Preliminary Market Engagement – Third-Party Risk Management (TPRM) Platform

Scope as published

Development Bank of Wales is undertaking a Preliminary Market Engagement exercise to better understand the market for Third-Party Risk Management (TPRM) platforms. The purpose of this exercise is to engage with potential suppliers and gather information on available solutions, functionality, delivery and implementation approaches, integration capabilities and indicative commercial models. Development Bank of Wales is particularly interested in understanding the capabilities of solutions across third-party risk management and monitoring, including how platforms differentiate themselves from solutions focused primarily on cyber-risk monitoring. Suppliers are invited to provide information regarding their proposed solution and to indicate whether relevant functionality is available as standard, through configuration, integration or customisation, or is included within the supplier's product roadmap. Suppliers should also identify any relevant dependencies, limitations, additional modules, third-party data sources and associated costs. This Preliminary Market Engagement exercise is being undertaken to inform Development Bank of Wales' understanding of the market and its consideration of potential future requirements and procurement options. Participation in this exercise does not constitute a formal tender process and does not guarantee that a subsequent procurement exercise will be undertaken. Any future procurement opportunity will be advertised separately in accordance with the applicable procurement requirements. Suppliers wishing to participate should access the Preliminary Market Engagement exercise through the eTenderWales eTendering Portal and submit their response in accordance with the instructions provided. PQQ_33940 - Preliminary Market Engagement – Third-Party Risk Management (TPRM) Platform Deadline for responses: 10:00 on 26 November 2026. Background and purpose Development Bank of Wales (DBW) is seeking to understand the market for Third-Party Risk Management (TPRM) platforms. The primary driver is the planned replacement of DBW’s existing third-party cyber risk monitoring capability. Rather than undertake a like-for-like replacement, DBW wishes to explore whether a broader TPRM platform could provide additional value across Information Security, Risk, Compliance, Procurement and Operational Resilience. This market evaluation is intended to: • Understand current market capabilities and solution approaches. • Assess platform maturity, functionality and delivery models. • Identify which capabilities are included as standard and which require additional modules or services. • Inform budget planning and the development of a future procurement specification. Target outcomes • Improved visibility of third-party risk. • A proportionate, risk-based approach to supplier oversight. • Reduced duplication of assurance activity across DBW functions. • Centralised, auditable reporting and evidence. • Better collaboration between Security, Risk, Compliance and Procurement. • Actionable supplier risk intelligence and remediation tracking. Capability areas Third-Party Cyber Risk Intelligence MANDATORY - DBW requires an effective replacement for its existing third-party cyber risk monitoring capability. • Continuous monitoring of supplier external attack surfaces and internet-facing assets. • Discovery and transparent attribution of supplier-owned assets. • Identification of vulnerabilities, misconfigurations and exposed services. • Monitoring of publicly disclosed breaches, leaked data and credential exposure. • Supplier cyber risk ratings, trends and material change notifications. • Evidence-based findings that distinguish confirmed and inferred risks. • Management of disputed findings, false positives and shared infrastructure noise. Supplier Due Diligence and Assessment DESIRABLE - DBW wishes to understand how platforms support proportionate supplier assurance. • Configurable questionnaires and assessment workflows. • Collection…

Classifications