Implementation of a company-wide PPS and resource management tool

Proof DIN EN ISO 9001 or equivalent - please attach!

See the necessary information in the rating table (appendix for performance description).

Submission of at least three project references. More details can be found in the file "Scoring Table as an attachment to the performance description..." and explained in more detail there.

Please indicate as a self-declaration whether you intend to subcontract parts of the overall contract to subcontractors. Subcontractors shall attach a declaration of commitment according to which they are willing to provide the services in the case of a contract. If the tenderer intends to have parts of the service performed by subcontractors, he must indicate the nature and extent of the respective services.

Proof DIN EN ISO 9001 or equivalent - please attach! If your company has valid proof of the application and/or certification of a quality assurance system according to DIN EN ISO 9001 or equivalent, it must be attached as an attachment. Alternatively, you confirm that your own quality management system is established in your company. Please create a max for this. 2-page self-declaration, in which you execute which measures exist for the qualitative assurance of the work processes in your company.

In particular, please address the following aspects: handling errors, customer orientation, accountability of leadership, involvement of the people involved, process-oriented system flows and system-oriented management approach, continuous improvement. Where confirmatory certificates are available, they shall be attached.

Data protection and information security that the following aspects are complied with and attach the required proof to the offer. Please note that evidence also from evl. subcontractors must be attached to the tender. a The contractor, as well as any subcontractors employed, must have a valid ISO27001 certification (or equivalent). This must be settled.

The certification process for ISO 27001 must be demonstrated. b The contractor, as well as any subcontractors employed, must operate a data protection management system that complies with the GDPR.

Deletion periods must be specified in writing and according to the requirements of the GDPR in the list of processing activities according to art. 30 GDPR are included. c) The contractor, as well as any subcontractors employed, must ensure suitable technical and organizational measures (TOM) that correspond to the state of the art and are compliant with laws and regulations, e.g. the GDPR. d Data processing must take place exclusively within the European Economic Area (EEA) or in countries with an adequacy decision in accordance with Art. 45 GDPR. e The contractor shall provide a data backup concept for the solutions it operates, reflecting the data backup and recovery services to be provided.

This must describe the procedures and measures for securing, storing and restoring data in a comprehensible manner. f The contractor must ensure that the evaluation of the data uses methods that are state-of-the-art (see ITGrundschutz compendium BSI OPS.1.1.5 Logging) and enable continuous traceability and reconstruction of attacks. g If it is necessary to use servers of the service provider, the data must be processed and stored within the European Union.

The server locations shall be specified and contractually guaranteed. h Direct contacts of the contractor are specified for security issues. The Contractor MUST define suitable contacts for security-related events. i The contractor must identify security gaps and emerging incompatibilities with dependent components, inform the client and provide immediate remedy.

A process must be established to ensure the flow of information during security incidents. k The contractor operates the solution and must work out fallback solutions before making changes. In the event of major, security-relevant changes, the client’s information security management must be involved in advance. l The contractor must support Transport Layer Security (TLS) in its solution in a version >1.1 (preferably 1.3). Unsafe versions of TLS must be deactivated. This is based on TR02102-2 of the BSI. In its solution, the contractor supports the security mechanism HTTP Strict Transport Security (HSTS) according to RFC 6797.

Data processing, logging, audit security, data backup and recovery The clients remain the owner of the data at all times. In its solution, the contractor must take into account the regulations required by law for logging data and document them in the concept. Protocols must be stored in an evaluable, traceable and audit-proof manner. Structured analysis and evaluation of the protocol data must be possible. In its solution, the contractor must take into account the regulations required by law for logging data and document them in the concept. The solution must provide a backup/recovery concept. The recovery must be complete and within defined technical parameters (e.g. data integrity).

For the duration of the contract, the contractor must prove liability insurance with coverage of the statutory liability for him as a policyholder with the following minimum coverage:

• Company liability insurance for personal, material and resulting property damage EUR 5.000.000 per insurance case
• IT professional liability insurance with a minimum coverage amount for property damage in the amount of EUR 500.000, - or a comparable property damage liability insurance for (pure) property damage in the amount of EUR 500.000 per insurance case. All coverage amounts are maximized at least 2 times.The existence of the insurance covers must be proven for the first time unsolicited within one month after the award of the contract by submitting a declaration by the insurer stating the risk (area of activity) and the cover sums and then immediately and unsolicited notification to the customer of any change in the insurance relationships that affects the nature, extent or existence of the insurance cover during the entire term of the contract.

Proof of Creditreform information or equivalent - please attach!

Business Registration Statement - Please attach! Please attach a current proof of registration in the professional and commercial register (not older than 6 months).