GE2612 - Servizi di consulenza specialistica applicativa in ambito Google Cloud Platform e Intelligenza Artificiale

The contract starts from the date of its stipulation. The date of stipulation is defined as the date the Contractor receives the contract document signed by InfoCamere. The total duration of the contract is 36 months. The contract ends after 36 months from its stipulation date, or earlier if the maximum contractual amount is reached.

Key milestones and phases include:

• Within 5 working days of the contract signing, the Contracting Authority will share a "Piano dei Fabbisogni" (Needs Plan) with the Contractor.
• The Contractor must respond within 10 working days of receiving the "Piano dei Fabbisogni."
• Activities include verification of compliance with agreed milestones and timings. Specific milestones can be included in engagement forms, along with activity start and end dates.
• There is an additional 12-month warranty period for any developed or modified application components, commencing from the date of their positive testing report. This warranty period is a post-contractual obligation and does not extend the contract's original 36-month duration.
• Monthly, the DEC will provide the Contractor with a document measuring service levels.
• A final compliance verification report is to be completed within 30 working days from the end of the services.

• Google Cloud Platform (GCP)
• Vertex AI
• Google ADK
• LangGraph
• SQL databases
• No-SQL databases
• API REST
• API SOAP
• OAuth2.0 protocol
• OpenID Connect protocol
• WSO2 API gateway
• Apigee API gateway
• Workflow engines
• Rule engines
• Python programming language
• TensorFlow framework
• PyTorch framework
• LangChain framework
• Gemini suite
• Big Data technologies
• Cryptographic systems
• Retrieval Augmented Generation (RAG) methodology
• Large Language Model (LLM) utilization
• OWASP Top 10 security best practices
• Zero-trust policy
• Principle of least privilege
• AGID guidelines for secure software development
• AGID design guidelines for Public Administration websites and digital services
• Version control system for software and documentation
• Regular application of security updates for software, libraries, and frameworks
• Deployment on non-obsolete environments
• Avoidance of non-standard configurations that hinder updates
• Monitoring, evaluation, and application of updates to software components
• Software must be free of blocking defects.
• Error messages must not expose critical or system data.
• Software must not log sensitive user data.
• Software must not contain deprecated or insecure functionalities/APIs.
• Input data must be validated syntactically and semantically.
• Periodic removal of unused/obsolete resources, code, libraries, configurations, network interfaces, protocols, and communication endpoints.
• Disabling/limiting access to system services.
• Application of multi-level defense where possible.
• Consistent error handling with logging of sufficient user context.
• Log retention for post-mortem analysis and compatibility with log management solutions.