IT Sicherheitsberatung für das JRC Karlsruhe

The European Commission Joint Research Centre (JRC) Karlsruhe invites requests to participate in a restricted two-stage procurement (EC-JRC/KRU/2026/RP/2931, TED 699278-2026) for IT security consultancy to revise and support implementation of an IT security concept for systems in nuclear installations and facilities. The procedure will establish a single-contractor framework agreement without reopening of competition for up to 48 months (initial 12 months plus up to three 12-month extensions) and the draft contract indicates a framework ceiling of €400,000. Participation requires EU Login/PIC registration and compliance with exclusion, selection and security requirements including handling RESTREINT UE/EU RESTRICTED information, with stage-one submissions via the Funding & Tenders Portal. The deadline for stage-one requests to participate is 17 November 2026 at 16:00 Europe/Berlin and the award criterion is lowest price among technically compliant offers.

Kurzüberblick

Was wird beschafft

Footnotes

1. 1Ausschreibungsunterlagen, Termine und elektronische Einreichung auf dem EU Funding & Tenders Portal: Call details.

Gegenstand und Leistungsumfang (kurz)

Bewerberanforderungen, Eignung und Nachweise

Vertragsform, Dauer, Volumen & Preisbewertung

Ablauf, Fristen, Einreichung

Ausschreibungsdokumente & Sicherheitsanforderungen

Vertragsbedingungen / Rahmenvertrag (Kurzüberblick)

Bewertung, Gewichtung, Zuschlag

Sonstige operative Hinweise für Bieter

Footnotes

1. 1Alle Originalunterlagen, Formulare (ITT, Technical Specifications, Administrative Annex, DoH, FA, NDA, Vertragsentwurf) müssen über das Funding & Tenders Portal (eSubmission) abgerufen und dort eingereicht werden. Siehe Portalseite der Ausschreibung für Downloads und Q&A.

Opportunity overview

This is a European Commission procurement opportunity, not a grant. The Joint Research Centre intends to procure specialist information security consultancy for its Karlsruhe site. The assignment covers revision of the existing IT security concept and support for implementing that concept in accordance with the directive governing the protection of IT systems in nuclear installations and facilities.

The contracting authority is the European Commission, Joint Research Centre, with the procurement managed by the JRC Karlsruhe site. The procedure reference is EC-JRC/KRU/2026/RP/2931 and the TED reference is 699278-2026, notice 196/2026.

The authoritative opportunity record and procurement documents are available through the EU Funding and Tenders Portal opportunity.

Key characteristics

The procurement is structured as a restricted procedure. Any eligible economic operator may submit a request to participate at stage one, but only applicants selected by the contracting authority will be invited to submit a financial and technical offer at stage two. An offer submitted by an operator that was not invited will not be considered.

The contract is for services under CPV code 72000000, IT services including consulting, software development, Internet and support. Additional classification information identifies CPV code 71241000, feasibility study, consultancy, analysis.

The procedure concerns one lot and is intended to result in one framework agreement with one contractor. The framework agreement is without reopening of competition. Signature of the framework agreement does not oblige the Commission to place any minimum volume of orders.

Contracting summary

Scope of work

The core requirement is to revise an IT security concept for JRC Karlsruhe and support its implementation. The work must reflect the requirements applicable to IT systems in nuclear installations and facilities, indicating that the assignment is likely to require both conventional information security expertise and experience with regulated nuclear, safety or classified environments.

The detailed technical scope is contained in the technical specifications document. The administrative specifications state that the technical specifications contain the detailed description of the services and any minimum requirements. Applicants should therefore avoid relying solely on the short portal description when preparing their participation request.

The procurement documents do not permit variants. Applicants must offer the solution and service approach required by the specifications rather than proposing an alternative model.

The framework is expected to support recurring purchases through individual contracts or purchase orders. The quantities stated in the financial model are estimates only. Actual call-off volumes will depend on the requirements ordered by the contracting authority and are subject to the framework ceiling.

Contract duration and structure

The framework agreement may run for a maximum of 48 months. The draft framework structure provides for an initial period of 12 months with up to three extensions, each requiring the applicable contractual renewal decision. The precise renewal mechanics, notice requirements and contractual conditions must be checked in the draft contract.

