Preliminary Market Engagement – Third-Party Risk Management (TPRM) Platform

Development Bank of Wales is undertaking a Preliminary Market Engagement exercise to better understand the market for Third-Party Risk Management (TPRM) platforms. The purpose of this exercise is to engage with potential suppliers and gather information on available solutions, functionality, delivery and implementation approaches, integration capabilities and indicative commercial models. Development Bank of Wales is particularly interested in understanding the capabilities of solutions across third-party risk management and monitoring, including how platforms differentiate themselves from solutions focused primarily on cyber-risk monitoring. Suppliers are invited to provide information regarding their proposed solution and to indicate whether relevant functionality is available as standard, through configuration, integration or customisation, or is included within the supplier's product roadmap. Suppliers should also identify any relevant dependencies, limitations, additional modules, third-party data sources and associated costs. This Preliminary Market Engagement exercise is being undertaken to inform Development Bank of Wales' understanding of the market and its consideration of potential future requirements and procurement options. Participation in this exercise does not constitute a formal tender process and does not guarantee that a subsequent procurement exercise will be undertaken. Any future procurement opportunity will be advertised separately in accordance with the applicable procurement requirements. Suppliers wishing to participate should access the Preliminary Market Engagement exercise through the eTenderWales eTendering Portal and submit their response in accordance with the instructions provided. PQQ_33940 - Preliminary Market Engagement – Third-Party Risk Management (TPRM) Platform Deadline for responses: 10:00 on 26 November 2026. Background and purpose Development Bank of Wales (DBW) is seeking to understand the market for Third-Party Risk Management (TPRM) platforms. The primary driver is the planned replacement of DBW’s existing third-party cyber risk monitoring capability. Rather than undertake a like-for-like replacement, DBW wishes to explore whether a broader TPRM platform could provide additional value across Information Security, Risk, Compliance, Procurement and Operational Resilience. This market evaluation is intended to: • Understand current market capabilities and solution approaches. • Assess platform maturity, functionality and delivery models. • Identify which capabilities are included as standard and which require additional modules or services. • Inform budget planning and the development of a future procurement specification. Target outcomes • Improved visibility of third-party risk. • A proportionate, risk-based approach to supplier oversight. • Reduced duplication of assurance activity across DBW functions. • Centralised, auditable reporting and evidence. • Better collaboration between Security, Risk, Compliance and Procurement. • Actionable supplier risk intelligence and remediation tracking. Capability areas Third-Party Cyber Risk Intelligence MANDATORY - DBW requires an effective replacement for its existing third-party cyber risk monitoring capability. • Continuous monitoring of supplier external attack surfaces and internet-facing assets. • Discovery and transparent attribution of supplier-owned assets. • Identification of vulnerabilities, misconfigurations and exposed services. • Monitoring of publicly disclosed breaches, leaked data and credential exposure. • Supplier cyber risk ratings, trends and material change notifications. • Evidence-based findings that distinguish confirmed and inferred risks. • Management of disputed findings, false positives and shared infrastructure noise. Supplier Due Diligence and Assessment DESIRABLE - DBW wishes to understand how platforms support proportionate supplier assurance. • Configurable questionnaires and assessment workflows. • Collection and retention of evidence, documents and attestations. • Assessment history, approvals, exceptions and accepted risks. • Scheduled and event-driven reassessments. • Secure supplier engagement and response management. Supplier Inventory and Tiering DESIRABLE - DBW wishes to understand how platforms enable risk-based supplier management. • Supplier inventory or integration with an authoritative supplier register. • Risk, criticality and business-impact tiering. • Identification of critical suppliers and links to important business services. • Differentiated monitoring, due diligence and reassessment by supplier tier. • Ability to reassess and reclassify suppliers when risk or criticality changes. Risk, Compliance and Operational Resilience MANDATORY - DBW requires cross-functional assurance, governance and auditability. • A common assurance view combining assessments, evidence, findings, decisions and actions. • Mapping to internal, regulatory and assurance frameworks. • Clear audit trails for assessments, approvals, exceptions and reassessments. • Identification of assurance gaps, stale evidence and incomplete information. • Support for regulatory compliance and financial crime as mandatory risk domains. • Support for operational resilience, data protection and other desirable domains where available. Workflow and Remediation MANDATORY - DBW requires clear accountability for supplier risk treatment. • Creation, assignment and tracking of findings, actions and remediation plans. • Configurable approvals, escalation routes, reminders and notifications. • Recording of accepted, mitigated, transferred or escalated supplier risks. • Reassessment or workflow activity following material changes in risk. • Supplier collaboration and secure exchange of remediation evidence where available. Reporting and Assurance MANDATORY - DBW requires reporting suitable for operational, executive, audit and assurance use. • Detailed findings, supporting evidence and supplier-level risk history. • Executive and portfolio reporting covering critical and high-risk suppliers. • Reporting of overdue reviews, expired evidence and outstanding actions. • Exportable assessment histories, audit trails and assurance evidence. • Data access suitable for DBW reporting and analytics platforms. Advanced and Future Capabilities DESIRABLE - DBW wishes to understand additional value available beyond the core requirement. • Fourth-party and wider supply-chain visibility. • Concentration risk analysis. • Financial health and credit-risk intelligence. • AI and emerging technology risk assessment. • Reputational risk monitoring and assessment. • Supplier sustainability information, evidence and reporting relevant to public-sector procurement. • Advanced analytics identifying connected or emerging supplier risks. Integrations and data portability Integrations are not assigned a single classification because necessity depends on the integration and the business outcome. Suppliers should describe native connectors, APIs, automated exports, licensing dependencies and implementation effort. Confidentiality, information governance and conflicts Suppliers should clearly identify information they consider genuinely commercially sensitive and explain the basis for that designation. DBW cannot guarantee that information marked confidential will be withheld where disclosure is required by law, including under applicable freedom of information, transparency or audit obligations. Suppliers should not include unnecessary personal data in their responses. Suppliers must disclose any actual or potential conflict of interest connected with this engagement, including any involvement in advising DBW on the requirement or procurement approach. DBW will assess and manage identified conflicts and any risk of unfair advantage in accordance with the Procurement Act 2023. DBW welcomes responses from small and medium-sized enterprises and other suppliers who can contribute relevant market insight. Suppliers may provide equivalent evidence, alternative delivery approaches or proportionate examples where these demonstrate the relevant capability. Nothing in this market engagement is intended to create an unnecessary barrier to participation.