Procurement documents

FRAMEWORK AGREEMENT DRAFT ……………… No. 2-2/2 6 /……………… Estonian Centre for Defence Investment s (registry code 70009764, address Järve 34a, 11314 Tallinn), Estonian Defence Forces (registry code 70008641, address Juhkentali 58, 15007 Tallinn , Estonia ), Defence Resources Agency (registry code 70007647, address Aiandi 15, 12918 Tallinn , Estonia ), represented on the basis of clause 6.3 of Directive No. 77 of the Director of the Estonian Centre for Defence Investment of 7 December 2020, by _____________ , Head of Procurement Department (hereinafter ‘ Contracting Authority ’), and Escal Institute of Advanced Technologies (SANS Institute) (registry code 2526777 , address 1200 Rockville Pike, Suite 200, North Bethesda, MD 20852 , USA ), represented on the basis of ____________ by _______ (hereinafter ‘ Contractor ’), referred to individually as a Party and collectively as Parties , have entered into the following Framework Agreement (hereinafter ‘ Agreement ’): Basis and object of the Agreement The Agreement is concluded based on procurement documents of the public procurement “ Tehniliste küberturbe koolituste korraldamine (Cybersecurity training)” (reference number 306192) (hereinafter ‘Public Procurement’) and the tender submitted by the Contractor in this Public Procurement. Under the Agreement, objects of the contract will be purchased within the framework of mandatory or voluntary central purchasing activities, which means that the Framework Agreement concluded by the Estonian Centre for Defence Investment as the central Contracting Authority may be used by other contracting entities using the central purchasing service of the Estonian Centre for Defence Investment in accordance with subsection 30 (2) of the Public Procurement Act. The Contracting Authority has entered into the Agreement with the Contractor based on the Contractor’s tender, the Contractor’s representations and declarations contained in the Agreement, and assuming in good faith the Contractor’s professionalism and ability to execute the Agreement according to the requirements. When using subcontractors, the Contractor shall remain responsible before the Contracting Authority for the proper execution of the Agreement. The Contractor represents and warrants that: they and their representative have all the rights and authorisations for the conclusion of the Agreement; they have read the Agreement and the supporting documents of the Public Procurement and fully understand the content and consequences of the undertaken obligations, and agree to the terms and conditions set out therein; the performance of the Agreement does not damage the rights of third parties and there are no circumstances that would exclude their right to conclude the Agreement and duly perform it; they have all the permits, registrations, representation rights, and certificates required for the performance of the Agreement and they shall keep such permits and registrations up to date during the validity of the Agreement. If renewal of the permits, registrations, representation rights, and certificates is not possible due to circumstances not depending on the Contractor, they shall immediately notify the Contracting Authority thereof; there are no third-party claims or other rights that third parties could enforce in relation to the Service to be provided to the Contracting Authority; the Contractor, the Service offered, and the related goods are not the subject of international sanctions and do not originate in a sanctioned territory within the meaning of the International Sanctions Act. The object of the Agreement is Cybersecurity training (hereinafter ‘ Service ’). Under the Agreement and the terms and conditions set out therein, the Contractor undertakes to provide the Service to the Contracting Authority, and the Contracting Authority undertakes to accept the Service and pay the Contractor the contract price for the Service in money. The provisions of the Law of Obligations Act governing service contracts shall apply to the Service to the extent that the relevant matters are not regulated in the Agreement and are not incompatible with the nature of the Service. The conditions and cost of the provision of the Service and the contact person of the Contracting Authority shall, if possible, be specified in public contracts. Required terms and conditions not known at that time shall be transmitted by email during the performance of the public contract. The Service shall conform, first and foremost , to the supporting documents of the Public Procurement and then to the tender submitted by the Contractor. The Service provided shall conform to the terms and conditions of the Agreement. All documents and packaging accompanying the Service shall also conform to the terms and conditions of the Agreement. The hierarchy of documents shall be as follows: the technical specification of the public procurement, including any special conditions set out in the invitation to submit a tender; the Framework Agreement, including any special conditions set out in the procurement contract; and finally the tender submitted by the Contractor. The terms and conditions set out in the Framework Agreement shall apply to the procurement contracts unless otherwise provided in the procurement contracts. The Contractor’s standard terms and conditions governing the provision of the Service shall apply only to the extent that they do not conflict with the terms and conditions of this Agreement. Parts of the Agreement The integral parts of the Agreement are the supporting documents of the Public Procurement, the Contractor’s tender and its annexes, the explanations given during the procurement procedure, the letters of confirmation, the invitations to tender and the tenders submitted under the Agreement, the public contracts awarded under the Agreement, the notices communicated between the Parties, and any future amendments to the Agreement or a public contract. If a public contract is not concluded , orders, order forms, purchase orders, etc., which involve a financial commitment are also considered as public contracts. Awarding of P ublic C ontracts Public contracts under the Agreement shall be awarded on the basis of the needs of the Contracting Authority for a single order (hereinafter ‘ single purchase ’) . The Agreement without a public contract shall not bind the Contracting Authority to order the Service from the Contractor. The Service shall be ordered according to the following procedure: The Contracting Authority submits an invitation to tender to the Contractor. The Contractor submits a tender, indicating the cost of the Service after receiving the invitation to tender from the Contracting Authority . The Contracting Authority accepts the tender by awarding a public contract or rejects the tender. The Contracting Authority is entitled to order the service through the Contractor’s electronic ordering system. The Contracting Authority has the right to order from the Contractor other Services that meet the requirements of the technical specifications (Service with the same purpose). Such Services shall be ordered by submitting invitations to tender where the Contracting Authority informs the Contractor of the particular technical specifications and the conditions for pricing the Services. Rights and obligations of the Contracting Authority The Contracting Authority has the right to verify the fulfilment of the obligations arising from the Agreement and inspect the documents relating to the ordering of the Services, and to request, at any time, information on the performance of the Agreement. The Contracting Authority has the right to verify the correctness and