File: DEMA-2026-027
Acquisition and Installation of software licenses for cybersecurity
tools intended to assess the security status of information and
communication systems of Ukrainian government agencies,
through vulnerability analysis and penetration testing.
FIAP internal code: 253500 Cybersecurity Ukraine
TECHNICAL SPECIFICATIONS DOCUMENT
1. PURPOSE OF THE CONTRACT
Acquisition and Installation of software licenses for cybersecurity tools intended to assess the
security status of the information and communication systems of Ukrainian governmental bodies,
through vulnerability analysis and penetration testing.
2. MINIMUM TECHNICAL REQUIREMENTS OF THE SUPPLIES
2.1. Scope of the solution
The contract includes a solution composed of:
• Supply of cybersecurity software licenses
• Associated technical support services
The solution covers:
• Web vulnerability scanning
• Web application penetration testing
• Network vulnerability scanning
2.2. Technical support
The provider’s technical support is included during the validity period of the licenses, including
standard provider support.
2.1. Included Tools
Name of Requirements
the procurement
item
Acunetix On Premise Premium Enterprise Web Vulnerability Scanner
Technical specifications:
Web Vulnerability • The license is valid for 3 years.
Scanner (type of • No limit on the total number of web addresses.
Acunetix On
Premise
Supports the following functionality:
Premium
Enterprise) • Has a web console and is accessible via a web browser;
• Includes a tool that records login sequences, allows editing, and
replays them during scanning;
• Supports automatic generation of web application firewall (WAF)
protective rules;
• Includes a built-in compliance report generator for: PCI DSS, OWASP
Top 10, ISO 27001, and HIPAA.
• Provides trend analysis and prioritization of discovered vulnerabilities;
V1_2026-04-14
File: DEMA-2026-027
Acquisition and Installation of software licenses for cybersecurity
tools intended to assess the security status of information and
communication systems of Ukrainian government agencies,
through vulnerability analysis and penetration testing.
FIAP internal code: 253500 Cybersecurity Ukraine
• Offers out-of-band vulnerability detection services;
• Accepts data import in the following formats: URL (.txt), Swagger,
.JSON, .YAML or .YML, .wsdl, BURP saved (.xml) and state files,
Selenium, .html, .side, or .HAR.
Supports the following automatic scanning methods:
• Detects over 7,000 vulnerabilities;
• Automatically detects during scanning: SQL Injection, Cross- Site
Scripting (XSS), XML External Entity (XXE), CSRF and all their
variations, blind XML/SOAP injection to external server, Blind XSS,
Host Header attack, Out-of-Band Injection, Remote Code Execution,
Out-of-Band SQL Injection, SMTP Header Injection, Server-Side
Request Forgery (SSRF)
• Identifies TLS/SSL vulnerabilities, web server vulnerabilities, and other
misconfigurations
• Automatically scans all website files using special authentication forms
or other session/access control methods;
• Scans all web pages, including those embedded in HTML5 and
JavaScript.
• Acts as a Java vulnerability scanner, analyzing applications built with
popular libraries such as Spring, Struts, and Java Server Faces (JSF)
• Replays user actions to execute scripts as a browser would (built-in
Logic Recorder tool);
• Uses antivirus engine to scan for malware signatures on the target.
Burp Suite Professional Web Application Scanner
Technical specifications:
• the license validity period is 3 years;
• number of users 17
• scan results are stored only on the local computer;
• detecting vulnerabilities contained in the OWASPTop 10, identify SQ
injection threats, crosssite scripting (CSS/XSS), vulnerable CGI script
Web Application
s, weak passwords, and configuration errors.
Scanner (type of
Burp Suite
Professional) Supports the following functionality:
• Proxy agent;
• Scanning web resources;
• Intruder - a tool for carrying out attacks;
• Repeater;
• Sequencer.
V1_2026-04-14
File: DEMA-2026-027
Acquisition and Installation of software licenses for cybersecurity
tools intended to assess the security status of information and
communication systems of Ukrainian government agencies,
through vulnerability analysis and penetration testing.
FIAP internal code: 253500 Cybersecurity Ukraine
System for detecting existing vulnerabilities in system and application
software (such as Nessus professional )
Technical specifications:
Network
Vulnerability • The license is valid for 3 years.
