Published
Rahmenvertrag Penetrationstests
Notice number: ocds-mnwr74-ed96b734-0376-49e9-a2bb-0e1e89dfa44f
KEY INFORMATION
- Submission deadline
- • Sep 22, 2026
- Location
- 🇩🇪 Germany
- Contracting authority
- degewo AG
- Accepted Languages
- DEU
- Tender type
- Services
- Contract Value
- Published date
- Aug 21, 2026
TENDER DESCRIPTION
This tender seeks a single-lot framework contract for the provision of penetration tests and security analyses, classified under CPV 72800000 (computer auditing and testing services), spanning from December 1, 2026, with a minimum duration of 12 months and potential extensions up to three times. The scope includes various penetration test types such as external/internal infrastructure, WLAN, hardening checks, mobile application, and web application/web service tests, to be delivered on a demand-driven call-off basis by personnel including Senior, Mid-level, and Junior Consultants. Key technical requirements include adherence to methodologies like BSI-Durchführungskonzept, OWASP Testing Guides, and NIST, personnel holding certifications such as OSCP, OSWE, GIAC/SANS, GPEN/CREST, CompTIA, and German language proficiency at C1 level, alongside strict GDPR-compliant processing, secured data transfer, and confidentiality. Financial requirements mandate business liability insurance with a minimum sum insured of 3 million EUR, confirmation of tax and duty compliance, and a declaration of no insolvency proceedings.
TENDER BRIEF
The contract timeline is as follows:
- Contract start date: December 1, 2026.
- Contract end date: November 30, 2027.
- Total duration: The minimum contract duration is 12 months. The contract automatically extends for an additional twelve months, up to a maximum of three times, unless it is terminated within the specified notice period.
- Key Milestones/Phases: The contract includes annual project phases:
- Preparation phase: 2-4 weeks.
- Test phase: 4-6 weeks.
- Evaluation phase: 4 weeks.
The actual duration of these phases may vary based on the scope, complexity, criticality, and availability of the test objects.
Sources
- 1EVB-IT Dienstleistungsvertrag.pdf — “Projektleitungsunterstützung ☐ ☐ ☐ ☐ ☐ ☐ ☐ Schulung Einführungsunterstützung Betreiberleistungen Benutzerunterstützungsleistungen Providerleistungen ohne Inhaltsverantwortlichkeit Unterstützung bei Planungsleistungen Unt…”
- 2Anlage 2 - DEGEWO_Vertrag_zur_Auftragsverarbeitung.docx — “die Ableitung von Maßnahmen zur Risikominimierung. 3. Laufzeit des Vertrags: Mindestvertragsdauer von 12 Monate bei maximal dreimaliger Verlängerung von 12 Monaten 4. Kündigung des Vertrags: Drei (3) Monaten zum Ablauf e…”
- 3eForm_16_12218.pdf — “Abrechnung Die Vergütung erfolgt ausschließlich auf Grundlage der tatsächlich beauftragten und erbrachten Leistungen zu den im Angebot angegebenen Personentagessätzen und sonstigen vertraglich vereinbarten Konditionen. D…”
The core scope of work for this tender is the provision of Penetration Tests for the period of 2026-2030. The type of contract is for services, specifically classified as computer auditing and testing (CPV: 72800000).
The core deliverables and scope of services explicitly include:
- Execution of Penetration Tests.
- Various types of penetration tests:
- External Infrastructure Penetration Test (Blackbox).
- Internal Infrastructure Penetration Test (Greybox).
- WLAN Network Penetration Test.
- Hardening Check (Whitebox).
- Mobile Application Penetration Test.
- Web Application and Web Service Penetration Test.
Services can be rendered as one-time, regular, or on-call services.
The project phases for each year involve:
- Preparation phase (2-4 weeks).
- Test phase (4-6 weeks).
- Evaluation phase (4 weeks).
Each individual call-off for services will specify:
- Description of the test object.
- Intended test scope and depth.
- Applicable test type (e.g., Blackbox, Greybox, or Whitebox).
- Prioritization of the call-off.
- Planned service period.
- Any specific technical requirements.
The services will be carried out by personnel in roles such as Senior Consultant, Consultant (Mid-Level), and Junior Consultant.
Sources
- 1Preisblatt.xlsx — “,,,,,,,,, ,Preisblatt,,,,,,,, ,"Projekt: ",Penetrationstests 2026–2030,,,,,,, ,Datum,07.05.2026,,,,,,, ,Name Bieter:,,,,,,,, ,,,,,,,,, ,,,,,,,,, ,"Hinweis Die im Preisblatt angegebenen Personentage (PT) stellen unverbind…”
- 2Leistungsbeschreibung RV PEN-Test.pdf — “degewo Leistungsbeschreibung vom 07.05.2026 Penetrationstests 2026-2030 Auftraggeber: degewo AG Potsdamer Str. 60 10785 Berlin - Deutschland Gegenstand der Ausschreibung 1. | 3 1.1. Unternehmen degewo.... | 3 1.2. Überge…”
- 3eForm_16_12218.pdf — “Abrechnung Die Vergütung erfolgt ausschließlich auf Grundlage der tatsächlich beauftragten und erbrachten Leistungen zu den im Angebot angegebenen Personentagessätzen und sonstigen vertraglich vereinbarten Konditionen. D…”
- 4EVB-IT Dienstleistungsvertrag.pdf — “Projektleitungsunterstützung ☐ ☐ ☐ ☐ ☐ ☐ ☐ Schulung Einführungsunterstützung Betreiberleistungen Benutzerunterstützungsleistungen Providerleistungen ohne Inhaltsverantwortlichkeit Unterstützung bei Planungsleistungen Unt…”
Login to view all answers and insights
Unlock tender brief for freeTENDER DOCUMENTS
DIRECTORY • 15 FILES
- Antwortenkatalog_KE-2026-RV-PEN-Test_04.09.26_09_47.pdf219 KBPDF
- NUN RV PEN-Test.docx120 KBDOCX
- Bewerbungsbedingungen.pdf101 KBPDF
and 8 other documents
Login to view and download all tender documents
Unlock documents for freeASK AI ABOUT THIS TENDER
Can a foreign company apply?
Yes, foreign companies can apply as long as they meet all the requirements set out in the procurement documents.
Login to ask more questions.
Unlock AI tender chat for freeUnlock your tender workflow
Run your first search, evaluate the results, save a daily monitor and start building a pipeline of tenders worth pursuing.