Poland – Software package and information systems – Wdrożenie zintegrowanej architektury cyberbezpieczeństwa IT i OT wraz z przygotowaniem organizacyjnym Zamawiającego w ramach projektu grantowego „Cyberbezpieczne Wodociągi

The subject of the contract is the implementation of an integrated IT and OT cybersecurity architecture along with the organisational preparation of the Buyer within the grant project "Cybersecure Water Supply". 2. Acting under the Act of 16 April 1993 on Combating Unfair Competition (Journal of Laws of 2026, item 85), the Buyer excludes the transparency of part of the OPZ. The exclusion applies to technical and organisational information regarding the Buyer's competence and organisational gaps, needs in the field of cybersecurity, teleinformatics systems, and applied security mechanisms, which constitute a business secret and whose disclosure could lead to an increased risk of cybersecurity breach, in particular by enabling the identification of the architecture of the systems or potential vulnerabilities, or security techniques and tactics of the infrastructure. The scope of the transparency exclusion has been limited to the information necessary to protect the security of the company, including teleinformatics systems, and does not violate the principles of fair competition or equal treatment of contractors, while at the same time providing contractors with access to the information necessary to prepare offers. The subject of the contract includes a coherent security model combining technical, organisational, and competence solutions. Although individual elements may have a general character, their combined set and reference to the actual environment of the Buyer leads to the disclosure of the overall security architecture. The disclosure of such a consolidated image could enable unauthorised persons to identify the security architecture, response methods to incidents, dependencies between systems, and potential weaknesses, which in consequence increases the risk of a successful attack. According to the MITRE ATT&CK approach, knowledge of protection mechanisms, organisational procedures, and user behaviours can be used at various stages of the attack chain, including the preparation, reconnaissance, and privilege escalation phases. The Buyer emphasises that the subject of the contract concerns systems important for ensuring the continuity of public service provision, and its aim is to achieve a real, operational level of cyber threat resilience. The exclusion of transparency has been applied as a proportional measure aimed at protecting the security of the Buyer, while at the same time ensuring that contractors have access to full documentation on an equal basis, after meeting the confidentiality requirements. 3. The public part of the OPZ is Annex No. 8 to the SWZ. 4. The non-public part of the OPZ, which is Annex No. 9 to the SWZ, will be made available to the Contractor who submits an appropriate application together with a confidentiality declaration, the template of which is Annex No. 10 to the SWZ, on the terms specified below. 5. The deadline for submitting the application referred to in point 4 expires 7 days before the specified date for submitting offers. Applications submitted after this deadline may be left unanswered by the Buyer. 6. The application for access to the non-public part of the OPZ may only be submitted by a Contractor who demonstrates the use of organisational and technical measures ensuring the protection of confidential information. The Buyer considers the fulfilment of the above condition, in particular, the possession of an implemented information security management system in accordance with the ISO/IEC 27001 standard or equivalent, confirmed by a certificate issued by an accredited certification body, or the possession of a valid industrial security certificate of any level or another document issued by independent entities confirming the use of organisational and technical measures ensuring the protection of information for any industry, e.g., a valid TISAX certificate (minimum level AL2) or a current SOC 2 Type II audit report. The Contractor attaches a certificate/document confirming compliance with the original as an annex to the application referred to in point 4. 7. The application together with the confidentiality declaration is signed by a person authorised to represent the Contractor or a duly empowered proxy. In the case of action by a proxy, the application must be accompanied by the appropriate power of attorney. 8. The application, signed with a qualified electronic signature, must be submitted via the Open Nexsus procurement platform no later than 7 days before the offer submission deadline, with the reservation that the Buyer does not bear responsibility for the inability to prepare an offer in the event of submitting an application within a timeframe that prevents familiarisation with the documentation and preparation of the offer before the offer submission deadline. 9. The Buyer will provide the non-public part of the OPZ upon receipt of a complete application, submitted in accordance with the SWZ. In the event of formal deficiencies in the application, the Buyer may call upon the Contractor to supplement them within a specified deadline. The non-public part of the OPZ will be provided after the formal deficiencies have been successfully supplemented. 10. Information contained in the non-public part of the OPZ may be used exclusively for the purpose of preparing and submitting an offer in this procedure. Its disclosure to third parties is prohibited, except for persons engaged on the Contractor's side in the preparation of the offer, provided that these persons are obliged to maintain confidentiality to at least the same extent as specified in the Contractor's declaration. The Contractor is responsible for the breach of the confidentiality obligation by persons to whom it has disclosed information covered by the non-public part of the OPZ. 11. The detailed obligations of the contractor in the field of implementing the subject of the contract are specified in the planned provisions of the contract for the public procurement - Annex No. 1 to the Specification of Contract Terms. 12. The Buyer does not allow the submission of partial offers.