UPU security certification system

UPU security certification system

Summary and analysis updated

UPU security certification system

Call for tenders UPU security certification system 25 March 2025  2 Table of contents Page 1 Introduction 4 1.1 Profile of the UPU 4 2 Terms and conditions 4 2.1 Confidentiality 4 2.2 Legal status of the Vendor 5 2.3 Scope of the call for tenders 5 2.4 Background 5 2.5 Objectives 5 2.6 Use of subcontractors 6 2.7 Use of the emblem, name and initials of the UPU 6 2.8 Collusive bidding, anti-competitive practices and any other similar conduct 6 2.9 Intellectual property 6 2.10 Privileges and immunities 6 2.11 Tax exemption 7 2.12 Language 7 2.13 Signature 7 2.14 Participation notification 7 2.15 Contact persons 7 2.16 Further inquiries and questions 7 2.17 Delivery of tenders and deadline 8 2.18 Evaluation procedure 8 2.19 Modification, suspension or cancellation of the call for tenders 8 2.20 Tentative schedule 9 3 Tender structure – Response format 9 3.1 Cover letter 9 3.2 Executive summary 9 3.3 Bidder information 9 3.4 Subcontractor information 10 3.5 Technical proposal 10 3.6 Pricing structure 10 3.7 Delivery and payment schedule 10 3.8 UPU General Terms and Conditions 10 4 Service requirements 10 4.1 Description of the services 10 4.2 Bidder requirements 13 4.3 Consultant requirements 14 4.4 Assessment criteria 14 4.5 Duration of services 15  3 Table of contents (cont.) Page 4.6 Location of the services 15 4.7 Reporting 15 4.8 Other requirements 15 4.9 Additional information 15  4 1 Introduction 1.1 Profile of the UPU The Universal Postal Union (UPU) was founded in 1874 in Berne, Switzerland, with the main goals of estab- lishing a single postal territory for the reciprocal exchange of letter-post items and adopting common principles for the international postal service in a non-discriminatory manner. Currently comprising 192-member coun- tries, the UPU became a specialized agency of the United Nations in 1948. The main mission of the UPU is to stimulate the lasting development of efficient and accessible universal postal services of quality, in order to facilitate communication between the inhabitants of the world. It does this by guaranteeing the free circulation of items over a single postal territory composed of interconnected networks, encouraging the adoption of fair common standards and the use of technology, ensuring cooperation and interaction among stakeholders, promoting effective technical cooperation, and ensuring the satisfaction of customers’ changing needs. The UPU is thus expected to play a major role in the continued revitalization of postal services. Furthermore, the UPU facilitates the development of worldwide postal services by providing an information and communication technology framework that allows the designated operators1 of UPU member countries to concentrate on the delivery of postal services to their customers. In this context, the UPU provides a global network with value-added services, as well as computerized applications for the management of international mail and international postal money orders. 2 Terms and conditions Unless otherwise indicated in this call for tenders, the term “Bidder” shall refer to any person, company or legal entity submitting a proposal in response to this call for tenders. The term “Vendor” shall refer to any selected bidder. 2.1 Confidentiality Bidders shall treat in strict confidence all information contained in this call for tenders and its attached docu- ments that is not already publicly known or generally accessible, particularly any documentation marked as confidential and distributed by the UPU to Bidders as additional confidential tender documentation. Bidders shall prevent the disclosure or distribution of all such information to third parties and other entities and persons not expressly authorized herein. In case of doubt, these confidentiality provisions shall nevertheless be observed. All Bidders are obliged to observe these confidentiality provisions before, during and after the tender process. These provisions shall not affect the legal obligations of the UPU and Bidders to disclose information. Bidders shall not use such information for any purposes other than those associated with this call for tenders. The call for tenders and all attached documents may be distributed or made available only to persons directly involved in the tender process on behalf of Bidders. If external agents or subcontractors are involved in the preparation of the tender documents, this must be indicated and their names provided in the participation notification (see section 2.14). Bidders shall assume full responsibility for the compliance of their agents, consultants, employees and sub- contractors, as well as any third parties involved on their behalf in this tender process, with these rules of confidentiality, and shall be liable for any damages resulting from misconduct or unauthorized disclosure. If a Bidder violates the confidentiality provisions contained herein, it shall be liable to pay a penalty to the UPU unless it can prove that no fault is attributable to it. This penalty shall not exceed 50,000 CHF per infringement. Payment of any such penalties shall not release Bidders from their obligation to observe these confidentiality requirements. 1 In accordance with article 2.1.6 of the UPU Constitution, a designated operator is any governmental or non-governmental entity officially designated by the member country to operate postal services and to fulfil the related obligations arising out of the Acts of the Union on its territory.  5 Bidders wishing to submit a proposal in response to this call for tenders must contact the person(s) specified in section 2.15 below and may, if necessary, request additional information from the UPU in relation to this call for tenders. Without prejudice to the confidentiality provisions set out above, Bidders agree that the receipt of any such information may be subject to the prior signature of a non-disclosure agreement between the Bidder and the UPU, under conditions to be determined and communicated by the latter. 