Evergreen management, compliance analysis and security review of the existing M365 platform

Professional or commercial register extract self-declaration on the registration in the professional or commercial register of the country of origin, insofar as registration is required. Proof by submitting an up-to-date copy of the trade register extract or alternative up-to-date proof of the legal pursuit of the profession (not older than 6 months from the date of publication of the contract notice) shall be required during the procedure only by prospective tenderers separately (see Appendix C.9).

Self-declaration on the existence or conclusion of a company liability insurance with normal market coverage sums for personal, property and property damage. The existence of the insurance cover must be proven within 2 weeks after the order has been placed by submitting a current insurance confirmation from the insurance provider about the scope and the amount of the coverage to the customer. In the case of groupings, the self-declaration shall be made by each member of the groupings; it can also only be submitted by a member of the grouping of tenderers if the insurance covers the participation in a grouping and the insurance of all other members of the grouping (see Annex C.9).

Self-declaration that the persons employed for the legal services to be provided according to the specifications are authorized to provide legal services (§ 2 RDG). Authorized to provide legal services are exclusively licensed lawyers within the meaning of §§ 1 ff. The ability to hold the office of judge or work as a syndicate lawyer for a company alone is not sufficient. Proof by presenting an up-to-date copy of the certificate of admission shall be required separately only by prospective tenderers during the procedure (see Appendix C.9).

Appropriate company-related references from the comparable field of activity of the contract (services in the field of Microsoft 365 (M365) Evergreenmanagement and M 365 Compliance Audit). Minimum requirements: 1 Required are at least 2 references from the area M 365 Evergreen Management with the following scope / content: a The reference services were provided to a public sector contracting entity. b The subject of the reference contract was (at least) a regular M365 evergreen management with at least four cycles per year related to several – at least 5 – M365 services in an M 365 environment with a total of ≥1,500 M365 users with the preparation of decision templates and recommendations for action, structured results documentation and committee support (in particular regular appointments); c) The reference project must be completed. An unfinished reference project is only sufficient if the services for M365 Evergreen Management have been provided for at least one (1) year. 2) At least 2 references from the area M 365 Compliance Audit are required with the following scope/content: a The reference services were provided to a public sector contracting entity. b The subject of the reference contract was (at least) a compliance audit of several – at least 5 – M365 services (objects of analysis) in an M 365 environment with ≥1 tenant and ≥1,500 M 365 users per tenant. c) The compliance audit must be completed. The compliance audit is considered to be completed if at least one final audit report and one final legal opinion have been submitted as result documents (no draft versions). Only references containing the following information are taken into account: • Name of the reference, • Name and address of the client of the reference (contact person, e-mail address and telephone number only on separate request), • Contract value in EUR net, • Performance period (from MM/YYYY to MM/YYYY), • Role in the execution of the order (i.e. main contractor, member of a working group, subcontractor), • Description of the reference/services provided, which in particular indicates the fulfilment of minimum requirements. The performance of each reference must have been terminated within the last three years, i.e. the end of performance of each reference must not have occurred more than three years ago. The month of dispatch of the contract notice (09/2023) shall be the relevant month. The information shall clearly indicate the fulfilment of the above minimum requirements, otherwise the reference is not considered/rated (see Appendix C.9).

Self-declaration about the existence of proof of a practiced, certified quality management system according to DIN EN ISO 9001 in relation to the advertised service or the description of which quality assurance measures are taken that correspond to a quality management system according to DIN EN ISO 9001 or are comparable. The proof by presentation of the valid certificate of an accredited body (in the original or in an officially certified copy or as an electronic extract; at least valid until 31.12.2026) is required in the course of the procedure only by prospective tenderers separately. In the case of groupings, the proof must be provided by each member of the grouping (see Appendix C.9).

Self-declaration about the existence of proof via an information security management system according to DIN EN ISO 27001 in relation to the advertised service or the description of which information security measures are taken that correspond to or are comparable to an information security management system according to DIN EN ISO 27001. The proof by presentation of the valid certificate of an accredited body (in the original or in an officially certified copy or as an electronic extract; at least valid until 31.12.2026) is required in the course of the procedure only by prospective tenderers separately. In the case of groupings, the proof must be provided by each member of the grouping (see Appendix C.9).

Indication of which parts of the contract the entity may intend to subcontract (see Appendix C.9).