Services for the Design, Development and Analysis of Cybersecurity Indexes

ENISA has published an open service tender ENISA/2026/OP/0013 to design, develop and analyse cybersecurity indexes covering EU Member States and other partners to produce evidence based insights on cybersecurity posture and maturity. The estimated maximum budget is €600,000 over a four year framework (initial 12 month term with renewals to 48 months). Submission is by mandatory electronic eSubmission via the EU Funding & Tenders Portal with a deadline of 21 September 2026 at 10:00 Europe/Athens. Eligible applicants are organisations able to deliver research, analysis and index development services as specified in the procurement documents and award criteria weight quality 70 and price 30.

Opportunity at a glance

Essential facts

Call identifier ENISA/2026/OP/0013. Tender to provide design, development and analysis services for cybersecurity indexes measuring posture and maturity across EU Member States and other partners. Domains include capacity building, policy implementation, risk management, incident response, vulnerability disclosure, exercises, reporting and supply chain practices.

Estimated contract value:Estimated overall amount €600,000. Framework contract initial period 12 months, renewable up to 3 times (total planned duration 48 months).

1. 1Who can apply: legal entities able to enter into contract with ENISA; consortia and subcontracting arrangements are addressed in the procurement documents.
2. 2Submission method and portal: eSubmission via the EU Funding & Tenders Portal.
3. 3Key dates: main submission deadline 2026-09-21 (10:00:59 CET). An earlier date (2026-01-01) appears in metadata but the official closing date is 2026-09-21; consult the tender documents for clarification.

Full tender dossier, draft contract and annexes available on the opportunity page:Tender page.

Opportunity summary

This is a public tender launched by the European Union Agency for Cybersecurity (ENISA) to procure services for the design, development and analysis of cybersecurity indexes covering EU Member States and other countries or partners. The objective is to generate evidence-based insights on cybersecurity posture and maturity at national and EU level across multiple domains such as capacity building, training and education, policy implementation, risk management, national strategies, vulnerability disclosure, exercises, incident response, operational cooperation, incident reporting, situational awareness and supply chain management practices. The procedure is an open e-submission tender for a framework contract with an initial duration and renewal options and an estimated overall contract value of €600,000. The call identifier is ENISA/2026/OP/0013.

Key dates:Publication date: 2026-07-24. Deadline (closing / submission): 21 September 2026, 10:00:59 (Europe/Athens timezone). Open tender event (information session or opening): 21 September 2026, 13:00:00 (local time). Deadline for additional information requests: 11 September 2026. Consider-changes period for tender documents until 7 August 2026. Multiple dates appear in metadata indicating early deadline references such as 1 January 2026 for other internal references; the formal closing date is 21 September 2026. ¹

Estimated contract value and duration

Estimated overall contract amount:€600,000. Planned implementation period: 48 months (framework contract concluded for an initial period of 12 months, renewable 3 times as per draft contract).

Type of procurement and CPV:Procurement type: services. Main CPV codes present: 73000000 (research and development services and related consultancy), 73220000, 73300000.

Eligibility and applicant requirements

ENISA is the contracting authority and invites economic operators to submit tenders via e-submission on the EU Funding & Tenders Portal. The tender documentation contains administrative and technical specifications, declaration-of-honour, financial offer form, draft contract, lists and templates for subcontractors, commitment letters, project references, simplified financial statement and editable annex templates. The tender is not flagged as SME suitable and follows ENISA procurement rules for public contracts. Tenderers must consult the tender documents (Annexes) for full selection and exclusion criteria, qualification requirements, required evidence and administrative forms. The tender uses standard EU procurement forms and templates provided in the call documents. ¹

