Framework agreement on the delivery of purple teaming tests

1.1.

Buyer

Official name : Danmarks Nationalbank

Email : amje@nationalbanken.dk

Legal type of the buyer : Body governed by public law

Activity of the contracting authority : Economic affairs

2.1.

Procedure

Title : Framework agreement on the delivery of purple teaming tests

Description : This procurement seeks to enter into framework agreements with 3 Suppliers, that are experts within the field of purple teaming testing. Any Statement of Work will be awarded suite of a subsequent re-opening of the competition. The purple teaming test (PTT) shall be conducted on Danmarks Nationalbank. The purpose of the purple teaming test is to enhance the Customer’s cybersecurity posture by integrating offensive and defensive security teams to simulate real-world attack scenarios and improve detection and response capabilities. The test shall be conducted as a cooperation between the offensive red team provided by the supplier and the defensive blue team. The test shall assess how well the Customer is equipped to protect against, detect, respond to and potentially recover from cyber-attacks from threat actors with realistically advanced capabilities and modus operandi. The test shall to the farthest possible extent mimic relevant real actors’ capabilities towards the defensive capabilities at the Customers disposal. The framework agreement will be awarded to three (3) suppliers.

Procedure identifier : d9f31002-81af-4d13-870f-a6c4ad8b9d01

Previous notice : 9b434abc-9d9f-40cf-9072-cc82b7f561fa-01

Internal identifier : TS 231059

Type of procedure : Restricted

The procedure is accelerated : no

2.1.1.

Purpose

Main nature of the contract : Services

Main classification ( cpv ): 72600000 Computer support and consultancy services

Additional classification ( cpv ): 72500000 Computer-related services

2.1.2.

Place of performance

Postal address : Langlinie Allé 47

Town : Copenhagen Ø

Postcode : 2100

Country subdivision (NUTS) : Byen København ( DK011 )

Country : Denmark

2.1.3.

Value

Estimated value excluding VAT : 31 550 400,00 DKK

Maximum value of the framework agreement : 3 991 125,00 DKK

2.1.4.

