10/KD/2026 Announcement of Electronic Open (International) Tender Above the Threshold for the Project Provision of Integrated Cybersecurity Solutions to the company Hellenic Defense Systems S.A. (EAS) for a period of three (3) years

Economic operators participating in the procurement procedure shall be required to perform an activity related to the subject-matter of the contract, namely the provision of services in the field of Information and Communication Technologies and the provision of Information Security Services.

Economic operators established in a Member State of the European Union are required to be registered in one of the professional registers kept in their State of establishment or to meet any other requirement set out in Annex XI to Directive 2014/24/EU.

Where economic operators are required to have a specific authorisation or to be members of a particular organisation in order to be able to provide the relevant service in their country of origin, the contracting entity may request them to demonstrate that they have such authorisation or that they are members of that organisation or invite them to make a sworn declaration before a notary regarding the exercise of that profession.

In the case of economic operators established in a Member State of the European Economic Area (EEA) or in third countries which have acceded to the GPA, or in third countries which do not fall under the previous indent and have concluded bilateral or multilateral agreements with the Union on procurement procedures, they are required to be registered in corresponding professional registers.

Economic operators established in Greece should be registered in the relevant professional register, where, under the legislation in force, registration is required for the service to be awarded. In the case of an association of economic operators, this criterion must be covered by each member individually.

In order to prove the suitability of a professional activity, tenderers should submit to the "Justices of Participation – Technical Offer" of their offer a Certificate of the Chamber from which to register it, as well as the profession with which the registration has been made. The certificate in question should have been issued up to thirty (30) working days prior to its submission, unless a specific period of validity is provided for in its specific provisions and this is in force when it is submitted.

Have an average general annual turnover for the last three (3) closed management uses (2023, 2024, 2025) at least equal to two hundred per cent (200%) of the estimated value of the contract, excluding VAT and any options. If the economic operator operates for a period of less than three management uses, then:

• The average general annual turnover for the management uses is at least two hundred per cent (200%) of the estimated value of the contract, excluding VAT and any options.

Have an average specific annual turnover from services related to the project (i.e. information security services – cybersecurity) for the last three (3) closed management uses (2023, 2024, 2025), at least equal to a hundred fifty percent (150%) of the estimated value of the contract, excluding VAT and any options. Where the economic operator operates for less than three management uses, then: The average specific annual turnover from services related to the project (i.e. security services – cybersecurity) for management purposes should be at least equal to a hundred and fifty percent (150%) of the estimated value of the contract, including VAT and any options.

Economic operators involved in the process of concluding this need to have a Project Group capable and reliable, in terms of qualification, professional qualifications, experience and size, in order to successfully carry out the requirements of the contract. In particular, the proposed Project Group should include the following executives:

• Project Manager, which is required: o To have a basic degree of study, a degree or a diploma in Higher Educational Institute (Greek or foreign University) as well as a master's degree in the cognitive subject directly related to the type of services provided under this Project o To have at least 10 years of professional experience in the Management of Information Security Projects o To have participated as Project Manager in at least two (2) projects related to an object o To have ISO 27001 Leading Auditor certification or equivalent certification related to external control of Information Security Management Systems.
• Manager for the Design and Implementation of MDR services (Managed Detection and Response), which is required: o To have a basic degree of study, a degree or a diploma in Higher Educational Foundation (Greek or foreign University), in the cognitive subject directly related to the type of services provided under this Project. o To have at least 5 years of professional experience in Information Security and more specifically around the Architectural Design of Information Security Systems o To have participated in the same role (Director of Cyber Security Planning and Implementation), in at least one (1) project related to the declared.The natural persons declared by the tenderer to the Project Group may be employed with an dependent employment relationship or an independent service contract, which is already in force at the time of submission of the offer. In the latter case, they shall be considered as own resources of the economic operator and not third party borrowers and shall not require the submission of EGTCs and the relevant means of proof.Where a postgraduate degree is required, the requirement may also be met by a doctorate. On page 26 of 178 Replacement of a member of the declared project group, during the implementation of the Convention, shall be allowed upon prior approval of the EAC, provided that the declared replacement has at least the same qualifications and experience as the replacement.The prospective contractor may include in his project group other executives considered necessary for the implementation of the project on the basis of his proposal, in addition to the above minimum, and present the framework for organisation proposed for the efficient provision of the envisaged services

Economic operators participating in the procurement procedure for this contract are required to ensure the quality of the services provided and to hold valid the following certificates:

