Security Advisory Service

The contract start date is 01.10.2026. The minimum contract duration is one year. The maximum contract duration is four years, ending on 30.09.2030.

The core scope of work for this tender primarily revolves around the provision of "Security Advisories". The contractor is required to provide all known information regarding security vulnerabilities and weaknesses (Security Advisories) in any hardware or software. These advisories must be made available immediately, at least once daily, to email addresses designated by the client.

Key aspects of the Statement of Work include:

• Provision of Security Advisories: Immediate and at least daily provision of all known information on security vulnerabilities and weaknesses in hardware and software to designated email addresses. A list of platforms and manufacturers must be covered at the start of the contract, and the provider must expand their portfolio proactively when vulnerability information becomes public, and upon request within 5 working days.
• Content of Security Advisories: Each advisory must include a unique reference number, type of message (new/update), change history, title, date, keywords (CPE-Tags where possible), an exact list of affected software with version numbers, affected platforms, impact, vulnerability type, attack vector, risk assessment (low, medium, high, critical), CVE/CVSS numbers (if available), product description, vulnerability description, information on patches, possible mitigations/workarounds, available exploits, revision history, and sources/references.
• Language and Format: Advisories must be in German, and affected platforms should be identified using CPE notation where possible.
• Distribution Rights: The client has the right to make these advisories accessible to all authorities and institutions of the North Rhine-Westphalian state and municipal administration, including all subordinate authorities, or to forward them.
• General Contractual Subject: The contract concerns the agreed-upon services of the contractor, not work contracts. The contractor is obligated to provide services diligently, adhering to the current state of technology at the time of service provision, unless otherwise agreed. Services are to be rendered in German, unless otherwise agreed.