Tenders Are Invited For Conducting A Comprehensive Cybersecurity Audit In Sp Zoz Csk Um In Łódź Implemented As Part Of The Project Entitled: Implementation Of E-Services In Csk Um In Łódź

3.1. The Subject Of The Order Is The Implementation Of The Sentence Entitled: Conducting A Comprehensive Cybersecurity Audit In The Sp Zoz Of The Central Clinical Hospital Of The Medical University Of Łódź Carried Out As Part Of The Project Entitled: Implementation Of E-Services In The Csk Um In Łódź. 3.2. The Task Is Carried Out As Part Of The Project Entitled: Implementation Of E-Services In The Csk Um In Łódź Financed From The Funds Of The Reconstruction And Resilience Instrument For Projects Implemented As Part Of Investment D.1.1.2 Accelerating The Processes Of Digital Transformation Of Health Care Through Further Development Of Digital Services In Health Care Which Is An Element Of Component D Efficiency, Accessibility And Quality Of The Health Care System (Kpod.07.03-Ip.10-0221/25)3.3. The Subject Of The Order Is To Conduct A Cybersecurity Audit Of The Ordering Partys Ict Systems, In Particular At The Ordering Partys Headquarters, Aimed At Assessing The Level Of Security, Identifying Vulnerabilities And Determining The Risks Related To Information Processing And The Continuity Of Operation Of It Systems.1. Purpose Of The Orderthe Purpose Of The Order Is To:• Assess The Current State Of The Ordering Partys Cybersecurity,• Identify Technical And Organizational Threats And Vulnerabilities,• Assess The Level Of Risk For Key Information Resources,• Present Recommendations For Corrective And Improvement Actions.2. Scope Of The Orderthe Scope Of The Audit Includes In Particular:1. Analysis Of The Architecture And Configuration Of The Ict Infrastructure (Networks, Servers, End Devices, Cloud Environments - If Any),2. Security Assessment Of Operating Systems, Applications And Network Services,3. Verification Of Identity Management And Access Control Mechanisms,4. Analysis Of Information Security Policies, Procedures And Documentation,5. Assessment Of Data Protection Safeguards, Including Personal Data,6. Assessment Of The Organizations Resistance To Social Engineering Threats (If Applicable),7. Verification Of Compliance With Applicable Legal Provisions And Norms And Standards, In Particular: O Gdpr, O National Interoperability Framework (Kri), O Iso/Iec 27001 (If Applicable).3. Implementation Methodologythe Audit Will Be Carried Out In Accordance With Recognized Methodologies And Good Industry Practices, Using The Following Activities: • Analysis Of Documentation Provided By The Ordering Party, • Interviews And Consultations With Designated Employees Of The Ordering Party, • Technical And Configuration Analyzes Of It Systems, • Risk Assessment, Taking Into Account The Probability Of Threats And Their Impact. The Implementation Of The Audit Cannot Cause Disruptions In The Operation Of The Ordering Partys Systems.4. Results Of The Order Implementation As Part Of The Order Execution, The Contractor Will Provide A Final Report Containing: • A Description Of The Current State Of Cybersecurity, • A List Of Identified Vulnerabilities And Inconsistencies,