Public procurement notice: Contract Notice
Published: 2023-01-03
Buyer: Hellenic Corporation of Assets and Participations S.A. ( HCAP )
Country: GR
Contract type: Services
Procedure: Open procedure
CPV classification: 72150000 | 72246000 | 79410000 | 79411000
Estimated value: 360000 EUR
Submission deadline: 2023-02-08
Award criteria: The most economic tender

Technical requirements: Advisory services for Cybersecurity risk profiling, maturity assessment and development of maturity enhancement roadmap for the companies in the Growthfund portfolio
Carries out a call for tenders to select an independent Advisor, recognised and of international standing, to provide advisory services for ‘Cybersecurity risk profiling, maturity assessment and development of maturity enhancement roadmap for the companies in the Growthfund portfolio with the following objectives:
•	Implementation of the IT/Cybersecurity management pillar within the portfolio-wide Risk Management Framework
•	Identification and assessment of IT risks for portfolio companies based on a common methodology, considering their impact on business operations and the likelihood of their occurrence
•	Adoption of a systematic IT risk management methodology by portfolio companies, based on monitoring data and best practices
•	Facilitation of communication and understanding of IT/cybersecurity risks by the competent bodies of each company and by Growthfund at a headquarters level, correlation of IT risks with impacts at the operational level
Implementation of a methodology that will include, but is not limited to, questions/interviews, analysis of the activity sector of each company and specific parameters that shape the risk environment, threat profiling and controls, correlation of infrastructure with services, etc. in order to record the inherent cybersecurity risks for the company, as well as the residual risks. The establishment of a controls’ framework based on international standards, best practices, and regulatory obligations pertaining to each company according to its area of activity, its services and infrastructure, its business and operating activities. Structured documentation of the current and residual controls from all the controls included in the framework created for the company, with recorded evidence of the current control-implementing mechanisms. Matching the current controls to the inherent risks they counter. Correlation of the residual controls with the risks that must be eliminated in order for the company to reach the risk level that has been set as a target, per area.
Formation of a risk response plan/roadmap for transitioning to the target risk level by implementing/activating controls/control mechanisms. Monitoring the implementation of the roadmap, delivery of support and advisory services for the optimum implementation of the relevant actions. Reports on the implementation of the roadmap.
The service provision contract has a duration of 1 year, starting from the date the contract is signed; it can be renewed for 1  plus 1  year, following the exercise of the exclusive unilateral right of the Company, which, should it exercise this right, shall notify the Advisor in writing that it wishes the contract to be extended  two (2) months prior to the end of the 1st and 2nd year.
The service provision contract has a duration of 1 (one) year, starting from the date the contract is signed; it can be renewed for 1 (one) plus 1 (one) year, following the exercise of the exclusive unilateral right of the Company, which, should it exercise this right, shall notify the Advisor in writing that it wishes the contract to be extended  two (2) months prior to the end of the 1st and 2nd year, respectively.
The date and place of opening of the Proposals shall be determined following decision of the competent Growthfund body and as provided by Growthfund's Procurement Regulation. The date of the opening of tenders may change due to business needs.

Eligibility requirements: Personal situation criteria and eligibility criteria as stated in the procurement documents.

Award value: 360000