Establishment of a Framework for Procurement of Network Security Layer

The contract duration is for four (4) years, with an option for ECMWF to extend it by an additional two (2) years by providing a 30-day prior written notice to the Contractor. The specific contract start date is not explicitly stated, as it is indicated as "[insert the start date of the 4-year term]". Consequently, the exact end date is also not provided.

Key milestones and phases related to the procurement process leading up to the contract include:

• Contract Notice sent to OJEU and ITT publication date: Tuesday, 4 August 2026.
• Last date for clarification questions: Monday, 7 September 2026, 23:59.
• Last date for publishing clarifications: Monday, 14 September 2026.
• Interested parties register their interest on the eProcurement Portal by: Tuesday, 22 September 2026, 15:00.
• Closing Date: Tuesday, 22 September 2026, 15:00.
• Evaluation, including clarification of tenders (if necessary): End-September to November 2026.
• Placing an order for Lot 1 and signing contracts: By Early-December 2026.
• The contract for the Initial Purchase (Lot 1) is anticipated to be awarded in December 2026.

The Tenderer's response for the framework is required to remain valid for a period of at least six months after the Closing Date.

The core scope of work for this tender, ECMWF/ITT/2026/381, is to establish a Framework Agreement with multiple suppliers for the procurement of a Network Security Layer. This involves providing equipment, software, and associated maintenance and support services, as well as other services, for installation by ECMWF at its Data Centre in Bologna and its three office sites in Reading, Bologna, and Bonn.

The key deliverables and components explicitly stated in the Statement of Work summary include:

• Data Centre Network Security Layer Appliances (DC NSL Appliances): These appliances must incorporate security controls such as Network Firewall, Application controls, Intrusion Detection System (IDS), Intrusion Prevention System (IPS), TLS (SSL) Decryption/Inspection, and Web Filtering. This also includes the associated hardware platforms, optical transceivers (if applicable), Direct Attached Cables (DACs) (if applicable), and software licenses for 1, 3, and 5-year subscriptions.
• Support & Maintenance: Various levels of support and maintenance are required, including 4-Hour Response, 8-Hour Response, and Next Business Day (NBD) response, for durations of 1, 3, and 5 years.
• Data Centre Remote Access VPN functionality (DC Remote Access VPN).
• Data Centre Site-to-Site VPN functionality (DC Site-to-Site VPN).
• Professional Services: These include design validation and onsite engineer presence during the deployment phase, if and when required.
• Training: Training for ECMWF staff is a required component.

The ITT also specifies an "Initial Purchase" (Lot 1), for which tenderers must provide a detailed quote including components and services, and user acceptance testing by ECMWF is a precondition for the acceptance of the solution. The overall objective is to secure ECMWF's mission-critical operations, systems, and data, and support its digital resilience across all sites.