Poland – Security software development services – Wdrożenie i utrzymanie Systemu Zarządzania Bezpieczeństwem Informacji (SZBI) oraz SOC wraz ze szkoleniami w Samodzielnym Publicznym Szpitalu Klinicznym im. Prof. W. Orłowskiego CMKP w Warszawie

The subject of the contract is the implementation and maintenance of the Information Security Management System (ISMS) and SOC along with training at the Independent Public Clinical Hospital named after Prof. W. Orłowski CMKP in Warsaw, which has been divided into two packages. Package No. 1 - Implementation and maintenance of the Information Security Management System (ISMS) The subject of the contract is the implementation and maintenance at the Contracting Authority of an Information Security Management System (ISMS) compliant with the standard PN-EN ISO/IEC 27001:2023-08, including: a) the development of comprehensive ISMS documentation and procedures, including the Information Security Policy, operational procedures, and incident response procedures, b) the implementation of the ISMS within the structures of the Contracting Authority, along with the appropriate technical and organizational configuration guidelines, c) the planning of processes for monitoring the effectiveness of the implemented ISMS and its continuous improvement, d) the conduct of training for the Contracting Authority's personnel: e-learning training based on the implemented ISMS documentation and raising awareness in the field of cybersecurity (cyber hygiene) — for current and future employees — as well as stationary training for the Contracting Authority's management. e) the maintenance and improvement of the ISMS for a period from the implementation and formal handover of the ISMS until 36 months from the date of signing the contract, including periodic ISMS reviews, updating documentation and the risk register, compliance reviews, support during controls and audits, as well as recommendations for corrective and improvement actions. A detailed description of the subject of the contract relating to Package No. 1 is in Annex No. 2 to the SWZ. Package No. 2 - Provision of Security Operations Centre (SOC) Service The subject of the contract is the provision of the Security Operations Centre (hereinafter: SOC Service), including: a) the SOC Service will be provided for a period of 36 months from the date of concluding the contract (including pre-implementation analysis and start-up). b) the SOC Service must be provided by an entity providing cybersecurity services, meeting the organizational and technical conditions resulting from the Act of 5 July 2018 on the national cybersecurity system, in the wording in force from 3 April 2026 (amended by the Act of 23 January 2026, Journal of Laws of 2026, item 252), and the executive acts to this Act. c) the SOC Service will be provided in real-time, on a continuous basis 24 hours a day, 7 days a week, for 365 days a year (24/7/365). d) for the purposes of implementing the SOC Service, the Contractor will provide a SIEM system and an Incident Management System in a service model, on the Contractor's platform or in the Contracting Authority's infrastructure, along with documentation and technical support for the entire period of providing the SOC Service. e) the operational procedures of the SOC Service (incident classification, response scenarios, playbooks) must be consistent with the ISMS documentation being prepared as part of this procedure, in particular with the procedure for managing serious incidents and the policy of logging and monitoring. A detailed description of the subject of the contract relating to Package No. 2 is in Annex No. 3 to the SWZ. The Contracting Authority does not require the submission of subject-related evidence with the offer. Information about the subject-related evidence is in Section 8 of the Specification of Contract Conditions.