Pentesten

The contract timeline is as follows:

The Framework Agreement begins on January 11, 2027, and is initially set to run until January 10, 2029, making the initial duration two years. The client has the option to extend the agreement twice, each time for an additional year, under the same terms. If both extension options are exercised, the Framework Agreement will conclude by operation of law on January 10, 2031.

The tender process includes the following key dates:

• Publication: September 11, 2026
• Closing of the first written question round: October 5, 2026, 10:00 AM
• Sending of the first Memorandum of Information: October 19, 2026
• Closing of the second written question round: October 26, 2026, 10:00 AM
• Sending of the second Memorandum of Information: November 2, 2026
• Closing for the submission of Bids: November 13, 2026, 10:00 AM
• Provisional award/rejection: December 7, 2026
• Objection period: until December 27, 2026
• Final award: December 31, 2026
• Effective date of the Framework Agreement: January 11, 2027

While project phasing is mentioned as a possibility within the ARBIT 2022 document, where different project phases would be defined in the Agreement, including activities, deadlines, and outcomes, no specific key milestones or phases for this particular contract are explicitly stated beyond the overall contract duration.

The core scope of work for this tender involves the execution of penetration tests (pentests) on all applications and environments of the Koninklijke Bibliotheek (KB). This service contract, classified under "Computer audit and testing services" (CPV 72800000), aims to identify vulnerabilities within the KB's IT infrastructure and digital services.

The Statement of Work summary and core deliverables include:

• Execution of Pentests: The primary activity is performing penetration tests across various applications and environments.
• Vulnerability Identification: The objective is to identify vulnerabilities within the applications and environments checked by the contractor.
• Structured Reporting: The contractor must provide well-structured reports that offer the KB the necessary insights to implement improvements.
• Cost Savings: The collaboration with a single contractor is expected to result in cost savings for the KB, covering both internal costs and execution costs.
• Adherence to Program of Requirements: The assignment must be carried out in accordance with the Program of Requirements (Bijlage 1).
• Detailed Planning and Methodology: The contractor's approach should outline how the scope and content of the pentest will be agreed upon, the activities and steps involved in each pentest, the techniques and methods used (including potential AI use and its reliability), and communication plans.
• Team and Hours: Offers from contractors must include a description of the team, an explanation of activities and working methods, a planning, and the number of hours (person-days) required for the pentest.