The FACIS (Federated Architecture for Composed Infrastructure Services) project is funded under the IPCEI-CIS/8ra initiative. It aims to develop a sovereign, interoperable and secure digital infrastructure that will support the seamless collaboration of cloud and edge services across Europe. To achieve this, FACIS is focusing on enabling trust-based federations by providing modular, standards-compliant components to facilitate service provision, management and governance in a decentralised ecosystem.

Aligned with the 8ra initiative's objectives of fostering a resilient, interoperable, and trusted European digital infrastructure, the FACIS project contributes foundational technologies that support cross-border and cross-domain collaboration. A fundamental prerequisite for such cooperation is establishing and managing trust relationships between participating organisations and their digital services.

To this end, FACIS is developing a Zero Trust Demonstrator to showcase how independent organisations can collaborate and exchange digital services securely within a federated environment. The demonstrator will illustrate the establishment of trust relationships between two participating trust domains, as well as demonstrating policy-based access to protected resources and services.

The Zero Trust Demonstrator is intended to represent a minimum viable federation consisting of two groups (federations represented by a multitude of participants), as well as the necessary trust and governance capabilities required for secure collaboration. It will provide an understandable and demonstrable environment for validating concepts, visualising trust relationships and evaluating interoperability within federated digital infrastructures.

The purpose of this award is to commission software development services for Lot Zero Trust Demonstrator by using the Eclipse Project XFSC (Cross Federation Services Components) as the foundation (https://projects.eclipse.org/projects/technology.xfsc).

For further participation and the processing of the documents, it should be noted that the development team must be complete as soon as the order is placed so as to be able to provide the development services on time and with the required quality.

Further details can be found in the service description.

1. The bidders must also complete the eligibility self-declarations pursuant to Sections 123 and 124 of Act against Restraints of Competition - GWB (cf. Section 31 (1) regulation on sub-threshold procurement - UVgO). The bidders must submit these with the participation application.

2. Extract from the relevant register not older than 6 months (since publication of the notice) for the company and - if envisaged - members of the bidding consortium as well as subcontractors to be used by way of suitability lending, in each case insofar as corresponding statutory register obligations exist.

3. The bidder must submit the following self-declarations according to the collection of forms:
- Self-declaration that the company is not in liquidation.
- Self-declaration that the company fulfils its obligations to pay taxes and duties.

1. Self-declaration of the company's total turnover in relation to the last three completed financial years in accordance with the collection of forms.

2. Minimum turnover: Average annual minimum turnover in each of the last three calendar years (2023-2025) EUR 100,000 net.

3. Proof of existing business liability insurance/professional liability insurance (copy) with a minimum amount of:

- EUR 1,000,000 for personal injury and property damage
- EUR 500,000 for financial losses

The above-mentioned amounts of cover must be available at least twice per insurance year.

In the case of bidding consortia, proof of insurance must be provided for each member.

In the case of a lower coverage of the liability insurance, confirmation from the insurance company stating that the coverage amount can be increased accordingly in the event of an order is sufficient.

1. Self-declaration of one or more references of essentially comparable services performed in the years 2023 - 2026 (by end of July) in accordance with the service description (the service must have been accepted in the essential parts within this period, or approx. 90% of the remuneration must have been paid). A reference service is deemed comparable with the services being awarded here if it is similar to them in terms of content, type of service, degree of difficulty, technically and organisationally to such an extent that it allows a valid conclusion to be drawn about the bidder's capability to perform the tendered service.

To demonstrate technical and professional capability, the bidder must collectively demonstrate the following four mandatory requirements:

1. Implementation within an OSS environment
2. Design, implementation, or integration of Zero Trust architectures or security infrastructures in cloud and/or edge computing environments (NIST Zero Trust Architecture)
3. Use of Decentralized Identifiers (DIDs), Verifiable Credentials (VCs), and federated trust frameworks (OpenID4VC, OAuth2.0, W3C VC-Standards)
4. Development, integration, or operation of policy engines, access control systems (e.g., Attribute-Based Access Control (ABAC) or Role-Based Access Control (RBAC))
5. Usage of Node-Red based Workflows or similar flow-based visual programming for building automations, integrations, and event-driven applications

The aforementioned five (5) mandatory requirements may be demonstrated by one or more reference project(s). Overall, however, the submitted references must demon-strate all mandatory suitability requirements. If bidders submit more than one reference, they do not have to come from different contracting authorities in order to be assessed.

Alternative proof for Mandatory Requirement 5

As an alternative to a project reference, the fourth mandatory suitability requirement ("Usage of Node-RED-based workflows or similar flow-based visual programming") may be demonstrated by successfully completing the practical work sample provided by the contracting authority (see Annex Work Sample Node Red).

The practical work sample may only be used as an alternative means of demonstrating Mandatory Requirement 5 ("Usage of Node-RED-based workflows or similar flow-based visual programming"). Mandatory Requirements 1 to 4 must be demonstrated exclusively by means of one or more reference projects. The work sample will be assessed on a pass/fail basis against predefined assessment criteria, that are listed in Annex Work Sample Node Red.

The work sample consists of a manageable implementation task intended to demonstrate practical experience with Node-RED related technologies without requiring an existing project reference. Based on our professional assessment, it can be completed within approximately four (4) hours and focuses on the use of the ORCE UI Builder and basic API integration.

Accordingly, bidders may demonstrate suitability either by:

- submitting one or more references that collectively cover all five mandatory suit-ability requirements; or
- submitting one or more references that collectively cover Mandatory Require-ments 1-4 and successfully completing the work sample for Mandatory Requirement 5.
In the case of a bidding consortium, the required reference(s) must have been performed by at least one member of the consortium.

The client reserves the right to check the accuracy of the information provided and to demand suitable proof of this at short notice.
Bidders who do not meet the minimum requirements listed above will be excluded from the award process.

2. A self-declaration is required to demonstrate that the company has the necessary personnel and technical resources to execute the contract properly.
The client reserves the right to check the accuracy of the information provided and to demand suitable proof of this at short notice.