2.2 Legal status of the Vendor The Vendor shall be regarded as having, in law, the legal status of independent contractor. The Vendor and its agents, consultants, employees and subcontractors (as authorized by the UPU) shall in no way be regarded as employees of the UPU. Such agents, consultants, employees and subcontractors of the Vendor shall not be entitled to any employment benefits from the UPU. The Vendor alone shall be responsible for due payment of all compensation owed to such agents, consultants, employees and subcontractors, including payment of any employment taxes, benefits, compensation and insurance. The Vendor shall represent and warrant that it will comply with all laws, rules and regulations required by the relevant authorities, including the appropriate withholding, reporting and payment of all necessary taxes. The Vendor shall be liable for all work performed, including any acts or omissions, by its agents, consultants, employees and subcontractors. 2.3 Scope of the call for tenders This call for tenders concerns the design and deployment of an automated security certification system to the UPU, along with training for UPU personnel in the use of the system, and technical support for six months following handover. 2.4 Background The UPU has developed general security standards in cooperation with Union member countries and other external stakeholders, such as the International Civil Aviation Organization (ICAO), International Air Transport Association (IATA), European Union (EU), United States Transportation Security Administration (TSA) and World Customs Organization (WCO), in furtherance of article 08-001 of its Convention Regulations. In October 2015, a methodology for self-assessment, peer review and UPU validation of designated operators’ compliance with UPU security standards S58 (Postal security – General security measures) and S59 (Postal security – Office of exchange and international airmail security) was presented to the UPU’s Postal Security Group. The current security certification process for these two security standards can be found at www.upu.int/UPU/media/upu/files/postalSolutions/programmesAndServices/postalSupplyChain/Security/ certification/En_Certification-process-for-UPU-security-standards-S58-and-S59.pdf. The certification process was aligned, as far as possible, with the existing UPU quality management certifica- tion process. It was also developed in accordance with the existing security standards and compliance certifi- cation processes of relevant external stakeholders, including ICAO, IATA and the WCO. In 2023, an evaluation and analysis of the certification process revealed certain inconsistencies across desig- nated operators and process reviewers, owing to the manual administration of the security certification process / conducted using the Excel workbook contained in Annex 1. As a result, the need for a digital/automated mech- anism to administer the security certification process was identified. 2.5 Objectives As the current manual process gives rise to inconsistencies across designated operators and process review- ers, the UPU seeks to automate the administration of the S58/S59 postal security certification process by means of a more efficient, scalable and secure digital solution. The details of the required services are specified in section 4 (Service requirements).  6 2.6 Use of subcontractors The Vendor shall not assign, sublicense, subcontract, pledge or otherwise transfer or dispose of its tender, or any of the rights and obligations contained therein or in an associated contract with the UPU, without the prior written consent of the UPU. The approval by the UPU of the engagement of any subcontractor shall not relieve the Vendor of any of its obligations or responsibilities concerning the work performed by such subcontractors. 2.7 Use of the emblem, name and initials of the UPU Bidders shall not advertise or otherwise make public the fact that they intend to provide, are providing or have provided services to the UPU, or use the emblem, name or initials of the UPU in connection with their business for purposes of commercial advantage or goodwill, without prior and explicit permission from the UPU. Bidders shall take all reasonable measures to ensure compliance with this provision by their agents, consultants, employees and subcontractors. 2.8 Collusive bidding, anti-competitive practices and any other similar conduct Without prejudice to the provisions in sections 3 and 4 below, Bidders (including their agents, consultants, employees and subcontractors) shall not engage in any collusive bidding, anti-competitive practices or any other similar conduct in relation to: – the preparation and submission of tenders; – the clarification of tenders; – the conduct and content of any negotiations, including final contract negotiations. For the purposes of this call for tenders, collusive bidding, anti-competitive practices and any other similar conduct may include the disclosure to, or exchange or clarification with, any other Bidder of information (in any form), whether or not such information is confidential to the UPU or to any other Bidder, in order to alter the results of the call for tenders in such a way that would lead to an outcome other than that which would have been obtained through a competitive process. In addition to any other remedies available to it, the UPU may, at its sole discretion, immediately reject any tender submitted by a Bidder that, in the UPU’s opinion, has engaged in any collusive bidding, anti-competitive practices or any other similar conduct with any other Bidder in relation to the preparation or submission of tenders, whether with respect to this call for tenders or other procurement processes conducted by the UPU. 2.9 Intellectual property This call for tenders and all its attached documents, including any content, forms, statements, concepts, pro- jects and procedures explicitly or implicitly forming part of the call for tenders, constitute the exclusive intellec- tual property of the UPU. This call for tenders is communicated to the various Bidders with the