accuracy of the invoices, calculations, and other expenses submitted by the Contractor. If necessary, the Contracting Authority has the right to request to see invoices from subcontractors. The Contracting Authority has the right to consult the Contractor on matters relating to the Service, such as matters relating to the provision of the Service. The Contracting Authority has the right to demand immediate elimination of any and all deficiencies in the Service. The Contracting Authority has the right to claim compensation for damages caused by the Contractor. The Contracting Authority reserves the right to order the Service outside of the Agreement if: the Contractor does not submit a tender; the tender submitted by the Contractor does not meet the requirements; the Contractor is unable to perform a public contract or has withdrawn from the Agreement or a public contract; the price of the Service offered is unreasonably high compared to the average market price and is financially unreasonable for the Contracting Authority. The Contracting Authority undertakes to pay the Contractor for the Service provided in conformity with the Agreement based on the terms and conditions of the Agreement. The Contracting Authority undertakes to respond within a reasonable time to any request made by the Contractor for clarification of the instructions. The Contracting Authority undertakes to inform the Contractor, as soon as possible, of any problems related to the performance of a public contract. Rights and obligations of the Contractor The Contractor undertakes to submit, at the request of the Contracting Authority and for a specified period, a summary statement of the Service ordered from the Contractor (including the date of the award of the public contract or the purchase order, the name and value of the Service (excluding VAT), the total value of the public contracts/purchase orders (excluding VAT), etc.) in MS Excel or any other format approved by the Contracting Authority within 10 (ten) days after receipt of a respective request, unless otherwise agreed by the Parties. At the request of the Contracting Authority, the Contractor undertakes to provide information (volume and purpose) on subcontractors. If the Contractor has provided such information before the entry into the Agreement, the Contractor shall obtain the prior approval of the Contracting Authority for any replacement of the aforementioned persons. The Contractor undertakes to immediately inform the Contracting Authority of any circumstances preventing the performance of the Agreement. The Contractor undertakes to notify the Contracting Authority immediately of any cyber-attack or cyber-incident against the Contractor and to provide the Contracting Authority, upon request, with a cyber-incident report. The Contractor undertakes to perform the Agreement in compliance with the conditions of fair trade and environmentally sustainable principles, and not to use slave or child labour. The Contractor undertakes to notify the Contracting Authority immediately if they are unable to provide the Service within the agreed term. The Contractor undertakes to provide the Service in a timely and proper manner, in the duly agreed upon volume and frequencies, in accordance with the terms and conditions laid down in the Agreement and in the course of submission of a purchase order, and with the requirements, norms, and standards applied in the best practices. The Contractor is entitled to receive the agreed remuneration for the Service provided in conformity with the Agreement under the terms and conditions set out in the Agreement. The Contractor has the right to obtain instructions, explanations or other information affecting the performance of the Agreement from the Contracting Authority. The Contractor has the right to make proposals for better organisation of the operations related to the provision of the Service. The Contractor has the right to offer the Contracting Authority the service on more favourable terms, for example by enabling the Contracting Authority to use discount codes when placing orders for the Service. Agreement value and payment terms The expected maximum total value of the Framework Agreement in the Public Procurement is EUR 8 00,000, plus VAT where provided for by law. In the case of single purchases, real prices shall be based on invitations to tender. The prices offered for a long-term contract shall be fixed for the term of the long-term contract. The aforementioned prices shall not exceed the maximum prices referred to in clause 7.2 or the maximum prices adjusted according to clause 7.3. In the event that the unit prices fixed in the Agreement are adjusted in accordance with clause 7.3, this shall not affect any prices fixed under an existing long-term contract. The unit prices for the Service shall include all expenses necessary for the performance of the Agreement, including the operations listed in the technical specifications. Payments for the Service shall correspond to the Service as ordered and actually provided based on the respective Delivery-Acceptance Act signed by both Parties. One e-invoice shall be issued per Service provided, unless otherwise agreed. The Contractor shall issue the invoice as an e-invoice (in machine-readable XML format). If a Contractor registered outside the Republic of Estonia is not able to issue an e-invoice for technical reasons, they shall send the invoice in PDF format to the email address specified in the Agreement, unless otherwise agreed in the public contract. The Contractor shall issue the invoice with the following information: Payer details (person paying the invoice): Estonian Centre for Defence Investment (registry code 70009764, address Järve 34a, 11314 Tallinn); Estonian Defence Forces (registry code 70008641, address Juhkentali 58, 15007 Tallinn); Defence Resources Agency (registry code 70007647, address Aiandi tn 15, 12918 Tallinn); Other information to be included in the invoice: name of the Contracting Authority’s contact person (to be specified in the public contract); number of the Framework Agreement; number of the public contract (purchase order); reference number of the Public Procurement; type of Service and period of provision; 15-digit reference number of the part of the Agreement (if any) from the Public Procurement Register; it can be found in the Public Procurement Register under the details of the Agreement with the Contractor in the Public Procurement. Contractor’s bank details: Recipient’s bank: …………………. Recipient’s bank account number: IBAN ………………… SWIFT ………………………….. The Contracting Authority shall pay for the Service received, and conforming to the terms and conditions of the Agreement, within 28 (twenty-eight) days after receipt of the invoice which conforms to the terms and conditions of the Agreement. The invoice shall be based on a Delivery-Acceptance Act statement signed by the Parties. The Contracting Authority shall not accept an invoice that does not conform to the terms and conditions of the Agreement. In this case, the Contractor shall issue a new invoice within seven (7) days. The payment is deemed to have been made once the Contracting Authority’s bank receives the payment order. Before making a payment for an invoice with a value of EUR 10,000 or more (inclusive of VAT), the Contracting Authority shall verify, on the website of the Estonian Tax and Customs Board, that the Contractor does not have any tax arrears. In the event of tax arrears amounting to at least EUR 10,000, the Contracting Authority shall inform the Estonian Tax and Customs Board about the outstanding invoice. Force majeure Breaching of an obligation under the Agreement shall be