Public procurement notice: Contract Notice
Published: 2025-06-30
Buyer: TSCNET Services GmbH
Country: DE
Region: DE212
Contract type: Services
Procedure: Negotiated with prior call for competition
CPV classification: 72222300: Information technology services
Submission deadline: 2025-07-30

Technical requirements: TSCNET Services GmbH located in Munich, Germany, is an ISO 27001:2022 certified organization providing services 24 hours a day, 7 days a week, 365 days a year, to customers operating critical infrastructure connected to the Central and Eastern European power grid. As part of TSCNET's risk mitigation strategy and it's adherence to legal, regulatory and contractual obligations, TSCNET wishes to contract a specialist third-party to ensure round the clock security monitoring, alert analysis and incident handling for up to 500 IT assets (based on the equivalent amount of IP addresses) distributed across hosted, mobile, on-premise and cloud instances. The third-party needs to be a Managed Security Services Provider (MSSP) with not only best of breed expertise, but excellent service delivery and multiple years' experience in the European energy sector.
Current entry in the professional or commercial register of the country of origin or presentation of a corresponding certificate.
References to services comparable to the advertised service.

The following information must be provided for each reference:
•	Client
•	Date of contract award
•	Order and final invoice value
•	Representation of project size and volume
•	Main service contents
•	Start and end of services
•	Number of applicant's employees working on the project
•	Naming of the responsible persons on the applicant’s side and on the reference client’s side
•	Providing the contact details of the reference client
The applicant must use the form "TSCNET_Reference list_MSSP.docx".
Confirmation by the applicant through self-declaration that the applicant  is able
a) to carry out the contract execution in English, including all documents and correspondence;
b) to provide project managers who speak fluent English (at least B2 or equivalent) in sufficient numbers to process the order;
c) on-site work managers who speak fluent English (at least B2 or equivalent);
d) to monitor and manage up to 500 IT assets across various environments (cloud, on-premise, mobile, hosted).
To meet the requirements of this Section III.1.4 in the EU notice, bidders must demonstrate ISO/IEC 27001:2022 certification, experience with 24/7 managed security services for critical infrastructure, and compliance with GDPR, NIS2, and the EU AI Act. They must also ensure data residency within the EU/EFTA, provide English-speaking personnel, and operate SIEM, SOAR, EDR, and CTI systems. Additional expectations include qualified staff with relevant certifications, acceptance of audit rights, and adherence to defined service levels. These criteria are detailed in the contract documents.

Eligibility requirements: Current entry in the professional or commercial register of the country of origin or presentation of a corresponding certificate.
References to services comparable to the advertised service.

The following information must be provided for each reference:
•	Client
•	Date of contract award
•	Order and final invoice value
•	Representation of project size and volume
•	Main service contents
•	Start and end of services
•	Number of applicant's employees working on the project
•	Naming of the responsible persons on the applicant’s side and on the reference client’s side
•	Providing the contact details of the reference client
The applicant must use the form "TSCNET_Reference list_MSSP.docx".
Confirmation by the applicant through self-declaration that the applicant  is able
a) to carry out the contract execution in English, including all documents and correspondence;
b) to provide project managers who speak fluent English (at least B2 or equivalent) in sufficient numbers to process the order;
c) on-site work managers who speak fluent English (at least B2 or equivalent);
d) to monitor and manage up to 500 IT assets across various environments (cloud, on-premise, mobile, hosted).
To meet the requirements of this Section III.1.4 in the EU notice, bidders must demonstrate ISO/IEC 27001:2022 certification, experience with 24/7 managed security services for critical infrastructure, and compliance with GDPR, NIS2, and the EU AI Act. They must also ensure data residency within the EU/EFTA, provide English-speaking personnel, and operate SIEM, SOAR, EDR, and CTI systems. Additional expectations include qualified staff with relevant certifications, acceptance of audit rights, and adherence to defined service levels. These criteria are detailed in the contract documents.
Information on the average number of employees employed in the last three completed financial years, broken down by trades/fields of activity, and certifications (e.g., CISSP, CISM, CEH, GIAC) of key personnel responsible for service delivery.
Submission of a current credit report.
Proof of commercial liability insurance (insured event: damage event), including product liability, covering the contractor's statutory liability for personal injury and/or property damage and environmental damage to third parties with an insured sum of at least EUR 1,5 million per insured event and twice per insurance year.
The tenderer must demonstrate financial capacity, inter alia, by showing that his average annual turnover for the last three completed financial years is at least twice the contract value of the subject matter of this contract notice.
The contractor must provide documentation of qualifications and certifications for key personnel, including project managers and security specialists.
This questionnaire is part of the integrity check and must be completed by tenderers who are to provide services for TSCNET as part of a self-disclosure procedure. The applicant must use the form "External_BP_Screening_Questionnaire.docx".