Incident Response Specialization Training

Summary

The procurement concerns online specialist training for police IT experts in cyber incident response and digital forensics. The contractor must offer a broad portfolio of existing courses that have already been proven in practice and can be accessed on demand and completed at the learner’s own pace. Training must be delivered in German or English, must not be subscription-based, and must support central administration and monitoring of participants’ progress. The portfolio must cover Windows, Linux and Apple operating system forensics; threat intelligence; the Internet of Things; network forensics and monitoring; malware analysis and reverse engineering; open-source intelligence; data analysis; AI-enabled attacks; data backup for complex systems; cybercrime investigations; and data backup and evidence evaluation. The contractor must provide the training environment. Access to the courses and administration area must be available for at least 12 months, and learners must have at least three months to complete a course once started. The framework agreement is planned for 2027–2030, with no guaranteed minimum annual order volume. Up to EUR 340,000 is allocated for 2027, and EUR 200,000–250,000 per year is currently planned for 2028–2030. Pricing is calculated for 40 participants, and the total price for 40 courses must not exceed EUR 340,000 including VAT. Evaluation covers the concept and delivery (40%), portfolio breadth (40%), and training materials (20%); offers scoring below 8.00 overall will be rejected. The deadline for submitting offers is 30 October 2026 at 12:00.