Абонамент за услуга за провеждане на кампании за проверка на устойчивостта на информационната инфраструктура на ДП РВД срещу кибератаки

The participant should have completed at least one service activity with a subject and volume identical or similar to that of the contract for the last three years from the date of submission of the tender. Notes: An activity for a service with an object and volume identical or similar to that of the order shall be understood as an activity for carrying out penetration tests. Tests must be performed for: - public organisations or - essential or important entities within the meaning of the Cybersecurity Act. A service activity shall be that activity the performance of which has been completed within the period laid down by the Contracting Party, irrespective of the date of execution. When submitting the tender, participants shall declare compliance with the selection criterion by filling in the EEDOP Part IV To demonstrate its technical and professional capabilities, the participant shall provide a list of services which are identical or similar to the subject-matter of the contract with an indication of the values, dates and recipients, together with documents demonstrating the service performed. The documents demonstrating compliance with technical and professional capabilities shall be submitted by the selected contractor before the contract for the award of the contract or upon request in the course of the procedure under the conditions of Art. 67, para. 5 of the Public Procurement Act.

The participant must have personnel with professional competence for the execution of the contract, as follows: 1. Service Delivery Manager and Information Security Expert, who must meet the following minimum requirements: • Higher education degree in the field of “Communication and Computer Engineering”, “Informatics and Computer Science”, “Information Technology”, or equivalent; • Minimum of 5 (five) years of professional experience in the field of information security, of which at least 3 (three) in project management related to penetration testing, cybersecurity, or vulnerability management; • Experience as a manager of at least 2 projects for penetration testing of information infrastructure and systems; • At least one valid certificate in the field of penetration testing: OSCP, GPEN, CEH, or equivalent; • At least one valid management certificate in the field of information security: CISSP, CISM, ISSMP, or equivalent. 2. Minimum of one “Penetration Tester” Expert specializing in network infrastructure, who must meet the following minimum requirements: • Higher education degree in the field of “Communication and Computer Engineering”, “Informatics and Computer Science”, “Information Technology”, or equivalent; • Minimum of 3 years of professional experience in penetration testing, of which at least 2 with a focus on network and infrastructure security; • Participation in a minimum of 2 network infrastructure penetration testing projects; • At least one valid certificate in the field of network penetration testing: OSCP, OSEP, GPEN, GXPN, PNPT, CRTP, CRTE, or equivalent. 3. Minimum of one “Penetration Tester” Expert specializing in server infrastructure, who must meet the following minimum requirements: • Higher education degree in the field of “Communication and Computer Engineering”, “Informatics and Computer Science”, “Information Technology”, or equivalent; • Minimum of 3 years of professional experience in penetration testing, of which at least 2 years with a focus on server infrastructure and operating systems (Windows, Linux/Unix); • Participation in a minimum of 2 server infrastructure penetration testing projects; • At least one valid certificate in the field of penetration testing: OSCP, OSEP, OSCE3, CRTP, CRTE, GCIH, GPEN, or equivalent. 4. Minimum of one “Penetration Tester” Expert specializing in web applications and APIs, who must meet the following minimum requirements: • Higher education degree in the field of “Communication and Computer Engineering”, “Informatics and Computer Science”, “Information Technology”, or equivalent; • Minimum of 3 years of professional experience in penetration testing, of which at least 2 with a focus on web applications and APIs; • Participation in a minimum of 2 web application penetration testing projects; • At least one valid certificate in the field: OSCP, OSWE, GWAPT, BSCP, or equivalent; • Proven experience with OWASP methodologies (Web Security Testing Guide, ASVS, API Security Top 10). When submitting the tender, participants declare their compliance with the selection criterion in the ESPD by filling in the relevant field of Part IV “Selection criteria”, Section C “Technical and professional ability”, field “Educational and professional qualifications” as follows: for each person in the proposed team, participants provide the information necessary to establish compliance with the requirements, indicating, as applicable according to the requirement for the specific person: - Full name of the person; - Team position; - Details of the document for acquired education/completed course/acquired professional qualification – educational institution, No. and date of the document, educational degree, professional field, and specialty; - Professional experience; - Certificates; Each expert may combine no more than 2 (two) roles, provided that they prove compliance with the minimum requirements for each of the expert roles. To prove its technical and professional abilities, the p…

The participant should hold a valid certificate for an implemented quality management system in the field of the subject-matter of this contract, according to standard EN ISO 9001:2015 or equivalent, or other evidence of equivalent quality assurance measures. When submitting the tender, participants shall declare compliance with the selection criterion by filling in the EEDOP Part IV For demonstration of its technical and professional capabilities, the participant shall provide a copy of a valid certificate for an integrated quality management system in the field of information technology, according to standard EN ISO 9001:2015 or equivalent, or other evidence of equivalent quality assurance measures. The documents demonstrating compliance with technical and professional capabilities shall be submitted by the selected contractor before the contract for the award of the contract or upon request in the course of the procedure under the conditions of Art. 67, para. 5 of the Public Procurement Act.