Request for information - eIDAS Regulation Trust Services and Identification Means Auditing Services

BACKGROUND INFORMATION The Digital and Population Data Services Agency (Digi- ja väestötietovirasto, later DVV) promotes the digitalization of society, secures the availability of data, and provides services for the life events of its customers. DVV employs approximately 1,000 professionals and serves its customers in 36 offices throughout Finland. DVV leads the way, reforms society, and supports citizens in their interaction with public administration. DVV’s aim is to further promote the smooth functioning of Finnish society. Digitalization is one important way to achieve this. This notice is a Request for information (RFI) for eIDAS Regulation 910/2014 Trust Services and Identification Means (including eIDAS Node) Auditing Services. With this Auditing Service RFI DVV is seeking information on suppliers interested in delivering the services described. DVV is planning to lauch a procurement procedure in Autumn 2024 of the above-mentioned Auditing Services. Auditing in 2025 and the following years will take place according to the new contract with the selected Auditing Services Provider. The objective of this Request are the Trust and Identification Services, including the Node for international transactions according to the Regulation (EU) No 910/2014. It is also possible to limit the Offer to Trust or Identity Services in the Autumn 2024 published procurement procedure. Identification means of DVV are issued on LoA 3 ”High”. It is possible that DVV will issue services on LoA 2, “Substantial”. The digital signature meets the requirement of articles 28 and 29 (QC and QSCD) of the Regulation 910/2014. DVV issues also other types of Qualified Trust Services, for example Time Stamp, Validation Services for Digital Signatures and Electronic Seal. Trust Services are audited once a year. This Request for information includes also the Services according to the REGULATION (EU) 2024/1183 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 11 April 2024 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework. The Regulation 2024/1183 has entered into force in May 2024 and the Technical Specifications are drafted in six months from the entering into force. The Regulation states requirements for digital wallet in 2026 at the latest, and other digital services. Citizens will also be able to manage their own data in digital and personal services. Using the digital wallet, it is possible to authenticate and sign a transaction digitally.

NOTE This is NOT a prior information notice, a procurement notice, a contract notice nor an invitation to tender. This notification and/or answering to it do not create any obligations for DVV or for those who choose to answer to it. DVV does not pay any compensation for taking part in answering to this RFI for eIDAS Regulation 910/2014 Trust Services and Identification Means Auditing Services. The information provided by DVV is preliminary at this point and it is subject to change. Taking or not taking part in this RFI-process for eIDAS Regulation 910/2014 Trust Services and Identification Means Auditing Services does not change the standing or status of a supplier in the eventual procurement process. INSTRUCTIONS ON HOW TO RESPOND TO THIS EIDAS REGULATION 910/2014 TRUST SERVICES AND IDENTIFICATION MEANS AUDITING SERVICES DIALOGUE PROCESS Please, respond to this request for information by 16.15 on 15th September 2024. Responses and their appendices should be sent by email to hankinnat@dvv.fi, and the responses should be titled as ‘Response to the RFI, eIDAS Regulation Trust Services and Identification Means Auditing Services, [Company name]’ In the response, please provide the following information and answers: 1. Brief company presentation, contact person(s) for the information request and an overview of your auditing services suitable for the needs described in the background information of the procurement object. 2. List of performed auditions in past five years corresponding to the procurement object in production (especially public administration organisations, if available). 3. What kind of eIDAS Auditing Services (Trust /identification Services/Both) the company can provide and what kind of accreditations the company have in order to provide eIDAS Services? Does it affect the content and operating model of the service how the accrediting scheme is established? 4. The general pricing model of the service offered, and estimates of workloads and resources needed for providing the services. 5. If there is not an accredited auditing scheme in Finland at the moment, what is the estimated timeline for getting such accreditation to be able to participate in the procurement? Is there any specified action required in order to get the accreditation status? 6. Does your company have the possibility to provide services in Finnish and / or Swedish? 7. General descriptions of the data protection and information security matters of the service (the tendering process is implemented, e.g. processing data is only permitted in the EU/EEA area) 8. Is your company familiar with the Finnish Identity Trust Network Scheme? Have you carried out audit concerning Finnish Identification and Trust Services? Information can be found: https://www.kyberturvallisuuskeskus.fi/en/our-activities/regulation-and-supervision/electronic-signatures-and-other-eidas-services 9. Is your company interested in participating in a common work-shop for questions in September 2024, if organised. PROCESSING OF INFORMATION REQUEST RESPONSES AND POSSIBLE PROCUREMENT PROGRESS The responses to the request for information will be treated as confidential and they will only be used in the preparation of the future tendering process. DVV also reserves the right to request additions to the responses received and to conduct more detailed discussions with market operators based on the responses. The aim is to make the final decisions on the implementation and method of the procurement in late 2024 so that when the tendering process is implemented, cooperation with the service provider(s) would begin in 2025. Privacy statement for the procurement of the Digital and Population Data Services Agency: https://dvv.fi/en/privacy-statement-for-the-procurement