General information

Additional information : Participation in the tender procedure may only take place by electronic means via the electronic tendering system used by the contracting entity. For access to the procurement documents, the candidate must be registered or register as a user. If the application contains several versions of the same document, the latest uploaded version will apply. All communication in connection with the tender procedure, including questions and answers, must take place through the electronic tendering system. Reference is made to the tender specifications and appendix B for information concerning questions and answers. Interested operators are requested to keep updated via the electronic tendering system. If the candidate encounters problems with the system, please contact support by e-mail, dksupport@eu-sup ply.com, or telephone (+45) 70 20 80 14. As its application, the candidate must submit an ESPD as preliminary documentation of the circumstances set out in section 148(1), paras (1)-(3) of the Danish Public Procurement Act (udbudsloven) and section 137(1) para (1) and para (3) and para (4) and para (5) of the Danish Public Procurement Act. It is not necessary for the candidate to sign the ESPD document. For groups of operators (e.g. a consortium), a separate ESPD must be submitted for each participating operator. Where the candidate is a group of operators, the ESPD document of each participant in the group must be signed by the participant in question. The candidate heading the group and submitting the application is not required to sign its ESPD document. If the candidate relies on the capacities of other entities, an ESPD must be submitted for and signed by each of the entities on which it relies. Before the award decision is made, the tenderer to whom the contracting entity intends to award the contract must provide documentation of the information submitted in the ESPD pursuant to sections 151-152, cf. section 153 of the Danish Public Procurement Act. As an alternative to the documentation mentioned in sections 153-155, 157 and 158 of the Danish Public Procurement Act, the applicant and tenderer may submit to the contracting entity a certificate of registration in an official list of approved economic operators, see section 156 of the Danish Public Procurement Act, issued by the competent authority. The contracting entity only accepts certificates of registration in an official list from applicants and tenderers established in the country holding the official list. The contracting entity will select the number of candidates by applying the selection criteria stated in this contract notice, unless the contracting entity receives no more than the stated number of compliant requests for participation. Section 134a of the Danish Public Procurement Act shall apply to this tender procedure. Participation in the tender procedure may only take place by electronic means via the electronic tendering system used by the contracting entity. For access to the tender documents, the tenderer must be registered or register as a user. If the tender contains several versions of the same document, the latest uploaded version will apply. All communication in connection with the tender procedure, including questions and answers, must take place through the electronic tendering system. Reference is made to the tender specifications and appendix B for information concerning questions and answers. Interested operators are requested to keep updated via the electronic tendering system. If the tenderer encounters problems with the system, please contact support by e-mail, dksupport@eu-supply.com, or telephone (+45) 70 20 80 14. The tenderer must submit an ESPD with the tender as preliminary documentation of the circumstances set out in section 148(1), paras (1)-(3) of the Danish Public Procurement Act (udbudsloven). It is not necessary for the tenderer to sign the ESPD document. For groups of operators (e.g., a consortium), a separate ESPD must be submitted for each participating operator. Where the tenderer is a group of operators, the ESPD document of each participant in the group must be signed by the participant in question. The tenderer heading the group and submitting the tender is not required to sign its ESPD document. If the tenderer relies on the capacities of other entities, an ESPD must be submitted for and signed by each of the entities on which the tenderer relies. It should be noted that each candidate may only submit one application for prequalification. Before the award decision is made, the tenderer to whom the contracting entity intends to award the contract must provide documentation of the information submitted in the ESPD pursuant to sections 151-152, cf. section 153 of the Danish Public Procurement Act. As an alternative to the documentation mentioned in sections 153-155, 157 and 158 of the Danish Public Procurement Act, the tenderer may submit to the contracting entity a certificate of registration in an official list of approved economic operators, see section 156 of the Danish Public Procurement Act, issued by the competent authority. The contracting entity only accepts certificates of registration in an official list from tenderers established in the country holding the official list. The difference between the estimated value and the maximum value is due to the uncertainty of the final value of the individual framework agreements. The estimated value thus reflects the contracting entity’s estimate of the expected purchase under the framework agreements, whereas the maximum value reflects the highest estimated value of all contracts to be performed within the term of the framework agreements. This takes into account, partly, the contracting entity’s expectations based on the most likely purchase under the framework agreement, partly, the expected uncertainty of such estimate. In relation to the estimated value, particular attention is drawn to the fact that the tenderers are not guaranteed any minimum purchase under the framework agreement, and the estimate therefore implies no commitment on the part of the contracting entity to make a minimum purchase under the framework agreement. Decisive for the estimated value of the framework agreement can be the unexpected complexity in the tests. It is specifically pointed out to the tenderer that the tenderer is bound by the prices offered, irrespective of the turnover specifically achieved under the framework agreement. This means that the tenderer is also bound by the prices offered if the specific turnover deviates from the estimated value, both upwards and downwards. The maximum quantity to be delivered under the framework agreement is DKK 39.911.255 exclusive VAT. The contracting entity may use the procedure of section 159(5) of the Danish Public Procurement Act in the event that tenders do not comply with the formal requirements of the tender documents. It should be noted that the indicated term of the contract will commence on signature of the framework agreement. An information meeting will be held Monday 8 September 2025, at 13.00-14.00 on MS teams. For practical reasons, operators interested in participating in the meeting are asked to sign up via the electronic tendering system not later than 1 days before the meeting with indication of name of business and names and e-mails of the participants. The contracting entity will draw up brief minutes of the information meeting which will be announced to all tenderers participating in the tender procedure via the electronic tendering system.

Legal basis :

Directive 2014/24/EU

The Danish Public Procurement Act - The tender procedure is covered by the Danish Public Procurement Act (Act No. 1564 of 15 December 2015 as amended), which implements the Public Procurement Directive (Directive 2014/24/EU).

5.1.

