How to bid in this country: portals, deadlines, thresholds →
Unified Vulnerability & exposure management tool: Delivery, implementation, configuration, support and maintenance integrated vulnerability management platform
Unified Vulnerability & exposure management tool: Levering, implementatie, configuratie, ondersteuning en onderhoud geïntegreerd kwetsbaarheidsbeheerplatform — original title
Your path to submission
- Deadline for requests to participate: 16 November at 10:00 — 15 days left. Two-stage procedure: by this deadline you submit a request to participate (proof of eligibility). Only shortlisted firms are then invited to submit a tender.
- You submit on BDA / e-Procurement Belgium — not here and not by e-mail. ↗
- Offer and evidence in: Dutch.
- Collect your evidence — use the eligibility analysis on this page: it lists the requirements and, for known certificates, how to get them.
What the buyer is looking for
The subject of the contract shall be the provision, implementation, configuration, integration, training, support and maintenance of a central integrated vulnerability management platform, also described as Unified Vulnerability Management, Exposure Management or equivalent functionality. The solution shall bring together, normalise, deduplicate, enrich, prioritise, assign, track and report vulnerabilities and related findings from a variety of automated and manual sources. It shall enable the contracting authority to manage vulnerabilities end-to-end, from detection or reporting to remediation, risk acceptance or formal closure, with support for team collaboration, secure information foreclosure and management reporting.
Contract
Type of service
Clement What the numbers say about this buyer
- In this sector the buyer awards roughly every 2 months (24 awards, most recently August 2026) — by that rhythm the next award was due around October 2026. The last award went to Citymesh Integrator.n = 24
- The award came in at a median 45% of the estimated value (5 awards with both estimate and value) — pricing at the estimate is usually too high here. Sector: 83%.n = 5
- The median procedure drew 2 bids (21 procedures with a bid count); 14% ended with a single bidder. Sector: median 5 bids.n = 21
- 9% of this buyer's awards went to companies that had already won here before (33 awards since 2021, spread over 28 companies). 91% went to new names.n = 33 awards since 2021
- 18% of awards went to companies from abroad (33 awards with a known winner country). Sector average: 29%.n = 33
From this buyer's documented awards; comparison values from the same sector and country. Not a forecast, not legal advice. As of 25/10/2026.
Tender documents at a glance
The essentials of the tender documents, checked statement by statement against the documents. For your bid, the original documents count.
Powered by eBriefing – EU language technology. Friedrich is an independent service, not an EU offering.
✓ found in the documents · ❓ not found in the documents or general statement
Unified Vulnerability & Exposure Management Tool – Selectieleidraad Overview
The input text concerns the Belgian public procurement procedure for a services framework agreement (“raamovereenkomst”) for a unified vulnerability & exposure management tool issued by AG Digipolis Antwerpen.
It describes the legal framework, the selection phase and related documentation requirements from the point of view of Belgian and EU public procurement law, referencing EU regulations, Belgian national legislation and EU‑wide instruments such as the Uniform Europees Aanbestedingsdocument (UEA).
Countries explicitly mentioned include Belgium (as the location of the contracting authority and reference legal system), other EU Member States (for social law and proof documents), and Russia, in the context of EU sanctions restricting participation of entities with Russian links.
Such as outlined in the “Kenmerken van de opdracht”, the scope of the contract is the delivery, implementation, configuration, support and maintenance of an integrated vulnerability management platform for AG Digipolis Antwerpen.
The assignment is a single, indivisible lot (no percelen, no fixed/conditional lots, no options or variants allowed).
The estimated total value over the full term is 200,000 EUR (excl.
VAT) with a maximum of 400,000 EUR (excl. VAT).
Such as laid out in the selection and submission provisions, candidates must submit: an electronically filed “aanvraag tot deelname” (application for participation) via the Belgian eProcurement platform in Dutch; the standard application form attached to the selectieleidraad (with identity data for natural persons, legal persons or groupings, including SPOC, RSZ number, enterprise number, SME status, indication of subcontractors, and personnel subject to other EU social legislation); the UEA (either integrated in eProcurement or uploaded externally) declaring absence of exclusion grounds and compliance with selection criteria; and, where applicable, a signed “Verbintenis terbeschikkingstelling middelen” from third parties whose capacities are relied upon, including joint and several liability for economic/financial support.
For foreign bidders, additional attestations (such as non-bankruptcy and absence of certain criminal convictions) of recent date must be attached.