The contracting authority may, within three years after signature, use a negotiated procedure for new similar services up to a maximum of 50 percent of the framework ceiling, subject to the conditions in the procurement documents and the applicable EU Financial Regulation.

Financial information

The portal record does not state an estimated total value or a maximum framework value in the supplied metadata. This is a significant commercial item that must be verified in the contract notice, administrative specifications and financial model before deciding whether to bid.

The financial offer form indicates estimated quantities of 380 hours for one activity category and 100 hours for activity performed at the contractor's premises. The extracted spreadsheet does not preserve all activity labels reliably, so these figures should be checked directly in the original financial offer workbook before pricing.

The financial offer is based on hourly unit prices and calculated total prices. The form provides for a net total price, German value added tax at 19 percent and a gross total price. The applicable tax treatment should be confirmed against the draft contract and the contractor's tax status.

The award criterion is lowest price. The procurement data assigns 100 percent weight to price, subject to the offer first meeting all administrative, technical, eligibility and security requirements. A low price cannot compensate for failure to satisfy mandatory technical or security conditions.

Who can apply

Participation is open to eligible natural persons and legal entities established within the scope of the EU Treaties, as well as international organisations. Participation may also be available to entities established in third countries covered by an applicable public procurement agreement, including the WTO Government Procurement Agreement, or by a specific agreement with the European Union.

The administrative specifications also refer to eligibility of entities in third countries that qualify for funding under the Euratom Research and Training Programme 2021 to 2025, including countries treated as associated countries where the relevant association arrangement applies at the time of award. Applicants must state their country of establishment and provide evidence requested by the contracting authority.

The opportunity is not identified as suitable for SMEs. This does not necessarily prohibit SME participation, but it indicates that the contracting authority does not consider the procurement specifically designed or reserved for SMEs.

Applicants may participate as a single economic operator or as a group of economic operators. A consortium must nominate a lead member with authority to represent the group. Consortium members are jointly and severally liable for full contract performance, and the required mandate or agreement must be submitted in the prescribed form.

Subcontracting is permitted, but subcontractors must be disclosed where they provide capacities used to satisfy selection criteria or where their known individual share exceeds 20 percent. Relevant subcontractors must provide commitment letters. Security-sensitive subcontracting requires prior written approval and compliance with all applicable security rules.

An applicant may rely on the capacities of another entity to meet selection requirements, provided it demonstrates that the necessary resources will be available. For technical and professional capacity, the supporting entity must perform the works or services for which those capacities are required. Abstract or unsupported availability statements will not be sufficient.

Core eligibility and exclusion requirements

Each applicant, consortium member, relevant subcontractor and supporting entity must satisfy the applicable exclusion and eligibility requirements. The required declaration on honour addresses, among other matters, insolvency, unpaid taxes or social security contributions, serious professional misconduct, fraud, corruption, criminal organisations, money laundering, terrorism financing, trafficking, irregularities, serious contractual failures and obstruction of audits or investigations.

Applicants must also confirm that they are not subject to EU restrictive measures and that relevant owners, directors, controlling persons and beneficial owners are not subject to applicable sanctions. Applicants must declare whether they have debts established as owing to the European Union, Euratom or an executive agency implementing the EU budget.

Applicants must have the legal and professional capacity to perform the contract and must not have conflicting professional interests that could negatively affect contract performance. The contracting authority may request evidence such as recent criminal records, tax clearance, social security clearance, legal registration documents and proof of signing authority.

Evidence may not always be required with the initial participation request, but applicants should prepare it in advance because the contracting authority may request it within a short period. Evidence previously submitted to the same contracting authority may be reusable where it remains current and the circumstances have not changed.

Security and confidentiality requirements

The contract involves access to, and handling or storage of, information classified as RESTREINT UE or EU RESTRICTED. The contract therefore includes special security requirements under the EU rules governing classified information. This is a central eligibility and delivery consideration rather than an administrative formality.

Selected applicants may receive sensitive security information during the second stage and must sign the prescribed non disclosure undertaking. Confidential information may be used only to prepare the tender, must be protected with an appropriate level of care, and may be shared only with authorised personnel and properly disclosed subcontractors subject to equivalent confidentiality obligations.

The contracting authority may require personnel to attend security briefings or training and to sign security declarations. In exceptional cases, personnel assigned to specific projects may need to hold a national security clearance or equivalent authorisation. All costs associated with security measures, including reliability checks and security clearances, are borne by the contractor.

