PKI L2/L3 maintenance services

The European Union Agency for the Space Programme (EUSPA) is procuring Level 2 and Level 3 preventive, corrective and perfective maintenance for the EUSPA Public Key Infrastructure supporting Galileo Open Service Navigation Message Authentication. The estimated total contract value is €1,100,000 with a maximum duration of 48 months, an indicative start in March 2027 and a tender submission deadline of 16 December 2026 (electronic submission via the EU Funding & Tenders Portal). The procurement is security-sensitive: bidders must be established in an EU Member State, obtain required facility and personnel security clearances, and may access classified information or source code subject to Non-Disclosure Undertakings. The contract will be awarded on a best price-quality basis weighted 60% quality and 40% price with detailed technical, security and financial submission requirements set out in the tender documents.

What it funds / contracts

Scope summary

Procurement for Level 2 and Level 3 preventive, corrective and perfective maintenance of the EUSPA Public Key Infrastructure (PKI) supporting Galileo OS-NMA. Main activities: recurring preventive maintenance (cybersecurity vulnerability monitoring, patch assessment and testing, obsolescence management), corrective interventions, delivery of technical/security documentation and reporting, and adherence to KPIs and security requirements.

Opportunity summary

Procurement by the European Union Agency for the Space Programme (EUSPA) to provide Level 2 and Level 3 preventive, corrective and perfective maintenance services for the EUSPA Public Key Infrastructure (PKI) that supports Galileo Open Service Navigation Message Authentication (OS-NMA). The tender is an open procedure, electronic submission via the EU Funding & Tenders Portal, award by best price-quality ratio, framework agreement with maximum duration 48 months and an estimated total value of €1,100,000 for the contract and options.

Scope and services required

The contract covers maintenance of the EUSPA PKI (RCA and SCA levels and associated PKI policies/procedures) primarily via recurring preventive maintenance (cybersecurity vulnerability monitoring, patch assessment and testing, obsolescence management, hardware/software monitoring), complemented by corrective interventions when required. The SoW and technical annexes (Annex I.1 and its sub-annexes) define the detailed deliverables, DRL, KPI regime, security and handover arrangements.

Who can apply (Eligible Applicant Types)

Eligible economic operators are commercial companies, consortia, subcontractors and other legal persons meeting participation, exclusion and selection conditions specified in the Tender Specifications. Entities must be established in an EU Member State with executive management in that Member State and must commit to carry out contract activities in one or more EU Member States (Participation Conditions under Art. 24 Space Regulation). Entities subject to security-sensitive tasks must be EU-established and not under control by third-country or third-country entities unless a waiver is granted and national competent authorities provide guarantees.

Funding type and contract nature

This is a public service procurement (framework agreement / direct contract) awarded by open procedure. The financial mechanism is a contract for services; award method is best price-quality ratio. Prices must be firm and fixed in euros for the contract duration (Annex I.F.1 and I.F.2 financial templates apply).

Consortium requirement

Single tenderer or joint tender (consortium) may submit. Joint tenders require Power of Attorney (Annex I.C) appointing a lead coordinator; all members are jointly and severally liable. Tenderers may rely on subcontractors or non-subcontractor partners by providing Letters of Intent (Annex I.D.1 and Annex I.D.2).

Beneficiary scope (Geographic eligibility)

Participation is limited to entities established in EU Member States (requirement for access to EU classified information and for security-sensitive activities). Subcontractors not involved in security-sensitive work may be outside those constraints, but key assets and security roles must be EU-based as defined in Annex I.H and Section 7 of the Tender Specifications.

Target sector and technologies

Project maturity / expected stage

Funding amount and contract duration

Submission and application type

Nature of support

Application stages and evaluation

Success rates

No official success rate published. Typical success depends on competition intensity for space cybersecurity contracts; only tenders meeting strict security, financial and technical thresholds proceed to award. The tender contains minimum thresholds (qualitative minimums, turnover minimum €500,000 p.a.) and security prerequisites that reduce number of eligible bidders.

Co-funding requirement

No co-funding from EUSPA is required beyond the priced service contract. Tenderers must provide firm fixed prices and financial evidence (Annex I.E). A subcontracting target of at least 5% competitive subcontracting outside the Undertaking is requested during contract execution (Section 5.2).

Templates and application structure

The procurement includes a comprehensive set of annex templates to populate and submit in the three envelopes. Key templates and their intended use:

Security and clearance requirements

Evaluation and award criteria

Award is to the most economically advantageous tender based on qualitative award criteria (Q1–Q6 with detailed sub-criteria) weighted 60% and financial score weighted 40%. Qualitative criteria cover compliance to technical baseline and SoW (Q1), approach to support tasks (Q2), management and staffing (Q3), supply chain and SME participation (Q4), compliance to contractual baseline and SAL (Q5) and financial consistency/traceability (Q6). Minimum score thresholds and per-criterion minima apply; tenders scoring below thresholds are eliminated before price evaluation.