Such as specified in the technical and professional capacity criteria, the minimum qualification requirements include: possession of a valid ISO/IEC 27001 certificate or equivalent for services related to the subject of the contract (with evidence of equivalence if no formal certificate); at least two references for similar services within the last three years preceding the deadline for participation requests, each reference having at least 5,000 uniquely managed ICT assets/endpoints actively processed by a platform; and each reference must comprise implementation and configuration, training sessions, post‑go‑live support to system administrators, and be backed by either a certificate of good performance or a declaration on honour.
Financial capacity is mentioned indirectly via the possibility to rely on third‑party capacity, but detailed turnover/insurance thresholds are not specified in the provided excerpts.
Such as indicated in the award criteria section, the contract will be awarded in the subsequent offer phase on the basis of the “beste prijs‑kwaliteitsverhouding” (best price‑quality ratio), with a weighting of 30 points for price and 70 points for quality.
Show all 46 statements
The detailed operational quality criteria will be defined in the bestek, which is only sent to candidates who successfully pass the selection phase.
The procedure is a “mededingingsprocedure met onderhandelingen”, and includes steps such as initial offer submission, possible regularisation, negotiations, improved/definitive offers, evaluation and ranking, award decision, and standstill period before contract signature.
Such as discussed under risks, special conditions and corrective mechanisms, there are several important provisions: strict exclusion grounds for criminal offences, tax and social security debts, serious professional misconduct, collusion, previous involvement causing distortion of competition, false statements and attempts to unlawfully influence the decision‑making process; EU sanctions against Russia are enforced through a compulsory declaration on whether the candidate or key subcontractors/third parties (over 10% of contract value) are linked to Russia as defined by Regulation (EU) 833/2014; subcontractors used to satisfy selection criteria are subject to the same exclusion checks, and for financial capacity their mere subcontracting commitment is insufficient – they must either accept joint execution liability or provide a parent company guarantee.
The AO may request additional evidence at any time, may stop the procedure without compensation, and will not reimburse participation costs.
Questions on the selectieleidraad or clarification requests must reach the AO at least 10 calendar days before the participation deadline; answers and any “verklarende nota” are published at least seven days before the deadline and form an integral part of the selectieleidraad.
As explicitly stated, if statements in annexes or other documents contradict the selectieleidraad, the selectieleidraad prevails.
Answers on the required criteria
Must securities be provided (bid bond, performance or warranty guarantee)? If so: which, in what amount and by when?
The selectieleidraad does not set out any explicit requirement for bid securities or performance/warranty guarantees in the selection phase.
It refers generally to the legal and financial risk profile of the framework agreement and describes how candidates may rely on third‑party economic/financial capacity through instruments such as a “parent company guarantee” or a joint and several commitment to execute the contract, but it does not impose a specific bid bond amount, performance bond percentage, or warranty guarantee in this document.
Such obligations, if any, are said to be stipulated later in the “bestek” (specification/terms) that is only sent to selected candidates in the second, offer phase.
Thus, as far as the provided text goes, securities are not required at the candidacy stage and details for eventual guarantees would appear only in subsequent tender documents.
Is subcontracting allowed? If so: with which limits and which disclosure duties?
Subcontracting and reliance on third parties are clearly regulated.
Candidates are allowed to rely on “onderaannemers” or other entities to meet minimum financial capacity or technical/professional capability criteria, such as ISO/IEC 27001 certification or references for similar services.
However, such as stated in point 4.1.2, these third parties must be identified in the application form, must fill in, date and sign the provided model commitment, and must themselves be free of exclusion grounds.
Where reliance is on financial capacity, a simple subcontracting commitment is not sufficient; the third party must either accept joint and several liability for performance of the contract or provide a parent company guarantee, depending on the corporate relationship.
The form for application explicitly asks whether subcontractors are used and also requires disclosure related to Russian sanctions if any subcontractor or capacity provider has links to Russia or accounts for more than 10% of the contract value.
The selectieleidraad does not impose a quantitative cap on subcontracting but emphasizes transparency, disclosure of all entities whose capacity is used, and compliance with EU sanctions rules.
Is there a site visit, and is attendance mandatory? If so: when?
Concerning site visits or information meetings, the text mentions that the contracting authority (AO) reserves the right to organize an “informatiebijeenkomst” to address questions.
Such as described in section 1.3, if the selectieleidraad is unclear, stakeholders must submit a “Verzoek om uitleg” by email, and the AO may decide to convene an information meeting.
