IT security check

The MHKBD is issuing a framework agreement for the execution of IT security checks at state and municipal level. The authorized parties in North Rhine-Westphalia are: - the state authorities, - the municipalities of North Rhine-Westphalia, - the IT service providers, - those controlled directly or indirectly by the state of NRW and/or the municipalities of North Rhine-Westphalia. The contractor must develop suitable audit schemes, e.g. in the form of suitable questionnaires, for carrying out the IT security check. This audit must cover all IT operating scenarios occurring in practice in the state of North Rhine-Westphalia with sufficient quality and to a sufficient standard, as well as the fulfillment of information security obligations by the organization being audited. When developing the audit schemes, reference should be made to relevant documents from the Federal Office for Information Security (BSI), particularly the "Weg in die Basisabsicherung" (WiBA). The operating scenarios include, in particular, the case of full in-house operation of IT services, the case of outsourcing of services, and any mixed forms. These operating scenarios must be fully covered by the audit schemes and - with regard to requirement fulfillment - recorded during the audit. By definition: In-house operation exists when a data-responsible entity (authority) is also the data-processing entity. Outsourcing exists when a data-responsible entity (authority) has its IT operated by a data-processing entity (IT service provider controlled directly or indirectly by the state of NRW and/or the municipalities of North Rhine-Westphalia). If a data-responsible entity has IT services operated by IT service providers that are not controlled directly or indirectly by the state of NRW and/or the municipalities of North Rhine-Westphalia, these (external) IT service providers are not covered by the scope of the audits and do not need to be included in the audit schemes themselves. Nevertheless, even in these cases, the audit schemes must record whether the data-responsible entity has fulfilled all relevant obligations of the BSI IT-Grundschutz and BSI Standards 200-x with sufficient quality and to a sufficient standard. The contractor must create the audit schemes strictly according to the technical specifications of the BSI IT-Grundschutz Compendium and the BSI Standards series 200-x, including the specific implementation of an audit using WiBA. At the request of the authorized parties, the contractor must carry out an IT security check. An IT security check within the meaning of this tender is a predominantly organizationally oriented standardized review of the maturity level of an information security management system (ISMS) of a public contracting authority. The focus is on, among other things, the existing policies, roles, responsibilities, and processes, especially including outsourcing, as well as their practical implementation within an ISMS based on the BSI IT-Grundschutz Compendium and BSI Standards series 200-x. The assessment is carried out by the later contractor primarily qualitatively using suitable audit schemes, e.g., through questionnaires, workshops, and interviews. The goal is a standardized report regarding the maturity level of the ISMS in the audited organization. In addition, the report must identify concrete and independently usable areas for action with associated recommendations. Explicitly not part of the tender is the remediation of identified deficits or the provision of individual consulting services beyond the standardized report and, if applicable, the results presentation to the audited organizations. The technical implementation of the ISMS requirements will only be considered in an overview and sample-based manner, without the use of in-depth technical scans or active testing measures...