Durchführung von Penetrationstests

The contract timeline includes the following details:

The contract begins with the award of the contract. The initial term of the contract is 48 months, with an option for a one-time extension of 12 months. This extension must be made in writing three months before the contract's scheduled end. The contract concludes either upon the expiration of its term or when the agreed scope of services has been fully utilized.

Key milestones and phases include:

• The contractor is expected to commence services on October 1, 2026.
• Specific services, such as Penetration Tests including Incident Response and the final report, have a minimum contract duration (MVD) of 72 months.
• Services are delivered in monthly, quarterly, and calendar-yearly cycles.
• Within one week of the contract award, the project manager will establish an agreed-upon project plan.
• The project manager is required to provide weekly written reports on the installation status and any project deviations.

Regarding the procurement process leading to the contract:

• The deadline for submitting offers is Wednesday, November 18, 2026, at 10:00 AM.
• Questions from bidders will be answered until October 30, 2026, provided they are submitted by October 29, 2026.
• The binding period for offers ends on January 15, 2027.

The core scope of work for this tender involves the provision of IT services by the contractor for conducting network-based penetration tests, as detailed in the service description.

The key services to be provided include:

• Penetration Tests: This is the primary service, including incident response and a results report. These tests are conducted from the perspective of both external and internal attackers.
• Consulting: General advisory services.
• Project Management Support: Assistance with project leadership and coordination.
• Training: Provision of training services.
• Implementation Support: Support during the implementation phase.
• Operator Services: Services related to the operation of systems.
• User Support Services: Assistance for end-users.
• Provider Services without Content Responsibility: Services as a provider, excluding content liability.
• Support for Planning Services: Assistance with planning tasks.
• Support for Software Development: Aid in software development.
• Hotline: Provision of a hotline service.

Specific regular services include:

• Monthly, Quarterly, and Annual Tests: The penetration tests are to be performed at these intervals, with reports provided after each test.
• Quarterly Services: This encompasses penetration tests from internal networks (e.g., DMZ, intranet, MPLS) and security audits of firewalls.
• Annual Services: This includes password audits, notebook audits, web server (HTTP/S) testing, and IT forensics.
• Incident Response: Management of security incidents.
• Reporting: Detailed result reports, including a management summary and explanation of testing procedures, are required monthly and quarterly.
• Project Leadership: The contractor must appoint a project manager for technical project management, coordination, monitoring, and weekly reporting to the client.
• Servicemanager and Service Center: Deployment of a service manager and operation of a service center.

All services are expected to achieve the functional goals of the tender, even if not explicitly detailed in the description. The contract has a minimum duration of 72 months for regularly performed penetration tests.