France – IT services: consulting, software development, Internet and support – Fourniture d’une plateforme d’intermédiation d’experts indépendants pour des prestations de prime aux bogues (Bug Bounty) et programme de divulgation des vulnérabilités (Vulnerability Disclosure Program)

This consultation concerns the supply of an intermediary platform, in SaaS mode, to connect La Poste with a community of independent cybersecurity experts for bug bounty (Bug Bounty) services and vulnerability disclosure programs (Vulnerability Disclosure Program). This service is for the internal use of La Poste's Service de Lutte contre la Cybercriminalité (SLCC). The SLCC is La Poste's CERT (Computer Emergency Response Team) and carries out the following activities:

- Threat analysis and handling

- Security incident detection

- Security advice and testing

The SLCC manages Bug Bounty operations to secure La Poste's and its subsidiaries' applications exposed on the Internet. The intermediary platform between La Poste and independent cybersecurity experts must enable Bug Bounty campaigns and the implementation of Vulnerability Disclosure Programs (VDP) aimed at identifying vulnerabilities in La Poste's applications, services, and information systems, in a secure and controlled framework. Bug Bounty campaigns aim to identify vulnerabilities. The "Vulnerability Disclosure Program (VDP)" aims to collect spontaneous vulnerability reports, including outside of any specific campaign. Independent cybersecurity experts will be remunerated by La Poste via the SaaS platform according to the criticality of the identified vulnerabilities. The services also include the animation of the community of independent cybersecurity experts, the support of La Poste in defining its needs, and the management of campaigns. The consultation consists of a single lot. The geographical scope of the global market is the entire French territory.