Delivery governance
Roles, cadence, decisions, dependencies, commercial view and change control made explicit.
- Responsibility matrix
- Decision and change logs
- Risk and dependency view
- Progress and forecast
- Escalation path
Procurement
Procurement information for software services.
This page describes our approach to delivery governance, security, accessibility, quality, continuity and contracting. Assignment-specific requirements are confirmed in the tender response and contract.
Evaluation areas
Common requirements in software procurement.
The final response follows the buyer’s invitation to tender, evaluation criteria, contract terms and governance model.
Security & data protection
Security requirements are defined with the solution and verified against its risks, data and operating context.
- Secure development lifecycle
- Access and identity controls
- Dependency and vulnerability management
- Logging and incident handling
- Data flows, locations and backups
Accessibility & usability
Legal baseline and target level are agreed early, then followed through design, code, content and acceptance.
- Requirements and user journeys
- Keyboard and focus behaviour
- Automated and manual checks
- Assistive-technology testing
- Findings, fixes and evidence
Quality assurance & testing
Acceptance criteria, testing levels and release gates create traceability from requirement to result.
- Quality and test strategy
- Code review and automation
- Integration and performance testing
- Security verification
- Acceptance and release record
Architecture & interoperability
Interfaces, data flows and system dependencies are documented for implementation, testing and maintenance.
- Current and target architecture
- APIs and integration contracts
- Identity and authorisation
- Non-functional requirements
- Portability and vendor dependencies
Data, AI & automation governance
AI-enabled solutions need a defined purpose, data view, human oversight, logging, testing and known limits.
- Intended use and boundaries
- Data provenance and quality
- Human oversight
- Evaluation and monitoring
- Risk and transparency record
Continuity, support & exit
Support and maintenance are defined per service, including ownership, response targets and controlled supplier transition.
- Service model and hours
- Monitoring and incident flow
- Backup and recovery targets
- Documentation and knowledge transfer
- Data export and exit support
Sustainability & lifecycle cost
Responsible choices are connected to maintainability, efficient use of infrastructure and a longer useful service life.
- Right-sized architecture
- Efficient software and data flows
- Maintainability measures
- Lifecycle cost visibility
- Measurable procurement-specific targets
Contracting & commercial terms
The commercial model, applicable terms, acceptance, responsibilities and service boundaries are agreed per engagement.
- Scope and assumptions
- Pricing and invoicing model
- IP and usage rights
- DPA and security annex
- SLA, acceptance and exit terms
Delivery team & competence
Named experts are proposed only against a confirmed scope, with clear roles, availability and assignment-relevant evidence.
- Named roles and CVs
- Core competence and languages
- Relevant assignments
- Availability and substitution
- Responsibility and collaboration model
Security supplier view
Ten security areas used in supplier assessment.
Controls are defined against the system’s risks, data and operating environment. The structure follows the supplier questions published by Finland’s National Cyber Security Centre.
Open the official Traficom guidance- 01Security governance
- 02Secure software development
- 03Updates & lifecycle
- 04Security & quality testing
- 05Dependencies, SBOM & supply chain
- 06Vulnerability management
- 07Identity & access
- 08Logging & monitoring
- 09Data protection & backups
- 10Compliance evidence
Tender evidence
Tender evidence organised by evaluation criterion.
Evidence is provided against the criteria and format of each procurement.
Evaluation areaResponse structureDelivery connection
SupplierVerified legal and commercial factsContract and invoicing baseline
PeopleNamed roles, CVs, competence and availabilityResponsibility and capacity plan
SolutionArchitecture, integrations and requirementsBacklog, decisions and technical baseline
QualityTest model, acceptance and release controlsTraceable verification evidence
SecurityControls, data, subcontractors and incidentsRisk treatment and operational evidence
TransitionDocumentation, training, recovery and exitService readiness and controlled handover
Finnish public ICT context
Applicable terms are agreed for each contract.
The contract identifies the applicable JIT 2025 terms, buyer-specific conditions, security and data-processing annexes, service levels, acceptance and transition requirements.
Read the official JIT 2025 publicationTeam structure
Typical delivery roles
The exact team, named experts and availability are confirmed for each procurement.
01Delivery leadership
02Software engineering
03Architecture & cloud
04UX & accessibility
05Data & AI
06Quality & security
07Support & operations
Market dialogue or active procurement
Send us the requirement set.
We will review the scope, evaluation criteria, risks and proposed delivery model.