Rahmenvertrag über 4 Jahre - Penetrationstests inkl. Beratungsdienstleistung

The contract is scheduled to start on November 1, 2026, and conclude on October 31, 2030. This indicates a total duration of four years. The contract can commence within 14 days of the award.

The framework agreement has an initial minimum term of two years. This term automatically extends by one additional year at a time, provided the client does not terminate the contract in writing or via email three months before the respective expiration date. The total duration, including any extensions, is capped at a maximum of four years from the effective date. Specifically, the framework agreement can be extended twice, each for 12 months, under the same conditions, unless the client terminates it with a three-month notice period before its end. Regardless, the agreement will terminate after a maximum of 48 months without requiring further notice.

The core scope of work for this tender involves the "Durchführung von Penetrationstests" (execution of penetration tests) and associated services.

The contractor must be capable of preparing, conducting, and post-processing penetration tests, along with providing related consulting services throughout the contract period.

Key deliverables and service contents include:

• Consulting: Providing advice on the capabilities and limitations of IT security investigations, both generally and specifically, based on current technological and research standards. This also includes consulting on organizational and technical frameworks, as well as estimated efforts (technical/personnel) for specific IT security investigations.
• Preparation: Complete preparation for specific IT security investigations, starting from the initial contact.
• Execution: Full execution of specific IT security investigations. This includes performing penetration tests according to an agreed workflow and test plan, adhering to current technical standards.
• Follow-up and Reporting: Comprehensive follow-up of IT security investigations, which includes final reporting and presentations. Technical consulting on identified IT security vulnerabilities is also part of this phase. The contractor is required to submit a first draft report within five working days and a quality-assured final report within ten working days after the implementation phase. In cases where critical security vulnerabilities are identified during an ongoing investigation, an ad-hoc report must be provided to the client by 5:00 PM CET the day following the discovery.
• Types of Penetration Tests: The tender specifies various scenarios for penetration tests:
• External Attack: Based on automated scans (IP ranges, domains, OSINT) and targeted tests of exposed systems, considering threat and attack scenarios (Scenario 1). This includes tests of RZ/IT infrastructure like WAN connections, VPN gateways, firewalls, and web proxies.
• Assumed Breach: Scenarios for standard employee clients (Scenario 2) and standard admin clients (Scenario 3).
• Selected IT Services or Infrastructure: Such as Office IT infrastructure services (e.g., network) (Scenario 4). This involves testing client and server objects (e.g., WIN workstations, Unix/Windows/SAP/DB/Web servers) based on account privilege escalation and existing vulnerabilities.
• Web Applications: Penetration tests on web applications based on existing vulnerabilities (Scenarios 7 and 8).

The services are called off through individual orders ("Einzelaufträge") under a framework agreement, with each individual order detailing the specific nature, scope, and deadlines of the services required. The maximum value for call-offs under this framework agreement is €400,000.00.