excusable when a Party has breached obligations due to force majeure. The Parties consider force majeure to be circumstances which are beyond the control of the Party who breached the obligation and which, at the time the Agreement was concluded, the Party could not reasonably have been expected to take into account or avoid or overcome the impediment or the consequences thereof, such as natural disasters, general power outages, wars and blockade. An inability of a third-party contractual partner of the Contractor to perform a contract shall not be considered as force majeure by the Parties. If any circumstance meeting the conditions of force majeure resulted in the non-performance of the Agreement within the term prescribed in the Agreement or the annexes thereto and its effect is temporary, the conduct of the Party that breached the obligation arising from the Agreement will only be excused for the period when force majeure hindered the performance of the obligation. In the event of force majeure, the time limit for the performance of a contractual obligation shall be postponed in accordance with the duration of the force majeure event, but for no more than 90 (ninety) days, unless otherwise agreed by the Parties. In the event of force majeure, an amendment to the public contract shall be made , if necessary, with regard to the delivery term. The Party that is unable to perform its obligations due to force majeure shall immediately notify the other Party of the occurrence and ending of such a situation. Failure to notify or untimely notification deprives a Party of the right to rely on the excused non-performance, i.e. the occurrence of force majeure, and the Party that has breached the notification obligation shall be liable for the breach of a contractual obligation pursuant to the provisions of the Agreement. If the effect of force majeure is permanent and does not allow the Parties to perform their contractual obligations in full or in part, the Parties have the right to terminate or withdraw from the Agreement by giving notice of termination or withdrawal to the other Party. The effect on the performance of the obligation to provide the Service resulting from the restrictions on imports from the Russian Federation and Republic of Belarus shall not be considered by the Parties as force majeure if these circumstances existed at the time of entry into the Agreement. Confidentiality and security requirements Confidential information is understood by the Parties to include information disclosed in the course of the performance of the Agreement, personal data, security data, documents clearly identified For Official Use Only and other information the disclosure of which could harm the interests of the Contracting Authority. Confidential information does not include information the disclosure of which is required by legislation, provided that such disclosure is effected in the most restrictive manner from among the available options. Under the confidentiality clause, a Party undertakes not to disclose confidential information of the other Party during or after the term of the Agreement without the other Party’s written consent. A Party shall protect the confidentiality of the information disclosed to them in the course of the performance of the Agreement. The Contractor undertakes to refrain from using any documents or information related to the Agreement without the written consent of the Contracting Authority, except in cases that are necessary for the performance of the Agreement. All documents other than the Agreement and annexes thereto are the property of the Contracting Authority and, if the Contracting Authority so requires, the Contractor shall return these documents to the Contracting Authority after expiry of the Agreement. Disclosure to third parties of any information marked For Official Use Only shall be prohibited . The confidentiality requirement shall be indefinite. Intellectual property rights “Intellectual Property Rights” means any and all rights to the results of creative work throughout the world, whether existing now or arising in the future and whether registered or unregistered, including copyright, related rights, database rights and industrial property rights. If the Service (including the relevant documentation) is protected by copyright in respect of all economic and moral rights, the Contractor shall grant the Contracting Authority, within the meaning of the Copyright Act, a worldwide irrevocable non-exclusive licence, with the right to grant sublicences , valid until the expiry of the copyright. The licence shall be deemed granted upon delivery of the relevant documentation, for which no separate fee shall be paid (the copyright fee is included in the contract price). If the Service (including the relevant documentation) is protected by related rights or industrial property rights , the Contractor shall grant the Contracting Authority the rights necessary for full use of the Service. In the cases set out in this Chapter, the Agreement shall also be deemed to constitute an author agreement. The terms and conditions for the transfer and use of Intellectual Property Rights may be agreed otherwise in the procurement contract. Liability The Parties shall be liable to each other in the event of improper performance or non-performance of their obligations under the Agreement in accordance with the provisions of the Agreement and applicable legislation. The Contractor shall be liable for non-conformity of the Service with the terms and conditions of the Agreement (deficiencies) if the non-conformity is discovered after the Service has been provided (i.e. the deficiencies could not have been discovered during normal inspection, so-called latent deficiencies). In the event of improper performance of the Agreement by the Contractor, the Contracting Authority, after becoming aware of the breach of obligation, has the right to refuse to accept the Service provided and to not pay the purchase price, while raising a claim against the Contractor for the performance of the obligation in the manner provided for in the Agreement, granting the Contractor a reasonable term for the performance of the Agreement. The Contractor shall be considered to have been delayed the provision of the Service until the proper Service has been provided to the Contracting Authority. The Service does not conform to the terms and conditions of the Agreement if, without limitation, the Service was not provided at the expected quality level, the Service does not have the agreed properties, the Service is not provided within the agreed term or in the agreed volume or with the specified frequency, the Contractor does not submit required documents related to the provision of the Service or fails to provide the Contracting Authority with information on the performance of the Agreement. The Contracting Authority shall notify the Contractor, at least by email, of the non-conformity of the Service with the terms and conditions of the Agreement within 30 (thirty) days of the Contracting Authority or the Contracting Authority’s authorised person becoming aware of the Service not conforming to the terms and conditions of the Agreement. In the notification, the Contracting Authority shall request that the Contractor perform the obligation by also giving a reasonable term to the Contractor for proper performance of the Agreement, which generally cannot be longer than 60 (sixty) days. If the Contracting Authority, after learning about the deficiencies in the Service, does not inform the Contractor of the deficiencies within the term established in the Agreement, the Contractor shall be released from the liability for any