• Certified Quality Management System in accordance with ISO 9001:2015, or equivalent, by an accredited body in the field of the Provision of Information Security Monitoring Services.
• Certified Information Security Management System ISO 27001:2013 or equivalent, by an accredited body in the field of the Provision of Information Security Monitoring Services.
• Certified Business Continuity Management System (ISO 22301:2019) or equivalent, by an accredited body in the field of the Provision of Information Security Monitoring Services. The contracting authority recognises equivalent certificates issued by bodies accredited by equivalent accreditation bodies, also established in other Member States.It also accepts other evidence of equivalent quality assurance measures, provided that the economic operator concerned had no possibility of obtaining said certificates within the relevant deadlines for reasons not attributable to itself, and provided that the economic operator demonstrates that the proposed quality assurance measures meet the required quality assurance standards. For the purposes of the preceding paragraph, an equivalent conformity assessment body shall also be deemed to be one which:
  1. is established in a state that is not a Member State of the European Union,
  2. is accredited by a national accreditation body that is not established in a Member State of the European Union and is a member of the European co-operation for Accreditation Multilateral Agreement (EA MLA) or the International Laboratory Accreditation Cooperation (ILAC) or the International Accreditation Forum Multilateral Recognition Agreement (IAF MRA).” Furthermore, economic operators participating in the procurement procedure for this contract are required to provide the following certifications regarding the services they provide:
• CREST Certification for Security Operations Center / Managed Detection & Response (MDR) services or equivalent recognised third-party certification or assessment Page 27 of 178 substantiating the operational adequacy and technical capability of the provider to provide continuous monitoring, detection, analysis, and security incident response services.
• CREST Cyber Incident Response Certification or equivalent recognised certification or assessment substantiating its capability in providing cybersecurity incident detection, analysis, and management services. Indicatively accepted are ISO/IEC 27035, SOC 2 Type II (with IR), participation in TIBER-EU schemes, or accredited participation in international bodies such as FIRST.
• CREST Penetration Testing Certification or equivalent recognised certification of competence in the field of security assessment using penetration testing techniques.
• Cyber Essentials Certification or equivalent certification of baseline compliance with cybersecurity standards. Indicatively accepted are: IASME Cyber Assurance, CIS Controls v8 (IG1), or documented implementation of the NIST Cybersecurity Framework Tier 1.Furthermore, economic operators must have received "recognition" from international assessment/analyst firms (e.g. Gartner, Forrester, etc.) on a continuous basis over the last 4 years, and maintain this recognition up to and including the year in which the publication date of this notice falls.It is noted that economic operators must comply with all European laws and regulations relating to the operation of Cybersecurity and Managed Services. In the event of a Consortium of Companies, the technical and professional ability may be covered by one or more of its members.

Economic operators may, with regard to the criteria of economic and financial competence (paragraph 2.5) and the technical and professional capacity (paragraph 2.6), rely on the capacities of other bodies, regardless of the legal nature of their links with them. In such a case, they shall demonstrate that they will have the necessary resources available to them, by providing the relevant commitment of the entities they rely on.

In particular, with regard to the professional competence criteria relating to the qualifications and qualifications set out in Part II of Annex XII to Appendix I to Law 4412/2016 or the relevant professional experience, economic operators may rely on the skills of other bodies only if the latter perform the tasks or services for which the specific skills are required.

Where economic operators rely on the capacities of other operators in respect of the criteria related to the declaration of economic and financial competence, those economic operators and those on whom they rely shall jointly be responsible for the performance of the contract. Under the same conditions, economic operators’ associations may rely on the capacity of the participants in the association or other bodies.

The contracting authority shall check whether the entities whose economic operator intends to support meet the relevant selection criteria and whether there are grounds for exclusion of paragraph 2.2.3.

The economic operator shall be required to replace an entity whose capacity is based, provided that the latter does not meet the relevant selection criterion or for which grounds for exclusion exist, within thirty (30) days of the relevant electronic call from the relevant invitation of the contracting authority addressed to the economic operator through the ‘Contact’ function of the ESADIS.

The body replacing the institution referred to in the preceding subparagraph shall not be replaced again. 2.2.8.2 Subcontracting The economic operator shall indicate in its tender the part of the contract which it intends to subcontract to third parties, as well as the subcontractors it proposes.

Where the tenderer states in his tender that he intends to award part(s) of the contract in the form of a subcontract to third parties in excess of thirty percent (30%) of the total value of the contract, the contracting authority shall check that the grounds for exclusion of paragraph 2.2.3 of this Agreement do not exist. The economic operator shall be required to replace a subcontractor if there are grounds for exclusion of paragraph 2.2.3. above.