Identity and Access Management -Solution (IAM) for VR Group / Invitation to participate

VR-Group Plc (hereinafter also "VR" or "contracting entity") is procuring a modern SaaS based IAM Solution. The procurement also includes implementation and support services (hereinafter “Solution”). The preliminary scope of the procurement is described in more detail in Annex 1 "Preliminary description of the procurement". More detailed information regarding the content and schedules of the negotiations will be provided to the selected tenderers. Functional and non-functional requirements as well as system and integration architecture requirements will be provided later during the procurement procedure. All requirements for the procurement, as well as the contract terms, will be defined during the procurement procedure. All final requirements will be presented in the final invitation to tender. VR is looking for a robust, scalable and Solution which is a single product or products from the same product family as well as supplier who will implement the Solution (including integrations and migrations) in the given target schedule and has expertise in similar implementation programs. Supplier provides solution continuous support. The scope of the procurement will cover all these aspects. The target of this procurement is that the new Solution will replace two current IAM systems. At the moment separate systems are used in Finland and in Sweden. Thus, the new Solution needs to cover operations in Finland, Sweden and be easily extended to other countries in the future, if necessary. This procurement will focus on IAM services for employees and VR’s partners. VR will renew the current VRIM IDM package and its related components with the Identity Governance and Administration (IGA) solution that is now being acquired. In addition, the selected Supplier must connect this new IGA solution to the parts of the services remaining to VR Group and implement it into a functional IAM entity. For the sake of clarity, it should be noted that VR Group has Access Management (AM) components in use and intends to continue using them in principle. In addition to the IGA solution, the procurement may also include [e.g. Access Management or Privileged Access Management (PAM)] modules as an option. VR expects the selected supplier to have proven expertise in implementing large scale IAM solutions for multinational organizations. The supplier should demonstrate experience with SaaS-based IAM implementations, including integrations with relevant enterprise systems. Additionally, the supplier should have the capability to provide ongoing support and system updates in compliance with European data protection regulations. VR Group consists of around 15 legal entities in Finland, Sweden and Latvia and has over 9100 employees. This procurement is made for all legal entities under VR Group, i.e. VR-Group Plc and all its group companies. At the commencement of the procurement procedure there are: • In Finland 12 relevant legal entities. In addition, there is also a maintenance company VR FleetCare. • In Sweden VR Sverige AB and VR Snabbtåg Sverige AB, and • In Latvia VR Services Latvia SIA The new Solution needs to cover operations in Finland, Sweden and be easily extended to other countries in the future, if necessary. In case new VR Group entities would be established, the procured solution must be possible to take into use in also such entities.

The fixed agreement period is four (4) years from the date of signing the agreement. After the fixed period the agreement shall remain valid until further notice. The Finnish Act on Procurements and Concession Contracts of Entities Operating in the Water and Energy Supply, Transport and Postal Services Sector 1398/2016 (later "Act on Procurement Contracts in the Utilities Sector") applies to the procurement. The procurement will be carried out by means of negotiated procedure. All requirements for the procurement, as well as the contract terms, will be defined during the procurement procedure. All final requirements will be presented in the final invitation to tender. This procurement is a joint procurement of VR-Group Plc and VR Snabbtåg Sverige AB as referred to in Article 57 point 4 of the Utilities Directive (25/2014/EU), section 32 subsection 3 of the Finnish Act on Procurement Contracts in the Utilities Sector (1398/2016) and chapter 7, sections 9, 12, 13 and 14 of the Swedish Act on Procurement in the Utilities Sectors (2016:1146). VR-Group Plc will conduct the procurement procedure on behalf of both VR-Group Plc and VR Snabbtåg Sverige AB. VR-Group Plc will be responsible for the entire procurement procedure including all stages of the procurement procedure and possible appeal and rectification procedures. All of these processes will be entirely conducted according to Finnish law according to applicable legislation. The Finnish Act on Procurement Contracts in the Utilities Sector (1398/2016) is applied to the procurement. For the avoidance of doubt, the procurement is made for all legal entities under VR Group, i.e. VR-Group Plc and all its group companies. VR-Group Plc and VR Snabbtåg Sverige AB have been mentioned specifically here due to procurement law reasons, but the procurement as such coverers all legal entities under VR Group as described also elsewhere in the procurement notice documents. A candidate must fulfil all suitability requirements set in the contract notice and its appendices in order to be qualified as a tenderer to the procurement procedure. Due to the need to manage the procurement process, the number of selected tenderers has been limited to three (3). Suitability requirements are presented in the ESPD form (European Single Procurement Document) attached to the contract notice. If more than three (3) requests to participate are received from candidates fulfilling the suitability requirements, the number of candidates will have to be reduced. In this case, VR will compare the references provided by the candidates to the extent that they exceed the minimum requirements set for the references and as described in section "Grounds for decision" in the invitation to participate and Annex 2 "Reference form". If there are three (3) or fewer candidates fulfilling the suitability requirements, references will not be scored and compared.