Poland – Computer audit and testing services – Provision of ICT security audit services, physical security audits, and support for PFRON

Opportunity description

Description of the subject matter of the contract. 1. To ensure transparency, standardize interpretation, and facilitate performance of the subject matter of the contract, the following defined terms have been used in this Specification of Contract Conditions (SWZ) and the draft contractual provisions (PPU): 1.1. Year 1 - a period of 12 months of contract performance under the basic contract, calculated from the date of conclusion of the contract, during which all Tasks will be performed.; 1.2. Year 2 - a period of 12 months of contract performance under the basic contract, commencing no earlier than after the expiry of 12 months from the date of conclusion of the Contract and ending no later than before the expiry of 24 months from the date of conclusion of the Contract, during which all Tasks, except Task 3, will be performed again.; 1.3. Year 3 - a period of 12 months of contract performance under the Option, commencing no earlier than after the expiry of 24 months from the date of conclusion of the Contract and ending no later than before the expiry of 36 months from the date of conclusion of the Contract, during which all Tasks, except Task 3, will be performed again. 2. The subject matter of the contract is: 2.1. Task No. 1 – conducting ICT security audits of PFRON information systems in accordance with the provisions of the Contract and the Description of the Subject Matter of the Contract (OPZ) (Appendix No. 1 to the Contract) under the basic contract, i.e. in Year 1 and Year 2, and under the Option in Year 3, with the scope, methodology, subject matter of the audits, and reporting requirements being identical (the same) for each Year. 2.2. Task No. 2 – a continuous specialist support service within the scope and in the manner described in the Contract and the OPZ (Appendix No. 2 to the Contract), comprising: under the basic contract (1,000 Person-hours) and under the Option (500 Person-hours). 2.3. Task No. 3 – designing, preparing, and conducting e-learning training in the field of cybersecurity in Year 1 of the term of the contract (basic contract), within the scope and in the manner described in the Contract and the OPZ (Appendix No. 3 to the Contract): 2.3.1. Stage 1 - Preparation of the scope, content, tests, and all training materials; 2.3.2. Stage 2 - Placement of the training courses on the Moodle platform and testing the operation of the training courses and tests; 2.3.3. Stage 3 - Conducting the training courses and preparing a report. 2.4. Task No. 4 – Phishing Simulations: 2.4.1. include planning, conducting, and settling two controlled phishing attack campaigns targeting the Contracting Authority's employees in a given Year of performance, at intervals of no less than 3 months, in accordance with the scope and in the manner described in the Contract and the OPZ (Appendix No. 4 to the Contract); 2.4.2. they will be performed twice under the basic contract, i.e. in Year 1 and Year 2, and once under the Option in Year 3; 2.4.3. the scope, methodology, number of campaigns, manner of their performance, and reporting requirements are identical (the same) for each Year. 2.5. Task No. 5 - conducting physical security audits of PFRON offices and branches and preparing a set of reports in accordance with the provisions of the Contract and the OPZ (Appendix No. 5 to the Contract) under the basic contract, i.e. in Year 1 and Year 2, and under the Option in Year 3, with the scope, methodology, subject matter of the audits, and reporting requirements being identical (the same) for each Year. 2.6. Task No. 6 - providing continuous support from specialists in the field of substantive consultations in the manner and according to the rules described in the Contract and the OPZ (Appendix No. 6 to the Contract) under the basic contract (1,000 Person-hours) and under the Option in Year 3 (500 Person-hours). . 1. To ensure transparency, standardize interpretation, and facilitate performance of the subject matter of the contract, the following defined terms have been used in this Specification of Contract Conditions (SWZ) and the draft contractual provisions (PPU): 1.1. Year 1 - a period of 12 months of contract performance under the basic contract, calculated from the date of conclusion of the contract, during which all Tasks will be performed.; 1.2. Year 2 - a period of 12 months of contract performance under the basic contract, commencing no earlier than after the expiry of 12 months from the date of conclusion of the Contract and ending no later than before the expiry of 24 months from the date of conclusion of the Contract, during which all Tasks, except Task 3, will be performed again.; 1.3. Year 3 - a period of 12 months of contract performance under the Option, commencing no earlier than after the expiry of 24 months from the date of conclusion of the Contract and ending no later than before the expiry of 36 months from the date of conclusion of the Contract, during which all Tasks, except Task 3, will be performed again. 