Lot : LOT-0000

Title : Framework agreement on the delivery of purple teaming tests

Description : This procurement seeks to enter into framework agreements with 3 Suppliers, that are experts within the field of purple teaming testing. Any Statement of Work will be awarded suite of a subsequent re-opening of the competition. The purple teaming test (PTT) shall be conducted on Danmarks Nationalbank. The purpose of the purple teaming test is to enhance the Customer’s cybersecurity posture by integrating offensive and defensive security teams to simulate real-world attack scenarios and improve detection and response capabilities. The test shall be conducted as a cooperation between the offensive red team provided by the supplier and the defensive blue team. The test shall assess how well the Customer is equipped to protect against, detect, respond to and potentially recover from cyber-attacks from threat actors with realistically advanced capabilities and modus operandi. The test shall to the farthest possible extent mimic relevant real actors’ capabilities towards the defensive capabilities at the Customers disposal. The framework agreement will be awarded to three (3) suppliers.

Internal identifier : TS 231059

5.1.1.

Purpose

Main nature of the contract : Services

Main classification ( cpv ): 72600000 Computer support and consultancy services

Additional classification ( cpv ): 72500000 Computer-related services

5.1.2.

Place of performance

Postal address : Langlinie Allé 47

Town : Copenhagen Ø

Postcode : 2100

Country subdivision (NUTS) : Byen København ( DK011 )

Country : Denmark

5.1.3.

Estimated duration

Duration : 48 Months

5.1.5.

Value

Estimated value excluding VAT : 31 550 400,00 DKK

Maximum value of the framework agreement : 3 991 125,00 DKK

5.1.6.

General information

Procurement Project not financed with EU Funds.

The procurement is covered by the Government Procurement Agreement (GPA) : yes

Additional information : Participation in the tender procedure may only take place by electronic means via the electronic tendering system used by the contracting entity. For access to the procurement documents, the candidate must be registered or register as a user. If the application contains several versions of the same document, the latest uploaded version will apply. All communication in connection with the tender procedure, including questions and answers, must take place through the electronic tendering system. Reference is made to the tender specifications and appendix B for information concerning questions and answers. Interested operators are requested to keep updated via the electronic tendering system. If the candidate encounters problems with the system, please contact support by e-mail, dksupport@eu-sup ply.com, or telephone (+45) 70 20 80 14. As its application, the candidate must submit an ESPD as preliminary documentation of the circumstances set out in section 148(1), paras (1)-(3) of the Danish Public Procurement Act (udbudsloven) and section 137(1) para (1) and para (3) and para (4) and para (5) of the Danish Public Procurement Act. It is not necessary for the candidate to sign the ESPD document. For groups of operators (e.g. a consortium), a separate ESPD must be submitted for each participating operator. Where the candidate is a group of operators, the ESPD document of each participant in the group must be signed by the participant in question. The candidate heading the group and submitting the application is not required to sign its ESPD document. If the candidate relies on the capacities of other entities, an ESPD must be submitted for and signed by each of the entities on which it relies. Before the award decision is made, the tenderer to whom the contracting entity intends to award the contract must provide documentation of the information submitted in the ESPD pursuant to sections 151-152, cf. section 153 of the Danish Public Procurement Act. As an alternative to the documentation mentioned in sections 153-155, 157 and 158 of the Danish Public Procurement Act, the applicant and tenderer may submit to the contracting entity a certificate of registration in an official list of approved economic operators, see section 156 of the Danish Public Procurement Act, issued by the competent authority. The contracting entity only accepts certificates of registration in an official list from applicants and tenderers established in the country holding the official list. The contracting entity will select the number of candidates by applying the selection criteria stated in this contract notice, unless the contracting entity receives no more than the stated number of compliant requests for participation. Section 134a of the Danish Public Procurement Act shall