Scanner (type of
Supports the following functionality:
Nessus
Vulnerability
Scanner Annual) • Customizable scan policies;
• Management via web interface using secure HTTPS
• connection;
• Import/export of scan results;
• Scheduled scanning;
• Ability to write and use custom checks;
• Configuration and patch audit capabilities for Windows,
• Unix/Linux, Cisco devices, and databases.
Nexpose corporate network vulnerability scanner
Technical specifications:
• The license is valid for 3 years;
• Scan results are stored only on the local computer;
• Simultaneous scanning of at least 512 devices (servers, workstations
running Windows/Linux/Mac OS, and network equipment).
Network
Vulnerability
Supports the following functionality:
Scanner (type of
Nexpose
• Web resource scanning;
Vulnerability
Scanner) • Customizable scan policies;
• Automatic updates from the Internet and mandatory capability to
update without Internet access;
• Scan results stored only locally (cloud storage not permitted);
• Two-way integration with penetration testing tools for validation of
vulnerabilities and returning exploitation success status to
management console;
• Import of report templates generated by third-party software.
3. WORK PLAN
The execution of the contract will be carried out based on different phases or milestones, each
including a set of activities that must be completed, and whose deliverables, defined in the
following section, will be validated by FIAP in order to proceed with invoicing. Below is the
proposed schedule for the different tasks:
V1_2026-04-14
File: DEMA-2026-027
Acquisition and Installation of software licenses for cybersecurity
tools intended to assess the security status of information and
communication systems of Ukrainian government agencies,
through vulnerability analysis and penetration testing.
FIAP internal code: 253500 Cybersecurity Ukraine
Milestone Description of the milestone and its deliverables Delivery schedule
Milestone 1: The contractor must provide documentation certifying
Delivery of the legal origin and authenticity of the supplied
documentation licenses. This documentation must be issued by the First 1 - 2 weeks of
of origin and manufacturer or an authorized distributor, execution
authenticity of guaranteeing that the licenses are official, valid and
the licenses comply with applicable legal requirements.
The contractor must provide complete documentation
Milestone 2:
of license traceability, including manufacturer
Delivery of
authorization or partner certification, proof of license
documentation First 1 - 2 weeks of
ownership, certificate of origin and invoices issued
of legality and execution
through authorized official channels. This set of
traceability of
documents will allow verification of the legal status and
licenses
correct provenance of the licenses.
The contractor must issue the proforma invoice
Milestone 3:
corresponding to the supply of the licenses, in
Issuance of
accordance with the contractual economic conditions, Before installation
proforma
as a prior step to the final invoicing and execution of
invoice
the established payments.
The contractor must supply the software licenses and
Milestone 4:
proceed with their installation in the infrastructure
Delivery and First 1 - 2 weeks of
designated by SSSCIP. This phase includes the
installation of execution
correct initial configuration of the tools for their
licenses
operational deployment.
Milestone 5:
Once the licenses are installed, the contractor must
Verification of
verify their correct functioning in the IT systems. As a
correct
result, an activation report will be delivered confirming After installation
functioning
that the tools are fully operational and available for
and activation
use.
report
4. DELIVERABLES
The products and deliverables derived from this contract include both tangible elements and
operational results linked to the effective implementation of the acquired tools.
The contractor must provide:
• Documentation certifying the legal origin and authenticity of the licenses, issued by the
manufacturer or authorized distributor.
• License traceability documentation, including
o Manufacturer authorization or partner certification
o Proof of license ownership
o Certificate of origin
• Installation of the solutions in the designated infrastructure
• Installation and activation report of the tolos
V1_2026-04-14
File: DEMA-2026-027
Acquisition and Installation of software licenses for cybersecurity
tools intended to assess the security status of information and
communication systems of Ukrainian government agencies,
through vulnerability analysis and penetration testing.
FIAP internal code: 253500 Cybersecurity Ukraine
Reproduction or transfer to third parties without express authorization will not be permitted.
All delivered documentation must be named according to the established nomenclature and
format, and must be validated and approved by FIAP. The contractor undertakes to carry out as
many revisions and deliveries as necessary until such documentation meets FIAP’s requirements.
All deliverables generated during the execution of the contract are the property of FIAP, and the
contractor may not retain them, obtain copies, or provide them to third parties without express
authorization from FIAP.
