Implementation of an integrated IT and OT cybersecurity architecture along with the preparation of the contracting party's organizational structure within the grant project 'Cybersecure Water Supply'

The Gmina Izbica Kujawska in Poland from Europe region has released this tender for 1. The subject of the order is the implementation of an integrated cybersecurity architecture for IT and OT, along with the preparation of the procuring entity's organizational structure within the framework of the grant project 'Cybersecure Water Supply Systems'. 2. Acting pursuant to the Act of April 16, 1993 on combating unfair competition (Journal of Laws from 2026, No. 85), and in accordance with Article 18, paragraph 4 of the Act on the Protection of Competition (Pzp), the procuring entity excludes certain parts of the public procurement document (OPZ). The excluded information includes technical and organizational details related to competency and organizational gaps, as well as the needs of the procuring entity in the field of cybersecurity, information systems, and security mechanisms that constitute business secrets and whose disclosure could increase the risk of cybersecurity breaches, particularly by enabling the identification of system architectures or potential vulnerabilities, as well as security techniques and tactics. The scope of the exclusion is limited to information necessary for protecting the entity's security, including information systems, without violating fair competition principles or equal treatment of contractors, while ensuring contractors have access to the information necessary for preparing tenders. The subject of the order includes a cohesive security model integrating technical, organizational, and competency solutions. Although individual elements may be general in nature, their combined implementation and alignment with the procuring entity's actual environment result in the disclosure of the comprehensive security architecture. Disclosure of such a consolidated view could enable unauthorized individuals to identify the security architecture, incident response methods, system dependencies, and potential weaknesses, thereby increasing the risk of successful attacks. Based on the MITRE ATT&CK approach, knowledge of security mechanisms, organizational procedures, and user controls can be utilized across various attack chain stages, including preparation, detection, and access escalation. The procuring entity emphasizes that the subject of the order pertains to systems critical for ensuring the continuity of public services, with the goal of achieving a real, operational level of resilience against cyber threats. The exclusion of information has been applied as a proportional measure to protect the procuring entity's security while ensuring contractors have equal access to complete documentation, subject to confidentiality requirements. 3. The public part of the OPZ is Annex 8 to the Invitation. 4. The confidential part of the OPZ, constituting Annex 9 to the Invitation, will be made available to the contractor who submits a request along with a confidentiality declaration, whose template is Annex 10 to the Invitation, subject to the terms below. 5. The deadline for submitting the request mentioned in point 4 expires two days before the scheduled start of negotiations. Requests submitted after this deadline may be disregarded by the procuring entity. 6. The request for access to the confidential part of the OPZ may be submitted exclusively by the contractor who demonstrates the implementation of organizational and technical measures ensuring information confidentiality. The procuring entity considers this requirement fulfilled in particular by possessing an implemented information security management system compliant with ISO/IEC 27001 or an equivalent standard, certified by an accredited certification body, or by holding a valid industrial security certificate of any level, or another document issued by independent entities confirming the implementation of organizational and technical measures for information security in any industry, such as a TISAX certificate (minimum level AL2) or a current SOC 2 Type II audit report. The contractor must attach a certified copy of the certificate/document confirming compliance with the original as an annex to the request mentioned in point 4. 7. The request, along with the confidentiality declaration, must be signed by an authorized representative of the contractor or a duly authorized agent. In cases where an agent submits the request, the relevant power of attorney must be attached. 8. The request, signed with a qualified electronic signature, must be submitted via the Open Nexus procurement platform no later than two days before the scheduled start of negotiations, subject to the proviso that the procuring entity is not responsible for any inability to prepare for negotiations if the request is submitted in a timeframe that prevents access to documentation and preparation of proposals before the start of negotiations. 9. The procuring entity will make the confidential part of the OPZ available upon receipt of a complete request submitted in accordance with the Invitation. In case of identifying formal deficiencies in the request, the procuring entity may request the contractor to rectify them within a specified timeframe. The confidential part of the OPZ will be made available after successful rectification of formal deficiencies. 10. Information contained in the confidential part of the OPZ may be used exclusively for preparing and submitting an initial proposal and participating in negotiations in this procedure. Disclosure to third parties is prohibited, except for individuals engaged by the contractor in preparation for negotiations, subject to a confidentiality obligation at least as extensive as that specified in the contractor's declaration. The contractor is responsible for any breach of confidentiality by individuals to whom information covered by the confidential part of the OPZ is disclosed. 11. In cases where contractors jointly apply for the award (consortium, civil company) or where contractors rely on the technical or professional capabilities of entities providing resources under the terms of Article 118 of the Act on the Protection of Competition (Pzp), the requirement to demonstrate the implementation of organizational and technical measures for information security must be fulfilled. with tender notice no. 695666-2026 published on 08 Oct 2026. The tender is due to expire on 06 Jan 2027. This tender is sourced from TED Europa and is eligible for suppliers interested in Cyber security. Interested bidders can obtain further information including complete bid documents or ways to participate by registering on Tender Impulse and referencing via Tender Impulse ID 15355614.