Selection of the provider of the Security Operations Center (SOC) service consisting of continuous monitoring of the IT systems and networks of Górnośląskie Towarzystwo Lotnicze S.A., as well as responding to emerging security incidents

The contractor must demonstrate that he is insured against civil liability in the scope of the activity related to the subject of the contract for a guarantee sum of not less than PLN 2 000 000,00 (in words: two million PLN 00/100).

Note: If the Contractor designates a currency other than Polish gold (PLN) to be converted to the value to demonstrate compliance with the conditions for participation in the proceedings The contracting authority shall apply the average NBP course on the date of dispatch of the contract notice to the Official Journal of the European Union;

The Contracting Authority shall, prior to the selection of the tender of the most favourable Contractor's Call, the tender of which has been the highest rated, subject to Article 127 of the PPO Act, to submit, within a specified period of time, not less than 10 days, the following statements and documents indicated (current at the date of their submission): In order to confirm compliance with the above conditions of participation: Document confirming that the Contractor is insured against civil liability in the scope of the activity related to the subject of the contract, indicating the guarantee sum of this insurance not less than PLN 2,000,000.

The contractor shall demonstrate that within the last 3 years before the deadline for the submission of tenders and, if the period of business is shorter, he has duly performed at least: 1) 3 SOC (Security Operations Center) services, each of which has a value of not less than PLN 1,000,000 gross.

In the case of services still carried out, the value of the part carried out until the deadline for submitting tenders must be at least PLN 1,000,000 gross. and (2) 2 services in which he managed or manages an electronic network comprising simultaneously at least 2,000 security and monitoring workstations in an EDR or XDR class system.

In the case of services still provided, the Contractor shall demonstrate that, before the deadline for the submission of tenders, he has provided an electronic network management service covering at least 2 000 protected and monitored workstations in the EDR or XDR class system for a continuous period of at least 6 months.

Note Where the Contractor designates, in order to demonstrate compliance with the conditions for participation in the proceedings, a currency other than the Polish zloty (PLN), to be converted The contracting authority shall apply the average NBP course of the day on which the contract notice is sent to the Official Journal of the European Union.

The Contracting Authority shall, prior to the selection of the tender of the most favourable Contractor's Call, the tender of which has been the highest rated, subject to Article 127 of the PPO Act, to submit, within a specified period of time, not less than 10 days, the following statements and documents indicated (current at the date of their submission): In order to confirm compliance with the above conditions of participation: List of services rendered during the last ten years, and if the duration of the activity is shorter, within that period, together with their values, the subject matter, the dates of performance and the entities to which the services have been carried out and the addition of evidence to determine whether these services have been duly performed, the evidence in question being references or other documents drawn up by the entity for which the services have been carried out, and if the Contractor is unable to obtain such documents for reasons beyond his control, the Contractor’s statement.

The period referred to above shall be retroactive from the date on which the time limit for the submission of tenders expires. The model list is set out in Annex 7 to the WWZ.

The Contractor shall demonstrate that it has at its disposal persons capable of performing the contract, namely: A. SOC Service Manager - minimum 1 person EXPERIENCE:

1. minimum 10 years of experience in the field of cybersecurity, and
2. minimum 10 years of experience in cooperation with law enforcement agencies, and
3. minimum 5 years of experience in managing SOC or CSIRT services, and
4. participation in the delivery of at least 10 SOC services for organizations employing a minimum of 250 employees or possessing critical infrastructure, and
5. experience in security incident management. B. SOC Operations Leader (SOC Team Leader) - minimum 3 persons EXPERIENCE

1. minimum 3 years of experience working in a SOC, and
2. experience in coordinating security incident handling, and
3. experience in developing policies and procedures for Client-SOC cooperation PROFESSIONAL QUALIFICATIONS The Contracting Authority requires that at least one person among the SOC Operations Leaders (SOC Team Leaders) holds a CEH or OSCP security certificate or equivalent. C. Tier 1 SOC Analyst – minimum 3 persons EXPERIENCE:

1. minimum 2 years of experience in security monitoring, and
2. knowledge of EDR/XDR tools, and
3. Knowledge of the operational fundamentals of: o Windows, o Linux, o Active Directory, o TCP/IP network fundamentals, o DNS, o DHCP, o VPN, and
4. Practical knowledge of a minimum of 3 solutions of the following class:

1. Microsoft Defender XDR, or
2. Eset Enterprise, or
3. SentinelOne, or
4. CrowdStrike, or
5. Trellix, or
6. Cortex XDR, or
7. Trend Vision One, or
8. Sophos MDR. D. Tier 2 SOC Analyst - minimum 4 persons EXPERIENCE

1. minimum 2 years of experience in the position of Tier 2 SOC Analyst, and
2. IOC analysis, and
3. TTP analysis in accordance with MITRE ATT&CK, and
4. conducting security investigations, and
5. ability to analyze network traffic enabling the detection of anomalies in a LAN. E. Tier 3 SOC Analyst / Incident Responder – minimum 1 person EXPERIENCE

1. minimum 10 years of experience in the position of Tier 3 SOC Analyst (projects/tasks), and
2. DFIR experience, and
3. memory analysis, and
4. disk analysis, and
5. malware analysis. PROFESSIONAL QUALIFICATIONS The Tier 3 SOC Analyst must demonstrate holding the following certificates:

1. CCLO (Cellebrite Certified Operator) or equivalent, and
2. CCPA (Cellebrite Certified Physical Analyst) or equivalent, and
3. X-WAYS Forensics or equivalent, and
4. CEH (Certified Ethical Hacker) or equivalent. F. Network Security Analyst - minimum 1 person EXPERIENCE

1. minimum 10 years of experience in the position of network security analyst, and
2. DFIR experience, PROFESSIONAL QUALIFICATIONS The network security analyst must demonstrate holding the following certificates:

1. OSWP (Offensive Security Wireless) or equivalent, and
2. OSCP (Offensive Security Certified Professional) or equivalent. G. Court Expert - minimum 2 persons PROFESSIONAL QUALIFICATIONS

1. status of court expert in the field of computer science/IT (specialization in cybersecurity, post-intrusion analyses, preservation of evidence), and
2. court expert status for at least 2 terms (the Contractor is required to provide the entry number in the list of court experts). H. Mobile Forensics Specialist - minimum 2 persons EXPERIENCE

1. has at least 5 years of professional experience gained within the last 5 years prior to the deadline for submission of tenders in performing mobile device forensic analyses, and
2. performed or participated as a team member in the execution of at least 50 mobile device forensic analyses carried out for the purposes of investigative proceedings, security incident handling, criminal proceedings, administrative proceedings, or internal organizational proceedings, and
3. has experience in acquiring, securing, and analyzing data from mobile devices while maintaining the principles of chain of custody, and
4. has practical knowledge of logical, file system, and physical data acquisitio…

I. Windows system administrator - minimum 2 people EXPERIENCE:

1. minimum 5 years of professional experience in Windows Server administration and
2. minimum 3 years of experience in maintaining production environments including at least 50 Windows servers and
3. experience in managing security incidents concerning Microsoft Windows operating systems and
4. experience in analyzing system logs and event logs (Windows Event Logs) and
5. practical knowledge of PowerShell and automation of administrative tasks and
6. experience in managing directory services Microsoft Active Directory, DNS, DHCP, Group Policy, DFS and PKI, and
7. experience in managing Microsoft Failover Clustering services and
8. experience in configuring Windows security in accordance with Microsoft Security Basel or CIS Benchmarks recommendations and
9. experience in handling EDR/XDR systems installed on Windows servers and
10. knowledge of Windows Server hardening principles and
11. experience in analysing and removing security incidents The Contracting Authority shall allow several certificates to be demonstrated by one person in order to confirm the fulfilment of the above conditions, excluding the Project Manager and the SOC Service Leader, who may not simultaneously serve as analysts L1 and L2.The Contracting Authority shall allow the Contractor to gain experience in both burglary analyses, investigators (response incident) and the correct protection of digital material for the purposes of the evidence. The above-mentioned composition of the Contractor must be treated as the minimum requirements of the Contracting Authority and shall not exhaust all personnel necessary for the performance of the Contractor's obligations.In cases where the abovementioned person participating in the execution of the order, does not know the Polish language, the Contractor is required to provide a full service of translation into and from the Polish language. The Contracting Authority requires that the language in force during the execution of this order is Polish.The contractor should provide the necessary support and assistance from other specialists, which may be necessary for the proper performance of the contract. The costs of remuneration of all employees Contractors must be included in the price of the offer.Note The Contracting Authority informs that from 12 July 2026 the rules on the certification of public procurement contractors are in force, allowing economic operators to demonstrate the absence of grounds for exclusion and to meet the conditions for participation in the procedure by means of the contractor certificate.At the same time, in the absence of all the implementing rules on certification of the performance of economic operators issued at the time of the initiation of the procedure, including rules on the establishment of capacity levels for supplies and services, The Contracting Authority shall assess the fulfilment of the conditions for participation in the proceedings on the basis of the conditions and the personal evidence referred to in this SWI.Where the contractor submits a valid certificate to the contractor, the Contracting Authority shall take into account its scope in accordance with Article 124 of the PZp Act, provided that, in respect of circumstances not covered by the certification or which do not appear unequivocally from the certificate, the contractor is required to demonstrate compliance with the conditions for participation in the proceedings as set out in the SWI.