KPIs, service levels and liquidated damages

The Draft Contract and Annex I.1 contain KPI Regime and Liquidated Damages. Examples include KPIs for anomaly management (analysis time, interim workaround time, permanent fix time) and cyber patching (timeliness by vulnerability criticality). Daily liquidated damages per anomaly/patch apply per KPI table in Annex I.1.IV (e.g. KPI-01 KPI-03: €200/€100/€50 per day depending on category, KPI-04 patch implementation: up to €200/day for Critical). Tenderers must accept KPI regime or clearly justify partial compliance as part of Q5.

Selection and evidence requirements — summary

Practical notes and risks for applicants

Applicants must plan early for security clearances and NDU processing (advisory NDU deadline 13/11/2026 to obtain classified material for tender preparation). The eSubmission system encrypts attachments and limits file sizes; QES is required for certain signed documents. Competitive subcontracting and minimum 5% subcontracting outside the Undertaking during execution are mandated and evaluated under Q4. Compliance with AI regulation (AI Act) must be shown if AI is used (Annex I.N). Tenderers should prepare to deliver UNCLASSIFIED parts of security documents in the offer and classified parts at kick-off subject to security arrangements.

This tender is intended to ensure continuity of maintenance after expiry of incumbent contract (CERTSIGN S.A. until 21 March 2027). The successful contractor will operate under strict IP, security, operational and reporting obligations defined in the Draft Contract and annexes, including deliverable lists (DRL), KPI regime and acceptance procedures.

Footnotes

1. 1Full procurement documentation, annexes and submission portal are available on the EU Funding & Tenders Portal: ec.europa.eu

Executive Summary

This is a public procurement tender, not a grant scheme. The European Union Agency for the Space Programme seeks a contractor to provide Level 2 and Level 3 preventive, corrective and perfective maintenance for the EUSPA Public Key Infrastructure supporting Galileo Open Service Navigation Message Authentication. The procurement is intended to maintain service continuity after expiry of the incumbent maintenance contract.

The opportunity is commercially relevant to established cybersecurity, public key infrastructure, secure systems, cryptographic services and space systems maintenance providers. It is security sensitive and has significant access, ownership, control, classified information, personnel clearance and EU establishment requirements.

The authoritative opportunity record is available through the EU Funding and Tenders Portal Official opportunity record.

Opportunity Identification

The principal CPV classification is 72267000, software maintenance and repair services. Additional classifications are 50312000, maintenance and repair of computer equipment, and 72250000, system and support services.

The procurement is conducted under the EU Financial Regulation and the legal and security framework applicable to the Union Space Programme, Galileo infrastructure, EU classified information and security-sensitive contracts.

Commercial Parameters

The estimated total contract value is €1,100,000 for the full contract duration, including options. This is an estimated procurement value and should not be treated as a guaranteed payment or minimum order value unless the final contract documents provide otherwise.

The maximum contract duration is 48 months, including options. The expected implementation start is March 2027, subject to completion of the evaluation, award and contract signature processes.

EUSPA reserves the right, within three years following contract signature, to use an exceptional negotiated procedure for additional services with the same contractor where the conditions of the applicable Financial Regulation are met.

The contract is expected to be a direct service contract. Its terms, service scope, performance requirements, payment arrangements and contractual obligations are established in the procurement documents rather than through later mini competitions.

There is no grant funding rate, co-financing rate or reimbursement percentage. Tenderers are expected to submit a complete commercial offer using the prescribed financial proposal and cost sheet templates.

Scope of Services

The services concern maintenance of the EUSPA PKI system and the associated PKI policies and procedures used for Galileo Open Service Navigation Message Authentication.

The PKI is based on a three-tier certification authority structure comprising a Root Certification Authority, a Subsidiary Certification Authority and an Issuing Certification Authority. The procurement is focused on maintenance of the elements required for the Root Certification Authority and Subsidiary Certification Authority, together with the policies and procedures needed to operate the EUSPA PKI.

The system infrastructure, including the operational and validation chains, is hosted at EUSPA facilities in Spain. The Root Certification Authority and Subsidiary Certification Authority are operated by EUSPA.

The principal service activities include:

The contractor may receive access to relevant source code and supporting technical documentation during contract implementation, subject to intellectual property, confidentiality and security arrangements.

Place of Performance and Working Language

The contractor's premises must be located within an EU Member State. Certain activities will also be performed at the EUSPA Galileo Security Monitoring Centre in San Martín de la Vega, Spain.