deficiencies in the Service, unless the failure to report the deficiencies was reasonably justifiable. If the Service provided does not conform to the terms and conditions of the Agreement, the Contracting Authority has the right to require the Contractor to provide the Service for a second time, in conformity with the terms and conditions of the Agreement. In the event that the Service does not conform to the terms and conditions of the Agreement and the Contracting Authority agrees to accept the Service with deficiencies, the Contracting Authority has the right to reduce the price of such a Service in proportion to the deficiencies by submitting a notice to that effect to the Contractor. If the Service is not provided on time, the Contracting Authority shall have the right to charge the Contractor a contractual penalty of up to 0.25% per day of the value of the Service not provided on time, but no more than 50% of the value of the public contract, unless otherwise provided in the public contract. In addition to the termination of or withdrawal from the Agreement, the Parties are entitled to claim a contractual penalty, demand compensation for damage, and use other legal remedies in case of a material breach of the Agreement. If the Contractor fails to comply with an obligation under the Agreement other than timely provision of the Service, the Contracting Authority is entitled to charge the Contractor a contractual penalty of up to 10% of the total value of the Service that is the object of the public contract. In the event of a breach of the confidentiality obligation, a Party is entitled to claim a contractual penalty from the breaching Party of up to EUR 10,000 for each such breach. If the Contracting Authority delays payment of an invoice, the Contractor has the right to charge the Contracting Authority a penalty for late payment, as provided for in subsection 113 (1) of the Law of Obligations Act, of up to 0.25% per day for each day of delayed payment, provided that the Contracting Authority has been notified of the delay within 30 (thirty) days of its occurrence. The total amount of the penalty for late payment shall not exceed 10% of the total amount overdue. A contractual penalty is intended to ensure the performance of an agreed obligation, not to substitute for the performance of the obligation. The charging of a contractual penalty shall not deprive the Contracting Authority of the right to claim from the Contractor compensation for the damage caused by a breach of the Agreement. The period for charging contractual penalties is 180 days from the discovery of the corresponding breach. Any contractual penalties and penalties for late payment shall be paid within 28 days after the receipt of the corresponding claim, unless agreed otherwise by the Parties. The Contracting Authority has the right to deduct the amounts of contractual penalty charges and the amounts of compensations for damage claimed by the Contracting Authority from the amount payable to the Contractor. Subject to an agreement, the Parties have the right to replace the contractual penalty (or a part thereof) with an item falling under the object of the Agreement or related assets of equivalent value. The implementation of this clause does not constitute a contractual penalty charge but a separate remedy arising from the Agreement. Grounds for termination of the Agreement Upon termination of / withdrawal from the Agreement, the Contracting Authority shall grant the Contractor a reasonable term to perform the Agreement, which generally cannot exceed 30 (thirty) days. A term granted for performance of the Agreement shall not release a Party from liability for the violation of an obligation. The Contracting Authority is not obliged to grant a term for performance of the Agreement in the event of termination of / withdrawal from the Agreement after a material breach of the Agreement. In such a case, the Contracting Authority shall provide the Contractor with a written notice of termination of / withdrawal from the Agreement within a reasonable period of time after becoming aware of the material breach. Termination of / withdrawal from the Agreement shall be deemed to have been effected once the Contractor receives the notice of termination /withdrawal. After the expiry of the additional term for the performance of the Agreement, the Contracting Authority may submit a written notice of termination /withdrawal to the Contractor. Termination of or withdrawal from the Agreement shall be deemed to have been effected once the Contractor receives the notice of termination /withdrawal. Submission of a termination /withdrawal notice is not required if the Contracting Authority, when granting an additional term, has made it clear in writing in advance that the Contracting Authority will terminate /withdraw from the Agreement if the contractual obligations are not performed within the term. In this case, the Agreement shall be terminated upon the expiration of the term determined by the Contracting Authority for the performance of the Agreement, provided that the Contractor has not offered proper performance to the Contracting Authority. A Party has the right to terminate or withdraw from the Agreement without granting an additional term if the other Party has materially breached their obligations under the Agreement (material breach). Material breaches include, without limitation, cases where: obligations under the Agreement are breached either intentionally or due to gross negligence; the Contractor has failed to fulfil its obligations within the additional term granted by the Contracting Authority; the Contractor notifies the Contracting Authority of a refusal to perform; the Contractor has not commenced the performance of the Agreement within a period of time that would allow the Agreement to be performed on time; false or falsified information is provided; the confidentiality obligation is breached; breach of an obligation gives a Party reasonable grounds to believe that the other Party will not perform the obligation in the future; the Contractor commits an offence during the term of the Agreement in connection with the provision of the Service covered by the Agreement; the Contractor’s permits for the performance of the Agreement expire and are not or cannot be renewed by the Contractor; the Contractor has breached the terms and conditions of the Agreement, other than those referred to in sub-clauses 13.4.1–13.4.9, more than three (3) times. The Contracting Authority has the right to extraordinary termination of the Agreement if the Contractor has been declared bankrupt or is subject to liquidation. The Contracting Authority has the right to terminate the Agreement at any time by giving the Contractor notice at least 30 (thirty) calendar days in advance. The Parties have the right to terminate the Agreement at any time by mutual agreement. Upon termination , the Parties will not be obligated to perform the Agreement. Upon termination of or withdrawal from the Agreement, the Parties shall return that which has been delivered in advance with respect to the time after termination of the Agreement pursuant to the procedure established in the Law of Obligations Act. Contact persons The Contracting Authority’s contact person is the Strategic Category Manager of the relevant category , who at the moment of entry into the Agreement is Kätlin Anepaio, classification manager for support and administrative services ( tel. +372 5346 7596, email [email protected]). Purchase orders are issued by the Contracting Authority’s purchasing project manager or by persons authorised by the Contracting Authority’s contact person. Authorisations are given