000", "description": "Software package and information systems" }, { "scheme": "CPV", "id": "72000000", "description": "IT services: consulting, software development, Internet and support" } ], "deliveryAddresses": [ { "region": "UK", "country": "GB", "countryName": "United Kingdom" } ], "relatedLot": "1" } ], "value": { "amountGross": 1.2, "amount": 1, "currency": "GBP" }, "mainProcurementCategory": "services", "aboveThreshold": true, "lots": [ { "id": "1", "suitability": { "sme": true }, "contractPeriod": { "startDate": "2027-04-01T00:00:00+01:00", "endDate": "2028-03-31T23:59:59+01:00", "maxExtentDate": "2035-03-31T23:59:59+01:00" }, "hasRenewal": true, "status": "planning" } ], "communication": { "futureNoticeDate": "2027-01-18T23:59:59+00:00" }, "status": "planning" }, "language": "en", "extensions": [ "https://standard.open-contracting.org/profiles/eu/latest/en/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_amendment_rationale_classifications_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_budget_breakdown_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_contract_completion_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_documentation_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_pagination_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_performance_failures_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_suitability_extension/master/extension.json", "https://raw.githubusercontent.com/portaledcahn/ocds_Links_extension/main/extension.json", "https://raw.githubusercontent.com/cabinetoffice/ocds_uk_extension/main/extension.json" ] }, "versionedRelease": { "ocid": "ocds-h6vhtk-0793af", "initiationType": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "tender" } ], "parties": [ { "id": "GB-PPON-PCWM-6438-QYVP", "name": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "Development Bank of Wales" } ], "identifier": { "scheme": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "GB-PPON" } ], "id": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "PCWM-6438-QYVP" } ] }, "address": { "streetAddress": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "Development Bank of Wales plc" } ], "locality": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "Cardiff" } ], "postalCode": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "CF10 4BZ" } ], "country": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "GB" } ], "countryName": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "United Kingdom" } ], "region": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "UKL22" } ] }, "contactPoint": { "name": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "Leanne Millard" } ], "email": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "leanne.millard@developmentbank.wales" } ], "telephone": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "+442920801715" } ] }, "roles": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": [ "buyer" ] } ], "details": { "url": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "http://www.developmentbank.wales" } ], "classifications": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": [ { "scheme": "UK_CA_TYPE", "id": "publicAuthorityCentralGovernment", "description": "Public authority - central government" }, { "scheme": "UK_CA_DEVOLVED_REGULATIONS", "id": "GB-WLS", "description": "Welsh devolved regulations apply" } ] } ] } } ], "buyer": { "id": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "GB-PPON-PCWM-6438-QYVP" } ], "name": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "Development Bank of Wales" } ] }, "planning": { "milestones": [ { "id": "engagement", "type": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "engagement" } ], "description": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "For each capability area, suppliers should explain their available functionality and identify whether it is:\n•\tFully supported as standard.\n•\tSupported through configuration.\n•\tSupported through integration.\n•\tSupported through customisation or professional services.\n•\tPartially supported.\n•\tA roadmap item.\n•\tNot supported.\nResponses should also identify relevant dependencies, implementation assumptions, limitations, additional modules, third-party data sources and additional costs.\nResponses must be submitted through [eTenderWales/portal] by 10:00 on Thursday 26 November. Responses received after the deadline may not be considered.\nAny clarification questions must be submitted through the portal by 12:00 on Tuesday 17 November. Suppliers should not contact DBW employees directly regarding this exercise. Clarification questions must be anonymised and must not include the names of any personnel, suppliers or organisations, or any other identifying details. DBW may decline to respond to questions that include such information. DBW may publish clarification questions and responses on an anonymised basis where they are relevant to other participants.\nResponses should be targeted around the supplier’s product offering and should clearly explain how it addresses the capability areas, market evaluation questions, and commercial and delivery information set out in this document. Responses should not exceed 10 pages, excluding appendices containing pricing schedules, technical documentation or supporting evidence.\nResponses will not be formally evaluated, scored or ranked and will not be used to shortlist or select suppliers. They will be reviewed solely to support DBW’s understanding of the market and inform any future procurement approach.\nDBW may invite suppliers to demonstrations, clarification meetings or other follow-up engagement where this would support its understanding of the market. Any such engagement will be conducted on a fair and consistent basis. DBW will take proportionate steps to ensure that participation does not confer an unfair advantage, including making relevant information available in any future procurement and allowing appropriate time for suppliers to prepare tenders.\nMarket evaluation questions\n1. What differentiates the platform from cyber-risk-only monitoring solutions?\n2. Which capabilities are included in the core platform, and which require additional modules, data sources or professional services?\n3. How does the platform combine externally observed intelligence with supplier-declared information and assurance evidence?\n4. How can the platform coexist or integrate with a separate supplier and contract management solution?\n5. How does the platform address financial crime, reputational risk and supplier sustainability?