English is the working language of the contract and will be used for correspondence with EUSPA and contract documentation unless the procurement documents specify otherwise.

Who Can Apply

Eligible tenderers may apply as a sole economic operator or as a group of economic operators. Joint tenders may be submitted by a formal or informal grouping, but the group must appoint a leader and provide the prescribed power of attorney. Group members are jointly and severally liable for performance of the contract.

Subcontracting is permitted. A tenderer may rely on the capacities of subcontractors or other entities, provided it demonstrates that the necessary resources will be available through the required letters of intent and supporting evidence.

The procurement is not identified as SME suitable in the portal record. Nevertheless, EUSPA expressly seeks broad participation by start-ups, new entrants and SMEs through the supply chain and requires the successful contractor to pursue competitive subcontracting outside its own undertaking.

Mandatory Participation Conditions

For the prime contractor, group members, Core Team members and subcontractors involved in security-sensitive activities, the following cumulative conditions apply:

These conditions must be met at tender submission and throughout the contract. The conditions apply individually to entities performing Level 2 or Level 3 maintenance, cyber maintenance, patching or vulnerability assessment, entities accessing classified areas at the Galileo Security Monitoring Centre, entities managing cryptographic accounts or keys, and entities accessing EU classified information.

A waiver may potentially be requested for the third-country control condition, but no waiver is available for the EU establishment and EU executive management conditions. Any waiver request must be submitted with the tender and supported by the required assessment and guarantees from a competent authority of an EU Member State.

Subcontractors that are neither Core Team members nor involved in security-sensitive activities are not subject to the same security participation conditions, although they remain subject to applicable exclusion, rejection, selection, restrictive measures and contractual requirements.

Security and Classified Information

The procurement has a substantial security component. Tenderers must be able to obtain, maintain and renew the security authorisations, clearances and approvals required for performance.

Access to EU classified information and EU proprietary information requires execution of the prescribed Non-Disclosure Undertaking. The tenderer must provide identification information, authority to sign, evidence of appointment of a Local Security Officer and evidence relating to communications and information systems accreditation where required.

The tender documents indicate an advisory deadline of 13 November 2026 for submitting the Non-Disclosure Undertaking. Requests submitted shortly before the tender deadline may not be processed in time to support tender preparation.

Information received under the Non-Disclosure Undertaking must only be disclosed to approved entities with a demonstrated need to know and equivalent confidentiality obligations. Entities that receive protected information but do not submit a tender, or that are unsuccessful, must comply with the return, destruction and other obligations in the undertaking.

Economic and Financial Capacity

Tenderers must demonstrate a stable financial position and meet the minimum yearly turnover requirement established in the tender specifications. The precise turnover threshold, calculation period and supporting evidence must be taken from Annex I.E and the relevant financial capacity section of Annex I.

The financial file must use the prescribed Financial Proposal and Cost Sheets. Tenderers should ensure that all recurring maintenance, corrective intervention assumptions, travel, on-site support, security compliance, staffing, tools, testing, documentation, overheads and subcontracting costs are reflected consistently in the price model.

Technical and Professional Capacity

Tenderers must demonstrate relevant experience and the technical and professional capacity to perform the contract. The selection assessment is based on the evidence and thresholds in the tender specifications and associated assessment templates.

Relevant evidence is expected to address experience in areas such as PKI operations, certificate authority maintenance, cryptographic infrastructure, vulnerability monitoring, patch management, secure systems, high-availability environments, classified or security-sensitive operations and structured Level 2 and Level 3 support.

The Core Team must be identified, together with the roles and responsibilities of the prime contractor, group members, subcontractors and other entities whose capacity is relied upon. Letters of intent are required for Core Team subcontractors and other supporting entities where their resources are used to satisfy selection criteria.

Award Method

The contract will be awarded using the best price-quality ratio. The published award weighting is 60 percent for quality and 40 percent for price.

The qualitative assessment includes the tenderer's approach to service delivery, technical compliance, organisation, risk management, security, continuity, subcontracting and supply chain participation. The exact scoring methodology and minimum quality thresholds are set out in the tender specifications.

A tender that is financially competitive but weak on security, continuity, technical methodology, staffing, risk management or compliance is unlikely to be competitive because quality represents the majority of the final score.

SME and Supply Chain Participation

The contractor is expected to achieve a minimum 5 percent share of subcontracting awarded through competitive tendering to entities outside its undertaking, unless a justified derogation is accepted by EUSPA.

The tender must include a detailed plan describing the intended subcontracted activities, the level of subcontracting, the participation of start-ups, new entrants and SMEs, their places of establishment, the competitive tendering approach, milestones and the proportion of each subcontracted task relative to the total tender price.

