IT Sicherheitsberatung für das JRC Karlsruhe

The contract timeline is as follows:

The framework agreement will be concluded for a maximum duration of 48 months. Initially, the contract is for a period of 12 months, commencing from the date specified in Article 3 of the main conditions. This agreement can be automatically extended up to three times, with each extension lasting 12 months. This automatic extension will occur unless either party formally notifies the other of a different decision at least three months before the end of the current term.

A "Phase Out" is also a defined stage, occurring upon the expiration or early termination of the framework agreement. During this phase, the contractor is required to prepare and execute an orderly exit, ensuring the client or a successor can resume activities without loss of knowledge or data. This includes ensuring all analyses, evaluations, results, security measures, action plans, justifications, histories, and other relevant information are correctly recorded, up-to-date, and usable in CRISAM. The contractor must also provide a clear and complete overview of the situation at the time of service completion and participate in knowledge and competence transfer. The Phase Out is considered complete only when the client confirms that the situation in CRISAM is complete, coherent, current, and sufficiently documented for the continuation of activities without dependence on the departing contractor.

The core scope of work for this tender involves IT security consulting services for the JRC Karlsruhe. The main objective is to revise an existing IT security concept and provide support for its implementation, specifically following the guidelines for protecting IT systems in nuclear facilities and installations.

The statement of work summary and core deliverables include:

• Conception and documentation of IT strategy and organization.
• Development and documentation of processes and guidelines.
• Documentation of procedures and work instructions.
• Development of technical concepts.
• Prioritization and assistance in the implementation of technical concepts.
• Support for interactions with authorities and accompanying audits.
• Training of JRC Karlsruhe IT Security Officers and system administrators.
• Support for the expansion and revision of Information Security Management Systems (ISMS).
• Consulting on the development of the security culture at JRC Karlsruhe.
• Consulting on the planned IT security infrastructure for new constructions.

All work must consider the nuclear-technical, safety-relevant, federal German regulatory framework. The contractor is also required to have extensive knowledge of SEWD-IT, DIN ISO/IEC 27001:2022, and BSI IT-Grundschutz, and to support the client in using CRISAM software for security analysis.