sole purpose of assisting them in the preparation of their respective tenders. Any hard copies of this call for tenders shall be destroyed or returned to the UPU by unsuccessful Bidders at the request of the UPU. 2.10 Privileges and immunities Nothing in or relating to this call for tenders, the activities described herein or any potential agreements related thereto shall be deemed as a waiver, expressed or implied, of any of the privileges, immunities and facilities that the UPU enjoys as a specialized agency of the United Nations system, pursuant to the Swiss Host State Act and the Agreement on Privileges and Immunities of the United Nations (on Swiss territory), the Convention on the Privileges and Immunities of the Specialized Agencies (outside Switzerland), and any other conventions and laws recognizing and/or granting such privileges, immunities and facilities to the UPU and its officials (such as the International Organizations Immunities Act in the case of the United States of America). Accordingly, the Vendor shall expressly acknowledge and agree that the property and assets of the UPU, including any archives, data, documents and funds belonging to the UPU or held by it (including, without limi- tation, the data/hosting environments and servers pertaining to or associated with the provision of the services, as well as any data or documents in any form belonging to or held by the UPU on behalf of UPU member countries and their designated operators), are inviolable and shall be immune from search, requisition, confis- cation, expropriation and any other form of interference, whether through executive, administrative, judicial or  7 legislative action. The Vendor shall immediately contact the UPU in the event of any attempt to violate or any violation of the UPU’s privileges and immunities, and shall take all reasonable measures to prevent such vio- lations. In the light of the UPU’s status as a specialized agency of the United Nations (and without prejudice to the observance, by the UPU, of any sanctions established by the United Nations Security Council), Bidders shall expressly certify their legal and operational willingness and ability to provide the services on a non- discriminatory basis for the benefit of all eligible entities established and/or situated in the territory of any UPU member country, irrespective of the existence of diplomatic relations between a Bidder’s country of incorpora- tion and/or operation and any UPU member country (including its designated operators). 2.11 Tax exemption Pursuant to article III, section 9, of the Convention on the Privileges and Immunities of the Specialized Agencies, the UPU is exempt from all direct taxes and from customs restrictions, duties and charges of a similar nature in respect of articles imported or exported for its official use. Furthermore, as an intergovernmental organization and a specialized agency of the United Nations, the UPU is exempt from value-added tax (VAT) in Switzerland (OLTVA, article 22; Instructions 2001 sur la TVA, arti- cles 574, 816 and others), as well as in other countries. Therefore, all prices shall be indicated in “net” form, without VAT or similar taxes. 2.12 Language Bidders must submit all tender documents entirely in English. 2.13 Signature Tender documents shall be signed by a representative (or representatives) duly designated and authorized to act on the Bidder’s behalf and with the authority to legally bind the Bidder and accept the terms and conditions of this call for tenders. 2.14 Participation notification Upon receipt of this call for tenders, Bidders shall send confirmation of participation to the contact person(s) listed in section 2.15 by the deadline indicated in section 2.20. 2.15 Contact persons Secretary of the Tenders and Procurements Committee Universal Postal Union International Bureau Weltpoststrasse 4 3015 BERNE SWITZERLAND E-mail: caa@upu.int 2.16 Further inquiries and questions Bidders must send any questions regarding the content of this call for tenders or any requests for clarification in writing to the contact person(s) listed in section 2.15 by 18 April 2025. Answers to questions submitted by Bidders, as well as any additional information and updates relevant to this call for tenders, shall be published on the UPU website at www.upu.int/en/Universal-Postal-Union/ Procurement.  8 2.17 Delivery of tenders and deadline All tenders must be submitted to the UPU by e-mail only at RFP-2025-009@upu.int with “RFP-2025-009 – UPU security certification system” as the subject line. The deadline for the submission of tenders is 5 May 2025 at 17.00 CEST. The UPU shall not take into consideration any tenders received after this date and time. Furthermore, it shall not accept any tenders sent to any e-mail address other than that specified above or sent by any other means. There shall be no charge to the UPU for the preparation and submission of tender documents by Bidders. 2.18 Evaluation procedure The objective of the UPU’s evaluation process is to ensure the selection of a qualified, reliable and experienced Vendor capable of providing the specialized services and fulfilling the objectives set out in this call for tenders. The UPU shall conduct its evaluation procedure with a view to determining as objectively as possible the tender that best meets its specific requirements. All tenders submitted shall be subject to an in-depth assessment, at the UPU’s sole discretion, in order to enable the UPU to engage the most appropriate service provider. Due consideration will be given to Bidders’ specific backgrounds, qualifications and experience in relation to the required services. The prescribed structure of tenders, as set out in section 3, is mandatory for all Bidders. The UPU shall not take into consideration any tenders that do not fulfil the mandatory criteria. Tenders received by the UPU must address all aspects of this call for tenders, and Bidders should identify any aspects where they envisage modifications being necessary or consider elements to be missing. Tenders shall be evaluated on the basis of the following criteria, in descending