Penetratietesten

The contract timeline is as follows:

Contract Start Date:

• The effective date of the Framework Agreement (`Raamovereenkomst`) is yet to be determined (n.t.b.).
• A further agreement (`Nadere overeenkomst`) comes into effect upon signature by both parties, with a specific start date to be filled in.

Contract End Date:

• For the Framework Agreement, the end date is not explicitly stated but is implicitly four years after the "n.t.b." start date.
• For a further agreement, the end date will be specified based on its determined period.

Total Duration:

• The Framework Agreement (`Raamovereenkomst`) has a duration of four (4) years, with a maximum term of four (4) years.
• Market consultations indicate an initial term of 36 months with extension options.
• Some recommendations suggest longer terms up to 4-5 years or even 8 years for strategic collaborations.
• Shorter terms of 12 to 24 months may be applicable for specific or temporary assignments and additional services.
• Minimum durations of 24 to 36 months are advised for core SOC/MDR services.

Key Milestones or Phases:

• Tendering Process Milestones:
• Publication of 1st Information Note: Wednesday, October 21, 2026.
• Closing of 2nd question round: Wednesday, October 28, 13:00.
• Publication of 2nd Information Note: Wednesday, November 18, 2026.
• Deadline for submitting bids via TenderNed: Monday, November 30, 2026, 14:00.
• Opening of bids vault: Monday, November 30, 2026, 14:05.
• Assessment of bids: Wednesday, December 2, 2026, to Thursday, February 11, 2027.
• Sending award decision: Monday, February 22, 2027.
• Latest date for winning bidders to provide requested evidence: Tuesday, March 9, 2027.
• Latest date for questions/provisional measures regarding award decision: Monday, March 15, 2027.
• Signing of Framework Agreement: To be determined (n.t.b.).
• Effective date of Framework Agreement: To be determined (n.t.b.).
• Announcement of awarded contract (latest publication date): To be determined (n.t.b.).
• Contract Phases (as per market consultation):
• Implementation, tuning, context validation, and building detection capacity.
• Onboarding, tuning of detection rules, integration with processes and tooling, and knowledge transfer.
• Longer startup periods of up to 6 months for the service to be properly established.
• Shorter technical implementation terms of 1-2 weeks to 8 weeks, depending on complexity.
• Exit and retransition periods, typically ranging from 1 to 3 months, for a smooth handover and data transfer upon termination.

The core scope of work for this tender primarily involves conducting one or more Information Security Investigations (Informatiebeveiligingsonderzoeken).

The Statement of Work (SOW) summary and core deliverables include:

• Intake Meeting: An intake meeting is a mandatory component of the assignment, to be held within 10 working days of the assignment's commencement and prior to any testing activities.
• Intake Report: The contractor must produce a report of the intake meeting, detailing discussed topics necessary for creating a Plan of Approach, the meeting date, participants, and information yet to be provided for the security investigation.
• Plan of Approach (Plan van Aanpak): A definitive Plan of Approach must be submitted after the intake meeting. This plan specifies:
• The scope and objectives of the assignment.
• The objects to be investigated, their ownership, and physical locations, along with implications for compliance with relevant laws and regulations.
• Optional: the location(s) where the investigation will be carried out.
• The methodologies, standards, attack perspectives (e.g., black/grey/whitebox, assume breach), attack scenarios, and tools to be utilized.
• A detailed schedule, including dates, times, attack window, expected resource deployment, and related agreements.
• Conditions and guarantees from both the contractor and participant regarding the planning.
• Agreements on how to manage potential risks.
• Investigation Execution: The contractor is responsible for verifying whether testing should occur in an acceptance environment and be validated in production, or if direct production environment testing is required. These arrangements are documented in the Plan of Approach. All objects identified within the scope must be tested.
• Reporting: Each information security investigation requires a report. The standard language is Dutch, but specific sections (excluding the management summary) can be in English if requested by the participant. The management summary must always be in Dutch.
• Deed of Indemnity (Vrijwaringsverklaring): A deed of indemnity is to be agreed upon for each specific agreement (Nadere overeenkomst) to conduct the information security investigation. This document outlines risks, grants permission for accessing or attacking specific objects, and details indemnification of liability.
• Performance Delivery: The contractor must ensure the delivery of the performance (result and objectives) as stipulated in Annex 2 (Plan van Aanpak), adhering to specified dates and locations which are considered strict deadlines.
• Work Location: The work activities are generally performed either at the contractor's site, the client's site, or through a hybrid model.
• Commencement: The contractor cannot begin the investigation without written approval from the participant for the required documents or any agreed deviations.