Project 1025 CSP Update, Evaluation, Recertification and API (CUERA)

1. Self-declaration of Article 5k of Regulation (EU) 833/2014 As part of the EU sanctions package related to Russia’s war of aggression against Ukraine, the following article was added to Regulation (EU) 833/2014 by Council Regulation (EU) 2022/1269 of 27.04.2023: Article 5k(1) It shall be prohibited to award public contracts or concessions falling within the scope of the Directives on public procurement and of Article 10(1), (3), (6)(a) to (e), (8), (9) and (10) and Articles 11, 12, 13 and 14 of Directive 2014/23/EU, Article 7(a) to (d), Article 8, Article 10(b) to (f) and (h) to (j) of Directive 2014/24/EU, Article 18, Article 21(b) to (e) and (g) to (i), Articles 29 and 30 of Directive 2014/25/EU and Article 13(a) to (d), (f) to (h) and (j) of Directive 2009/81/EC to the following persons, entities or bodies: continue to perform contracts with such persons, entities or bodies: (a) Russian nationals, natural persons resident in Russia or legal persons, entities or bodies established in Russia; (b) legal persons, entities or bodies whose shares are held for more than 50 % directly or indirectly by one of the entities referred to in point (a), or (c) natural or legal persons, entities or bodies acting on behalf of or at the direction of any of the entities referred to in point (a) or (b), including where they represent more than 10 % of the contract value, subcontractors, suppliers or undertakings whose capacities are used within the meaning of the Public Procurement Directives. Please confirm that none of the above-mentioned exclusion grounds for a public procurement or concession award or a continuation of the contract applies to you and that you do not make any changes (e.g. by involving a subcontractor or a supplier) in the context of the execution of the contract that violate the aforementioned exclusion grounds? Please answer the question only with "YES" (→ Confirmation) or "NO" (→ no Confirmation). Minimum requirement: the question was answered ‘yes’. If the answer to the question is ‘no’, this shall lead to exclusion from the procurement procedure. You are aware that a knowingly incorrect indication of the declaration leads to exclusion from the procurement procedure and entitles the customer to extraordinary termination after conclusion of the contract. In the offer, only list the title of the criterion and your answer. Forgo the literal or analogous citation of the criterion.

2. Exclusion of a conflict of interest Confirm that neither you nor your partners in the case of a bidding community nor, if applicable, Do subcontractors have interests that are inconsistent with the performance of the services of this project and that may adversely affect the outcome of the project? This confirmation shall include the staff employed in the project. Please answer “YES” or “NO”. A conflict of interest exists, for example, if the creator of the protection profile is not technology-neutral. Minimum requirement: If the question has been answered “no” (= there is a conflict of interest), explain the conflict and how you want to resolve it. In this case, the offer can only be considered if the described solution approach is assessed by the BSI as sufficient. In the offer, only list the title of the criterion and your answer. Forgo the literal or analogous citation of the criterion.

3. References Provide appropriate references of the companies involved. References are suitable if the projects on which the reference is based have essentially similar requirements for the undertakings in terms of technical and technical capacity as the tendered service. This is particularly the case with the present call for tender, experience in the creation of protection profiles according to the Common Criteria and extensive experience in the mentioned contexts. These references must in particular demonstrate the ability of the participating companies in the field of IT security requirements. By means of the references, it must therefore be demonstrated that the participating companies have already gained experience in the following areas of experience: 1. knowledge of the Common Criteria (CC) and the implementation of evaluation activities on IT systems or products on the basis of defined and CC-related evaluation criteria 2. development of concepts in the area of IT security requirements 3. projects and extensive practical experience in the contexts eID/sovereign documents and technical security facilities (TSE / SMAERS), 5G or FIDO 4. Experience in projects related to crypto specifications When creating the reference proof, address the following points: − Client incl. specialist area − (detailed) presentation of the subject of the contract / activity − Scope / Affected experience area − Duration − Order volume The presentation should not exceed two A4 pages per reference project. No reference letters from previous clients are required. Minimum requirement: In total, at least three appropriate references shall be provided. All experience areas shall be supported by appropriate references, with one reference being used to cover several areas.