5. EXPECTED OPERATIONAL RESULTS
The implementation of the software licenses will allow:
• Increasing the security level of public sector information systems through early detection
of vulnerabilities
• Facilitating the identification of potential threats and the adoption of timely responses
• Establishing a systematic approach to vulnerability analysis
This approach will be aligned with international best practices and recognised standards,
including:
• NIST
• ISO/IEC 27001
• OWASP
Likewise, the use of these tools will contribute to:
• Improving vulnerability detection processes
• Reducing the likelihood of successful cyberattacks against state authorities and critical
infrastructures
• Ensuring the continuity and stability of critical services
• Strengthening trust in the national cybersecurity system
The execution of the contract will allow:
• The development of technical capacities of information security personnel
• The acquisition of practical experience in the use of advanced security assessment tools
• The improvement of knowledge on modern attack techniques and protection measures
6. LICENSE USAGE MODEL
For the purposes of correct implementation and operational sizing, the following license usage
model is established:
• Burp Suite Professional: licenses assigned to named users
• Acunetix On Premise Premium Enterprise: total permitted installations (non-
simultaneous)
• Nessus Vulnerability Scanner: licensing based on number of scanners
• Nexpose: scanning capacity based on number of concurrent IPs (512 IPs)
V1_2026-04-14
File: DEMA-2026-027
Acquisition and Installation of software licenses for cybersecurity
tools intended to assess the security status of information and
communication systems of Ukrainian government agencies,
through vulnerability analysis and penetration testing.
FIAP internal code: 253500 Cybersecurity Ukraine
7. SUPPORT INCLUDED IN THE LICENSE
Technical support will be provided during the contract period, including vendor support in
accordance with the terms of the license.
Included:
• Incident handling
• Security updates and patches
The awarded contractor must provide a standard accompanying service associated with the
supply of licenses, which includes administrative support and technical support in case of
occasional need during the term of the contract, without assignment of exclusive personnel or
personalized services.
As an inherent condition of the supply, the contractor must provide a basic support service
throughout the duration of the contract, including the handling of occasional administrative queries
and the resolution of technical incidents derived from the use of the licenses, without this implying
the assignment of exclusive personnel, permanent liaison, or provision of personalized services.
Such support shall be understood as a standard service inherent to the supply, exclusively aimed
at guaranteeing the correct functioning of the licenses during the contractual period.
8. MODEL OF COMMUNICATION, QUALITY CONTROL AND MONITORING OF
EXECUTION
The organization and execution of the service must allow formal monitoring, establishing periods
for the evaluation of the quality of the work performed. The person or persons authorized for
relations with FIAP shall be specified, without prejudice to the company’s responsibility,
guaranteeing the correct use of the materials and information handled, with the obligation to
maintain confidentiality even after the end of the contract until such information loses its
confidential nature or is authorized by FIAP.
The contractor shall be responsible for the technical quality of the work performed and the
services provided, as well as for the consequences for FIAP or third parties derived from
omissions, errors, inadequate methods or incorrect conclusions in the execution of the contract.
During execution, FIAP will maintain regular communication with the contractor, including
periodic meetings (and whenever requested by FIAP), allowing adequate monitoring and
performance of assigned functions. The contractor must ensure compliance with the technical
and solvency conditions established in the contract, in particular:
Maintenance of committed human and material resources
• Execution of the work according to the planned program
• Resolution of incidents and pending issues
• Compliance with delivery deadlines, identifying causes and responsibilities in case of
deviations
9. SUMINISTRO PLACE OF PERFORMANCE / SUPPLY
The supply and installation of the licenses will be carried out on-premise within the SSSCIP
infrastructure in Ukraine and with FIAP’s conformity.
V1_2026-04-14
File: DEMA-2026-027
Acquisition and Installation of software licenses for cybersecurity
tools intended to assess the security status of information and
communication systems of Ukrainian government agencies,
through vulnerability analysis and penetration testing.
FIAP internal code: 253500 Cybersecurity Ukraine
Technical support will be provided according to the operational needs of SSSCIP and with FIAP’s
conformity.
10. DATA MIGRATION
In the event that the successful bidder offers an equivalent license to those described herein and
currently in operation, it shall be responsible, included in the price, for carrying out all data
migration at its own expense.
In Madrid, on the date of signature.
V1_2026-04-14
La vista PDF está disponible solo para usuarios registrados.