Four-year framework agreement for penetration testing and consulting services

Summary

The tender concerns a framework agreement of up to four years for preparing, conducting and following up penetration tests of ÜSTRA's various IT systems and infrastructure, together with related consulting services, in Hannover and remotely where required. The agreement takes effect upon award, has an initial term of two years and may be extended twice by one year; the maximum term is four years. The maximum framework value is EUR 400,000 excluding VAT, and call-off volumes are not guaranteed. The bidder must provide at least one suitable reference covering at least 5 required test objects and at least one reference covering at least 3 types of penetration tests. The bidder and its penetration testing team must be based in the EU or EEA. For participation, up to 4 references from different reference customers from the last 6 years, starting in 2020, must be available, together with a central technical contact with at least C1 German-language skills and certifications for at least 3 employees in CISSP, OSCP or OSWE. The services may cover networks, servers, workstations, applications, web applications, cloud environments and security systems. The services include test preparation and planning, testing, technical consulting, result analysis, German-language reports and presentations. A first report draft is generally due within 5 working days and the final quality-assured report within 10 working days after completion of the testing phase. For a critical finding, an ad hoc report must be delivered by 17:00 Central European time on the day following identification. Participation requests or tenders must be submitted electronically by 25 September 2026 at 11:00. Price accounts for 30% of the evaluation and quality for 70%; within quality, the main contact's references account for 30% and the presentation for 70%.