Evaluation report of the ECCC required under Article 38(4) of Regulation (EU) 2021/887

The European Commission (DG CNECT) has published an open tender to contract an external evaluation of the European Cybersecurity Competence Centre (ECCC) required under Article 38(4) of Regulation (EU) 2021/887, with an estimated total value of €200,000 and a maximum duration of six months (Phase 1 mandatory; Phase 2 optional). Tender submissions must be made electronically via the Funding & Tenders Portal by 19 October 2026 16:00 Europe/Brussels and the procedure is open to economic operators covered by the EU/EEA and WTO GPA (UK eligible). The contract is for services (CPV 79400000) and will be awarded on the best price-quality ratio with a 60% quality and 40% price weighting, requiring demonstrable evaluation, policy analysis and stakeholder consultation experience. Bidders must meet specified financial and technical selection criteria and provide required declarations and annexes as set out in the tender documents.

Who can apply

Eligible bidders

Open tender by the European Commission (DG CNECT). Eligible economic operators established in the EU/EEA and in GPA parties may tender. Consortia/joint tenders and subcontracting are allowed; identified subcontractors above 20% must be declared.

Value:Estimated total value €200,000 (fixed price for Phase 1 and optional Phase 2) ¹

1. 1What it funds: external study, evidence gathering, stakeholder input, analysis and drafting of an evaluation report of the European Cybersecurity Competence Centre (ECCC) under Article 38(4) of Regulation (EU) 2021/887; optional follow-up support to draft an Impact Assessment if the Commission activates Phase 2.
2. 2Who can apply: companies, consultancies, research organisations or consortia with demonstrated experience in EU-level evaluations, impact assessments and cybersecurity policy; must meet financial and technical selection criteria in the tender specifications.
3. 3How much and duration: maximum contract value €200,000; maximum contract duration 6 months (Phase 1 up to 3 months; Phase 2 optional up to 3 months).

Award will follow the best price-quality ratio. Tenders submitted exclusively via the EU Funding & Tenders Portal eSubmission system; use your Participant Identification Code (PIC) and EU Login account. Contracting authority: European Commission, DG CNECT. Main CPV: 79400000 (business and management consultancy).

Footnotes

1. 1Official procurement documents, full tender specifications, annexes and submission details are available on the Funding & Tenders Portal Tender notice.

Reference:EC-CNECT/2026/OP/0144 (TED ref. 638955-2026). Contracting authority: European Commission, DG CNECT - Communications Networks, Content and Technology (Cybersecurity and Trust, Cybersecurity Technology and Capacity Building). Main CPV: 79400000 Business and management consultancy and related services. Nature of contract: services. Estimated total value: €200 000. Maximum contract duration: 6 months, comprising Phase 1 (mandatory) and Phase 2 (optional, conditional on Commission activation). Submission method: electronic via Funding & Tenders Portal (EU Login required). Deadlines: tender receipt 19/10/2026 16:00 (Brussels time); public opening 20/10/2026 14:00 (Brussels time). Questions deadline: 09/10/2026 23:59 (Brussels time).

Opportunity summary and objectives

Purpose:procure external expertise to support the European Commission in carrying out the comprehensive evaluation required by Article 38(4) of Regulation (EU) 2021/887 of the European Cybersecurity Competence Centre (ECCC) following submission of the ECCC implementation report. The contractor will gather evidence and data, perform analysis, draft an interim and final evaluation report and prepare presentation material. The contractor must assess the ECCC’s mandate, legal and administrative framework, governance and coordination mechanisms and the ECCC’s cooperation with the Network of National Coordination Centres (NCCs), the Cybersecurity Competence Community and ENISA, and examine synergies and overlaps with other Union institutions, bodies, offices and agencies to identify fragmentation, overlaps and inefficiencies in the EU cybersecurity ecosystem.

Contract structure:two phases. Phase 1 (mandatory, maximum 3 months from commencement) covers scoping, data and evidence gathering (desk research, limited interviews/questionnaires as guided by the Commission), analysis, interim report (within 2 months), and final evaluation report (within 3 months), plus summary and visuals. Phase 2 (optional, maximum 3 months if activated) provides support to prepare an Impact Assessment (IA) staff working document and associated deliverables, including stakeholder consultation analysis, options development, impacts assessment (economic, social, environmental), options comparison and final IA package. Activation of Phase 2 is at the Commission's discretion and will be notified at least 10 days before start.