The applicant should assess at an early stage whether its organisation, personnel, information systems, subcontractors and proposed delivery locations can handle EU classified information in accordance with the required security framework. The draft contract and security annexes should be reviewed by the applicant's security, legal and compliance functions before submission.

Required stage one submission

The stage one submission is a request to participate rather than a complete priced tender. It must be submitted exclusively through the electronic submission system connected to the Funding and Tenders Portal. Email, post and other submission methods are not accepted.

The principal documents identified in the portal and procurement package are as follows.

The declaration on honour may be signed using a qualified electronic signature compliant with the eIDAS framework. If a qualified electronic signature is not available, the document may be completed electronically, printed, dated and signed by hand, subject to the requirements in the procurement documents.

Registration and electronic submission requirements

Every participating organisation, including each consortium member, must be registered in the European Commission Participant Register and have a Participant Identification Code. A PIC is mandatory for submitting a request to participate or tender. Organisations should verify whether an existing PIC is already available before creating a new registration.

An EU Login account is required to access the eSubmission function, submit the request, ask questions and manage procurement participation. Applicants should establish the required user roles and ensure that the individual responsible for submission has access to the correct organisation and PIC.

The deadline is 17 November 2026 at 16:00 Europe/Berlin. The official eSubmission receipt with its date and time is the evidence of timely receipt. Applicants should not wait until the deadline because technical validation, file upload, signature and role permissions may delay submission.

Only one participation request per applicant will be considered. If multiple requests are submitted and none is withdrawn, only the latest submission is considered. The latest submission must be complete and cannot rely on earlier submissions to add, correct or supplement missing content.

The portal information indicates that attachments must comply with eSubmission technical requirements. The available guidance states that individual files must be below 50 MB and that the system accepts a maximum of 200 attachments. Applicants should nevertheless check the current system requirements at the time of submission because technical rules may be updated.

Evaluation process

Stage one evaluates access to procurement, administrative compliance, exclusion criteria, selection criteria, absence of restrictive measures and other grounds for rejection. The evaluation is based on the information and evidence in the participation request, together with any clarification or supporting evidence requested by the contracting authority.

Only selected applicants will proceed to stage two. The contracting authority may provide stage two applicants with confidential documents needed to prepare their tenders, subject to execution of the non disclosure undertaking.

Stage two evaluates administrative compliance and conformity with the technical specifications. Among compliant offers, the contract is awarded using the lowest price criterion. The offer must therefore be complete, technically compliant and correctly priced in the prescribed financial offer format.

Important commercial and legal conditions

The framework agreement does not guarantee a minimum number or value of individual contracts. Actual work will be ordered through individual contracts or purchase orders according to the contracting authority's needs, and total orders may not exceed the framework ceiling.

The applicant bears all costs associated with preparing and submitting the participation request and any subsequent tender. Those costs are not reimbursed.

The invitation and submission of a participation request do not create a contractual obligation for the Commission. The contracting authority may cancel the procurement before contract signature without owing compensation, subject to the applicable legal requirements.

The successful contractor must comply with audit, control, fraud prevention, confidentiality, security, environmental and equal treatment obligations. The contractor remains responsible for the performance of subcontractors and must flow down relevant obligations to them.

Key applicant risks

Recommended preparation plan

Overall assessment

This is a specialised, security sensitive public procurement opportunity for an established IT security consultancy with demonstrable capability in nuclear or similarly regulated environments. It may suit a specialist cybersecurity firm, nuclear safety and security consultancy, or consortium combining IT security governance, nuclear compliance and secure classified-information handling.

The opportunity is commercially attractive because it can create a relationship with the JRC over a potential four year period, but the framework structure provides no guaranteed workload and the award is based on lowest price. The most significant bid differentiators are likely to be demonstrable eligibility, credible access to appropriately qualified and potentially cleared personnel, ability to comply with classified-information controls, and disciplined pricing against the prescribed financial model.

The immediate priority is to qualify the opportunity against the full technical specifications and draft contract, particularly the precise security requirements, selection thresholds, framework ceiling, call-off mechanism, service locations, required experience and evidence deadlines. Submission should be treated as a two-stage procurement process, with the current deadline applying to the request to participate rather than the final tender price.