Security Incident Response 2.0 (2026)

The contract duration is initially two (2) years. There are two (2) options for extension, each for one (1) year, bringing the maximum total duration to four (4) years. Further Agreements (Nadere Overeenkomsten - NOKs) may extend up to six (6) months beyond the end of the Framework Agreement (Raamovereenkomst - ROK).

Key milestones for the tender process include:

• The deadline for requests for additional information is 02-10-2026 at 10:00 Central European Summer Time.
• The deadline for receiving requests to participate is 22-10-2026 at 12:00 Central European Summer Time.
• The expected date for sending out invitations to tender is 23-10-2026.

Contract start and end dates are not explicitly stated.

The core scope of work for this tender, titled "Security Incident Response 2.0 (2026)", encompasses the provision of Security Incident Response services to participants via a Service Level Agreement (SLA). The core deliverables and statement of work summary include:

Core Components:

• Analysis: Mapping the scope and cause of an incident, and then proactively and adequately investigating and responding to it.
• Coordination: Coordinating the incident approach among participants, which can cover all parts of the assignment.
• Defense and Mitigation: Containing and eradicating affected parts of the IT and OT Infrastructure.
• Investigation: Performing digital forensic investigations.
• Evaluation and Reporting: Adequately transferring detailed investigation results to designated incident response partners. These reports should also support compliance, potentially by providing a 'second opinion'.

Deliverables/Services within Core Components:

• Supply and/or deployment of hardware and software necessary for the assignment, compatible with the participant's existing standards and installed base.
• Provision of training courses upon the participant's request.

Additional Scope Items:

• Strategic and Technical Advising: Providing advice on incident handling, including guidance on compensation for attacks/ransomware and strategic policy related to these subjects.
• Communication Advice: Offering counsel on communication strategies and incident-specific communication, which may involve assisting in drafting communiqués, translating technical information for external communication, and advising on report sharing with communities or third parties.
• Negotiation: Conducting discussions on behalf of the Institution concerning security incidents with malicious parties.
• Knowledge Sharing: Contributing knowledge and expertise through exercises, red teaming, and training to enhance cooperation in the incident response process.

The nature of the contract is for "Services," primarily focusing on IT services such as advice, software development, internet, and support. Each incident response request can encompass one or more of these tasks, but not necessarily all.