1. 1Eligible applicant types: legal entities able to provide consultancy, research and development services in cybersecurity such as private sector companies (including large enterprises and SMEs), research organisations, universities, consultancies, think tanks, non-profit organisations and consortia. Individual natural persons are not typical tenderers for framework service contracts of this nature; participation is expected at organisational level.
2. 2Consortium requirement: The tender documentation allows participation of single economic operators or consortia (joint bids), and the presence of annex templates for subcontractors, commitment letters by identified subcontractors and entities whose capacities are relied upon indicates that consortia and subcontracting are permitted. Tenderers must follow the procurement specifications for lead entity and subcontracting proportions.
3. 3Beneficiary geographic scope: Primarily EU Member States coverage and the contracting authority is an EU agency (ENISA). Eligible economic operators are those permitted to participate in EU public procurement tenders; typically organisations established in EU Member States, EEA or other countries listed in the procurement rules and tender documentation. The published call references coverage across EU Member States and other partners/countries.
4. 4Target sectors and topics: cybersecurity, cyber policy, cyber resilience, capacity building, cybersecurity education and training, cyber risk management, national cybersecurity strategies, vulnerability disclosure, incident response and reporting, operational cooperation, situational awareness, supply chain security and cybersecurity exercises.
5. 5Project stage and expected deliverables: The work is aimed at design, development, measurement and analytical assessment of indexes; projects should cover data collection, methodology development, index design, technical implementation, validation, analysis and reporting. This implies work across research, development, validation, demonstration and ongoing monitoring stages.
6. 6Funding type: This is a public procurement tender (service contract / framework agreement) not a grant. The contracting mechanism is direct procurement for services and delivery of outputs under contract.
7. 7Nature of support: Non-grant financial contract payments for delivered services under the framework contract (money via contract payments).
8. 8Application type: Open call / public tender with mandatory e-submission via the Funding and Tenders Portal (ESUBMISSION).
9. 9Co-funding requirement: The tender documentation does not indicate any requirement for co-funding from tenderers. The tender is a priced service contract where tenderers submit financial offers for the services; any required financial guarantees or declarations are specified in the tender documents.
10. 10Application stages: Single-stage submission process (tender submission by deadline) followed by evaluation, potential clarifications, contract award and signature. The procurement uses award criteria split between quality (70) and price (30) as per the lot description.
11. 11Success rates: Not specified. As a single-award framework contract for services with an estimated value of €600,000 and standard public procurement evaluation, expected success rates depend on number and quality of offers; no historical success rate is provided.

Procurement documents and application templates

The procurement package includes a set of annexes and templates that bidders must complete and submit. These are provided as separate downloadable documents in the tender file list and include editable templates and required forms. Tenderers must use, complete and sign the templates where applicable and attach supporting evidence as specified in each template. ¹

1. 1Invitation to tender (main document) — details the objective, scope, procurement procedure and practicalities.
2. 2Annex I Part 1 Administrative Specifications — contains administrative requirements, submission instructions and selection/exclusion criteria.
3. 3Annex I Part 2 Technical Specifications — details technical tasks, expected methodology, deliverables, milestones and performance indicators.
4. 4Annex II Draft Contract — draft framework contract terms, renewals and contractual obligations.
5. 5Annex 02 Declaration on Honour (tender) — standard exclusion and eligibility declaration to be signed.
6. 6Annex 03 Agreement/Power of Attorney — for authorised signatories if needed.
7. 7Annex 04 List of identified subcontractors and proportion of subcontracting — to declare subcontracting usage and proportions.
8. 8Annex 05.1 Commitment letter by an identified subcontractor — template for subcontractors to commit.
9. 9Annex 05.2 Commitment letter by an entity on whose capacities is being relied — for reliance on third-party capacities.
10. 10Annex 06 Financial Offer — financial proposal form to be completed in full.
11. 11Annex 07 Simplified Financial Statement — financial capacity evidence template.
12. 12Annex 08 Project References List — template to list relevant past projects and references.
13. 13Annex 09 Administrative ID and Declaration form — standard administrative identification and declarations.
14. 14Editable documents pack containing Annexes 2,3,4,5.1,5.2,6,7,8,9 in native formats to facilitate completion.

Evaluation and award

Award will be based on quality and price criteria. The lot metadata indicates a weighted split of quality 70% and price 30%; bidders must address the technical specifications with strong methodology, demonstrated project references, expert CVs and proposed workplan to score on quality. The tender documents set detailed scoring rules, thresholds and minimum requirements for passing quality gates. Tender validity period is 6 months.

Selection and exclusion:Tenderers must satisfy standard EU public procurement selection and exclusion criteria, including absence of grounds for exclusion, demonstration of financial and operational capacity (via simplified financial statement and other evidence), relevant references, and compliance with administrative requirements. Exact required documents and proof are listed in Annex I Administrative Specifications.

Technical scope and expected expertise

ENISA expects bidders to provide comprehensive services covering methodological design, multi-country data collection, index calculation and weighting, statistical validation, sensitivity analysis, visualisation/dashboards, reporting, and policy-relevant interpretation of the indexes. Expertise areas required or strongly relevant include cybersecurity policy and governance, national capability assessments, metrics and indicators development, statistics and data science, survey design, structured interviews, stakeholder engagement with national authorities, secure data handling, and experience in EU-level cybersecurity projects or similar international assignments.