Key deliverables and schedule

1. 1Phase 1 – Task 1: Scoping meeting and Commission-approved work plan (kick-off).
2. 2Phase 1 – Task 2: Data and evidence gathering (desk research, interviews/questionnaires if authorised by Commission).
3. 3Phase 1 – Task 3: Analysis and drafting of evaluation report in line with Article 38(4) of Regulation (EU) 2021/887 (interim and final versions).
4. 4Phase 1 – Task 4: Summary, presentation and visual materials for briefings.
5. 5Phase 2 (optional) – Task 1: Support to stakeholder consultation analysis and summary report.
6. 6Phase 2 (optional) – Task 2: Develop IA core elements (context, problem definition, EU added value, objectives, initial options).
7. 7Phase 2 (optional) – Task 3: Detailed policy options, IA methodology, quantitative and qualitative impact assessment, comparison and ranking of options.
8. 8Phase 2 (optional) – Task 4: Full IA documentation and annexes, final report and presentation materials.

Phase durations and maximum total:Phase 1: up to 3 months. Phase 2 (optional): up to 3 months. Total maximum duration: 6 months.

Eligibility and who should apply (detailed classification answers)

Eligible Applicant Types:The tender is open to legal persons and natural persons established in entities covered by the EU Treaties, including EU Member States, contracting parties to the WTO Government Procurement Agreement and third countries with procurement access agreements. Eligible applicant types that commonly bid: consultancies, large professional services firms, specialised public policy research organisations, university research centres, research institutes, think tanks, consortia led by management consultancy/legal/economic/technical specialists, SMEs (where capability demonstrated), NGOs with relevant evaluation expertise and market research providers. Subcontracting is allowed and the tender requires identification of subcontractors whose individual share exceeds 20% or whose capacities are used to meet selection criteria. UK suppliers are eligible because the procurement is covered by the GPA and the UK is a GPA party (Q&A published by the contracting authority confirms this).

Funding Type:Tender / service contract (procurement) with fixed price. Payment by invoice; award based on best price-quality ratio.

Consortium Requirement:Either single tenderer (sole) or joint tender (consortium) allowed. Joint tenders must appoint a group leader and sign Agreement/Power of Attorney (Annex 3). All group members are jointly and severally liable.

Beneficiary Scope (Geographic Eligibility):Any economic operator established in EU Member States, EEA and countries covered under the WTO Government Procurement Agreement or other procurement access agreements. The procurement documents and Q&A confirm access by UK suppliers under GPA.

Target Sector:Cybersecurity policy, research, innovation and industrial capacity; governance and coordination in the EU cybersecurity ecosystem. The study touches on digital policy, public administration, research programmes (Horizon Europe, Digital Europe Programme), and EU agency coordination (ENISA).

Mentioned Countries:Explicit mentions: European Union, Belgium (location of contracting authority). Q&A clarifies United Kingdom (UK) eligibility under GPA. Geographic scope for analysis: whole EU. Delivery: contractor premises and Commission premises in Brussels for meetings.

Project Stage:Policy evaluation and analysis: maturity expected at evaluation/demonstration stage. The contractor must be able to analyse implementation to date and assess effectiveness, coherence, relevance, efficiency and EU added value; Phase 2 requires IA skills (policy options and impact analysis).

Funding Amount:Estimated total procedure value €200 000. Maximum amounts indicated in tender specifications: Phase 1 maximum €80 000; Phase 2 maximum €120 000 (activation optional). All amounts inclusive of expenses; fixed price not subject to revision.

Application Type:Open call for tenders (open procedure). Electronic submission through eSubmission (Funding & Tenders Portal) only. EU Login required; PIC mandatory for each organisation.

Nature of Support:Financial: money via service contract (fees). Non-monetary: project management, analytical and drafting services, stakeholder consultation support and presentation materials.

Application Stages:Single-stage submission with electronic tender submission; evaluation followed by award. The procedure includes: administrative compliance check, exclusion check, selection criteria assessment and technical/price evaluation. Tenderers may be asked to provide supporting evidence during evaluation; presumed winner will provide documentary evidence on exclusion/selection as requested.

Success Rates:Not published. Award method is best price-quality ratio. Tenderers should note strict minimum thresholds (technical score threshold per criterion and overall technical threshold 60/100) – tenders failing thresholds are rejected. The contracting authority reserves the right to exclude abnormally low tenders under Financial Regulation rules.

Co-funding Requirement:No co-funding from the Commission required beyond the fixed price contract. Tenderers must cover preparation costs themselves. If relying on other entities for selection criteria, commitment letters (Annex 5.2) are required.

Eligibility, selection and administrative requirements (detailed)

Exclusion and selection:Tenderers must complete the Declaration on Honour (Annex 2) on exclusion and selection criteria. The contracting authority may request supporting documents (company registration, financial statements for last 3 closed years, profit and loss accounts, references for projects, CVs for key experts). Economic and financial minimum: average yearly turnover over last three financial years above €200 000 (consolidated assessment allowed). Technical minimums: at least 3 similar projects in the last 3 years with minimum value €140 000 each; key expert profiles required (minimum project manager, policy experts, data analyst) with specified years of experience and relevant language skills. See tender specifications for full evidence lists.