and withdrawn by email or using a procedure to be specified in a public contract. The Contractor’s contact person is ____ (tel. +372 ____, email ___). The contact persons for receiving the Service shall be specified in the public contract. All notices without legal effect shall be sent by email and shall be addressed to the contact persons of the Agreement, unless otherwise agreed in a public contract. A Party shall promptly notify the other Party by email of any change of contact person or other information. This notice does not constitute an amendment to the Agreement. Final provisions The Agreement shall enter into force once it is signed by the Contracting Authority . The Agreement shall be valid for 48 (forty-eight) months from its entry into force or until the maximum value of the Framework Agreement set out in clause 7.1 is reached, whichever comes first. The language of performance of the Agreement shall be E nglish , unless otherwise agreed by the Parties. In case of inconsistencies in Estonian and English documents, the E nglish version shall prevail. In the performance of the Agreement and in the event of disputes arising from the Agreement, the legislation of the Republic of Estonia shall apply, unless otherwise agreed by the Parties. The Parties have agreed to take all measures to solve mutual disagreements by means of negotiations. If an agreement is not reached , the dispute shall be settled in accordance with the law of the Republic of Estonia in Harju District Court, unless otherwise agreed by the Parties. The invalidity of any provision of the Agreement shall not render the entire Agreement or other provisions of the Agreement invalid. Neither Party has the right to transfer their contractual rights and obligations to third parties without the written consent of the other Party. Amendments to the Agreement may be agreed on in accordance with the Public Procurement Act. Amendments to the Agreement shall be valid if made in writing. Failure to comply with the requirement of written format shall render any amendments to the Agreement invalid. All amendments to the Agreement shall enter into force upon signing by the Parties or on the date specified by the Parties. Notices with legal effect between the Parties shall be sent in writing or by email in a digitally signed form. A notice shall also be deemed received once it is delivered by a post office with returnable delivery notice at the address specified in the Agreement and five (5) days have passed from handing the notice over to the post office. When sending a notice by email, it shall be deemed to have been received on the next working day. The Agreement is drawn up in two (2) copies of equal legal force and signed by hand . If the Agreement is signed by hand, the Parties shall have the right to send the signed Agreement to the other Party for signature via email in scanned PDF format, which the other Party shall sign and send back in scanned PDF format via email. The Parties are also obliged to provide the original documents within 15 days after signing, although the Agreement will enter into force from the date of the last signature transmitted by email. Annexes Annex 1 . Technical Specifications ; Annex 2 . The Contractor’s tender ; Annex 3 . Security requirements. Contracting Authority Contractor ( signed digitally) ( signed digitally) _______________ __________ position position Technical Description Annex 2 Cybersecurity Training and Certification Services Scope of Services The Contractor shall provide advanced cybersecurity training and internationally recognized certification to institutions within the administrative area of the Estonian Ministry of Defense (hereinafter: MoD), including its subordinate institutions and affiliated organizations . The Contractor shall provide the Contracting Authority with the ability to select, purchase, and enroll in courses that are available in the Contractor’s online course catalogue or platform. The Contractor shall provide access to certification exams, practice tests, and preparation materials, where applicable. The Contractor shall allow flexible ordering of courses and certifications without requiring separate procurements. Service Requirements The Contractor shall provide advanced-level, specialist cybersecurity courses. The Contractor shall maintain up-to-date course content aligned with current threat landscape. The Contractor shall offer preparation for, and access to, globally recognized certifications where available for the specific course. The Contractor shall provide a system delivering near real-time analytics on participant performance, including course completion, assessments, and engagement, with secure role-based access . The Contractor shall provide Quarterly Business Reviews (QBRs) to the Contracting Authority. Each QBR shall include an overview of participant progress, including the number of participants who have completed courses, those currently enrolled, and those requiring additional support. Each QBR shall include benchmarking analysis comparing the performance of participants from the MoD with that of participants from comparable organizations (e.g., NATO Allied countries), where such data is available, including relevant certification metrics. Each QBR shall include recommendations for future training and certification pathways, taking into account emerging cybersecurity threats and the evolving needs of the MoD. The Contractor shall notify the Contracting Authority of : any new courses that are relevant to the MoD ’ s training requirements and operational needs any courses that are taking place in Estonia, the Baltic States, or Northern Europe. The Contractor shall notify the Contracting Authority in advance of the expiry of any participant ’ s GIAC certification, providing sufficient time to enable renewal. The Contractor shall provide a dedicated Customer Manager who will serve as the primary point of contact for the Contracting Authority for all operational support, course registration, and participant-related issues. The Customer Manager shall: Ensure continuity and accountability by handling all communications directly . Respond to inquiries or issues within 24 hours. Escalate unresolved issues to higher-level support. The Contractor shall review feedback from the Contracting Authority and, where feasible, provide alternative courses or recommend adjustments if a course is unsuitable, too advanced, or too basic, ensuring timely options for participants. Upon receiving the Contracting Authority ’ s planned course participation schedule at the beginning of the year, the Contractor shall provide participants with optimal opportunities to complete the specified courses, including suitable dates and locations. The Contractor shall ensure instructors hold relevant industry certifications (e.g., GIAC, CISSP , OSCP or equivalent). The Contractor shall ensure participants have free access to all learning materials and tools required for the course. Costs for these materials shall be included in the unit price. The Contractor shall provide all necessary equipment, except items participants must bring as indicated in the course description. The Contractor shall provide training in English or if applicable in Estonian Course Requirements and Deliverables The training shall be conducted either in person at a location designated by the Contractor or online, as agreed between the parties. The Contractor shall maintain accurate records of participants’ attendance and promptly notify the Contracting Authority if a participant fails to attend all required sessions. The Contractor shall provide confirmation of attendance and completion to the Contracting Authority. The Contractor shall provide the course agenda, learning objectives, and prerequisites to the Contracting Authority and participants in advance of the training. The Contractor shall issue training completion certificates to participants who successfully complete the training. The Contractor shall provide all training materials, including slides, lab guides, and any digital resources used in the course, to the participants. Annex 3 to the 11.05.2026 contract No 2-14/26/1682 SECURITY REQUIREMENTS As the object of the public procurement is located within the security area of the Defence Forces, the contracting partner shall be informed of the following conditions, rights and obligations in order to clarify the parties’ rights and obligations regarding compliance with security requirements within the Defence Forces security area. 1. DEFINITIONS 1.1 Person responsible for security (hereinafter „PRS“) – the Defence Forces sub-unit or service member responsible for ensuring compliance with the security requirements applicable to the public procurement object located within the relevant Defence Forces security area (hereinafter „DFSA“). 