\n6. How are asset attribution, false positives and shared infrastructure handled?\n7. What implementation approach is recommended for an organisation transitioning from cyber monitoring to broader TPRM?\n8. Which relevant capabilities are roadmap items rather than generally available?" } ], "dueDate": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "2026-11-26T23:59:59+00:00" } ], "status": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "scheduled" } ] } ], "documents": [ { "id": "102703-2026", "documentType": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "marketEngagementNotice" } ], "noticeType": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "UK2" } ], "description": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "Preliminary market engagement notice on Find a Tender" } ], "url": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "https://www.find-tender.service.gov.uk/Notice/102703-2026" } ], "datePublished": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "2026-10-29T14:37:17Z" } ], "format": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "text/html" } ] } ] }, "tender": { "id": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "DBW00229.00" } ], "legalBasis": { "id": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "2023/54" } ], "scheme": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "UKPGA" } ], "uri": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "https://www.legislation.gov.uk/ukpga/2023/54/contents" } ] }, "title": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "Preliminary Market Engagement – Third-Party Risk Management (TPRM) Platform" } ], "description": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "Development Bank of Wales is undertaking a Preliminary Market Engagement exercise to better understand the market for Third-Party Risk Management (TPRM) platforms.\nThe purpose of this exercise is to engage with potential suppliers and gather information on available solutions, functionality, delivery and implementation approaches, integration capabilities and indicative commercial models.\nDevelopment Bank of Wales is particularly interested in understanding the capabilities of solutions across third-party risk management and monitoring, including how platforms differentiate themselves from solutions focused primarily on cyber-risk monitoring.\nSuppliers are invited to provide information regarding their proposed solution and to indicate whether relevant functionality is available as standard, through configuration, integration or customisation, or is included within the supplier's product roadmap. Suppliers should also identify any relevant dependencies, limitations, additional modules, third-party data sources and associated costs.\nThis Preliminary Market Engagement exercise is being undertaken to inform Development Bank of Wales' understanding of the market and its consideration of potential future requirements and procurement options.\nParticipation in this exercise does not constitute a formal tender process and does not guarantee that a subsequent procurement exercise will be undertaken. Any future procurement opportunity will be advertised separately in accordance with the applicable procurement requirements.\nSuppliers wishing to participate should access the Preliminary Market Engagement exercise through the eTenderWales eTendering Portal and submit their response in accordance with the instructions provided. \nPQQ_33940 - Preliminary Market Engagement – Third-Party Risk Management (TPRM) Platform\nDeadline for responses: 10:00 on 26 November 2026.\nBackground and purpose\nDevelopment Bank of Wales (DBW) is seeking to understand the market for Third-Party Risk Management (TPRM) platforms. The primary driver is the planned replacement of DBW’s existing third-party cyber risk monitoring capability. Rather than undertake a like-for-like replacement, DBW wishes to explore whether a broader TPRM platform could provide additional value across Information Security, Risk, Compliance, Procurement and Operational Resilience.\nThis market evaluation is intended to:\n•\tUnderstand current market capabilities and solution approaches.\n•\tAssess platform maturity, functionality and delivery models.\n•\tIdentify which capabilities are included as standard and which require additional modules or services.\n•\tInform budget planning and the development of a future procurement specification.\nTarget outcomes\n•\tImproved visibility of third-party risk.\n•\tA proportionate, risk-based approach to supplier oversight.\n•\tReduced duplication of assurance activity across DBW functions.\n•\tCentralised, auditable reporting and evidence.\n•\tBetter collaboration between Security, Risk, Compliance and Procurement.\n•\tActionable supplier risk intelligence and remediation tracking.\nCapability areas\nThird-Party Cyber Risk Intelligence\nMANDATORY - DBW requires an effective replacement for its existing third-party cyber risk monitoring capability.\n•\tContinuous monitoring of supplier external attack surfaces and internet-facing assets.\n•\tDiscovery and transparent attribution of supplier-owned assets.\n•\tIdentification of vulnerabilities, misconfigurations and exposed services.\n•\tMonitoring of publicly disclosed breaches, leaked data and credential exposure.\n•\tSupplier cyber risk ratings, trends and material change notifications.\n•\tEvidence-based findings that distinguish confirmed and inferred risks.\n•\tManagement of disputed findings, false positives and shared infrastructure noise.\nSupplier Due Diligence and Assessment\nDESIRABLE - DBW wishes to understand how platforms support proportionate supplier assurance.\n•\tConfigurable questionnaires and assessment workflows.\n•\tCollection and retention of evidence, documents and attestations.\n•\tAssessment history, approvals, exceptions and accepted risks.\n•\tScheduled and event-driven reassessments.\n•\tSecure supplier engagement and response management.\nSupplier Inventory and Tiering\nDESIRABLE - DBW wishes to understand how platforms enable risk-based supplier management.\n•\tSupplier inventory or integration with an authoritative supplier register.\n•\tRisk, criticality and business-impact tiering.\n•\tIdentification of critical suppliers and links to important business services.\n•\tDifferentiated monitoring, due diligence and reassessment by supplier tier.\n•\tAbility to reassess and reclassify suppliers when risk or criticality changes.\nRisk, Compliance and Operational Resilience\nMANDATORY - DBW requires cross-functional assurance, governance and auditability.