order of importance: – Quality of the tender (according to the specifications herein); – Knowledge and experience of the Bidder and its team and/or consultant(s), as applicable to the subject matter; – Price. The winning tender will be selected based on a non-exhaustive list of criteria as set out in section 4. Bidders should therefore consider how their tender corresponds with the criteria listed and clearly indicate this in their response document. The deliberations of the UPU Tenders and Procurements Committee (TPC) are strictly confidential. The TPC shall submit a report on its evaluation of the tenders received to the Director General of the UPU International Bureau, together with its final recommendation, for his assessment and authorization. The UPU is not bound to accept the lowest tender and reserves the right to accept all or part of a tender. In awarding the contract, account will be taken of both the overall costs of the work and of the nature and quality of the services to be provided. The UPU reserves the right to negotiate prices and terms and conditions of contract after receipt of tenders. Bidders will be informed of the outcome of their tender as soon as possible after the UPU has made its final selection. 2.19 Modification, suspension or cancellation of the call for tenders The UPU reserves the right, at its sole discretion and at any time before the conclusion of the tender process (i.e., at any time prior to the signature of the relevant contract with the Vendor), to modify, suspend or cancel all or part of this call for tenders.  9 2.20 Tentative schedule Publication of call for tenders 25 March 2025 Deadline for submission of participation notification 18 April 2025 Deadline for submission of queries 18 April 2025 Deadline for provision of responses to queries 25 April 2025 Deadline for submission of tenders to the UPU 5 May 2025 at 17.00 CEST Estimated start of engagement 26 May 2025 3 Tender structure – Response format All information provided by Bidders must be fully compliant with the terms and conditions set out in section 2 above, as well as the provisions of this section and the service requirements listed in section 4 below. Moreover, the requirements stipulated in this call for tenders must be met in their entirety, according to the structure defined below and following the sequence and numbering provided in this section. The UPU shall evaluate all Bidder responses in accordance with the structure defined herein and shall have the right to reject any tenders that do not fulfil the requirements of this call for tenders. For each of the requirements listed in this call for tenders, Bidders shall answer with one of the following statements: – Covered; – Covered with limitations (explaining relevant limitations); – Not covered. Where the answer is “covered” or “covered with limitations”, Bidders shall provide further details and/or exam- ples of existing implementations of their solution in the field (existing use cases). 3.1 Cover letter Bidders shall submit a cover letter including: – A statement that the Bidder has read, understands and accepts all provisions of this call for tenders; – The Bidder’s name, telephone number, postal address and e-mail address, and the name(s) of its rep- resentative(s); – A statement that the Bidder’s tender documents are valid for a minimum period of 120 days. The cover letter shall be signed by a representative (or representatives) duly designated and authorized to act on the Bidder’s behalf and with the authority to legally bind the Bidder and accept the terms and conditions of this call for tenders, and shall also include a confirmation of such authorization by the Bidder. 3.2 Executive summary Bidders shall provide an executive summary highlighting the most important aspects of their tender. 3.3 Bidder information Bidders must provide the following information: – Company structure, locations/subsidiaries; – Financial data (turnover, profit, etc.); – Partners and equity holders of the company; – Company history; – Market position and share in relevant markets.  10 3.4 Subcontractor information Bidders shall provide a list of any subcontractors to be directly involved in this call for tenders and must specify the exact degree of these subcontractors’ involvement in the provision of the services. 3.5 Technical proposal Bidders shall submit a technical proposal addressing all of the requirements set out in section 4 (Service requirements). This proposal should outline the methodology, processes and timelines, as appropriate, that Bidders intend to implement in order to fulfil the objectives of this call for tenders. The assessment criteria applicable to the technical proposal are outlined in section 4.4. 3.6 Pricing structure Bidders shall provide a financial proposal setting out their pricing structure, as follows: – Daily and annual rate per consultant; – Full-service quotation (all inclusive); – Detailed description of pricing structure and services offered. In the event of the sudden departure of an individual consultant, the Vendor shall provide 10 extra consulting days by the replacement consultant at no additional charge. Bidders shall not include VAT in their pricing structure (see section 2.11 above). All pricing information shall be set out exclusively in Swiss francs (CHF). 3.7 Delivery and payment schedule The target dates for provision of the services are as follows: Start date: 26 May 2025 End date: 25 May 2026 The delivery and payment schedules should be proposed by Bidders in their pricing structures, and must be agreed with the UPU. The services provided by the Vendor shall be invoiced in arrears on a monthly basis. The UPU will make payment within 30 business days of receipt of invoice, subject to its acceptance of the services provided and the Vendor’s transmission to the UPU of any and all documentation clearly detailing the services to which the invoice pertains (in a format to be established by the UPU). 