1.2 Security requirements – the general security requirements established for entry to and presence within the Defence Forces security area (Annex 5), as well as the requirements laid down in other legislation for the purpose of ensuring the security of the Defence Forces. 1.3 Defence Forces Security Area (hereinafter “DFSA”) – the territory under the control of the Defence Forces and the vessels, aircraft and vehicles of the Defence Forces. 1.4 Contracting Partner’s Contact Person – the person designated by the Contracting Partner and/or its subcontractor who is responsible for compliance with the contractual performance requirements and the Security Requirements. 1.5 Consent – the prior written consent required for the conduct of a background check, by which the person authorises the Defence Forces to collect data concerning him or her and to make enquiries for a period of five years from the giving of the consent (pursuant to § 41 6 of the Military Service Act) (Annex 3 in English). 1.6 ECDI Contact Person – the person designated under the contract through whom the organisation of the performance of the contractual obligations and the transmission of notices, claims and other documents provided for in the contract shall be carried out on behalf of the Estonian Centre for Defence Investment (ECDI). 1.7 Object of the Public Procurement – the work area located within the Defence Forces Security Area designated for the performance of the contract. 1.8 Background Check – a check carried out pursuant to § 413 of the Defence Forces Organisation Act (EDFOA) and in the manner provided in § 41⁵ thereof, for the purpose of deciding whether to permit a person associated with the provision of services to the Defence Forces (the “Service Provider”) to access the Defence Forces Security Area (DFSA). 1.9 Background Check Request (e-mail) – a request submitted by the Contracting Partner’s Contact Person to the Service Provider to initiate the conduct of a background check (Annex 1). 1.10 Service Provider – an employee of the Contracting Partner and/or its subcontractor in respect of whom a background check is conducted, subject to his or her prior written consent, in connection with an application for access rights to the DFSA. 1/4 1.11 Secure Area – an area authorised for the processing of state secrets or classified foreign information at the level of confidential, secret or top secret, and for the processing of classified information carriers containing such information. 1.12 Access Application (e-mail) – a request submitted by the Contracting Partner’s Contact Person for permitting the Service Provider to access the Defence Forces Security Area (Annex 4) 1.13 Right of Access – the right to be present at the object of the public procurement located within the Defence Forces Security Area in connection with the performance of the contract. 1.14 Person Holding a Right of Access – a person who has passed the background check, whose entry to the object of the public procurement located within the Defence Forces Security Area has been approved, and who is entitled to enter and remain at that object unescorted in connection with the performance of the contract. 2. RIGHTS AND OBLIGATIONS OF THE CONTRACTING PARTNER 2.1 The Contracting Partner, including the Service Provider and the Contracting Partner’s Contact Person, shall have the right to obtain from the Person Responsible for Security (PRS) of the object of the public procurement the information necessary for complying with the Security Requirements and information concerning the obtaining of access rights to the Defence Forces Security Area (DFSA). The ECDI Contact Person shall provide the Contracting Partner with the contact details of the PRS for the specific object at the earliest opportunity. 2.2 The Contracting Partner shall: 2.2.1 The Contracting Partner shall not plan to assign to the Defence Forces Security Area any foreign nationals who are subject to a notification obligation. At the date of conclusion of the contract, the states subject to such notification obligation, pursuant to Order No. 1-3/112 of the Minister of the Interior of 29 September 2023, are1: Republic of Armenia; Republic of Azerbaijan; People’s Republic of China (including the Hong Kong and Macao Special Administrative Regions); Islamic Republic of Iran; Republic of Kazakhstan; Kyrgyz Republic; Democratic People’s Republic of Korea; Republic of Tajikistan; Turkmenistan; Republic of Uzbekistan; Republic of Belarus; Russian Federation. Should the above-mentioned Order be amended, the Contracting Partner shall be notified thereof and these Security Conditions shall be amended as necessary; 2.2.2 shall ensure that the Contracting Partner’s Contact Person submits the Background Check Request (Annex 1 together with Annex 3) at the earliest opportunity, taking into 1 https://kapo.ee/sites/default/files/content_page_attachments/Teatamiskohustusega%20v%C3%A4lisriikideni mekirja%20kehtestamine_0.pdf 2/4  account the contractually agreed commencement date of performance and the time required for the background check (14 calendar days), to the e-mail address [email protected]; 2.2.3 shall ensure that, in the case of a foreign national, the Contracting Partner’s Contact Person attaches to the background check initiation request: 2.2.3.1 a copy of the page of the identity document containing the photograph, including the visa or other document evidencing a lawful basis for stay in Estonia; 2.2.3.2 an extract from the criminal records register of the person’s country of residence; 2.2.4 shall ensure that the Contracting Partner’s Contact Person submits the Access Application (Annex 4) at the earliest opportunity—taking into account the contractually agreed commencement date of performance and a reasonable time for processing the application—to the e-mail address of the ECDI Contact Person or the person designated by the latter; 2.2.5 shall immediately notify, by e-mail, of the early cessation of the Service Provider’s need for access to the DFSA, to the Defence Forces background check address [email protected] and to the ECDI Contact Person; 2.2.6 shall comply with, and ensure the Service Provider’s compliance with, the Security Requirements under the conditions established within the DFSA, and shall ensure such compliance by its subcontractor(s). 