The Contracting Authority shall, prior to the selection of the tender of the most favourable Contractor's Call, the tender of which has been the highest rated, subject to Article 127 of the PPO Act, to submit, within a specified period of time, not less than 10 days, the following statements and documents indicated (current at the date of their submission): In order to confirm the fulfilment of the above conditions of participation: List of persons referred to by the contractor for the performance of the public contract, in particular those responsible for the provision of services, together with information on their professional qualifications, powers, experience and education necessary for the performance of the public contract, as well as on the scope of their activities and on the basis of their disposal.

The model list is set out in Annex 8 to the WWZ. NOTE The Contracting Authority informs that from 12 July 2026 there are rules on the certification of public procurement contractors, allowing economic operators to demonstrate the absence of grounds for exclusion and to fulfil the conditions for participation in the procedure by means of an economic operator certificate.

At the same time, in the absence of all the implementing rules on certification of the performance of economic operators issued at the time of the initiation of the procedure, including rules on the establishment of capacity levels for supplies and services, The Contracting Authority shall assess the fulfilment of the conditions for participation in the proceedings on the basis of the conditions and individual means of proof laid down in the SWI.

Where the contractor submits a valid certificate to the contractor, the Contracting Authority shall take into account its scope in accordance with Article 124 of the PZp Act, provided that, in respect of circumstances not covered by the certification or which do not appear unequivocally from the certificate, the contractor is required to demonstrate compliance with the conditions for participation in the proceedings as set out in the SWI.

The Contractor must demonstrate that he holds: (a) a valid certificate of compliance with the PN-EN ISO/IEC 27001 standard issued by an accredited certification body, confirming that the Contractor has, maintains and updates a security management system for information in respect of at least the services covered by the contract and (b) a valid certificate of compliance with the requirements of the Polish PN-EN ISO 22301 standard issued by the accredited certification body, in respect of at least the services covered by the contract, together with the Contractor's obligation to maintain its validity throughout the period of performance of the contract and (c) a valid certificate of conformity with the requirements of the Polish PN-EN ISO 9001 standard issued by the accredited certification body, in respect of at least the services covered by the contract, together with the Contractor's obligation to maintain its validity throughout the period of performance of the contract.

The Contracting Authority shall, prior to the selection of the tender of the most favourable Contractor's Call, the tender of which has been the highest rated, subject to Article 127 of the PPO Act, to submit, within a specified period of time, not less than 10 days, the following statements and documents indicated (current at the date of their submission):

1. a valid certificate of compliance with the PN-EN ISO/IEC 27001 issued by an accredited certification body confirming that the Contractor has, maintains and updates an information security management system for at least the services covered by the contract.
2. a valid certificate of compliance with the requirements of the Polish PN-EN ISO 22301 standard issued by an accredited certification body, in so far as at least the services covered by the contract, together with the Contractor's obligation to maintain its validity throughout the performance of the contract.