Acuerdo Marco de homologación de proveedores para el servicio de asistencia técnica en el ámbito de la ciberseguridad mediante un acuerdo marco para la Autoridad Portuaria de Tarragona.

The contract timeline is as follows:

Contract start date:

• For the Framework Agreement, the start date is the date of the homologation agreement, unless specified otherwise in the Specific Contractual Clauses (CCP).
• For based contracts, the start date is the award date, unless otherwise indicated in the CCP. If the contract begins with a start order, that will be the start date. If the start order is not issued within one month of the contract award, the contract's duration commences at that point.

Total duration:

• The initial duration is 12 months.
• There is a provision for up to 3 extensions, each lasting 12 months.
• The maximum duration of the contract is 48 months (12 months initial duration plus three 12-month extensions).
• Service contracts, including any extensions, have a maximum duration of five years.
• The estimated contract value is distributed over the years 2026 to 2029, suggesting a four-year period.

Key milestones or phases:

• Preparatory phase: This phase occurs before the service begins, during which the approved company teams must acquire necessary knowledge about the systems, processes, tools, and the functioning of the Port Authority of Tarragona (APT).
• Regular service phase: During this phase, the standard service tasks outlined in the specifications will be carried out, and service levels become contractual.
• Service return phase: The objective of this phase is to transfer service responsibility back to the APT or its designated party.
• Guarantee period: A 12-month guarantee period is established, which is separate from the contract's duration.

The core scope of work for this tender primarily involves supporting the Information Systems Department of the APT in defining, developing, implementing, and promoting its Cybersecurity Management System, along with deploying cybersecurity controls and measures.

The Statement of Work summary includes activities such as:

• Consulting, implementation, and support for cybersecurity solutions and necessary tools to maintain, improve, evolve, develop, or implement new solutions.
• Project Management, covering aspects like time, scope, actors, quality, risks, resources, and communication management.
• Cybersecurity Regulatory and Governance Consulting, which entails developing strategic security plans, drafting security policies and procedures, creating cybersecurity training and awareness plans, elaborating business continuity plans, and ensuring compliance with security regulations through gap analysis, action plans, and audit preparation.
• GRC Consulting (Governance, Risks, and Compliance), providing support in verifying regulatory compliance, conducting risk analyses, deploying organizational security policies, and delivering cybersecurity training and dissemination.
• Cybersecurity Architecture.
• Digital Surveillance and Fraud Service to investigate, track, and collect online information (including from the Deep and Dark Web) to identify malicious activities affecting the APT, offered 12x5 (8:00 to 20:00).
• Advanced Analytics with AI Service, covering data collection and processing, predictive analysis, pattern and anomaly detection, process optimization, data visualization, reporting, data-driven decision making, scalability, and adaptability.
• Works related to Critical Infrastructure Protection, including reviewing and updating information security procedures and policies, supporting mandatory security exercises and simulations, developing training and awareness plans, and conducting periodic risk analyses.

All generated documentation will be the exclusive property of the APT, and services are to be delivered following methodological frameworks such as ISO 9001, ISO 27001, ITIL, and ENS. The work is considered complete upon finalization of all tasks, validation by the APT, resolution of security issues, technical testing, and verification of all resulting products.