apply to this tender procedure. Participation in the tender procedure may only take place by electronic means via the electronic tendering system used by the contracting entity. For access to the tender documents, the tenderer must be registered or register as a user. If the tender contains several versions of the same document, the latest uploaded version will apply. All communication in connection with the tender procedure, including questions and answers, must take place through the electronic tendering system. Reference is made to the tender specifications and appendix B for information concerning questions and answers. Interested operators are requested to keep updated via the electronic tendering system. If the tenderer encounters problems with the system, please contact support by e-mail, dksupport@eu-supply.com, or telephone (+45) 70 20 80 14. The tenderer must submit an ESPD with the tender as preliminary documentation of the circumstances set out in section 148(1), paras (1)-(3) of the Danish Public Procurement Act (udbudsloven). It is not necessary for the tenderer to sign the ESPD document. For groups of operators (e.g., a consortium), a separate ESPD must be submitted for each participating operator. Where the tenderer is a group of operators, the ESPD document of each participant in the group must be signed by the participant in question. The tenderer heading the group and submitting the tender is not required to sign its ESPD document. If the tenderer relies on the capacities of other entities, an ESPD must be submitted for and signed by each of the entities on which the tenderer relies. It should be noted that each candidate may only submit one application for prequalification. Before the award decision is made, the tenderer to whom the contracting entity intends to award the contract must provide documentation of the information submitted in the ESPD pursuant to sections 151-152, cf. section 153 of the Danish Public Procurement Act. As an alternative to the documentation mentioned in sections 153-155, 157 and 158 of the Danish Public Procurement Act, the tenderer may submit to the contracting entity a certificate of registration in an official list of approved economic operators, see section 156 of the Danish Public Procurement Act, issued by the competent authority. The contracting entity only accepts certificates of registration in an official list from tenderers established in the country holding the official list. The difference between the estimated value and the maximum value is due to the uncertainty of the final value of the individual framework agreements. The estimated value thus reflects the contracting entity’s estimate of the expected purchase under the framework agreements, whereas the maximum value reflects the highest estimated value of all contracts to be performed within the term of the framework agreements. This takes into account, partly, the contracting entity’s expectations based on the most likely purchase under the framework agreement, partly, the expected uncertainty of such estimate. In relation to the estimated value, particular attention is drawn to the fact that the tenderers are not guaranteed any minimum purchase under the framework agreement, and the estimate therefore implies no commitment on the part of the contracting entity to make a minimum purchase under the framework agreement. Decisive for the estimated value of the framework agreement can be the unexpected complexity in the tests. It is specifically pointed out to the tenderer that the tenderer is bound by the prices offered, irrespective of the turnover specifically achieved under the framework agreement. This means that the tenderer is also bound by the prices offered if the specific turnover deviates from the estimated value, both upwards and downwards. The maximum quantity to be delivered under the framework agreement is DKK 39.911.255 exclusive VAT. The contracting entity may use the procedure of section 159(5) of the Danish Public Procurement Act in the event that tenders do not comply with the formal requirements of the tender documents. It should be noted that the indicated term of the contract will commence on signature of the framework agreement. An information meeting will be held Monday 8 September 2025, at 13.00-14.00 on MS teams. For practical reasons, operators interested in participating in the meeting are asked to sign up via the electronic tendering system not later than 1 days before the meeting with indication of name of business and names and e-mails of the participants. The contracting entity will draw up brief minutes of the information meeting which will be announced to all tenderers participating in the tender procedure via the electronic tendering system.

