Romania – Computer platforms – Central systems architecture and cybersecurity for the railway information system

Opportunity description

Any interested economic operator has the right to request clarifications/additional information in connection with the procurement documentation 22 days before the deadline established for the submission of tenders. The contracting entity will respond clearly and completely to all requests for clarifications/additional information in connection with the procurement documentation on the 12th day before the deadline for the submission of tenders. The contracting entity will not respond to requests for clarifications submitted after the established deadline. Description of the products to be purchased and their intended purpose: Processing and storage architecture Complex monitoring and storage solution Train traffic monitoring solution Processing and storage architecture A central component and a local component are envisaged. The initial architecture of the applications in the IRIS system was conceived in the context of activities distributed across railway locations throughout Romania on a network with a radial topology implemented using SDH technology and a low transfer speed (32 kb/s for small workplaces and up to 1 Mb/s for large workplaces). For this reason, the applications were designed with a distributed architecture (client components on users' workstations, local servers) or with the process/services layer eliminated. With technological development, data transmission speeds on the RENTRAD network have increased to a minimum of 10 Mbps for locations with 1–2 workstations. This created the conditions for consolidating operations in the central data center while retaining the local architectures in the regional agencies of Societatea Informatică Feroviară SA. The local architectures will implement virtualization solutions and will be used for process/service servers and for managing the regional IT infrastructure. Several objectives were pursued in defining the requirements for the technical specifications: - The architecture will be implemented in the form of several medium-sized virtualization clusters; - The virtualization solutions were selected according to the nature of the hosted applications (Oracle Virtualization for the Oracle environment, Hyper-V for the Windows application environment, and RedHat OpenShift for the containerized staging environment); - Separation of the production and development/testing/training environments into distinct clusters in order to ensure safe testing conditions in the event of firmware updates; Use of virtualization platforms that allow the implementation of isolated multi-tenant solutions. In this way, zones with different security levels can be implemented on each cluster (critical production environments, development environments, testing flows); - Separation of the storage platform into two components: - high-performance storage (all-flash, at least 4 controllers, NVMe transfer, high transfer rate, only block) for the production environment, - storage with a classic architecture (low transfer rate, low disk speed, high capacity, block and file) for historical data, DMZ cluster, and repository; - All servers will be enterprise-class but with a general architecture so that they can be easily replaced in the event of failure; - The network equipment must integrate into the architecture currently in operation in the central data center. The local component consists of two servers installed in the data rooms of the regional IT agencies, NAS-type storage equipment, and equipment. NAS-type storage equipment identical to that in the regions will be installed in the Informatică Feroviară data center and is intended for saving operational information, service documentation, and intermediate data. The solutions must have capacity expansion capabilities. Complex monitoring and cybersecurity solution The components of the solution must provide the following functionalities: - Monitoring of the communications infrastructure: - Ensuring network visibility in the core area and the data center router area, - Monitoring traffic information in the core area and the data center router area; - Protecting the internal network through detection and response solutions against cyberattacks with a local sandbox environment; - Increasing the security level of essential services by ensuring: - Access management for privileged users (system and database administrators, content administrators, users with access to confidential and critical information); - Monitoring access to databases; - Vulnerability management; - Access control to the TSM-ERTMS network; - Security information and event orchestration management (SIEM). Train traffic tracking solution This solution is intended for CNCFR technical personnel involved in train traffic scheduling and tracking activities, as well as personnel in the railway traffic safety departments. The following components are included: - Workstations for CNCFR personnel involved in the train traffic scheduling and tracking process and in railway traffic safety; - Integrated system for receiving, displaying, and managing video sources, which will receive information from the traffic tracking subsystem; - Videoconferencing solution. The products requested for the IT infrastructure targeted by this project create a computing platform with a complex central architecture and a local (regional) architecture that allows the implementation of a high level of security. Contract duration: 84 months (60 months representing the warranty period) from the date the contract is signed by both parties. The estimated value of 110.552.200,00 lei excluding VAT is broken down as follows: - 99.552.200,00 lei excluding VAT for IT products (hardware and software components) -11.000.000,00 lei excluding VAT for installation, commissioning, integration, and testing services. Procedure: open. Estimated value: 110,552,200 RON. Review the original TED notice for the complete requirement, lots, amendments and attachments.