3.8 UPU General Terms and Conditions Bidders shall include in their tender a statement of acceptance of the UPU General Terms and Conditions for the Provision of Services, attached hereto for reference. The final terms of any contract arising from this call for tenders shall be defined by the UPU and accepted by the Vendor. Contract negotiations shall commence only after the final selection of a Vendor by the UPU. 4 Service requirements 4.1 Description of the services The Vendor will be expected to provide the following services: – Delivery of a fully functional future-proof and scalable automated security certification system; – Documentation, including system architecture, user guides and security protocols; – Training for UPU staff and selected security experts on system administration and maintenance; – Ongoing technical support and system updates.  11 The project entails the design, development and deployment of an automated security certification system aligned with the S58/S59 standards, which should be delivered within three to six months from award of the contract. Following handover of the system to the UPU, ongoing technical support and system updates should be provided for a period of six months. The system should allow for various user profiles, namely security focal points, reviewers, administrators and superusers, with role-based access and functionalities. The potential opening up of the UPU security standards to wider postal sector players (WPSPs) should also be taken into consideration. The envisaged tool must automate the security certification process and should meet the business and tech- nical requirements set out below. User access and management – Secure role-based access for users: the four user profiles are defined below. These roles operate in parallel to ensure that postal organizations meet the requirements set out in the S58/S59 security stand- ards, thereby enhancing the security of the global postal network, as follows: • Security focal points: The security focal point is the designated person in a postal organization responsible for overseeing and managing the organization’s compliance with the S58/S59 secu- rity standards. This person acts as the primary contact for security matters and certification- related processes, and ensures the submission of the country commitment form. Key responsi- bilities: coordinate security measures within the organization to ensure adherence to S58/S59 standards; act as the main liaison between the postal organization and external bodies (such as the UPU or certifying authorities); implement and monitor security practices across postal facilities; • Reviewers: A reviewer is an individual tasked with evaluating an organization’s S58/S59 security compliance during the certification or audit process. Reviewers assess the effectiveness of secu- rity measures and validate adherence to the established standards. Key responsibilities: conduct security assessments and audits of the postal organization; review documentation and physical security procedures; provide feedback and recommendations for improvement to ensure full compliance; • Administrators: An administrator is responsible for managing the technical and administrative aspects of the S58/S59 security certification process. Administrators maintain certification rec- ords, facilitate communications and provide operational support for certification activities. Key responsibilities: manage security certification applications and schedules; oversee the security management system (e.g. compliance tracking, record keeping); support security focal points and reviewers by ensuring that proper documentation and processes are in place; • Superusers: This is a high-level administrative role with extensive access and control over the platform’s functionalities. Superusers are responsible for managing the system, overseeing secu- rity certification processes and ensuring compliance with established protocols. Their key respon- sibilities are as follows: – User management • Create, modify and deactivate user accounts • Assign and manage roles and permissions for other users • Monitor user activity logs to ensure compliance – System administration • Configure and maintain platform settings • Troubleshoot and resolve technical issues • Implement updates and security patches  12 – Certification process oversight • Monitor the progress of security certification applications • Approve or escalate certification requests as needed • Ensure adherence to certification requirements and standards – Data security and compliance • Enforce data protection policies and user access controls • Conduct audits and generate security reports • Address potential security threats or breaches – Reporting and analytics • Generate and review reports on certification status, compliance and system performance • Provide insights and recommendations for process improvement – Integration and support • Coordinate with IT teams for platform integrations and maintenance • Provide support and training to users on the platform’s functionalities – Multi-level access control management: different access rights should be implemented for each user profile, taking into account the following: • Superuser rights must be limited to authorized personnel within the UPU and actively monitored, following zero-trust security principles; • Multi-factor authentication must be implemented for superusers and administrators; • Audit logs must record all actions performed by superusers and administrators, including login attempts, data access, configuration changes and user privilege modifications; • Rights assignment should follow the principle of least privilege to prevent unauthorized access; • The system should be accessible only to the authorized personnel or security focal points of des- ignated operators, and WPSPs if applicable, with individual credentials granted by the UPU through account activation; • Individual datasheets should be created providing various details specific to the designated oper- ator(s) of each UPU member country, and for the restricted unions and their security action groups. Monitoring, auditing and maintenance – Implement a continuous monitoring system for administrative and superuser activities using real-time security