Rahmenvertrag Penetrationstests

The contract is set to begin on December 1, 2026, and conclude on November 30, 2027. The minimum contract duration is 12 months. The contract includes an automatic extension clause, allowing it to be prolonged for an additional twelve months, up to a maximum of three times, unless it is terminated in due time.

Key project phases mentioned are:

• Preparation and Conception Phase: 2-4 weeks.
• Test Phase: 4-6 weeks.
• Evaluation Phase: 4 weeks.

These phases form the annual framework for planning, executing, and evaluating all individual call-offs. The actual duration of these phases might change based on the scope, complexity, criticality, and availability of the respective test subjects.

The core scope of work for this tender is the provision of Penetration Tests for the period of 2026-2030.

The Statement of Work (SOW) summary includes:

• Service Type: The primary service is "Computer audit and testing" (CPV: 72800000), delivered as services on call.
• Penetration Test Types: Specific penetration tests to be conducted include:
• External Infrastructure Penetration Test (Blackbox).
• Internal Infrastructure Penetration Test (Greybox).
• WLAN Network Penetration Test.
• Hardening Check (Whitebox), including comparison with CIS-Benchmarks and Best Practices.
• Mobile Application Penetration Test (dynamic analysis of 4 apps - Android/iOS), focusing on data protection, cryptography, authentication, and reverse engineering.
• Web Application and Web Services Penetration Test (testing of 5 web applications, REST-APIs, and SOAP-Services), with a focus on authentication, authorization, session management, injection attacks, and configuration security.
• Deliverables/Phases per year: The services are structured into annually recurring project phases:
• Preparation Phase (2-4 weeks).
• Test Phase (4-6 weeks).
• Evaluation Phase (4 weeks).
• Call-off Details: Each individual call-off requires:
• Description of the test object.
• Intended test scope and depth.
• Applicable test type (e.g., Blackbox, Greybox, or Whitebox).
• Prioritization of the call-off.
• Planned service period.
• Specific technical or professional requirements, if applicable.
• Rules of Engagement and Reporting: All penetration tests must be performed based on a mutually agreed and approved test plan from the client. This plan will define the specific test object, allowed test scope and depth, permissible and impermissible test methods/attack scenarios, timeframes, classification of critical systems, escalation and emergency procedures, contact persons, communication channels, and any technical/organizational limitations. The project also includes reporting.
• Personnel: The tender specifies roles such as Senior Consultant, Consultant (Mid-Level), and Junior Consultant, with an indicative total of 120 person-days for offer comparison.