CCapability-led route

Bereitstellung eines Dokumentenmanagementsystems (DMS) als SaaS-Lösung

Geschäftsstelle des Wissenschaftsrats

Deadline
07 Sept 2026, 11:00
Value
—
Region
Köln, Nordrhein-Westfalen, Germany (NUTS DEA23)
Reviewed
16 Aug 2026
Portfolio verdict

Capability-led route

Tier C and no-prime: the functional domain fits Digital David's document-workflow and secure-SaaS competencies, but the buyer is procuring a mature DMS product and eight-year operating route. Current company evidence does not prove the DMS-specific turnover, insurance, three DMS references, ISO 27001/equivalent platform certification or operational C5-baseline compliance. Missing evidence is recorded as unknown, not failed.

Recommended actionDo not prime. Reconsider only with a mature DMS platform partner that can satisfy the DMS turnover, three-reference, insurance, ISO 27001/equivalent and C5-baseline obligations, with the partner structure and evidence confirmed before 28 August 2026.

What the opportunity means

Supply, configure and operate a mature DMS as SaaS for 120 named internal users and up to 600 temporary external collaborators, including support, maintenance, training, project support and transition.

Portfolio thesis

Document workflows, controlled processing, secure SaaS and Microsoft integrations align with demonstrated delivery capabilities. The procurement is nevertheless a product-and-operation contract with hard DMS-specific commercial, reference and security gates that the current company evidence does not substantiate.

Qualification reality

The portfolio demonstrates secure SaaS, document/evidence workflows and integrations, but no existing general-purpose DMS product meeting this mature SaaS procurement. The route is therefore core competency only, and the current evidence pack cannot prove the three DMS-specific turnover years, insurance, three qualifying DMS references, or the required platform-security controls.

Portfolio evidence

Products and reusable delivery strengths

Products

Factifyholz-platformKuebiko

Competencies

document and evidence workflowssecure SaaS and cloud integrationworkflow and rights managementMicrosoft ecosystem integrationtraining and operational support

Decision gates

Eligibility and delivery gates

  • Company matchUnknown
    DMS-specific turnover
    MustRequired

    The bidder must show at least EUR 500,000 net revenue from introduction, provision and operation of DMS in each of the last three closed financial years. The evidence pack contains total turnover for 2024 and 2025 only, no 2023 figure, and no DMS revenue split. Consortium member turnover may be aggregated.

  • Company matchUnknown
    Professional/business liability insurance
    MustRequired

    At least EUR 500,000 per loss event is required for financial, property and personal injury, or an insurer commitment to raise the limit before award. The company evidence pack contains no insurance evidence.

  • Company matchUnknown
    Three comparable DMS references
    MustRequired

    Three references must each cover successful DMS introduction, productive commissioning and operation, be completed within the three-year lookback and have at least EUR 250,000 net contract value; one must include DMS SaaS operation with GDPR Article 28 processing. The local evidence pack contains no approved reference pack and portfolio descriptions cannot substitute for buyer-confirmable references.

  • Company matchUnknown
    German hosting and certified platform
    MustRequired

    Infrastructure must be in Germany and the platform must be certified to ISO 27001 or equivalent. No certification or deployment-location evidence exists in the company qualification pack.

  • Company matchUnknown
    C5 baseline and ISMS/security concept
    MustRequired

    A C5 attestation is not required, but all current C5 baseline criteria must be met. The supplier must also operate a documented security concept and ISMS to ISO 27001/equivalent, oriented to ISO 27017 and, for personal data, ISO 27018. The current evidence pack does not prove these controls.

  • Company matchMet
    Commercial-register entry
    MustRequired

    The qualification pack records Digital David AG's German commercial-register entry and registration details.

  • Company matchUnknown
    Exclusion, minimum-wage, sanctions and data-protection declarations
    MustRequired

    Tender-specific declarations under sections 123/124 GWB, the minimum-wage rules, Russia sanctions and data protection must be completed; the qualification pack does not pre-authorise tender-specific declarations.

  • Company matchPartially met
    Operational service capability
    DeliveryNot required

    The portfolio demonstrates secure cloud and operated software delivery, but the evidence pack does not prove the exact 99.5% availability, German hotline, C5 controls or required incident-response commitments for this DMS platform.