1. 1Methodology development for composite indexes and indicators, with transparent weighting and robustness checks.
2. 2Design and execution of country-level data collection (qualitative and quantitative), including surveys, interviews and documentary analysis with Member State stakeholders.
3. 3Data cleaning, management, and secure storage solutions compatible with EU data protection rules.
4. 4Statistical analysis, validation, trend analysis and sensitivity testing.
5. 5Production of periodic analytical reports, country profiles, EU aggregated reporting and bespoke analyses for partners.
6. 6Development of interactive dashboards and visualisations to present index results.
7. 7Provision of expert workshops, capacity-building sessions and briefings for ENISA and Member State representatives.
8. 8Ability to coordinate subcontractors or partner entities with clear allocation of tasks.

Application and submission practicalities

All submissions must be made electronically through the Funding and Tenders Portal (ESUBMISSION). Tenderers should register and verify their organisations on the portal, follow the instructions for completing administrative and technical parts, upload the requested annexes and signed declarations, and submit the financial offer using the provided financial offer form. Late submissions or submissions outside the portal are not permitted. There is an open tender event and deadlines for clarifications; tenderers are encouraged to consult the tender documents and request clarifications within the period indicated.

Mentioned countries and geographic scope

The tender explicitly targets EU Member States coverage for the indexes and allows inclusion of other countries or partners designated by ENISA. The contracting authority is an EU agency (ENISA) and the procurement is EU-level. Therefore the primary geographic scope is EU Member States and the European Union as a whole, with possible inclusion of other partner countries as requested by ENISA.

Co-funding, payments and financial arrangements

This is a priced service contract. The tender documentation contains the Financial Offer form (Annex 06) and the draft contract that sets payment terms, invoicing conditions and possible milestones. There is no indication of an external co-funding requirement; bidders are paid by ENISA according to the contractual payment schedule upon delivery of services and acceptance by ENISA. Subcontracting proportions must be declared and follow the rules outlined in Annex 04.

How to prepare a competitive bid

To be competitive bidders should:1) follow exactly the templates and forms provided in the annex pack; 2) present a robust methodological approach to indexing and measurement with clear indicators, data sources, weighting rationale, validation procedures, and an implementation plan; 3) demonstrate prior experience and references on comparable projects, ideally at national or EU level; 4) provide CVs of key personnel with relevant expertise in cybersecurity, statistics and data science; 5) ensure data protection and secure handling protocols; 6) propose a realistic budget and timeline aligned to the draft contract; and 7) declare any subcontracting and provide commitment letters where needed.

Full structured answers to categorisation questions

1. 1Eligible Applicant Types: Private sector companies (large enterprises and SMEs), consultancies, research organisations, universities, non-profit organisations, think tanks, public entities where allowed by procurement rules, consortia of such organisations. The documentation includes templates for subcontractors and for entities whose capacities are relied upon, supporting consortium and subcontracting arrangements.
2. 2Funding Type: Procurement service contract (framework agreement) — financial mechanism: contract payment for services (procurement), not grant or loan.
3. 3Consortium Requirement: Other (single tenderers or consortia allowed). The procurement allows submissions by single economic operators and by consortia/joint bids; subcontracting and reliance on capacities of other entities are provided for via annexes 04, 05.1 and 05.2.
4. 4Beneficiary Scope (Geographic Eligibility): EU Member States focus and contracting by an EU agency. Tenderers should follow eligibility rules in the administrative specifications, typically operators established in EU/EEA or countries eligible under EU procurement rules; the indexes themselves cover EU Member States and possibly other partner countries as designated by ENISA.
5. 5Target Sector: Cybersecurity, cyber policy and governance, cyber resilience, security analytics and measurement, capacity building and training, governance and supply chain security.
6. 6Mentioned Countries: EU Member States and the European Union as a whole; other countries or partners may be included at ENISA's discretion. No specific non-EU countries are named in the tender text.
7. 7Project Stage: Research and development of indices, methodological design, validation, demonstration, monitoring and reporting — spanning research, development, validation and demonstration phases and ongoing monitoring throughout the framework period.
8. 8Funding Amount: Estimated overall contract value €600,000. The framework contract duration and renewals determine distribution of payments over time.
9. 9Application Type: Open public tender via e-submission (Funding & Tenders Portal); not a rolling or invitation-only call.
10. 10Nature of Support: Monetary payments under a service contract (contract funds paid upon delivery of services).
11. 11Application Stages: Single formal submission stage followed by evaluation, clarifications if required, contract award. The procurement uses a single-stage tendering process with evaluation based on quality and price, although internal procurement steps may include shortlist checks and clarifications.
12. 12Success Rates: Not specified in the documentation. As with public procurements, success rate depends on number and quality of bids and is not published in the tender notice.
13. 13Co-funding Requirement: No explicit co-funding required. The tender is a paid contract for services; bidders submit a financial offer to provide the contracted services and are remunerated by ENISA.

