Interne Audits und Sicherheitsrevisionen zur Aufrechterhaltung der Informationssicherheit der EU-Zahlstelle im MLEUV

The contract timeline is as follows:

• Contract Start Date: The main contract services are set to begin on January 1, 2027. However, a coordination meeting for the project launch is scheduled for 2026, and optional services may also be commissioned during 2026.
• Contract End Date: The contract is scheduled to end on December 31, 2030.
• Total Duration: The core services span from January 1, 2027, to December 31, 2030, totaling four years. Overall project activities, including optional services and initial coordination, extend from 2026 to 2030. The minimum contract duration concludes on December 31, 2027.
• Key Milestones/Phases:
• A coordination meeting for project start is to be conducted in 2026.
• Up to two optional audits for two audit subjects can be commissioned in 2026.
• The minimum contract duration (MVD) ends on December 31, 2027.
• Four audits are planned annually from 2027 to 2030.
• Ideally, an audit will occur each quarter of the respective audit year.
• All audit reports must be submitted by the end of January of the following year.

The core scope of work for this tender involves the planning and execution of internal audits and security reviews. These services are essential for maintaining the information security of the EU Payment Agency Brandenburg-Berlin, specifically for its ISO 27001 certified information system, which is based on the BSI IT-Grundschutz methodology. The project aims to secure the continuous fulfillment of the "security of information systems" criterion required for the EU Payment Agency's certification. The organization lacks internal personnel for these audits, necessitating the engagement of external experts.

The Statement of Work summary and core deliverables include:

• Execution of Internal Audits and Security Reviews: The primary service is the planning and conducting of these audits and security reviews.
• Annual Audit Schedule:
• 2026: 2 optional audits (20 Person-days).
• 2027: 4 audits (40 Person-days).
• 2028: 4 audits (40 Person-days).
• 2029: 4 audits (40 Person-days).
• 2030: 4 audits (40 Person-days).
• This totals 18 audits over the period, representing 180 Person-days (including optional audits).
• Methodology and Standards: Audits must be carried out according to the BSI IT-Grundschutz methodology, including the BSI Auditing Scheme or the Guideline for IS Revisions based on IT-Grundschutz. The services are subject to BSI Standards 200-1 to 200-4, the BSI IT-Grundschutzkompendium, and potentially future relevant regulations from the Federal Office for Information Security.
• Project Kick-off and Coordination: A coordination meeting is to be held in 2026 at the project start to agree on the audit plan and introduce other framework conditions.
• Audit Frequency: Preferably, one audit will take place per quarter of each audit year.
• Reporting: All audit reports must be submitted by the end of January of the respective following year.
• Contract Duration: The contract period is from January 1, 2027, to December 31, 2030, with a minimum contract duration of one year.
• On-site Presence: For on-site audits, presence at locations throughout Brandenburg and Berlin is required for both regular and optional audits.
• Contract Type: An EVB-IT Service contract will be concluded.