Penetratietesten

Question: What is the contract timeline?

Context: Contract start date, end date, total duration, and any key milestones or phases mentioned. Return null if not stated.

The contract timeline for the Framework Agreement is as follows:

• Contract start date: null (stated as "n.t.b.*" - to be determined).
• Contract end date: null (dependent on the start date, which is "n.t.b.").
• Total duration: The Framework Agreement has a duration of four (4) years.
• Key milestones or phases:
• The tender process includes various deadlines:
• Publishing 1st Note of Information: Wednesday, October 21, 2026.
• Closing 2nd question round: Wednesday, October 28, 2026, at 13:00.
• Publishing 2nd Note of Information: Wednesday, November 18, 2026.
• Deadline for submitting bids via TenderNed: Monday, November 30, 2026, at 14:00.
• Opening of bids: Monday, November 30, 2026, at 14:05.
• Assessment of bids: Wednesday, December 2, 2026, to Thursday, February 11, 2027.
• Sending award decision: Monday, February 22, 2027.
• Deadline for winning bidders to provide requested evidence: Tuesday, March 9, 2027.
• Deadline for questions and/or requesting provisional measures regarding the award decision: Monday, March 15, 2027.
• Signing Framework Agreement: n.t.b.* (to be determined).
• Start date Framework Agreement: n.t.b.* (to be determined).
• Announcement of awarded contract (latest publication date): n.t.b.* (to be determined).
• For individual Further Agreements (Nadere overeenkomsten), general phases and recommended durations include:
• Connection and disconnection period: Approximately 4 to 12 weeks, with an average of 5 to 8 weeks. This includes technical implementation, organizational decision-making, and operational readiness.
• Startup period: Approximately 6 months after connection to implement and optimize services.
• Notice period for termination: Generally 1 to 3 months.
• Recommended minimal durations for different service types:
• Monitoring & Detection (M&D): 24-36 months (some parties advise 3-5 years).
• Knowledge Sharing, Signaling & Response (KS&R): 12-24 months.
• Vulnerability Research/Management (VOC): Minimum 2 years, preferably 3 years.
• Specific modules (e.g., Threat Intelligence, Forensics): 12-24 months.
• An initial term of 36 months with extension options is mentioned, with longer terms up to 4-5 years or even 8 years for strategic cooperation. Shorter terms of 12-24 months are considered for temporary or smaller assignments, often at higher costs. A minimum contract duration of 3 years is also advised.

The core scope of work for this tender primarily involves conducting one or more Information Security Investigations (Informatiebeveiligingsonderzoeken).

The Statement of Work (SoW) summary is established per participant within a Master Agreement (Raamovereenkomst) to define the specific scope, roles, and expectations for each assignment.

Key deliverables and elements of the Plan of Approach (Plan van Aanpak), which details the execution of the work, include:

• A description of the assignment's scope and objectives, the objects to be investigated, their ownership, and physical locations, along with compliance implications for relevant laws and regulations.
• The methodologies, standards, attack perspectives (e.g., black/grey/whitebox, "assume breach"), attack scenarios, and tools to be utilized.
• A detailed planning, including dates, times, attack windows, expected resource deployment, and related agreements.
• Conditions and guarantees from both the contractor and participant concerning the planning.
• Arrangements for managing potential risks.

The investigation's standard report will contain:

• A management summary detailing the standards used, CIA-scores per scope-object (if requested), a root-cause analysis (if applicable), and an overview of vulnerabilities categorized by CVSS (Critical, High, Medium, Low, Informative).
• A summary of major findings and recommendations for improvement.
• An overview of the scope objects, noting which were tested and any deviations.
• Confirmation of the scope agreed during the intake and documented in the Plan of Approach.
• A section on the application and validation of the "assume breach" principle.
• The physical locations (country) of the investigated objects.