Poland – Security software development services – Implementation and maintenance of an Information Security Management System (ISMS) and SOC, together with training, at the Prof. W. Orłowski CMKP Independent Public Clinical Hospital in Warsaw

Opportunity description

The subject matter of the contract is the implementation and maintenance of an Information Security Management System (ISMS) and SOC, together with training, at the Prof. W. Orłowski CMKP Independent Public Clinical Hospital in Warsaw, which has been divided into two packages. Package No. 1 - Implementation and maintenance of an Information Security Management System (ISMS) The subject matter of the contract is the implementation and maintenance at the Contracting Authority of an Information Security Management System (ISMS) compliant with the PN-EN ISO/IEC 27001:2023-08 standard, comprising: a) development of comprehensive ISMS documentation and procedures, including the Information Security Policy, operating procedures and incident response procedures, b) implementation of the ISMS within the Contracting Authority's structures, together with appropriate technical and organizational configuration guidelines, c) planning processes for monitoring the effectiveness of the implemented ISMS and its continuous improvement, d) conducting training for the Contracting Authority's personnel: e-learning training on the implemented ISMS documentation and training to raise awareness of cybersecurity (cyber hygiene) — for current and future employees — as well as in-person training for the head of the Contracting Authority. e) maintenance and improvement of the ISMS for the period from the implementation and formal handover of the ISMS until 36 months from the date of signing the contract, comprising periodic ISMS reviews, updates to the documentation and risk register, compliance reviews, support during inspections and audits, and recommendations for corrective and improvement actions. A detailed description of the subject matter of the contract concerning package No. 1 is contained in Annex No. 2 to the SWZ. Package No. 2 - Provision of the Security Operations Center service (SOC Service) The subject matter of the contract is the provision of the Security Operations Center service (hereinafter: SOC Service), comprising: a) The SOC Service will be provided for a period of 36 months from the date of conclusion of the contract (including pre-implementation analysis and commissioning). b) The SOC Service must be performed by an entity providing cybersecurity services that meets the organizational and technical conditions arising from the Act of 5 July 2018 on the national cybersecurity system, in the wording applicable from 3 April 2026 (amended by the Act of 23 January 2026, Journal of Laws of 2026, item 252), and the implementing acts for that Act. c) The SOC Service will be provided in real time, continuously, 24 hours a day, 7 days a week, 365 days a year (24/7/365). d) For the purposes of providing the SOC Service, the Contractor will provide a SIEM system and an Incident Management System under a service model, on the Contractor's platform or within the Contracting Authority's infrastructure, together with documentation and technical support for the entire period of provision of the SOC Service. e) The SOC Service operating procedures (incident classification, response scenarios, playbooks) must be consistent with the ISMS documentation being prepared as part of this procedure, in particular with the major incident management procedure and the logging and monitoring policy. A detailed description of the subject matter of the contract concerning package No. 2 is contained in Annex No. 3 to the SWZ. The Contracting Authority does not require the submission of subject-matter evidence together with the tender. Information on entity-related evidence is contained in Chapter 8 of the Specification of Contract Terms. The detailed description of the subject matter of the contract constitutes Annex No. 2 to the SWZ. The detailed description of the subject matter of the contract constitutes Annex No. 3 to the SWZ. Procedure: open. Review the original TED notice for the complete requirement, lots, amendments and attachments.