However, no specific date, mandatory attendance requirement, or formal “site visit” is defined in the provided text.
The text therefore provides for optional information meetings at the AO’s discretion, not for a scheduled, obligatory site visit.
In which language must the tender and the supporting documents be submitted, and are documents in other languages accepted?
On language requirements, the selectieleidraad is explicit: the application for participation (kandidatuur) must be submitted electronically in Dutch (“Taal van de aanvraag tot deelname: de kandidaat moet zijn aanvraag tot deelname (kandidatuur) elektronisch indienen in het Nederlands”).
Such as stated in section 3.3, applications cannot be submitted on paper and must be lodged via the Belgian eProcurement platform.
While the text details how foreign (non‑Belgian) candidates must provide equivalent certificates and can consult eCertis to identify the right documents in their country of origin, it does not state that other languages are accepted for the application itself; Dutch is clearly imposed for the candidacy.
Any supporting documents from foreign authorities (e.g. non‑faillissement attest) may naturally be issued in the language of the country of origin, but the core application and candidate form are expected in Dutch.
How long is the bidder bound by the tender (validity period), and is there a deadline for bidder questions? If so: until when?
The emphasis is rather on written clarification: questions may be submitted up to ten calendar days before the deadline for applications, and the AO will publish explanations in a “verklarende nota” and/or via the eProcurement forum.
Regarding the period during which bidders are bound by their offer (validity) and the deadline for questions, the text only covers the selection phase and therefore does not specify a tender validity period for offers; that will be set in the bestek in phase two.
It does, however, define clear deadlines for questions about the selectieleidraad.
Such as set out in section 3.2 and 1.3, stakeholders must submit questions via the eProcurement forum at the latest on the 10th calendar day before the final date for submission of applications; the AO will publish its answers on that forum no later than seven days before that final submission date.
For formal “Verzoek om uitleg” by email, the same 10‑day advance limit applies.
Further details
The input text is the “selectieleidraad” (selection guideline) for the Belgian public procurement procedure C00920 “Unified vulnerability & exposure management tool”, issued by AG Digipolis Antwerpen.
It describes the first (selection) phase of a two‑stage competitive procedure with negotiation and sets out definitions, exclusion and selection criteria, submission rules, and communication arrangements.
The text is written from the point of view of Belgian public procurement law (wet van 17 juni 2016, KB 18 april 2017), but it also explicitly addresses candidates established in other EU or non‑Belgian countries, for instance by specifying which documents foreign candidates must supply.
Countries explicitly or implicitly mentioned include Belgium (as the place of the contracting authority and reference legal framework) and other EU Member States, notably via references to EU law and sanctions against Russia under Regulation (EU) No. 833/2014.
The limit date and exact hour for submitting applications themselves are not fixed in the text but are referenced in the eProcurement notice (“zie bekendmaking eProcurement”).
Only the contracting authority's tender documents are binding. As of: 19/10/2026
Selection criteria — in the procurement documents
The buyer states in the notice that the selection criteria are in the procurement documents (link on this page), not in the EU form. The document analysis below extracts them from there — bid and evidence in Dutch.
Eligibility analysis from the tender documents
Tender documents — direct download
Who has won at this buyer so far
Across all contract types of this buyer — not just this sector. A city buys software and fire engines through the same purchasing office.
| Company | Awards | Period |
|---|---|---|
| EKZ BENELUX BELGIË | 2 | 2025 |
| Tracs Systems | 2 | 2025 |
| Deloitte Consulting & Advisory | 2 | 2024–2025 |
| PLAY AV | 1 | 2024 |
| Nitro Software Belgium | 1 | 2024 |
How often this buyer tenders this kind of work
Contracting authority contact
Tactics
When this buyer has awarded in this sector, usually only one or two bids came in. A solid bid has a real chance here. (Based on 15 completed awards — not a statement about this procedure.)
This procedure allows 31 days between publication and deadline — typical in this country is 34 (median of 3,181 procedures). A normal window for this market.
The deadline falls on a Monday — your last full working day is the Friday before. Have evidence and guarantees together by Thursday.
Foreign bidders
In Belgium · IT services, 537 contracts went to foreign companies over the last 3 years (of 2,133 recorded awards) — mostly from France, Germany, Luxembourg.
Submission language: Dutch.
How to bid
Don't miss the next one
Friedrich finds tenders like this for you — every morning at 7:30, each one checked by Claude (Anthropic) for fit, and he learns from your feedback what your company really does.
Register now