Servicios de ciber-seguridad del dato clínico (securización informática y procedimental del espacio de datos ómicos, clínicos y administrativos de IMDEA Nutrición, con especial atención a la plataforma GENYAL), a adjudicar por procedimiento abierto (SARA) con pluralidad de criterios.

The contract timeline includes an initial execution period of 12 months, with a possible extension of 6 months.

Key milestones and phases include:

• The deadline for offer submission is September 14, 2026, at 23:59.
• The opening of economic offers is scheduled for September 15, 2026, at 15:01.
• Offers must have a validity period of 2 months.
• The hiring of one full-time Data Protection Officer (DPO) or data security coordinator is planned for 18 months.
• There is a plan to analyze and approve a roadmap covering 180, 360, and 720 days, along with corresponding decision milestones.
• A Data Committee, comprising Management, DPO/Coordinator, Legal, and a scientific leader, is to be appointed with a monthly meeting cadence.

Contract start date: null

Contract end date: null

Total duration: Initial 12 months, with one possible 6-month extension.

The core scope of work for this tender is focused on providing cybersecurity services for clinical data, specifically involving the IT and procedural securitization of omic, clinical, and administrative data space for IMDEA Nutrición, with particular attention to the GENYAL platform. This includes strategic consulting, provision of specialized resources, implementation of security infrastructures, and evaluation of the access model and user training. The contract falls under technical IT support services (CPV code 72611000). The execution period is 12 months, with a potential extension of one period of 6 months.

The statement of work is structured into work packages with the following core deliverables:

• Work Package 1 (PT1):
• Hiring a full-time Data Protection Officer (DPO) in a technical-operative or data security coordinator role for 18 months.
• Work Package 2 (PT2):
• Appointment of a Data Committee (comprising Management, DPO/Coordinator, Legal, and a scientific leader) and establishment of a monthly meeting cadence.
• Assessment of necessary licenses and investment range for technologies such as Entra ID P1, SharePoint/M365, SIEM (Security Information and Event Management), and Workspace/VDI (Virtual Desktop Infrastructure).
• Consensus on the plan with GRPD Legal for compliance and the scientific leader to ensure research is not hindered.
• Analysis and approval of a 180/360/720-day roadmap, including decision milestones (e.g., deployment or discarding of Workspace/VDI after a pilot).
• Work Package 3 (PT3):
• Development of an exchange channel project, specifically a SharePoint Dropzone.
• Development and launch of the "Ficha Persona-Datos-Apps" (Person-Data-Apps Sheet), also referred to as "Catálogo del Dato v0" (Data Catalog v0).
• Evaluation of logs for SIEM, including sign-ins for Entra ID, M365 audit, file servers, and SSH/sudo Linux, ensuring this process does not cause blocking.
• Work Package 4 (PT4):
• Execution of a proof of concept and a decision on BYOD/Workspace solutions for both external and internal users.
• Provision of user training.