\n•\tA common assurance view combining assessments, evidence, findings, decisions and actions.\n•\tMapping to internal, regulatory and assurance frameworks.\n•\tClear audit trails for assessments, approvals, exceptions and reassessments.\n•\tIdentification of assurance gaps, stale evidence and incomplete information.\n•\tSupport for regulatory compliance and financial crime as mandatory risk domains.\n•\tSupport for operational resilience, data protection and other desirable domains where available.\nWorkflow and Remediation\nMANDATORY - DBW requires clear accountability for supplier risk treatment.\n•\tCreation, assignment and tracking of findings, actions and remediation plans.\n•\tConfigurable approvals, escalation routes, reminders and notifications.\n•\tRecording of accepted, mitigated, transferred or escalated supplier risks.\n•\tReassessment or workflow activity following material changes in risk.\n•\tSupplier collaboration and secure exchange of remediation evidence where available.\nReporting and Assurance\nMANDATORY - DBW requires reporting suitable for operational, executive, audit and assurance use.\n•\tDetailed findings, supporting evidence and supplier-level risk history.\n•\tExecutive and portfolio reporting covering critical and high-risk suppliers.\n•\tReporting of overdue reviews, expired evidence and outstanding actions.\n•\tExportable assessment histories, audit trails and assurance evidence.\n•\tData access suitable for DBW reporting and analytics platforms.\nAdvanced and Future Capabilities\nDESIRABLE - DBW wishes to understand additional value available beyond the core requirement.\n•\tFourth-party and wider supply-chain visibility.\n•\tConcentration risk analysis.\n•\tFinancial health and credit-risk intelligence.\n•\tAI and emerging technology risk assessment.\n•\tReputational risk monitoring and assessment.\n•\tSupplier sustainability information, evidence and reporting relevant to public-sector procurement.\n•\tAdvanced analytics identifying connected or emerging supplier risks.\nIntegrations and data portability\nIntegrations are not assigned a single classification because necessity depends on the integration and the business outcome. Suppliers should describe native connectors, APIs, automated exports, licensing dependencies and implementation effort.\nConfidentiality, information governance and conflicts\nSuppliers should clearly identify information they consider genuinely commercially sensitive and explain the basis for that designation. DBW cannot guarantee that information marked confidential will be withheld where disclosure is required by law, including under applicable freedom of information, transparency or audit obligations. Suppliers should not include unnecessary personal data in their responses.\nSuppliers must disclose any actual or potential conflict of interest connected with this engagement, including any involvement in advising DBW on the requirement or procurement approach. DBW will assess and manage identified conflicts and any risk of unfair advantage in accordance with the Procurement Act 2023.\nDBW welcomes responses from small and medium-sized enterprises and other suppliers who can contribute relevant market insight. Suppliers may provide equivalent evidence, alternative delivery approaches or proportionate examples where these demonstrate the relevant capability. Nothing in this market engagement is intended to create an unnecessary barrier to participation." } ], "items": [ { "id": "1", "additionalClassifications": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": [ { "scheme": "CPV", "id": "48170000", "description": "Compliance software package" }, { "scheme": "CPV", "id": "48000000", "description": "Software package and information systems" }, { "scheme": "CPV", "id": "72000000", "description": "IT services: consulting, software development, Internet and support" } ] } ], "deliveryAddresses": [ { "region": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "UK" } ], "country": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "GB" } ], "countryName": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "United Kingdom" } ] } ], "relatedLot": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "1" } ] } ], "value": { "amountGross": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": 1.2 } ], "amount": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": 1 } ], "currency": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "GBP" } ] }, "mainProcurementCategory": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "services" } ], "aboveThreshold": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": true } ], "lots": [ { "id": "1", "suitability": { "sme": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": true } ] }, "contractPeriod": { "startDate": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "2027-04-01T00:00:00+01:00" } ], "endDate": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "2028-03-31T23:59:59+01:00" } ], "maxExtentDate": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "2035-03-31T23:59:59+01:00" } ] }, "hasRenewal": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": true } ], "description": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": null } ], "status": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "planning" } ] } ], "communication": { "futureNoticeDate": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "2027-01-18T23:59:59+00:00" } ] }, "status": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "planning" } ] }, "language": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": "en" } ], "extensions": [ { "releaseID": "102703-2026", "releaseDate": "2026-10-29T14:37:17Z", "releaseTag": [ "planning" ], "value": [ "https://standard.open-contracting.org/profiles/eu/latest/en/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_amendment_rationale_classifications_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_budget_breakdown_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_contract_completion_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_documentation_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_pagination_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_performance_failures_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_suitability_extension/master/extension.json", "https://raw.githubusercontent.com/portaledcahn/ocds_Links_extension/main/extension.json", "https://raw.githubusercontent.com/cabinetoffice/ocds_uk_extension/main/extension.json" ] } ] } } ] }