Seminarverwaltungssoftware für das Bildungszentrum Reinhardtsgrimma

The contract timeline is structured around the "Zuschlagserteilung" (Award of Contract), which marks the project start. The implementation is divided into phases for two main software components:

Software Component 1 (Internal Seminar Administration):

• Start of Test Phase: Latest 3 months after the award of contract (project start).
• Test Duration: 3 months.
• Adaptation Phase: Maximum 3 months following the results and adaptation needs from the test phase.
• Implementation: Latest 2 months after the end of the adaptation phase.

Software Components 2 and 3 (Web Components - Fortbildungskatalog and Registration Management):

• Start of Test Phase: Latest 5 months after the award of contract (project start), potentially parallel to Software Component 1's test phase.
• Test Duration: 2 months.
• Adaptation Phase: Maximum 3 months following the results and adaptation needs from the test phases.
• Implementation: Latest 2 months after the end of the test phase.

An overall timeline visualizes these phases, extending up to 12 months from the award of contract.

The contract explicitly mentions the "Zuschlagserteilung" as the project start. It does not explicitly state a single "contract end date" or "total duration" for the entire contract, but rather specifies deadlines for the implementation of the different software components. Key milestones include the start of test phases, the completion of adaptation phases, and the final implementation of each software component.

• Microsoft-Server
• Ubunto-Linux (as an alternative for servers, in coordination with Abteilung 11)
• Microsoft Windows Systems (for clients)
• MS-Terminalserver with Citrix Virtual Apps (for multi-user client environments)
• Active Directory (AD-Kopplung for user control, must support multi-domain models)
• SVN (for defined access routes to internet services/cloud services, generally HTTPS over Proxy/Reverse Proxy)
• Microsoft-Installer (*.msi) format (preferred for client software delivery)
• NTLMv2
• Kerberos
• LDAPS
• Java (no license-pflichtige modules, e.g., OracleJava)
• .NET Runtime (for new and adaptation developments: minimum .NET Framework 4.7.1 or .NET 8.0)
• ESRI ArcGIS Pro 3.x (Client GIS)
• ESRI ArcGIS Desktop (ArcMap/ArcCatalog) Version 10.8.1 (Client GIS, support until February 2024, no new applications)
• ESRI ArcGIS Server Standard Enterprise 10.9.1 (Server GIS for ArcGIS Enterprise and Web deployment)
• Spatial Datatype SDO_Geometry
• ESRI ArcGIS Server Basic 10.8.1 (with Oracle Database Client)
• Cadenza Web Classic Version 8.3 (update to version 9.1 planned for Q3 2023, based on XML-Repositories)
• Cadenza Server/Client 8.3 (update to version 9.1 planned for Q3 2023)
• TortoiseSVN (for version management of Cadenza XML-repositories)
• FME Desktop and Server ESRI Edition (Version 2020) (ETL-Tool for geodata processing in ESRI area)
• Talend 8 (ETL-Tool for geodata processing in disy Cadenza (IDA) with Oracle area)
• Oracle Database (for Cadenza Workbooks, database-based repositories)
• BSI TR-02102-1: Kryptographische Verfahren: Empfehlungen und Schlüssellänge (Version 2024-01, or newer)
• BSI TR-02102-2: Kryptographische Verfahren: Empfehlungen und Schlüssellängen, Teil 2 - Verwendung von Transport Layer Security (TLS) (Version 2024-01, or newer)
• BSI TR-02102-3: Kryptographische Verfahren: Empfehlungen und Schlüssellängen, Teil 3 - Verwendung von Internet Protocol Security (IPsec) und Internet Key Exchange (IKEv2) (Version 2024-01, or newer)
• BSI TR-02102-4: Kryptographische Verfahren: Empfehlungen und Schlüssellängen, Teil 4 - Verwendung von Secure Shell (SSH) (Version 2024-01, or newer)
• Software Bill of Materials (SBOM) documentation (for non-self-developed program components)
• BSI TR-03183: Cyber-Resilienz-Anforderungen an Hersteller und Produkte, Teil 2: Software Bill of Materials (SBOM) (Version 1.0, or newer) (as an orientation for SBOM)
• Unattended installation (for basic configuration)
• Authentication via AD-Kopplung (password data not to be stored in the application)
• Human-readable configuration data (for developed applications)
• No use of the Windows-Registrierdatenbank for technical configuration data by the administrator
• All deployed software products must be operable in a virtualized environment
• Pure specialized applications must be runnable as released Citrix applications
• Client applications must be operable in a VDI environment
• Support for graphics card virtualization for graphic-intensive applications in VDI
• Secure software development paradigm
• SAST (Static Application Security Testing) (to be supported by development tools)
• DAST (Dynamic Application Security Testing) (to be supported by development tools)
• SCA (Software Composition Analysis) (to be supported by development tools)
• OWASP Application Security Verification Standard (ASVS, Version 4.0.3) (to be considered for web application development)
• 3-tier architecture (Client, Application, Database) for applications
• BSI-Standards for IT-Grundschutz (for information security)
• Adherence to current security standards for deployed software
• Security concept required for non-standard software
• Adherence to the current state of technology for IT systems and software
• DSGVO compliance (for processing personal data)
• Encryption of communication paths (minimum TLS 1.3 or higher)
• Standardized communication methods over HTTPS: SOAP, WebDAV, XML-RPC (for cross-location data exchange)