1. 1Mandatory forms and annexes to submit with tender: Declaration on Honour (Annex 2), Agreement/Power of Attorney for consortium (Annex 3) if applicable, Annex 4 list of identified subcontractors (if any), Annex 5.1 commitment letters from identified subcontractors and Annex 5.2 commitment letters from entities whose capacities are relied upon, Annex 6 financial tender form (use supplied template).
2. 2Technical tender must describe methodology, work plan, allocation of resources, quality control measures, CVs of key experts, list of relevant projects (references).
3. 3Financial tender must be fixed price, inclusive of all costs, expressed in EUR and VAT excluded. Use Annex 6 spreadsheet.

Security and data protection:Contractor and personnel must comply with Commission security requirements (Appendix 1). Personal data processed must remain within EU/EEA data centres unless prior written authorisation and appropriate safeguards are agreed. The contractor will notify security incidents within 48 hours and assist the Commission in notification to competent authorities where required. Contractors must follow Commission rules for background security screening of personnel when access to Commission premises or IT is required. See Appendix 1 for full requirements.

Award and evaluation details

Award method:best price-quality ratio with weighting Price 40% / Quality 60%. Quality evaluated on three technical sub-criteria: (1) Quality of methodology and fit to objectives (max 50 points, threshold 30), (2) Organisation of work and allocation of resources (max 25 points, threshold 15), (3) Quality control measures (max 25 points, threshold 15). Minimum overall technical score 60/100 required for acceptance. Financial offer is the total fixed price for Phase 1 and Phase 2 combined (Phase 2 optional).

Abnormally low tenders:the contracting authority may request clarification where a tender appears abnormally low and may reject an offer that cannot be justified under the Financial Regulation rules.

How to apply and practical submission guidance

Submission method and portal:all tenders must be submitted electronically through the Funding & Tenders Portal eSubmission system. EU Login account and PIC are required. The eSubmission Quick Guide and system requirements (supported browsers: latest Google Chrome or Mozilla Firefox, maximum attachment sizes 50 MB per file, max 200 files per submission) are available on the Portal. The contracting authority will not accept submissions by e-mail or post. Tenderers are advised to test eSubmission well in advance and to ensure file names and formats follow the system rules. Drafts can be edited until the deadline. Submission receipt timestamp from the system is proof of on-time submission.

1. 1Register organisation in Participant Register and obtain PIC (re-use if already available).
2. 2Prepare technical tender (methodology, work plan, CVs of minimum 4 experts, project references, quality controls).
3. 3Prepare financial tender using Annex 6 financial form and quote fixed price in EUR (Phase 1 and Phase 2 combined).
4. 4Provide Declaration on Honour (Annex 2) signed by authorised representative; provide Agreement/Power of Attorney (Annex 3) if joint tender; include Annex 4 list of subcontractors and Annex 5 letters where relevant.
5. 5Submit all documents via eSubmission and check submission receipt timestamp before deadline.

Important compliance notes:Tenders that do not meet minimum requirements, or that do not provide required declarations and documents where these must be supplied with the tender, will be rejected. The contracting authority reserves the right to ask tenderers to provide documentary evidence during the evaluation and before award.

Templates and application forms structure:The procurement provides mandatory models and templates: Annex 2 Declaration on Honour, Annex 3 Agreement/Power of Attorney for consortiums, Annex 4 list of identified subcontractors, Annex 5.1 commitment letter for subcontractors, Annex 5.2 commitment letter for entities on whose capacities the tenderer relies, Annex 6 financial tender form (spreadsheet). The technical tender should include: executive summary, proposed methodology and work plan with milestones and deliverables, description of data gathering approach and stakeholder engagement, risk and mitigation plan, organisation and staffing chart, CVs of key experts (minimum profiles specified in T2), quality control measures and examples of similar work, and a list of references for at least 3 comparable projects. Financial tender must be uploaded separately as Annex 6 completed spreadsheet. Use the Commission Word/PDF template that will be provided after contract signature to final deliverables; for the tender, follow the format described in Annex 1.

Access to procurement documents, tender specifications, draft contract, security appendix and all annexes are published on the Funding & Tenders Portal at the tender details page. The contracting authority has provided detailed tender specifications and a draft service contract; tenderers must read the draft contract and all annexes carefully and price accordingly. The invitation to tender and tender specifications (Annex I) describe privacy, accessibility and publication requirements. The tender specifications include mandatory deliverable timing, reporting and formatting rules and the requirement to respect Commission visual identity and accessibility standards for publishable materials ¹.

Procurement contact:cnect-tendering@ec.europa.eu for administrative/award matters; project officer contact is listed in tender documents for technical clarifications. Watch the Portal Q&A for published clarifications and the single published Q&A confirming UK eligibility under GPA.