Official clarifications · selected by AI relevance

Relevant bidder questions

  1. Q1Is a C5 attestation unnecessary, with operation merely needing to orient itself to the C5 baseline criteria?
    Buyer answer

    A C5 attestation is not required, but the service must comply with every applicable current C5 baseline criterion; mere orientation is insufficient.

    Portfolio impact

    This removes the attestation-document gate but retains a substantive operational compliance obligation. The current company evidence does not establish full C5-baseline compliance, so the gate remains unknown and partner evidence would be needed.

  2. Q2What initial data volume and annual growth should be used for pricing?
    Buyer answer

    Provide at least 1.5 TB initially. The buyer migrates existing data itself. Annual growth is estimated at 200 to 250 GB.

    Portfolio impact

    The bidder must price storage growth and operation across a potentially eight-year term while excluding migration of the existing data from its scope.

Interpreted scope

Delivery shape

  • Provide and operate a production DMS as SaaS, including licences, server components, a full-version test/training environment, maintenance, service and support.
  • Configure and customise document filing, collaboration, workflows, rights and role concepts for the Wissenschaftsrat's working groups and administration.
  • Support Microsoft Office add-ins and internal/external collaboration for 120 named users and up to 600 temporary external users.
  • Deliver administrator and end-user training, documentation, project-management assistance, installation and transition.
  • Operate from infrastructure in Germany under GDPR Article 28 processing terms, ISO-aligned security controls, C5 baseline criteria and the stated service levels.
  • Provide optional customisation, training and transition services during the term.

Bid package

Required submissions

  • 01 A-I offer letter
  • 02 B-I exclusion-ground declaration
  • 03 B-II minimum-wage declaration
  • 04 B-III consortium declaration where applicable
  • 05 B-IV subcontractor evidence where applicable
  • 06 B-V reliance-on-capacity declaration and 07 B-VI third-party commitment where applicable
  • 08 B-VII Russia-sanctions declaration
  • 09 B-VIII technical and professional capability form with three qualifying references
  • 10 B-IX economic and financial capability form with DMS turnover and insurance declarations
  • 11 B-X data-protection declaration
  • 13 C-II completed requirements catalogue
  • 14 D completed price sheet
  • 20 E-VI informational contract questionnaire
  • Complete German-language electronic tender through DTVP; tender-specific forms must be signed or completed as instructed

Commercial reading

Contract and pricing terms

  • EVB-IT Cloud contract and Cloud AGB apply together with the NRW supplementary conditions, tariff-compliance conditions and Article 28 GDPR processing agreement.
  • The evaluated SaaS quantity covers 120 named users for the 36-month base and extension period, with pauschal licensing for up to 600 temporary external collaborators and a full-version test environment.
  • All price-sheet amounts are net and must include incidental and travel costs; explanatory conditions or mixed pricing can lead to exclusion.
  • Initial services include operational readiness and 65 person-days stated in the price structure; optional customisation, training and transition day rates are evaluated.
  • Monthly SaaS remuneration may first be adjusted after 48 months; relevant day rates may first be adjusted after 36 months and thereafter annually under the EVB-IT contract.
  • Invoices are generally payable within 30 days under the contract package.
  • The processor agreement includes audit, subprocessor, security and deletion/return duties; data processing and hosting constraints must be reflected in the solution and supply chain.

Evidence trail

Sources and bidder information

Authoritative DTVP communication area checked on 2026-08-16T22:20:00+02:00. Two bidder Q&A catalogues were available (published 7 and 14 August 2026), containing two material questions in total. The clarification deadline is 28 August 2026.

DTVP authoritative notice ↗Official procedure data, buyer, deadlines, scope, award method and hard eligibility criteria.DTVP authoritative document room ↗Official tender package and current forms, specifications, contract documents and pricing workbook.DTVP authoritative communication area ↗Official bidder Q&A catalogues 1 and 2.

Package reviewed 16 Aug 2026, 22:20

Research files

Documents used for this evaluation

ZIPComplete DMS tender package ↓Direct official package containing the specification, requirements catalogue, price sheet, EVB-IT Cloud contract, cloud criteria, data-processing agreement and submission forms used for the evaluation.ZIPBidder Q&A catalogue 1 attachments ↓Direct official archive containing the first bidder Q&A PDF on C5 baseline compliance.ZIPBidder Q&A catalogue 2 attachments ↓Direct official archive containing the cumulative second bidder Q&A PDF, including the storage-volume clarification.