Evaluation des Sofortprogramms Cybersicherheit

The contract timeline is as follows:

• Contract Start Date: The anticipated contract award date is October 29, 2026.
• Contract End Date: The project must be completed by December 31, 2029, at the latest. The final report, after coordination and revision, is to be submitted by the agreed-upon date with the client, but no later than December 31, 2029.
• Total Duration: The entire evaluation duration is approximately 36 months from the date of contract award.
• Key Milestones/Phases:
• Kick-off Meeting: To be planned and organized in the offer.
• Early Project Phase: Weekly half-hour Jour Fixe meetings via video conference and monthly progress reports (max. 1 page) are to be considered in the planning.
• Committee Meetings/Events: Capacities for participation in committee meetings (approx. 1-2 per half-year) or other events are to be provided.
• Measurement Periods: There will be three survey periods, each with specific measurement points and corresponding interim reports. The exact dates for these will be definitively set after the contract award in consultation with the client.
• Final Measurement: This includes a final report.
• Methodology and Model Concept Report: The final methodology and model concept (Module 1) must also be presented in a separate report.
• Draft Final Report Submission: A draft of the accessible final report, along with the final invoice, must be submitted by November 15, 2029, at the latest.
• Revised Final Report Submission: The revised final report is to be submitted afterward.

The core scope of work for this tender is the "Evaluation of the Cybersecurity Immediate Program" (Evaluation des Sofortprogramms Cybersicherheit).

The statement of work is summarized into four main modules:

1. Module 1: Model Development involves the (further) development of holistic, integrative, and standardized maturity models to assess the IT security and digitalization levels of system-relevant healthcare facilities in Germany. This includes presenting a concept draft for adapting the DigitalRadar and developing one or more additional maturity models.

2. Module 2: Technical Provision and Operation encompasses the technical provision and operation of the survey instrument or platform, and the execution of the survey, including technical implementation and data collection.

3. Module 3: Scientific Evaluation and Analysis focuses on the scientific evaluation of the survey or self-assessment results and the analysis of the longitudinal course.

4. Module 4: Accompanying Evaluation covers the accompanying evaluation activities.

Core deliverables explicitly stated include:

• An "Umsetzungskonzept" (Implementation Concept) that details the quality of service provision, intended approach, selected methods for tasks, project organization, responsibilities, temporal and content sequence of work steps, module interfaces, coordination with the client and stakeholders, quality assurance, and risk management. This concept must contain a separate short concept for each of the four modules.
• Within the short concept for Module 1, a concept draft for the adaptation of the DigitalRadar and the development of additional maturity models is required.
• The final deliverables include the maturity models (with model foundations, evaluation matrix, and assessment algorithm), the survey instrument, the survey platform (with source code, database schema, and configuration files), and the dashboard.
• Accompanying method, model, build, and operational documentation for all developed components.
• All work results must be documented, runnable, and capable of further development by a knowledgeable third party without the contractor's involvement.