Central solution for secure remote access to IT and OT systems

1. Client Joint requirement of Hamburger Wasserwerke GmbH & Hamburger Stadtentwässerung AöR The client is an operator of critical infrastructure in the area of water supply and wastewater disposal and operates a distributed IT and OT system landscape. 2. Objective of the market exploration The client intends to introduce a central solution for the secure control and execution of remote access to IT and OT systems. The aim of this market exploration is to gain an overview of solutions available on the market and different technical and organizational approaches. In particular, insights are to be gained on: • suitable solution architectures • technical implementation options for remote access • operating and support models • license and cost structures • scalability and volume requirements • typical procedure models for the introduction of corresponding solutions • BSI conformity and certifications The market exploration serves exclusively the preparation of a possible award procedure and does not constitute a tender.

3. Initial situation The client currently operates a distributed infrastructure with: • various administrative, plant, or operational sites • own data centers • diverse IT and OT systems External service providers access different systems for maintenance, troubleshooting, updates, and project work, including: • IT systems (e.g., servers, applications, databases) • OT systems (e.g., technical plants) For remote access, heterogeneous solutions and procedures currently exist. 4. Target state (functional requirements) A solution is sought that supports the following requirements in particular: • Central control and management of remote access • Support for internal and external user groups • Granular role and authorization concept • Approval-controlled and time-limited access • Logging and traceability (audit capability) • Support for access to IT and OT systems • Secure connection architecture (e.g., via mediation instances / DMZ) • Scalability for a distributed infrastructure The client is expressly interested in different solution approaches. 5. Operating and support requirements In addition to providing the solution, support services in operation are also expected. The client generally operates the solution themselves (e.g., administration and user management) but requires support in the following areas in particular: • Maintenance and updating of software components • Maintenance and, if necessary, replacement of hardware components • technical support • Support with malfunctions and error analysis • Execution of updates and release changes Approaches for supported self-operation as well as possible alternative operating models are sought. 6. Questions to the market Interested companies are requested to provide feedback on the following points: Solution & Architecture • What solution approaches do you offer for secure remote maintenance and access to IT and OT systems? • How is the control and approval of access implemented? • What components are typically required (software, hardware)? • What experience do you have with the integration of your solution into Security Information and Event Management systems (SIEM)? Operation & Organization • How is user and rights management carried out? • How is audit-proof logging and traceability ensured? • What operating and support models do you offer? (SaaS, On-Prem, hybrid) • What experience do you have with customer-internal operating costs during/after the introduction of the solution? Scaling & Costs • How can your solution be scaled technically and organizationally if additional locations, systems, or users are connected (e.g., with regard to required components, performance, operating costs, and costs)? • What license and price models are typically used for your solution (e.g., per user, location, infrastructure, or usage)? • What price indication can be expected for your solution and what factors significantly influence the pricing? Introduction & Implementation • How is the introduction of your solution typically carried out (e.g., reference project structure or phase model)? • What timeframe is typically expected for the introduction of your solution? • What success factors and typical challenges should be considered on the customer side for the successful introduction of your solution (e.g., roles, processes, and requirements)? • What experience do you have in introducing comparable solutions in the critical infrastructure environment, especially in the water sector? 7. Participation and further procedure Interested companies are requested to submit their feedback by August 24, 2026, 12:00 PM via ausschreibungen@hamburgwasser. The client is initially interested in the submission of company documents, presentations, or comparable documents that answer the above questions. Based on the feedback received, the client reserves the right to conduct in-depth discussions and presentation or demonstration appointments with selected companies. In this case, the signing of an NDA is necessary. Participation in the market exploration is voluntary and non-binding. The client reserves the right to conduct an award procedure based on the results.