3. RIGHTS AND OBLIGATIONS OF THE DEFENCE FORCES 3.1 The Defence Forces shall have the right to: 3.1.1 conduct a Background Check on a person associated with the provision of services to the Defence Forces for the purpose of deciding whether to permit access to the DFSA; 3.1.2 grant or restrict the Service Provider’s Right of Access to the DFSA on the basis of circumstances established in the course of the Background Check2; 3.1.3 leave a Background Check Request unexamined in accordance with the Administrative Procedure Act; 3.1.4 refuse, on security grounds, to grant a Right of Access to a person who has not undergone a Background Check, has failed the Background Check, or for whom it is not possible to conduct a Background Check; 3.1.5 restrict or refuse to grant a Right of Access to the DFSA and to Secure Areas to stateless persons or foreign nationals on security grounds; 3.1.6 verify compliance with the Security Requirements applicable at the object of the public procurement by any Service Provider holding a Right of Access and, in the event of non- compliance or breach, prohibit the Service Provider from being present within the DFSA. 3.2 The Defence Forces shall: 3.2.1 notify, in a form reproducible in writing, the person who submitted the Background Check Request of the outcome of the Service Provider’s Background Check; 2 https://www.riigiteataja.ee/akt/106072023031#para14 3/4  3.2.2 notify, in a form reproducible in writing, the person who submitted the Access Application of the Service Provider’s obtaining a Right of Access to the DFSA, including any restrictions thereto; 3.2.3 brief the Service Provider on the Security Requirements in force at the object of the public procurement located within the DFSA; 3.2.4 notify ECDI if the Service Provider and/or the Contracting Partner breaches the Security Conditions or fails to comply with the Security Requirements applicable at the object of the public procurement (Annex 5); 3.2.5 where a request is left unexamined pursuant to clause 3.1.3, provide written notice thereof. 4. FINAL PROVISIONS 4.1 The contact persons referred to in the security conditions shall be designated upon conclusion of the procurement contract and any changes thereto shall be notified to the parties by e-mail. 4.2 The processing of personal data shall be carried out in accordance with the requirements laid down in the applicable legislation. 4/4 Annex 1: Sample Background Check Request (e-mail) Send the request to: [email protected] SUBJECT: Background Check Request (name of campus and object) FOR INTERNAL USE TEXT: ESTONIAN DEFENCE FORCES Restrictions on access apply as of the date the form is completed and as long as required but no longer than 75 years. Legal grounds: Public Information Act clause 35 (1) 12) Hello, In connection with ECDI contract [contract name], No. [xxxxxxxxx], concluded on [dd.mm.yyyy], I hereby submit to the Defence Forces the details of the persons listed below for the purpose of conducting a Background Check. Background Check documents are attached to this e-mail. Additional information is provided in the table: Object where Provision of service Service to Start date of End date of Personal ID the service in a Secure Area First name Surname Company be service period service period code will be YES/NO provided (dd.mm.yyyy) (dd.mm.yyyy) provided I am aware that the Background Check may take up to 14 calendar days from the submission of a compliant request. Kind regards, [First name Surname of the requester] [Position] [Company name] [Contact phone, e-mail address] 1/1  FOR OFFICIAL USE ONLY ANNEX 3: CONSENT FORM (English) FOR INTERNAL USE ESTONIAN DEFENCE FORCES Restrictions on access apply as of the date the form is completed and as long as required but no longer than 75 years. Legal grounds: Public Information Act clause 35 (1) 12) APPROVED With the Commander of the Defence’s Order No. 223 of 07.02.2025 Annex No. 4 AUTHORISATION FOR BACKGROUND CHECK FOR A PERSON APPLYING TO GET CLEARANCE TO ENTER THE RESTRICTED MILITARY AREAS OF THE ESTONIAN DEFENCE FORCES FOR THE PROVISION OF SERVICES (first and last name) Personal identification code: I hereby authorise the Estonian Defence Forces to process my personal data in order to obtain clearance to access restricted military areas for the duration of my service provision agreement but no longer than five years after I gave authorisation. By giving this authorisation, I confirm that I am aware of the following conditions: 1. The Estonian Defence Forces (EDF) has the right to conduct a background check in accordance with section 415 of the Estonian Defence Forces Organisation Act (hereinafter the EDFOA). 2. I have the right to refuse to authorise the background check (clause 416 (2) 1) of the EDFOA). 3. I have the right to refuse to disclose information that might cause myself, my partner or a person close to me to become subject to offence proceedings (clause 416 (2) 2) of the EDFOA). 4. I have the right to request the termination of collecting my data or making queries about me (clause 416 (2) 3) of the EDFOA). 5. I have the right to give explanations about the information collected about me (clause 416 (2) 4) of the EDFOA). 6. I have the right to turn to the court, the Chancellor of Justice and the Data Protection Inspectorate to protect my rights and challenge the decisions made about me based on the data collected in accordance with section 416 of the EDFOA to verify that my data is collected in compliance with my fundamental rights and freedoms and the principle of good governance (clause 416 (2) 5) of the EDFOA). FOR OFFICIAL USE ONLY 1/2  FOR OFFICIAL USE ONLY 7. If I refuse to authorise or request the termination of collecting my data or making queries about me, this serves as the grounds for not giving me clearance to enter the restricted military area of the EDF (section 417 of the EDFOA). 8. The EDF has the right to restrict my rights regarding the personal data being processed (clause 4110 (3) 4) of the EDFOA). 9. When I am on the restricted military area of the EDF (subsection 52 (3) of the EDFOA), I am obligated to follow the order in force in the EDF (including the order for fire safety, traffic and parking) and the orders of representatives of the EDF (subsection 52(2) of the EDFOA), and I am aware that 9.1. it is forbidden to enter the restricted military area of the EDF while in the possession of alcohol or narcotic or psychoactive substances, firearms, explosives, partially or fully automatic or remote-controlled flying objects (e.g. drones), radioactive and easily flammable substances or items that contain such substances, and other things that might endanger myself or other persons, technology and equipment on the premises; 9.2. third persons cannot be brought to or allowed to enter the restricted military area of the EDF without the permission of the EDF; 9.3. the person entering the restricted military area of the EDF in a vehicle is obligated to cover up, turn off or remove all on-board cameras with video and/or audio recording; 9.4. the EDF has the right to detain a person (or a vehicle) entering, staying in or leaving the restricted military area of the EDF to conduct a security inspection and check the person (including their clothing, possessions and vehicle) by visual inspection, groping, or with a technical device or a trained service dog; 9.5. for security and safety reasons, the EDF can temporarily prohibit a person from entering the restricted military area, or to order the persons staying in the restricted military area of the EDF to leave, or to prohibit them from leaving; 9.6. without a prior consent of the EDF, it is forbidden to take photographs or videos or make audio recordings in the restricted military area or buildings of the EDF, and to share/upload such recordings in any form or environment; 9.7. it is forbidden to stay in the restricted military area of the EDF under the