Dienstleistung eines Audits des Informationsverbundes HIL nach ISO 27001 auf Basis IT-Grundschutz

The contract timeline is as follows:

The contract has a duration of three years, commencing with the award of the contract. The total contract value is capped at 999,960.00 EUR. There is an option for the client to extend the contract by a maximum of 12 months if the specified volume has not been fully utilized by the end of the initial term.

The estimated start date for service provision is March 18, 2027, or immediately following the contract award, which is estimated to be March 5, 2027.

Key milestones and phases include:

• Regular audits are the subject of this contract, aiming for an ISO 27001 certification by 2028.
• An Audit-Universe is to be established initially.
• Following the establishment of the Audit-Universe, a base load of 50% of the assumed person-days (PT) per year is to be planned.
• Planning, with approval from the ISB (Information Security Officer), should be finalized in Q1 of each respective year, unless the contract award date dictates otherwise.
• A lead-time of a maximum of four weeks is essential for audit projects, from commissioning to the start of the review.
• Individual reviews are expected to not exceed 15 calendar days, including preliminary final recommendations.
• The estimated annual effort in person-days (PT) is 209 PT for each of the years 2027, 2028, and 2029.
• An additional buffer of 23 person-days is allocated across the entire contract duration for unforeseen issues.

The core scope of work for this tender involves providing an audit service for the HIL GmbH information network, based on ISO 27001 and IT-Grundschutz.

The primary objective is to prepare HIL for ISO 27001 certification based on BSI IT-Grundschutz by the year 2028. This includes identifying areas for improvement, evaluating partial security concepts for critical applications and hardware, and developing solution-oriented measures.

The Statement of Work summary and core deliverables include:

• Regular audits of the HIL GmbH information network, encompassing all applications, hardware, associated properties, and relevant processes.
• The audit methodology involves aligning the scope and controls with Annex A of ISO 27001, conducting document reviews, performing system audits (technical analysis and evaluation of application/hardware hardening), executing technical tests (such as pentests), conducting interviews with responsible personnel, and performing on-site inspections.
• Reporting will be done via the SAVe Tool, specific text reports, and results presentations.
• Deliverables also include the creation of risk analyses related to the information network, evaluation of complex architecture and application requirements within change management, and the development of selected guidelines for HIL GmbH's Information Security Management System (ISMS).
• The service also entails individual coaching for the Information Security Officer (ISB), project management, and system owners, along with consulting on potential advancements in IT-Grundschutz.
• Planning and conducting at least quarterly status meetings with HIL project management/ISB are also required.
• A key initial deliverable is the establishment of an Audit-Universe.

Certain core services, specifically the Project Leader role, are excluded from subcontracting. These critical core performances include strategic overall control and methodological responsibility, final evaluation and quality assurance, risk and measure responsibility, process and emergency control, and overall result responsibility and representation.

The contract duration is for three years, starting upon the award of the contract, with an estimated annual effort of approximately 209 person-days for the years 2027, 2028, and 2029.