IT application used for two purposes: scheduling and dispatching

✓Secondly, concerning the scope of the contract (what, how much, where, when), the documents describe the project as part of SNCB/NMBS’s multi-year transformation program “shERPa” to migrate from SAP ECC to SAP S/4HANA Private Cloud Edition (PCE) and various SAP SaaS solutions (IBP, APM, C4C) via a greenfield approach.

✓Within this program, the contract covers a scheduling & dispatching solution for B-Technics (maintenance and revision of trains), in the context of projects such as Centre of Competence, Pilot Traction Workshop and Revision.

✓The solution must (such as) flexibly plan and dispatch SAP maintenance orders via a graphical planning board, handle capacity, materials, statuses, deadlines, dependencies, and maintenance shutdowns (scheduling), and allocate operations to technicians based on availability, qualifications, conflicts, progress and workload (dispatching).

✓It must integrate seamlessly with SAP S/4HANA and satisfy requirements concerning security, single sign-on (SSO), authorisations and performance.

❓The exact contract period and detailed timeline are not in the excerpts; deadline for receipt of requests to participate is “see e-Procurement”.

✓Only selected candidates receive the full tender specifications and can submit an offer, implying that detailed scope/volumes and timelines are in later documents not included here.

❓Thirdly, regarding award criteria and weighting, the input text does not explicitly state any award criteria or their relative weighting.

✓The documents provided concern the selection phase (eligibility, exclusion, economic/financial and technical capacity) rather than the award phase.

❓They emphasise minimum thresholds and security/compliance conditions but do not describe value-for-money criteria, qualitative criteria or scoring matrices.

❓Thus, based on the available text, one can only note that award criteria and weighting are not specified here and are likely contained in the later “cahier des charges”/bestek sent to selected candidates.

❓Fourthly, on risks and special conditions (penalties, guarantees, subcontracting, validity period, question deadline, site visit), the documents place strong emphasis on cyber- and information security, data protection and regulatory compliance rather than classical commercial penalties or guarantees.

✓Special conditions include: (such as) the obligation to complete and sign the “SNCB_NMBS Cyber-infoSec Exclusion criteria for suppliers – No-IACS – 3.3.2” document, where the supplier must declare compliance or non-compliance with security requirements.

✓For services involving sensitive or confidential SNCB/NMBS information, suppliers must have valid ISO 27001 certification or equivalent, and sign the SNCB/NMBS Data Protection Agreement (DPA/GBO/CPD) or equivalent accepted by SNCB/NMBS.

✓The DPA annexes specify minimum security measures, information security policy, security organisation (appointment of an information security manager / DSO), personnel, physical, network and backup security.

✓The contractor must process SNCB data only on SNCB media/systems unless authorised, notify SNCB promptly of personnel changes affecting access to SNCB assets, and implement robust incident management, including informing SNCB within 24 hours of security incidents or data breaches.

✓Outsourcing and supply chain security conditions stipulate that subcontractors may only be used with prior written approval by SNCB; subcontractor contracts must impose equivalent obligations (security, confidentiality, audit rights, etc.), and subcontractors must hold all certifications required by SNCB for the relevant services.

✓NMBS/SNCB reserves the right to audit contractors at least annually (more often depending on risk), with at least 5 days’ notice except in regulator-driven or suspected fraud cases; if audits show non-compliance, the contractor must immediately remedy and indemnify SNCB for audit-related costs.

✓In case of significant or persistent breach of the DPA or cybersecurity/data-protection legislation, or failure to comply with binding decisions of courts/supervisory authorities, SNCB may instruct suspension of processing of SNCB data and ultimately terminate the contract without compensation.

✓The condition to perform services and data processing exclusively within the EEA, using EEA-established entities and EEA-based personnel, is explicitly highlighted as a special risk-management requirement.

❓Penalties, guarantees, offer validity periods, question deadlines and site visits are not detailed in the excerpts beyond the general note that deadlines and additional information are available on e-Procurement.

✓Fifthly, concerning contradictions or corrections within the documents and which statement applies, the French “Guide de sélection” (version 5.0, 01/06/2023) and the Dutch “Selectieleidraad” (version 6.0, 02/04/2026) are substantively aligned on all core selection conditions (forms, turnover thresholds, reference conditions, use of ESPD, exclusion grounds).