influence of alcohol, narcotic, or psychoactive substances, or with the suspicion or signs of such influence; 9.8. it is forbidden to display symbols of aggression (including in vehicles) in the restricted military area of the EDF. (day, month, year) [ signed digitally]3 3 Can also be signed on paper FOR OFFICIAL USE ONLY 2/2 ANNEX 4: Sample Access Application (e-mail) The request shall be sent to the e-mail address of the ECDI Contact Person designated in the contract or to the person designated by the latter. SUBJECT: Access Application (name of campus and object) TEXT: FOR INTERNAL USE Hello, ESTONIAN DEFENCE FORCES Restrictions on access apply as of the date the form is completed and as long as required but no longer than 75 years. Legal grounds: Public Information Act clause 35 (1) 12) In connection with ECDI contract [contract name], Contract No. [xxxxxxxxx], concluded on [dd.mm.yyyy], I hereby submit an Access Application. Additional information is enclosed as an attachment (to be provided in Microsoft Excel format): Object Vehicle make and Service to Start date of End date of Personal ID where the registration First name Surname Company be service period service period code service will number provided (dd.mm.yyyy) (dd.mm.yyyy) be provided The applicant is aware that: 1. passing the Background Check does not guarantee automatic access to the Defence Forces Security Area (DFSA); 2. the Defence Forces are entitled to restrict persons’ access to the DFSA. Kind regards, [First name Surname of the requester] [Position] [Company name] [Contact phone, e-mail address] 1/1 ANNEX 5: The general EDF security requirements established for entry to and presence within the security area. When present in the EDF security area (subsection 52 (3) of the EDFOA), one must comply with the rules in force in the EDF (including fire safety, traffic and parking regulations) and the instructions of the representative of the EDF (subsection 52 (2) of the EDFOA), including: 1. it is forbidden to enter the restricted military area of the EDF while in the possession of alcohol or narcotic or psychoactive substances, firearms, explosives, partially or fully automatic or remote- controlled flying objects (e.g. drones), radioactive and easily flammable substances or items that contain such substances, and other things that might endanger myself or other persons, technology and equipment on the premises; 2. third persons cannot be brought to or allowed to enter the restricted military area of the EDF without the permission of the EDF; 3. the person entering the restricted military area of the EDF in a vehicle is obligated to cover up, turn off or remove all on-board cameras with video and/or audio recording; 4. the EDF has the right to detain a person (or a vehicle) entering, staying in or leaving the restricted military area of the EDF to conduct a security inspection and check the person (including their clothing, possessions and vehicle) by visual inspection, pat-down, or with a technical device or a trained service dog; 5. for security and safety reasons, the EDF can temporarily prohibit a person from entering the restricted military area, or to order the persons staying in the restricted military area of the EDF to leave, or to prohibit them from leaving; 6. without a prior consent of the EDF, it is forbidden to take photographs or videos or make audio recordings in the restricted military area or buildings of the EDF, and to share/upload such recordings in any form or environment; 7. it is forbidden to stay in the restricted military area of the EDF under the influence of alcohol, narcotic, or psychoactive substances, or with the suspicion or signs of such influence; 8. it is forbidden to display symbols of aggression (including in vehicles) in the restricted military area of the EDF. 1/1 Rhys Palmer Escal Institute of Advanced Technologies 11.05.2026 No 2-14/26/1682 [email protected] Procurement documents „Cybersecurity training” (306192) 1. General data 1.1. Title of the procurement: „Cybersecurity training” (in Estonian: „Tehniliste küberturbe koolituste korraldamine”). 1.2. Contracting Entity: Estonian Centre for Defence Investments, registry code 70009764, address Järve 34a, 11314 Tallinn. 1.3. Type of procurement procedure: negotiated procurement procedure without prior publication. 1.4. Any questions about the procurement documents should be sent to Aare Lokk and Kätlin Anepaio via e-mail: [email protected] and [email protected]. 2. Object of the public procurement 2.1. The object of the procurement is to provide advanced cybersecurity training and internationally recognized certification to institutions within the administrative area of the Estonian Ministry of Defense, including its subordinate institutions and affiliated organizations. 3. Submission of tender documents 3.1. The deadline for the submission of tender documents will be stated in the procurement documents (hereinafter PD). Tender documents must be submitted no later than 18.05.2026 11:00 o’clock Eastern European Time (EET) by e-mail to [email protected]. A copy shall be sent to [email protected]. The subject line must include: person responsible Aare Lokk, „Cybersecurity training” (306192). 3.2. Tender documents must include the documents required in Clause 4. 3.3. The grounds for exclusion and the tender documents must be prepared in accordance with the terms and conditions specified in the PD and must not be misleading in any way. 3.4. The tenderer shall bear all costs related to participation in the procurement. 3.5. Tender documents must be submitted in English or Estonian. The contracting entity has the right to request translations into Estonian or English of documents submitted in any other language, including certificates, evidence, and certified statements. Promotional materials annexed to the tender may be submitted in another foreign language (preferably English). All correspondence within the procurement process shall be conducted in Estonian or English. Communication with the successful tenderer during the performance of the framework agreement shall also be conducted in Estonian or English. 3.6. Submitted documents must be final and must not contain corrections or additions. Järve 34a / 11314 Tallinn / Estonia / +372 717 0400 / [email protected] / www.ecdi.ee Registration code 70009764 4. Structure of the tender documents and list of documents 4.1. The tenderer shall submit excerpt from the commercial register. 4.2. Suggestions, proposals, and comments regarding the draft Framework Agreement (Annex 1 to the PD), if any. 5. Submitting a tender and the compliance to the PD 5.1. A tender meets the compliance requirements if the tenderer has submitted all documents required in the PD, and the contracting entity verifies that the tender complies with the requirements specified in the PD (in accordance with Clause 4). 5.2. The contracting entity has the right not to conclude the framework agreement if new circumstances arise during the procurement procedure that prevent the procurement from being carried out under the terms and conditions set out in the PD or make the conclusion of the framework agreement inadvisable for the contracting entity. 6. Validity period of the tender 6.1. The validity period of the tender shall begin on the tender submission deadline and last for 90 days. 7. Final provisions 7.1. In matters not regulated by the PD, the contracting entity and the tenderer shall be governed by the Estonian Public Procurement Act. Respectfully, Kätlin Anepaio Strategic Category Manager Support and administrative services Annexes: Annex 1. Framework Agreement draft; Annex 2. Technical description; Annex 3. Security Requirements. 2