Evaluation des Sofortprogramms Cybersicherheit

The contract timeline is as follows:

The anticipated contract start date is October 29, 2026, which is the expected date of contract award ("Zuschlagserteilung"). The project's total duration is approximately 36 months from this contract award date. The project must be completed by December 31, 2029, at the latest, which serves as the contract end date.

Key milestones and phases include:

• A kick-off meeting, which needs to be planned and organized as part of the offer.
• Weekly half-hour Jour Fixe via video conference during the early stages of the project.
• Monthly progress reports, not exceeding one page in length.
• Provisions for participation in committee meetings, estimated at 1-2 per half-year.
• Three distinct survey periods, each with specific measurement times and associated interim reports.
• A final measurement culminating in a final report.
• A separate report detailing the final methodology and model concept for Module 1.
• Submission of a draft of the accessible final report along with the final invoice by November 15, 2029.
• The revised final report is to be submitted subsequent to the draft.
• The final submission of the overall final report is due by December 31, 2029.

It is noted that the exact schedule, including the dates for the three measurement periods and their respective interim reports, will be definitively established after the contract award in consultation with the client. The dates and timeframes provided are preliminary and subject to change.

The core scope of work for this tender is the Evaluation of the Cybersafety Immediate Program. This comprehensive evaluation is structured into four main modules:

• Module 1: Model Development - This involves the (further) development of holistic, integrative, and standardized maturity models. These models are intended to assess the IT security and digitalization levels of system-relevant healthcare facilities in Germany.
• Module 2: Technical Provision and Operation - This module covers the technical provision and ongoing operation of the survey instrument or platform. It also includes the execution of the survey, encompassing both technical implementation and data collection. Up to 4,000 facilities are expected to be included in the second and third data collection phases.
• Module 3: Scientific Evaluation - The focus here is on the scientific evaluation of data obtained from surveys and self-assessments, as well as the analysis of longitudinal developments. This includes processing collected data, preparing it for the client and stakeholders, and providing it in an analyzable format with full variable and value documentation. Results should describe IT and digitalization levels and allow for differentiated analysis by subcohorts, suitable for interactive visualizations like a dashboard.
• Module 4: Accompanying Evaluation - This module involves an ongoing evaluation component that runs alongside the main project activities.

The project also requires the submission of an implementation concept. This concept must detail the quality of service, the intended approach, selected methods for tasks, project organization, technical and personnel responsibilities, chronological and substantive sequence of work steps, interfaces between modules, coordination with the client and stakeholders, quality assurance, and risk management. Within this concept, separate short concepts must be provided for each of the four modules, outlining objectives, work steps, methods, expected results and deliverables, timelines, milestones, responsibilities, dependencies, interfaces, and quality assurance measures. A concept draft for adapting the "DigitalRadar" and developing additional maturity models must also be included in the short concept for Module 1, addressing national and international standards, regulatory requirements, and user-friendliness.

Core deliverables include:

• Maturity models (including model foundations, evaluation matrix, and description of the assessment algorithm).
• The survey instrument and the survey platform (including source code, database schema, interfaces, scripts, and configuration files).
• A dashboard (including its visualizations).

These deliverables must be provided in a documented, executable, and developable form, allowing for operation and further development by a knowledgeable third party without the contractor's involvement.

• Intermediate reports for each of the three measurement periods.
• A final report, which is due by December 31, 2029. All reports must be submitted in electronic form (Word and barrier-free PDF).