❓The Dutch version is more recent (2026 vs 2023) but does not present any obvious conflicting requirements; instead it mirrors and updates the French text.

✓Both explicitly state that the ESPD must be used and that false declarations may lead to exclusion or prosecution; both set identical turnover thresholds and financial rating conditions; both define the same reference requirements and additional obligations (support languages, SAP certification, ISO27001 or Cyber Fundamentals “Important”).

✓The cyber and information security exclusion criteria documents in Dutch and English (version 3.3.2 – 09/04/2025) also align conceptually with the DPA annexes; they introduce a questionnaire format but do not contradict the annexed obligations, rather they operationalise them for supplier qualification.

❓Where language versions overlap (FR/NL/EN), the latest version number and the contracting authority’s clarification in the tender documents would normally prevail; from the provided text there are no explicit conflicting statements that require choosing one over another.

Answers on the required criteria

Must securities be provided (bid bond, performance or warranty guarantee)? If so: which, in what amount and by when?

❓Such as in the sections on economic and financial capacity, the documents set minimum turnover thresholds but do not mention any requirement for bid bonds, performance guarantees or warranty securities.

❓No specific bid bond, performance bond, or warranty guarantee amount or timing is described in the provided excerpts.

Is subcontracting allowed? If so: with which limits and which disclosure duties?

✓Such as in the detailed “Agreement on Confidentiality, Security and Processing of SNCB Data”, subcontracting is explicitly allowed but strictly controlled.

✓The contractor may only use a subcontractor with prior written approval from SNCB, requested at least one month before engagement, and must provide all necessary information so SNCB can decide.

✓The contractor retains full responsibility for subcontractor performance and compliance, must maintain and disclose a list of subcontractors, and must ensure standard contractual clauses (SCCs) are in place for any EEA‑restricted transfers.

Is there a site visit, and is attendance mandatory? If so: when?

❓The documents do not mention any site visit, nor any mandatory attendance requirement, nor a schedule for such a visit.

In which language must the tender and the supporting documents be submitted, and are documents in other languages accepted?

✓On language, the solution itself must at least support French, Dutch and English (FR/NL/EN), and the contractor must be able to offer support services at least in English.

❓The official selection documents are bilingual (French “Guide de sélection”, Dutch “Selectieleidraad”), and reference the use of the standard EU procurement form (DUME/UEA); however, the excerpts do not explicitly state a single mandatory language for submitting tenders or supporting documents beyond the use of the EU form and the e‑Procurement platform.

How long is the bidder bound by the tender (validity period), and is there a deadline for bidder questions? If so: until when?

❓They do not specify for how long bidders are bound by their tenders (no validity period is given in the excerpts), nor do they set a formal deadline for bidder questions or clarifications.

❓Any rules about tender validity and Q&A periods would need to be sought in the later “cahier des charges/bestek”, which is expressly mentioned as being sent only to selected candidates and is not included in the provided text.

Further details

✓SNCB/NMBS shERPa Scheduling & Dispatching Solution – selection and data protection requirements

✓The input text concerns a Belgian public procurement procedure launched by the National Railway Company of Belgium (SNCB/NMBS) for an IT application providing scheduling and dispatching functions integrated with SAP S/4HANA.

✓The perspective is clearly Belgian and EU‑based, repeatedly referring to Belgian legislation, EU directives (notably NIS2, GDPR), and the European Economic Area (EEE/EEA) requirements for data processing and service provision.

✓Instead, risk is managed through selection criteria: an annual turnover of at least 2,000,000 EUR in each of the last three financial years; average turnover of at least 500,000 EUR per year over the last three years for similar services in Europe; and external creditworthiness checks via Dun & Bradstreet or CreditSafe, with exclusion if the candidate has a poor rating (CreditSafe International Score D or E).

✓ISO 27001, Cyber Fundamentals, SAP certification where relevant), and (iv) grant SNCB audit and inspection rights.

✓Such as regarding practical tendering aspects, the selection guides state that requests to participate must be submitted electronically via the Belgian e‑Procurement platform, using the European Single Procurement Document (DUME/UEA).

✓Such as in the sections on deadlines and validity, the texts refer only to the “date limite de réception des demandes de participation / uiterste datum voor ontvangst van aanvragen tot deelname”, which must be checked on e‑Procurement.