information and event management tools – Create periodic access reviews and audits to verify appropriate rights allocation and identify unauthor- ized access attempts – Integrate security alerts for sensitive actions, such as rights elevation, unauthorized access attempts and failed login attempts – Maintain an automated maintenance schedule for rights updates, deactivation of inactive accounts and periodic system checks to ensure compliance with S58/S59 standards Hosting and infrastructure security – The certification platform may be hosted on the UPU’s servers or in the cloud, with infrastructure managed by the UPU International Bureau and maintained by the UPU’s Postal Technology Centre – The servers must comply with international cybersecurity standards, such as ISO 27001 (Information security, cybersecurity and privacy protection – Information security management systems) – Implement network segmentation to protect sensitive data and services from unauthorized access or breaches  13 Digitalization of certification tools – Digitalize the current tools used for the certification process, including the self-assessment and certifi- cation assessment workbooks used by designated operators and reviewers / – Enable uploading and secure storage of supporting required documents (as per Annex 2) and additional photographic evidence / – Automate the certification scoring system on the basis of the information provided in Annex 3: reviewers will assess designated operators using the digitalized certification workbook, with standardized certifi- cation points generated on the basis of each section and sub-section thereof. The scores achieved for each section will collectively determine the final certification level achieved by the designated operator. Automated workflow and notifications / – Automate the certification process workflow, including self-assessment submissions (as per Annex 4), reviews and certificate issuance – Prepare and provide automated notifications for key stakeholders (i.e. member countries, their desig- nated operators and the UPU), including reminders for recertification and task updates – the UPU will provide template letters for incorporation in the automated system Monitoring and reporting – Provide a dashboard for real-time tracking of certification status (ongoing, due for renewal, expired) – Log user activities and budget expenditure, and provide audit trails Multilingual support In addition to English, ensure localization of the system in Arabic, French, Spanish, Portuguese and Russian. Security and scalability – Implement robust security measures to protect sensitive data – Support scalability to accommodate all UPU member countries and their designated operators, and WPSPs if applicable – Integration of additional certification frameworks: the application should support the incorporation of new security and safety certification modules as they become available, ensuring adaptability to evolving regulatory and operational requirements – Plug-in compatibility: the solution must facilitate seamless integration of optional plug-ins or expansion packs that enhance functionality, such as risk assessment tools, compliance reporting modules and AI- driven threat detection capabilities – Interoperability: the system must be capable of integrating with other security and safety applications through standardized APIs, ensuring compatibility with emerging technologies and third-party solutions – User-configurable features: the architecture should allow for configuration and customization by superusers and administrators to accommodate future certification schemes without requiring significant redevelopment – Scalable infrastructure: the application should be designed to support increasing certification volumes and expanding datasets without compromising performance Other IT requirements The solution shall rely on the UPU’s Active Directory database for authentication of users. 4.2 Bidder requirements Bidders shall demonstrate a record of satisfactory performance in similar activities (i.e., reference letters and/or work completion certificates). The business transactions and activities carried out by the Bidder must be com- pliant with the mandates and principles of the UPU.  14 Bidders must present in their tender their proposed methodology, work plan and approach to organizing the work. The business transactions and activities carried out by the Bidder must be compliant with the mandates and principles of the UPU. Bidders (and their consultants) should meet the criteria set out below: – Experience: • Experience in developing automated systems – Skills and capabilities: • Strong technical and development skills • Strong interpersonal and communication skills • Strong analytical, reporting and writing abilities • Ability to plan, organize, implement and report on work • Ability to work under pressure and to tight deadlines • Proficiency in the use of office IT applications and the Internet to conduct research • Outstanding communication, project management and organizational skills • Excellent presentation and facilitation skills • High level of integrity and ethical standards • Positive and constructive attitude to work • Sensitivity and adaptability with regard to culture, gender, religion, race, nationality and age • Fluency in English 4.3 Consultant requirements Bidders not operating as an independent consultant should propose at least three individual consultants in accordance with the requirements specified in this call for tenders for the performance of the services and activities described herein. Bidders are required to provide the CVs and diplomas of the said consultants, as well as a letter of motivation and a brief write-up (maximum 1,000 words) of the consultants’ approach and methodology with regard to the project, for further verification and evaluation by the UPU. The UPU shall have the right to reject a proposed consultant if the individual does not fulfil the UPU’s requirements as defined in this call for tenders. Bidders not operating as an independent consultant should describe any relevant procedures concerning the replacement of individual consultants if so, requested by the UPU. 4.4 Assessment criteria Bidders will be assessed on the basis of a scoring system of up to 70 points for their technical proposal and 30 points for their pricing structure. The technical proposal shall be assessed on the basis of the following criteria: Criteria Points obtainable Technical solution and alignment with requirements 25 Experience with similar projects in the postal or certification domain 15 Project timeline and implementation plan 20 Support and maintenance services 10 Cost effectiveness and total cost of ownership 30 Bidders shall provide evidence of their ability to meet these requirements by means of a list of references.  