5.1.10.

Award criteria

Criterion :

Type: Price

Name : Price

Description : We refer to the tender specifications, Appendix A.

Category of award weight criterion: Weight (percentage, exact)

Award criterion number : 30,00

Criterion :

Type: Quality

Name : Competences

Description : We refer to the tender specifications, Appendix A.

Category of award weight criterion: Weight (percentage, exact)

Award criterion number : 25,00

Criterion :

Type: Quality

Name : Methodology and work modalities

Description : We refer to the tender specifications, Appendix A.

Category of award weight criterion: Weight (percentage, exact)

Award criterion number : 25,00

Criterion :

Type: Quality

Name : Risk management and information security

Description : We refer to the tender specifications, Appendix A.

Category of award weight criterion: Weight (percentage, exact)

Award criterion number : 20,00

5.1.15.

Techniques

Framework agreement :

Framework agreement, with reopening of competition

Information about the dynamic purchasing system :

No dynamic purchase system

Electronic auction : no

5.1.16.

Further information, mediation and review

Review organisation : Klagenævnet for Udbud

Information about review deadlines : Pursuant to the Danish Act on the Complaints Board for Public Procurement, etc. (lov om Klagenævnet for Udbud m.v.) (the Act is available (in Danish) at ww.retsinformation.dk), the following deadlines apply to the lodging of complaints: Complaints of not having been selected must be submitted to the Danish Complaints Board for Public Procurement before the expiry of 20 calendar days, see section 7(1) of the Act, from the day after submission of notification to the candidates concerned of the identity of the successful tenderer where the notification is accompanied by an explanation of the grounds for the decision in accordance with section 2(1), para (1) of the Act and section 171(2) of the Danish Public Procurement Act. In other situations, complaints of award procedures, see section 7(2) of the Act, must be lodged with the Danish Complaints Board for Public Procurement before the expiry of: 1) 45 calendar days after the contracting entity has published a notice in the Official Journal of the European Union that the contracting entity has entered into a contract. The deadline is calculated from the day after the day when the notice was published. 2) 30 calendar days calculated from the day after the day when the contracting entity has notified the candidates concerned that a contract based on a framework agreement with reopening of competition or a dynamic purchasing system has been entered into if the notification has included an explanation of the relevant grounds for the decision. 3) 6 months after the contracting entity entered into a framework agreement calculated from the day after the day when the contracting entity notified the candidates and tenderers concerned, see section 2(2) of the Act and section 171(4) of the Danish Public Procurement Act. 4) 20 calendar days calculated from the day after the contracting entity has submitted notification of its decision, see section 185(2) of the Danish Public Procurement Act. Not later than at the time of lodging a complaint with the Danish Complaints Board for Public Procurement, the complainant must notify the contracting entity in writing that a complaint has been lodged with the Danish Complaints Board for Public Procurement and whether the complaint was lodged during the standstill period, see section 6(4) of the Act. In cases where the complaint was not lodged within the standstill period, the complainant must furthermore indicate whether a suspensory effect of the complaint has been requested, see section 12(1) of the Act. The e-mail address of the Complaints Board for Public Procurement is klfu@naevneneshus.dk. The Complaints Board’s own complaints procedure is available at https://naevneneshus.dk/startdin-klage/klagenaevnet-for-udbud/vejledning/.

Organisation providing additional information about the procurement procedure : Danmarks Nationalbank

Organisation providing offline access to the procurement documents : Danmarks Nationalbank

Organisation providing more information on the review procedures : Konkurrence- og Forbrugerstyrelsen

Organisation signing the contract : Danmarks Nationalbank

Maximum value of the framework agreements in this notice : 31 550 400,00 DKK

Approximate value of the framework agreements : 31 550 400,00 DKK

6.1.

Result lot identifier : LOT-0000

Winner selection status : At least one winner was chosen.

Framework agreement :

Maximum value of the framework agreement : 39 911 255,00 DKK

Re-estimated value of the framework agreement : 31 550 400,00 DKK

6.1.2.

Information about winners

Winner :

Official name : mnemonic as

Tender :

Tender identifier : Framework agreement on the delivery of purple teaming tests - mnemonic as

Identifier of lot or group of lots : LOT-0000

The tender was ranked : no

The tender is a variant : no

Subcontracting : No

Contract information :

Identifier of the contract : Framework agreement on the delivery of purple teaming tests - mnemonic as

Date of the conclusion of the contract : 03/02/2026

Information about European Union funds :

Organisation signing the contract : Danmarks Nationalbank

Winner :

Official name : Dionach

Tender :

Tender identifier : Framework agreement on the delivery of purple teaming tests - Dionach

Identifier of lot or group of lots : LOT-0000

The tender was ranked : no

The tender is a variant : no

Subcontracting : No

Contract information :

Identifier of the contract : Framework agreement on the delivery of purple teaming tests - Dionach

Date of the conclusion of the contract : 03/02/2026

Information about European Union funds :

Organisation signing the contract : Danmarks Nationalbank

Winner :

Official name : Reversec Denmark A/S

Tender :

Tender identifier : Framework agreement on the delivery of purple teaming tests - Reversec Denmark A/S

Identifier of lot or group of lots : LOT-0000

The tender was ranked : no

The tender is a variant : no

Subcontracting : No

Contract information :

Identifier of the contract : Framework agreement on the delivery of purple teaming tests - Reversec Denmark A/S

Date of the conclusion of the contract : 03/02/2026

Information about European Union funds :

Organisation signing the contract : Danmarks Nationalbank

6.1.4.

