UCaaS solution

Membership of a statutory accident insurance institution Declaration of registration in the competent professional association or a comparable statutory accident insurance institution. A certificate shall be submitted only upon separate request. The indication does not constitute a membership obligation beyond the legal obligations of the declaring company.

Entry in a professional or commercial register. A current extract from the register or equivalent proof of the country of origin shall only be submitted upon separate request. The requirements for timeliness and form result from the separate requirement.

Professional or company liability insurance The applicant must have professional, company or IT liability insurance or an equivalent combination of several insurances at the latest before the start of the service provision. The insurance cover must adequately cover the legal liability risks associated with the advertised IT, telecommunications, cloud, installation, operational and service services. In particular, statutory liability claims of third parties must be insured for personal and material damage as well as for financial damages arising from IT and telecommunications services. This includes, as far as is customary insurable, also financial damages as a result of the deletion, damage or impairment of data, the violation of data protection regulations or an information security incident caused by the insured activity. The insurance coverage must explicitly cover the cloud, UCaaS, integration, installation, operation, maintenance and managed services offered by the applicant. The following minimum insurance sums apply: - Personal and property damage together: EUR 5.000.000 per insured event - Property damage: EUR 5.000.000 per insured event - Maximum reimbursement per insurance year: at least twice the insured amount mentioned above If the required insurance cover is not yet complete when the application for participation is submitted, a binding and unconditional declaration must be submitted by an insurance company or an insurance broker authorised to do so, according to which the required insurance cover can be established in the event of a surcharge. The full insurance cover must be proven at the latest before the start of the service provision and maintained throughout the entire term of the contract. In the case of associations of applicants, the insurance cover must cover all members and their respective contributions. The proof can be provided by a joint insurance or by several insurances that are completely sufficient together. Other undertakings must provide proof of this in so far as their insurance cover or economic and financial capacity is used to meet this requirement. Performing subcontractors must either be covered by the contractor’s insurance cover or have their own insurance cover appropriate to their benefit share.

References on comparable supply and services With the request to participate, a minimum of three and a maximum of five references, which are comparable in nature, scope and complexity with the advertised UCaaS solution, must be submitted. Each reference shall be represented by reference sheet 1.14. The signature, stamping or other formal confirmation of the reference document by the reference provider shall not be required. Before naming a reference, the applicant must verify that the reference provider agrees with the naming and a possible verification of the reference information by the Sana. The applicant shall inform the nominated contact person of the transmission of his/her contact details and ensure that he/she may be contacted for an objective reference examination. Reference services provided within the last three years before the expiry of the period for participation shall be taken into account. The referenced solution must have been productively operated for at least six months at the end of the participation period. The required information and comparability characteristics result exclusively from 1.14. Additional references in this form are not required. For the selection evaluation, the three best-point complete and worthwhile references are taken into account. The assessment instructions are published immediately in 1.14. The issuing body may verify the references provided. The unavailability or lack of response of the reference transmitter does not in itself lead to the disregard of the reference. Before an adverse assessment, the applicant shall be given the opportunity to explain the information within a reasonable time or to appoint another appropriate contact person of the reference provider. Substantial inconsistencies remaining after clarification may be taken into account in accordance with the published award conditions and in accordance with the principles of transparency, equal treatment and proportionality. A minimum of 3 and a maximum of 5 complete and valid references shall be submitted. For the selection evaluation, only the 3 best scoreable references are considered. Reference services within the last three years before the deadline for participation shall be taken into account. The referenced solution must have been productive for at least six months at this time. A confirmation, signature or stamp of the reference provider is not required. The details and assessment instructions are given in 1.03 and 1.14. Weighting of the criterion "references" for selection evaluation: 40 % The sub-criteria of the criterion "references" are included in the criterion "references" as follows: Objective reference characteristics: 70 % Qualitative reference assessment: 30 %

Information security The information security and existing regulatory competence required in the competition shall be provided in 1.16. Weighting of the criterion "information security" for selection evaluation: 15 % The sub-criteria of the criterion "information security" are included in the criterion "information security" as follows: Security organisation and ISMS: 25 % Regulatory competence: 20 % Technical security measures: 30 % Security operations and incident response: 25 %

Digital Sovereignty and Operation The information on information security and existing regulatory competence required in the competition is to be provided in 1.16. Weighting of the criterion "Digital Sovereignty and Operation" for selection evaluation: 15 % The sub-criteria of the criterion "Digital Sovereignty and Operation" are included in the criterion "Digital Sovereignty and Operation" as follows: Data management, processing and transparency: 30 % Cloud operating model and key sovereignty: 25 % Operational, reliability and service: 25 % Multi-tenant or multi-instance capability: 20 %

Innovation and AI The information on information security and existing regulatory competence required in the competition is to be provided in 1.16. Weighting of the criterion "Innovation and AI" for selection evaluation: 10% The sub-criteria of the criterion "Innovation and AI" are included in the criterion "Innovation and AI" as follows: AI maturity and proven benefits: 35% AI governance and controlled use of data: 40% controllability and technical integration of AI functions: 25%

Project team and human capacity The information on existing organisational and human capacity, intended roles, team-related experience and competence, and to ensure sufficient capacity, availability and human continuity shall be provided exclusively in project questionnaire 1.15. The information shall be provided solely for the purpose of demonstrating and assessing the applicant’s technical and professional capacity. An order-related solution, migration or implementation concept must not be submitted in the participation competition. Personal CVs, a specification of the project team to be deployed later and a separate declaration of the annual number of employees by occupational group are not required. Relevant are the role- and team-related information required in the project questionnaire. The review and evaluation shall be carried out exclusively on the basis of the criteria and scales immediately published in 1.15. Weighting of the criterion "Project Team and Human Capacity" for selection evaluation: 20% The sub-criteria of the criterion "Project Team and Human Capacity" are included in the criterion "Project Team and Human Capacity" as follows: Project organisation: 30% UCaaS and integration competence: 40% capacity and scalability: 20% Personnel continuity: 10%

Data protection-related declarations and information are to be provided exclusively in the documents provided for this purpose: - Annex 1.07 contains the formal declaration on compliance with data protection requirements - Annex 1.08 contains the structured data protection self-information including the information on the technical and organisational measures - Annex 1.16 contains the required information on the existing information security and compliance competence - Annex 1.13 contains exclusively the information of Sana on the processing of personal data in the procurement procedure; it is not to be filled in and is not to be returned with the request to participate Which documents are to be submitted by which company is based on the published statement of installations and evidence. A blanket consent to data processing not yet specified, an anticipated recognition of future contract documents or the conclusion of an agreement for order processing are not part of this self-declaration. The specific drafting of data protection contracts takes place in the offer and negotiation phase on the basis of the offered service and operating model.