15 4.5 Duration of services The services are scheduled to commence in mid-May 2025 for a total contract term not exceeding one year. 4.6 Location of the services The Vendor or its assigned consultant shall in principle work from its own premises or his/her home office. The Vendor or its assigned consultant shall liaise and work closely with the UPU (as instructed by the latter) and may be required from time to time to carry out certain tasks from the headquarters of the UPU in Berne, Switzerland. 4.7 Reporting The Vendor shall provide the UPU with weekly reports setting out the relevant services performed by the Vendor during that time frame. Such reports shall be prepared in accordance with a structure and format defined by the UPU (i.e., time sheets). The UPU may contest the Vendor’s time sheets within 10 business days of receipt thereof. If the time sheets are not contested by the UPU within the said time frame, the services detailed therein may be deemed as duly provided by the Vendor and accepted by the UPU. 4.8 Other requirements Bidders shall describe any relevant procedures for ensuring the continuity of the services provided and for appropriate backup and retraining, as well as any relevant procedures pertaining to project management and communication. Bidders shall also confirm that their tender covers all costs associated with the provision of the services referred to herein. Any other costs to be incurred by the Vendor, including any travel and subsistence costs incurred in the provision of the services at locations other than its own premises and specifically designated by the UPU, shall be subject to the prior written consent of the UPU. No other fees shall be paid, with the exception of reimbursement of other unavoidable costs incurred for successful delivery of the services, which shall also be subject to the prior written consent of the UPU. 4.9 Additional information Bidders may include any additional information that they deem necessary or relevant in order for the UPU to gain a clear and detailed understanding of the services being offered. 

Published

UPU security certification system

Call for tenders UPU security certification system 25 March 2025  2 Table of contents Page 1 Introduction 4 1.1 Profile of the UPU 4 2 Terms and conditions 4 2.1 Confidentiality 4 2.2 Legal status of the Vendor 5 2.3 Scope of the call for tenders 5 2.4 Background 5 2.5 Objectives 5 2.6 Use of subcontractors 6 2.7 Use of the emblem, name and initials of the UPU 6 2.8 Collusive bidding, anti-competitive practices and any other similar conduct 6 2.9 Intellectual property 6 2.10 Privileges and immunities 6 2.11 Tax exemption 7 2.12 Language 7 2.13 Signature 7 2.14 Participation notification 7 2.15 Contact persons 7 2.16 Further inquiries and questions 7 2.17 Delivery of tenders and deadline 8 2.18 Evaluation procedure 8 2.19 Modification, suspension or cancellation of the call for tenders 8 2.20 Tentative schedule 9 3 Tender structure – Response format 9 3.1 Cover letter 9 3.2 Executive summary 9 3.3 Bidder information 9 3.4 Subcontractor information 10 3.5 Technical proposal 10 3.6 Pricing structure 10 3.7 Delivery and payment schedule 10 3.8 UPU General Terms and Conditions 10 4 Service requirements 10 4.1 Description of the services 10 4.2 Bidder requirements 13 4.3 Consultant requirements 14 4.4 Assessment criteria 14 4.5 Duration of services 15  3 Table of contents (cont.) Page 4.6 Location of the services 15 4.7 Reporting 15 4.8 Other requirements 15 4.9 Additional information 15  4 1 Introduction 1.1 Profile of the UPU The Universal Postal Union (UPU) was founded in 1874 in Berne, Switzerland, with the main goals of estab- lishing a single postal territory for the reciprocal exchange of letter-post items and adopting common principles for the international postal service in a non-discriminatory manner. Currently comprising 192-member coun- tries, the UPU became a specialized agency of the United Nations in 1948. The main mission of the UPU is to stimulate the lasting development of efficient and accessible universal postal services of quality, in order to facilitate communication between the inhabitants of the world. It does this by guaranteeing the free circulation of items over a single postal territory composed of interconnected networks, encouraging the adoption of fair common standards and the use of technology, ensuring cooperation and interaction among stakeholders, promoting effective technical cooperation, and ensuring the satisfaction of customers’ changing needs. The UPU is thus expected to play a major role in the continued revitalization of postal services. Furthermore, the UPU facilitates the development of worldwide postal services by providing an information and communication technology framework that allows the designated operators1 of UPU member countries to concentrate on the delivery of postal services to their customers. In this context, the UPU provides a global network with value-added services, as well as computerized applications for the management of international mail and international postal money orders. 2 Terms and conditions Unless otherwise indicated in this call for tenders, the term “Bidder” shall refer to any person, company or legal entity submitting a proposal in response to this call for tenders. The term “Vendor” shall refer to any selected bidder. 