Germany – IT services: consulting, software development, Internet and support – IT-Sicherheitscheck

The State of North Rhine-Westphalia, represented by the Ministry for Home Affairs, Municipalities, Building and Digitalisation of the State of North Rhine-Westphalia (MHKBD), wishes to enhance information security at the state level and at the municipal level. To achieve this goal, the MHKBD intends to offer state authorities, municipalities, and IT service providers controlled by the State of NRW or municipalities the possibility to have an IT security check carried out. The IT security check is intended to determine the overall information security of the eligible parties, identify potential for improvement and provide the MHKBD with an empirically sound overview of systematic problems regarding information security (categorised according to various criteria, e.g. regional). The basis for this is also the information security analysis carried out in 2024. The contractor must carry out the IT security check in accordance with the specifications of the BSI IT Baseline Protection Catalogue and the BSI standards of the 200-x series. An IT security check within the meaning of the present invitation to tender is a predominantly organisationally oriented standardised review of the maturity level of an information security management system (ISMS) of a public contracting authority. The focus is on, among other things, the existing guidelines, roles, responsibilities and processes as well as their lived implementation within the framework of an ISMS on the basis of the BSI Baseline Protection Catalogue and the BSI standard series 200x. The assessment is primarily qualitative, for example through questionnaires, workshops and interviews, with the aim of determining the maturity level of the ISMS organisation in a standardised report and identifying areas for action. The technical implementation of the ISMS specifications is only considered in an overview and sample manner, without the use of more in-depth technical scans or active testing measures. The scope of the IT security check will be uniformly prescribed. For this purpose, the MHKBD is awarding a framework contract, on the basis of which the eligible parties - state authorities, municipalities and IT service providers controlled by the state or municipality - can commission the contractor to carry out an IT security check. This enables the eligible parties to call up the service without an additional formal tendering procedure. The MHKBD will bear the costs for the municipalities and the municipally controlled IT service providers until 31.12.2026 from funds under the Law on the Regulation of the State of North Rhine-Westphalia's Grants to Municipalities and Municipal Associations (Municipal Financing Law). The state authorities and IT service providers of the state must bear the costs themselves.