Risk, confidentiality, checks and audits

The contracting authority will perform standard checks and audits, including rights of access for Court of Auditors, OLAF and EPPO. The contractor must keep original documents for five years following payment of the balance, cooperate with audits and allow on-site inspections. The contractor must report security incidents within 48 hours and cooperate on mitigation and reporting. The contractor must comply with EU data protection rules (Regulation (EU) 2018/1725) and technical constraints on data location (EU/EEA) described in the tender specifications.

What is required from bidders — capacities and recommended approach

Minimum demonstrated capacities:consolidated average turnover > €200 000 for last 3 years; at least 3 comparable projects in last 3 years (each min €140 000) demonstrating experience with EU evaluations, policy reports or impact assessments in cybersecurity, digital or research policy; team including at least one experienced project manager (min 6 years), policy experts (min 4–6 years as specified) and quantitative analyst (min 6 years) with survey and data-handling experience; proven experience of working with EU institutions and familiarity with Better Regulation Toolbox. Recommended approach: provide a clear methodology aligned to the tender tasks, realistic workplan with milestones, description of stakeholder engagement approach (limited interviews subject to Commission approval), data sources to be exploited, quality control and draft/final review cycles, risk mitigation and confidentiality controls.

Final summary — what is this opportunity about and how to explain it

This is a Commission open tender to contract a short, fixed-price external study to evaluate the European Cybersecurity Competence Centre (ECCC) in accordance with Article 38(4) of Regulation (EU) 2021/887, following the ECCC implementation report. The work requires rigorous, evidence-based evaluation of the ECCC’s mandate, legal and administrative framework, governance, coordination with NCCs, ENISA and the Cybersecurity Competence Community, and an assessment of synergies and fragmentation across the EU cybersecurity ecosystem. The contract is structured in two phases: Phase 1 (mandatory) to deliver the evaluation report and Phase 2 (optional) to provide support for an Impact Assessment should the Commission choose to pursue a legislative initiative. The award will be on best price-quality ratio; tenders must meet minimum financial and technical selection criteria and provide the specified declarations, Annexes and templates. All submissions are electronic via the Funding & Tenders Portal and the tender documents (invitation, specifications, draft contract, annexes and security appendix) must be followed carefully. The estimated budget is €200 000 fixed price, maximum 6 months total duration. Eligibility covers EU, EEA and countries under the GPA (UK eligible under GPA per Q&A).

Footnotes

1. 1Procurement documents, tender specifications, draft contract, Annexes 1-6 and the Appendix on Security requirements are published on the Funding & Tenders Portal tender page. System and submission technical guidance and templates are available on the portal.

This is a public services tender for an external contractor to support the European Commission in evaluating the European Cybersecurity Competence Centre. The assignment is linked to the Commission's statutory evaluation duty under Article 38(4) of Regulation (EU) 2021/887 ¹.

What the contract is about

The contractor will help prepare a comprehensive evaluation of the ECCC after the submission of its implementation report. The work will assess the effectiveness of the ECCC mandate, its legal and administrative framework, and the functioning of its governance and coordination mechanisms, using input from the Governing Board, National Coordination Centres and the wider cybersecurity community.

The study will also examine how well the ECCC creates synergies with other Union institutions, bodies, offices and agencies, and identify opportunities to reduce fragmentation, overlaps and inefficiencies across the EU cybersecurity ecosystem.

Estimated value:€200000.

Contract duration:Maximum 6 months.

Who can apply

This is an open procedure for tenderers capable of delivering consultancy and evaluation services in a public policy or institutional context. The contract is for services, not a grant, so there is no funding rate or co financing percentage. The portal indicates that the procurement is covered by the Government Procurement Agreement, and the published question and answer set states that UK suppliers are eligible.

The main classification is business and management consultancy and related services, which suggests the contracting authority is looking for teams with evaluation, policy analysis, organisational assessment and stakeholder consultation capability rather than a purely technical cybersecurity delivery team.

Submission and award

What applicants should note

• The work is time limited and should be structured for rapid mobilisation and a short delivery window.
• The evaluation focus is institutional and policy oriented, so proposals should demonstrate experience with EU governance, programme evaluation and stakeholder analysis.
• The tender requires electronic submission through the Funding and Tenders Portal and EU Login access.
• Questions submitted after 9 October 2026 23:59 Brussels are not guaranteed a reply.
• The procurement is based on the best price-quality ratio, so a strong technical approach will matter more than the lowest price alone.

Footnotes

1. 1Article 38 of Regulation (EU) 2021/887 sets out the monitoring, evaluation and review framework for the European Cybersecurity Competence Centre and the Commission's implementation reporting obligations. The regulation text is available at EUR-Lex. [4]