If competitive subcontracting cannot be completed before tender submission, the tenderer must provide a signed undertaking and credible plan explaining how the target will be achieved during implementation.

The plan and commitments are assessed under a qualitative award criterion and become contractual obligations after award. Failure to comply may trigger contractual remedies.

Artificial Intelligence Requirements

If the tenderer intends to use artificial intelligence systems or general-purpose AI models in delivering the services, the technical proposal must identify the tool, describe its intended purpose, classify it under the EU Artificial Intelligence Act, identify the relevant provider or deployer roles and provide a risk assessment.

The tenderer must also address information security, data protection, fundamental rights, classified information handling and continuing compliance throughout the contract. AI use should therefore be treated as a controlled and fully documented activity rather than an informal productivity tool.

Exclusion, Rejection and Restrictive Measures

Tenderers, group members, Core Team entities and relevant subcontractors must not be subject to the exclusion or rejection grounds in the Declaration of Honour and applicable EU Financial Regulation.

Supporting evidence may include recent judicial records or equivalent documents and certificates confirming payment of taxes and social contributions. Such evidence is specifically required for the tenderer, Core Team members and subcontractors whose contribution exceeds the stated 10 percent threshold, without limiting EUSPA's right to request evidence from other entities.

The tenderer must also confirm that it and relevant participating entities and persons are not subject to applicable EU restrictive measures. Restricted persons must not receive funds or benefits under the procurement.

Tender Composition and Competition Rules

An entity may not submit more than one tender as a sole tenderer, group leader or group member. Separate tenders by related entities may be permitted only where the tenders are prepared independently and autonomously.

Cross-subcontracting is prohibited where two tenderers subcontract to one another within the same procedure. EUSPA may reject tenders where it identifies collusion, anti-competitive conduct or inadequate independence between bids.

A joint tender involving entities that could individually perform the contract must justify why all members are necessary or demonstrate that the joint tender creates significant efficiencies, is indispensable and does not eliminate competition.

Submission Requirements

Tenders must be submitted exclusively by electronic means through the designated Funding and Tenders Portal eSubmission system. An EU Login account is required to access submission functionality, submit questions and upload the tender.

A Participant Identification Code is mandatory for organisations submitting as sole tenderers or consortium members. Tenderers should verify or create their organisation registration well before the deadline and ensure that the correct legal entity and PIC are used.

The submission is organised into three principal files or envelopes:

Tender documents must be prepared in accordance with the prescribed formats and naming requirements. Portal technical limits should be checked before upload, including attachment size, supported file types and the maximum number of files.

Key Dates

Documents Applicants Should Review

Applicant Readiness Assessment

Key Risks and Practical Observations

The most material eligibility risk is failure to satisfy the EU establishment, executive management and third-country control requirements for security-sensitive entities. This should be assessed for the entire delivery chain, not only the prime contractor.

The most material operational risk is the need to provide secure and continuous maintenance for infrastructure supporting Galileo authentication services while complying with classified information, cryptographic handling and site access requirements.

The most material bid risk is underestimating the quality component. Quality represents 60 percent of the award weighting, and the tender must demonstrate credible technical delivery, security governance, service continuity, staffing and risk control rather than merely offer a low price.

The incumbent contract is stated to continue until 21 March 2027, while the estimated new contract start is March 2027. Tenderers should therefore examine the handover, transition, asset access and continuity provisions carefully and explain how service mobilisation will avoid any interruption.

The €1,100,000 estimated value over 48 months implies an average planning value of approximately €275,000 per year, but this is only a simple indicative average and does not establish the actual annual payment profile, option value, milestone structure or volume of corrective work.

Overall Assessment

This is a specialised, security-sensitive EU agency procurement suited primarily to providers with demonstrable PKI, cryptographic, cybersecurity and secure infrastructure maintenance capability. It is accessible to sole tenderers, consortia and subcontracting structures, but the requirements for EU control, classified information handling, technical capacity and security authorisations materially narrow the practical bidder pool.

A credible bid should be built around assured service continuity, strong preventive maintenance, rapid and controlled vulnerability and patch response, qualified personnel, transparent escalation, secure supply chain management, measurable KPIs, robust transition planning and a defensible cost model. Applicants should treat the tender specifications and all annexes as controlling documents and verify every threshold, template and security requirement before submission.

Source and Evidence Note

The opportunity details, tender documents, deadlines, value, duration, award weighting and participation requirements should be verified against the official Funding and Tenders Portal record and the current versions of the published procurement annexes before any bid decision or submission. 1

Footnotes

1. 1Official source: EU Funding and Tenders Portal opportunity