Statistical information

Summary of the review requests the buyer received :

Number of complainants : 0

Received tenders or requests to participate :

Type of received submissions : Requests to participate

Number of tenders or requests to participate received : 18

Type of received submissions : Tenders

Number of tenders or requests to participate received : 4

8.1.

ORG-0001

Official name : Danmarks Nationalbank

Registration number : 61092919

Department : Danmarks Nationalbank

Postal address : Langelinie Allé 47

Town : København Ø

Postcode : 2100

Country subdivision (NUTS) : Byen København ( DK011 )

Country : Denmark

Contact point : Astrid Jepsen

Email : amje@nationalbanken.dk

Telephone : +45 33636035

Buyer profile : https://eu.eu-supply.com/ctm/company/companyinformation/index/281426

Roles of this organisation :

Buyer

Organisation providing additional information about the procurement procedure

Organisation providing offline access to the procurement documents

Organisation signing the contract

8.1.

ORG-0002

Official name : Klagenævnet for Udbud

Registration number : 37795526

Postal address : Nævnenes Hus, Toldboden 2

Town : Viborg

Postcode : 8800

Country subdivision (NUTS) : Vestjylland ( DK041 )

Country : Denmark

Email : klfu@naevneneshus.dk

Telephone : +45 72405600

Internet address : https://klfu.naevneneshus.dk/

Roles of this organisation :

Review organisation

8.1.

ORG-0003

Official name : Konkurrence- og Forbrugerstyrelsen

Registration number : 10294819

Postal address : Carl Jacobsens Vej 35

Town : Valby

Postcode : 2500

Country subdivision (NUTS) : Nordsjælland ( DK013 )

Country : Denmark

Email : kfst@kfst.dk

Telephone : +45 41715000

Internet address : http://www.kfst.dk

Roles of this organisation :

Organisation providing more information on the review procedures

8.1.

ORG-0004

Official name : mnemonic as

Size of the economic operator : Micro, small, or medium

Registration number : 982089549

Postal address : Henrik Ibsens gate 100

Town : OSLO

Postcode : 0255

Country subdivision (NUTS) : Innlandet ( NO020 )

Country : Norway

Email : karema@mnemonic.no

Telephone : +47 97060616

Roles of this organisation :

Tenderer

Winner of these lots : LOT-0000

8.1.

ORG-0005

Official name : Dionach

Size of the economic operator : Micro, small, or medium

Registration number : 03908168

Postal address : Unipart House, Garsington Road Cowley

Town : Oxford

Postcode : OX4 2PG

Country : United Kingdom

Email : tenders@dionach.com

Telephone : +44 1865877830

Roles of this organisation :

Tenderer

Winner of these lots : LOT-0000

8.1.

ORG-0006

Official name : Reversec Denmark A/S

Size of the economic operator : Micro, small, or medium

Registration number : 32559409

Postal address : Holmbladsgade 133 (5th floor)

Town : Copenhagen

Postcode : 2300

Country subdivision (NUTS) : Byen København ( DK011 )

Country : Denmark

Email : martin.naumann@reversec.com

Telephone : +45 60683830

Roles of this organisation :

Tenderer

Winner of these lots : LOT-0000

8.1.

ORG-0007

Official name : Mercell Holding ASA

Registration number : 980921565

Postal address : Askekroken 11

Town : Oslo

Postcode : 0277

Country subdivision (NUTS) : Oslo ( NO081 )

Country : Norway

Contact point : eSender

Email : publication@mercell.com

Telephone : +47 21018800

Fax : +47 21018801

Internet address : http://mercell.com/

Roles of this organisation :

TED eSender

Notice identifier/version : a84284bc-51f1-4d30-aba8-0114c502711b - 01

Form type : Result

Notice type : Contract or concession award notice – standard regime

Notice subtype : 29

Notice dispatch date : 20/02/2026 09:49:31 (UTC+00:00) Western European Time, GMT

Notice dispatch date (eSender) : 20/02/2026 11:01:12 (UTC+00:00) Western European Time, GMT

Languages in which this notice is officially available : English

Notice publication number : 124558-2026

OJ S issue number : 37/2026

Publication date : 23/02/2026

Fakta om udbudet

Framework agreement on the delivery of purple teaming tests

Danmarks Nationalbank