Auditing services for eIDAS Regulation Services

BACKGROUND INFORMATION The Digital and Population Data Services Agency (Digi- ja väestötietovirasto, later DVV) promotes the digitalization of society, secures the availability of data, and provides services for the life events of its customers. DVV employs approximately 900 professionals and serves its customers in over 30 offices throughout Finland. DVV leads the way, reforms society, and supports citizens in their interaction with public administration. DVV’s aim is to further promote the smooth functioning of Finnish society. Digitalization is one important way to achieve this. SCOPE AND OBJECT OF THE PROCUREMENT The scope and object of this procurement are Auditing services for Trust Services, Identification Means Services and the eIDAS Node for international transactions according to the Regulation (EU) No 910/2014 This procurement is divided into three (3) lots. The objective of this procurement in more detailed level are Auditing Services for the Trust and Identification Services, including the Node for international transactions according to the Regulation (EU) No 910/2014. Identification means of DVV are issued on LoA 3 ”High”. It is possible that DVV will issue services on LoA 2, “Substantial”. The digital signature meets the requirement of articles 28 and 29 of the Regulation 910/2014. DVV issues also other types of Qualified Trust Services, for example Time Stamp, Validation Services for Digital Signatures and Electronic Seal. Trust Services are audited once a year. This procurement also includes the Services according to the REGULATION (EU) 2024/1183 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 11 April 2024 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework. The Regulation 2024/1183 has entered into force in May 2024 and the Technical Specifications are drafted in six months from the entering into force. The Regulation states requirements for digital wallet in 2026 at the latest, and other digital services. Citizens will also be able to manage their own data in digital and personal services. Using the digital wallet, it is possible to authenticate and sign a transaction digitally. Trust Services are in accordance with the eIDAS Regulation 910/2014, Chapter III, Trust Services, and the Annexes to that; and the Regulation 2024/1183, including e.g. the issuance and validation of the issuance of electronic attestations of attributes. Requirements of the Identification Means Services are in accordance with the eIDAS Regulation, Chapter II, Electronic Identification, and the Implementing regulations to Regulation 910/2014 and the Regulation 2024/1183, including e.g. the Digital EUDI-Wallet. Requirements of the Node Service are in accordance of the eIDAS Regulation, Chapter II, Electronic Identification, and the Implementing regulation to Regulation 910/2014, Articles 6-12. The scope of the procurement is further defined in the annexes of this call for tenders, especially in annex 1 'Description of the procurement object'. CONTRACT PERIOD The Agreement enters into force once it has been signed by both Contracting Parties and remains in force for the initial fixed period of 2 years (audits for years 2025-2026). After this fixed period, DVV as the Customer has the right to prolong the Agreement for two (2) additional years.