Templates:The procurement provides multiple templates and editable documents to be completed by tenderers. Key application templates include the Administrative ID and Declaration, Declaration on Honour (exclusion/eligibility), Financial Offer form (Annex 06), Simplified Financial Statement (Annex 07), Project References List (Annex 08), Commitment Letters for subcontractors and entities relied upon (Annex 05.1 and 05.2), List of identified subcontractors (Annex 04), Agreement/Power of Attorney (Annex 03) and the draft contract (Annex II). Tenderers must complete and upload these templates as specified in Annex I (Part 1 Administrative Specifications) and Part 2 Technical Specifications. Editable native versions of many annexes are provided to facilitate accurate completion.

Summary and recommendation

What this opportunity is about and how to approach it:ENISA is procuring a supplier or consortium to design, develop and analyse cybersecurity indexes to assess and monitor cybersecurity posture and maturity across EU Member States and possibly partner countries. The work covers methodological design, data collection, analysis, validation, reporting and visualisation, including policy-relevant interpretation and capacity building. The tender is an open e-submission procurement with an estimated total value of €600,000 and a framework structure that allows renewals. Bidders should prepare a high-quality technical proposal focused on robust index methodology, proven delivery capacity, secure data handling, relevant references and a clear workplan. Administrative and financial forms provided as annexes must be completed exactly as requested. Quality will be the dominant award factor (70% weight), so invest in method, team CVs and evidence of past performance. Consult all annexes and the draft contract closely and submit through the Funding & Tenders Portal before the 21 September 2026 deadline. ¹

Footnotes

1. 1Primary procurement documents and annexes are available on the EU Funding & Tenders Portal tender page for ENISA/2026/OP/0013: Services for the Design, Development and Analysis of Cybersecurity Indexes. Download the Invitation to Tender, Annex I Parts 1 and 2, Draft Contract and all other annexes (Annexes 02-09 and editable document pack) from the call documents section: ec.europa.eu

This is an ENISA open service tender for support services to design, develop and analyse cybersecurity indexes covering EU Member States and other countries or partners, with the aim of producing evidence based insight on cybersecurity posture and maturity.[1]

What the contract covers

The scope includes work on cybersecurity capacity building, training and education, cybersecurity policy implementation, cyber risk management practices, national cybersecurity strategies, vulnerability disclosure policies, cybersecurity exercises, cybersecurity incident response, operational cooperation mechanisms, cybersecurity incident reporting, situational awareness, and supply chain management practices.[1]

The tender is intended to support evidence based measurement and comparative analysis across Member States, the European Union as a whole, and other designated partners.[1]

Who can apply

The notice is structured as an open service procurement, so it is intended for organisations able to deliver professional research, analysis, and index development services and to submit a bid through the EU electronic submission system.[1]

A secondary procurement listing states that eligible applicants are economic operators established in countries with access to EU procurement under the EU Treaties or a specific EU public procurement agreement, and that participation is not open on the basis of the WTO GPA alone.[2]

Budget, duration, and commercial terms

The publicly visible maximum budget is €600,000 over 4 years, and because this is a procurement contract rather than a grant, there is no EU funding rate or co financing percentage stated in the notice.[1]

The search extract does not provide the detailed award criteria, contract duration split, or detailed eligibility documentation, so applicants should review the tender documents on the portal before submitting.[1]

Practical implications for bidders

1. 1Prepare evidence of prior experience in cybersecurity measurement, policy analysis, and quantitative or qualitative research aligned with the listed domains.[1]
2. 2Be ready to work across multiple countries and to compare cybersecurity maturity consistently across different national contexts.[1]
3. 3Submit only through eSubmission by the ENISA deadline.[1]