Cybersecurity Technical Assistance and Consultancy Framework Agreement

Summary

The procurement establishes a framework agreement to select providers of technical assistance and consultancy for the Port Authority of Tarragona’s cybersecurity programme. Providers will support the definition, development and implementation of a cybersecurity management system and the deployment of security controls and technical measures. Assignments may cover cybersecurity strategy and governance, regulatory and standards compliance, risk analysis, security architecture and solution deployment and administration, security audits and penetration testing, digital threat and fraud monitoring, and AI-based data analytics. Consultancy, training, procedure development and audits concerning critical infrastructure and classified information may also be required. Work will be ordered as needed through separate contracts under the framework; neither a minimum number of orders nor a minimum revenue is guaranteed. Up to three providers will be admitted, and each call-off will be competed among them. The initial framework term is 12 months, with three possible extensions of up to 12 months each, for a maximum total of 48 months. The estimated value is €1,400,000 excluding VAT, with an annual ceiling of €350,000; payment depends on work actually ordered and delivered. Maximum hourly rates excluding VAT are €140 for the project manager, €108 for the senior regulatory and governance expert, €88 for the GRC expert, €132 for the cybersecurity architect, €97 for the systems administrator, €116 for the technical auditor and €110 for the AI and data management specialist. The procurement is not divided into lots. Bidders must demonstrate the required turnover, professional liability insurance, relevant experience, certifications and competence of a team covering seven required profiles. The bid must include the European Single Procurement Document, a commitment to provide the team and resources, and a compliant service proposal. Evaluation is weighted equally between price and other formula-based criteria on one hand, and quality and the technical proposal on the other. Environmental and data protection obligations apply during performance; a guarantee may be required for each call-off with an estimated value of €15,000 or more.