Netherlands – IT services: consulting, software development, Internet and support – Security Incident Response 2.0 (2026)

The provision of Security Incident Response services for the Participants via an SLA. The scope of this tender consists of the following core components. - Analysis: mapping the extent and cause of an incident and investigating it promptly and adequately; - Coordination: coordinating the handling of the incident with Participants. Coordination of the work can relate to all parts of the Contract. - Defence and mitigation: containing and eradicating the “infected” parts of the IT and OT infrastructure (“firefighting function”) - Investigation: conducting digital forensic investigation (“detective function”). - Evaluation and reporting: adequately transferring results (details of investigation) to incident response partners designated by us (“reporting function”). With these reports, it should also be possible to contribute to ‘compliance’, for example by providing a ‘second opinion’. As part of these core components, the following can be provided: - The supply and/or use of hardware and software to carry out parts of this Contract. In doing so, the Contractor will take into account the standards used by the Participant and/or the installed base. - Training: In case, the Participant can request the Contractor to conduct or provide training. In addition to these core components, the following are also part of the scope. - Strategic and technical advice: strategic and technical advice on the handling of incidents. Think here of advice on paying compensation in the event of attacks/ransomware. Or strategic advice on policy regarding these topics. - Communication advice: advice on communication strategies and advice on communication in the event of specific incidents. This can include assisting the Institution in drafting communiqués and/or translating technical matters into understandable language to support general communication to the outside world. Additional reporting activities can also be included here, such as advising on how reports can be shared with the (SURF) communities and/or third parties or providing contributions to presentations in which results are shared. - Conducting negotiations on behalf of the Institution regarding security incidents with ‘malicious parties’. - Other forms of knowledge sharing within and outside the Institutions/community, such as contributing knowledge and expertise to exercises, red teaming and training to strengthen cooperation within the incident response process. Each incident response request can include one or more of the aforementioned tasks, but does not have to include all tasks. Thus, in the event of an incident, the Institution may call on ‘defence and mitigation’, but this Institution can itself provide for the coordination of the work. Other combinations of parts of the contract can also be assigned to the contractor by the Institution.