4. Quality management Please represent the quality management of your company. Please also provide information about certifications your company has acquired. Minimum requirement: Quality management is established and documented and can be proven.

2. Exclusion of a conflict of interest Confirm that neither you nor your partners in the case of a bidding community nor, if applicable, Do subcontractors have interests that are inconsistent with the performance of the services of this project and that may adversely affect the outcome of the project? This confirmation shall include the staff employed in the project. Please answer “YES” or “NO”. A conflict of interest exists, for example, in the case of an obligation to or cooperation with the manufacturer of a product under investigation or due to another economic dependence on the said product. Minimum requirement: If the question has been answered “no” (= there is a conflict of interest), explain the conflict and how you want to resolve it. In this case, the offer can only be considered if the described solution approach is assessed by the BSI as sufficient. In the offer, only list the title of the criterion and your answer. Forgo the literal or analogous citation of the criterion.

3. References Provide appropriate references of the companies involved. References are suitable if the projects on which the reference is based have essentially similar requirements for the undertakings in terms of technical and technical capacity as the tendered service. This is particularly the case in this call for tender, in the case of experience in the development and development of projects in the field of network and information security or of encryption systems and their components. The references mentioned must in particular demonstrate the ability of the participating companies in the field of evaluation in accordance with CC:2022. By means of the references, it must therefore be demonstrated that the participating companies fulfil the following requirements: 1st CC Verifier: Due to the special nature of the services to be awarded, the contract can only be awarded to an EUCC Verifier (ITSEF high) approved during the entire project period, which meets the requirements for the technical domain “Smartcards and similar Devices” (TD SC).2 The tender shall contain a statement to that effect. When creating the reference proof, go into the following points: − Client incl. specialist area − (detailed) presentation of the object of the order / activity − Scope / Area of experience affected − Duration − Order volume The presentation should not exceed two A4 pages per reference project. No reference letters from previous clients are required. Minimum requirement: demonstration of the requirement under 1. as CC verifier.

2. Exclusion of a conflict of interest Confirm that neither you nor your partners in the case of a bidding community nor, if applicable, Do subcontractors have interests that are inconsistent with the performance of the services of this project and that may adversely affect the outcome of the project? This confirmation shall include the staff employed in the project. Please answer “YES” or “NO”. A conflict of interest exists, for example, if the creator of the interface description is not technology-neutral. Minimum requirement: If the question has been answered “no” (= there is a conflict of interest), explain the conflict and how you want to resolve it. In this case, the offer can only be considered if the described solution approach is assessed by the BSI as sufficient. In the offer, only list the title of the criterion and your answer. Forgo the literal or analogous citation of the criterion.

3. References Provide appropriate references of the companies involved. References are suitable if the projects on which the reference is based have essentially similar requirements for the undertakings in terms of technical and technical capacity as the tendered service. This is particularly the case in this call for tender, in the case of experience in the development and development of projects in the field of network and information security or of encryption systems and their components. These references must demonstrate in particular the capacity of the participating companies in the field of research and development and the development and implementation of innovative solutions. By means of the references, it must therefore be demonstrated that the participating companies have already gained experience in the following areas of experience: 1. development and documentation of technical interface specifications (API) 2. projects and extensive practical experience of protocols and procedures in the contexts eID/sovereign documents and technical security facilities (TSE / SMAERS). Experience in the field of IT security, in particular protection against attacks by third parties 4. projects in the field of client/server communication interfaces via REST, WebSocket, or similar 5. Experience in the implementation and secure implementation of cryptographic algorithms and protocols, including the corresponding relevant specifications of recognized institutions 6. Project experience in the field of conformity certification 7. Several years of practical experience in the implementation of client/server interfaces in common programming languages and server frameworks When creating the reference proof, go into the following points: − Client incl. subject area − (detailed) presentation of the object of the order / activity − Scope / Affected experience area − Duration − Order volume The presentation should not exceed two A4 pages per reference project. No reference letters from previous clients are required. Minimum requirement: In total, at least three appropriate references shall be provided. All experience areas shall be supported by appropriate references, with one reference being used to cover several areas.