2. The subject matter of the contract is: 2.1. Task No. 1 – conducting ICT security audits of PFRON information systems in accordance with the provisions of the Contract and the OPZ (Appendix No. 1 to the Contract) under the basic contract, i.e. in Year 1 and Year 2, and under the Option in Year 3, with the scope, methodology, subject matter of the audits, and reporting requirements being identical (the same) for each Year. 2.2. Task No. 2 – a continuous specialist support service within the scope and in the manner described in the Contract and the OPZ (Appendix No. 2 to the Contract), comprising: under the basic contract (1,000 Person-hours) and under the Option (500 Person-hours). 2.3. Task No. 3 – designing, preparing, and conducting e-learning training in the field of cybersecurity in Year 1 of the term of the contract (basic contract), within the scope and in the manner described in the Contract and the OPZ (Appendix No. 3 to the Contract): 2.3.1. Stage 1 - Preparation of the scope, content, tests, and all training materials; 2.3.2. Stage 2 - Placement of the training courses on the Moodle platform and testing the operation of the training courses and tests; 2.3.3. Stage 3 - Conducting the training courses and preparing a report. 2.4. Task No. 4 – Phishing Simulations: 2.4.1. include planning, conducting, and settling two controlled phishing attack campaigns targeting the Contracting Authority's employees in a given Year of performance, at intervals of no less than 3 months, in accordance with the scope and in the manner described in the Contract and the OPZ (Appendix No. 4 to the Contract); 2.4.2. they will be performed twice under the basic contract, i.e. in Year 1 and Year 2, and once under the Option in Year 3; 2.4.3. the scope, methodology, number of campaigns, manner of their performance, and reporting requirements are identical (the same) for each Year. 2.5. Task No. 5 - conducting physical security audits of PFRON offices and branches and preparing a set of reports in accordance with the provisions of the Contract and the OPZ (Appendix No. 5 to the Contract) under the basic contract, i.e. in Year 1 and Year 2, and under the Option in Year 3, with the scope, methodology, subject matter of the audits, and reporting requirements being identical (the same) for each Year. 2.6. Task No. 6 - providing continuous support from specialists in the field of substantive consultations in the manner and according to the rules described in the Contract and the OPZ (Appendix No. 6 to the Contract) under the basic contract (1,000 Person-hours) and under the Option in Year 3 (500 Person-hours). 3. The Contracting Authority provides for the possibility of exercising the Option: 3.1. under Task No. 1 – regarding repetition of the audits of PFRON information systems and preparation of a set of reports in Year 3 - a maximum of one repetition under the Option; 3.2. under Task No. 2 – regarding repetition of the continuous specialist support services within the scope and in the manner described in the Contract and the OPZ in Year 3 (a maximum of 500 Person-hours under the Option); 3.3. under Task No. 4 – regarding repetition of the Phishing Simulations in Year 3; 3.4. under Task No. 5 – regarding repetition of the physical security audits of PFRON offices and branches and preparation of a set of reports in accordance with the provisions of the Contract and the OPZ in Year 3; 3.5. under Task No. 6 – regarding repetition of the provision of continuous specialist support in the field of substantive consultations in accordance with the Contract and the OPZ in Year 3 (a maximum of 500 Person-hours under the Option. 4. A detailed description of the subject matter of the contract and the manner of its performance is contained, as applicable, in the OPZ together with the appendices (Appendices Nos. 1, 2, 3, 4, 5, and 6) and in the draft provisions of the Contract, which will be incorporated into the content of the public procurement Contract (Appendix No. 2). 5. Contract performance period - a maximum of 36 months from the date of conclusion of the Contract. Detailed deadlines for the performance of individual Tasks are specified in Paragraph 3 of the Contract. 6. The Contracting Authority provides for the possibility of amending the contract. Details concerning amendment of the contract are provided in Appendix No. 2 to the SWZ. 7. Tender validity period - until 03.08.2026. Procedure: open. Estimated value: 2,522,639.32 PLN. Review the original TED notice for the complete requirement, lots, amendments and attachments.