Consulting Services for Cybersecurity & Resilience Strengthening

To achieve the stated project objectives, the following specific requirements are placed on the service provider: Specifically, in addition to project management services, the service provider must provide the following technical services: a) Based on existing company information (company policy, strategies, guidelines, procedures, work instructions, processes, IT/OT landscape, BIA gap analyses, network plans, project results, etc.), develop, coordinate, and support the implementation of effective and sustainable deliverables/governance documentation (policies, strategies, concepts, risk analyses, playbooks, etc.). Implementation support includes, unless otherwise specified in the mentioned sub-projects, at least: aa) the creation or adaptation of effective and sustainable policies, procedures, work instructions, processes (BPMN), etc., ab) the definition of roles and responsibilities, particularly with regard to segregation of duties, and their documentation in a RACI matrix, ac) the development of meaningful metrics and KPIs to enable control and further development, ad) data collection and consolidation of decentralized specialist information into one or more systems, ae) the provision and dissemination of information for management and affected organizational units, for the presentation of new requirements and procedures. Specific work packages of the tender are: - Project Management Package - Security & Resilience Policy Package - Asset Management Package - Information Security Risk Management Package - Risk Management Package in preparation for the national risk analysis - Resilience Plan Package - Incident Management Package - Business Continuity Package - IT Service Continuity Management (ITSCM) Package - Identity and Access Management Package - Security Awareness Package - HR Security Package - Physical Security Package - Network Package - Cryptography Package - System and Network Monitoring Package - Secure Development Package - Supply Chain Security Package - Optional Package: IT-SIKAT Support Services The following services are not part of this tender: - Implementation of structural security measures. - Provision, procurement, or operation of hardware or software. - Legally binding individual case reviews or legal advice, in particular o binding interpretations of legal obligations under NIS2 or KRITIS-DachG, o representation towards supervisory or reporting authorities, o creation of legally binding statements. - Operational support for real security incidents or crisis situations, in particular o incident response services in the event of an incident, o 24/7 on-call duty or emergency support, o operational communication with authorities or external bodies. - Audits, certifications, or conformity assessments, in particular o internal or external audits according to KRITIS-DachG, ISO/IEC 27001, BSI IT-Grundschutz or comparable standards, o checks to determine legal or normative conformity, o preparation, accompaniment, or execution of audits by supervisory or certification bodies. - Creation, updating, deepening, or re-execution of gap analyses for NIS2 or KRITIS-DachG. - Execution of a Business Impact Analysis (BIA).