2.1 Confidentiality Bidders shall treat in strict confidence all information contained in this call for tenders and its attached docu- ments that is not already publicly known or generally accessible, particularly any documentation marked as confidential and distributed by the UPU to Bidders as additional confidential tender documentation. Bidders shall prevent the disclosure or distribution of all such information to third parties and other entities and persons not expressly authorized herein. In case of doubt, these confidentiality provisions shall nevertheless be observed. All Bidders are obliged to observe these confidentiality provisions before, during and after the tender process. These provisions shall not affect the legal obligations of the UPU and Bidders to disclose information. Bidders shall not use such information for any purposes other than those associated with this call for tenders. The call for tenders and all attached documents may be distributed or made available only to persons directly involved in the tender process on behalf of Bidders. If external agents or subcontractors are involved in the preparation of the tender documents, this must be indicated and their names provided in the participation notification (see section 2.14). Bidders shall assume full responsibility for the compliance of their agents, consultants, employees and sub- contractors, as well as any third parties involved on their behalf in this tender process, with these rules of confidentiality, and shall be liable for any damages resulting from misconduct or unauthorized disclosure. If a Bidder violates the confidentiality provisions contained herein, it shall be liable to pay a penalty to the UPU unless it can prove that no fault is attributable to it. This penalty shall not exceed 50,000 CHF per infringement. Payment of any such penalties shall not release Bidders from their obligation to observe these confidentiality requirements. 1 In accordance with article 2.1.6 of the UPU Constitution, a designated operator is any governmental or non-governmental entity officially designated by the member country to operate postal services and to fulfil the related obligations arising out of the Acts of the Union on its territory.  5 Bidders wishing to submit a proposal in response to this call for tenders must contact the person(s) specified in section 2.15 below and may, if necessary, request additional information from the UPU in relation to this call for tenders. Without prejudice to the confidentiality provisions set out above, Bidders agree that the receipt of any such information may be subject to the prior signature of a non-disclosure agreement between the Bidder and the UPU, under conditions to be determined and communicated by the latter. 2.2 Legal status of the Vendor The Vendor shall be regarded as having, in law, the legal status of independent contractor. The Vendor and its agents, consultants, employees and subcontractors (as authorized by the UPU) shall in no way be regarded as employees of the UPU. Such agents, consultants, employees and subcontractors of the Vendor shall not be entitled to any employment benefits from the UPU. The Vendor alone shall be responsible for due payment of all compensation owed to such agents, consultants, employees and subcontractors, including payment of any employment taxes, benefits, compensation and insurance. The Vendor shall represent and warrant that it will comply with all laws, rules and regulations required by the relevant authorities, including the appropriate withholding, reporting and payment of all necessary taxes. The Vendor shall be liable for all work performed, including any acts or omissions, by its agents, consultants, employees and subcontractors. 2.3 Scope of the call for tenders This call for tenders concerns the design and deployment of an automated security certification system to the UPU, along with training for UPU personnel in the use of the system, and technical support for six months following handover. 2.4 Background The UPU has developed general security standards in cooperation with Union member countries and other external stakeholders, such as the International Civil Aviation Organization (ICAO), International Air Transport Association (IATA), European Union (EU), United States Transportation Security Administration (TSA) and World Customs Organization (WCO), in furtherance of article 08-001 of its Convention Regulations. In October 2015, a methodology for self-assessment, peer review and UPU validation of designated operators’ compliance with UPU security standards S58 (Postal security – General security measures) and S59 (Postal security – Office of exchange and international airmail security) was presented to the UPU’s Postal Security Group. The current security certification process for these two security standards can be found at www.upu.int/UPU/media/upu/files/postalSolutions/programmesAndServices/postalSupplyChain/Security/ certification/En_Certification-process-for-UPU-security-standards-S58-and-S59.pdf. The certification process was aligned, as far as possible, with the existing UPU quality management certifica- tion process. It was also developed in accordance with the existing security standards and compliance certifi- cation processes of relevant external stakeholders, including ICAO, IATA and the WCO. In 2023, an evaluation and analysis of the certification process revealed certain inconsistencies across desig- nated operators and process reviewers, owing to the manual administration of the security certification process / conducted using the Excel workbook contained in Annex 1. As a result, the need for a digital/automated mech- anism to administer the security certification process was identified. 2.5 Objectives As the current manual process gives rise to inconsistencies across designated operators and process review- ers, the UPU seeks to automate the administration of the S58/S59 postal security certification process by means of a more efficient, scalable and secure digital solution. The details of the required services are specified in section 4 (Service requirements).  6 2.6 Use of subcontractors The Vendor shall not assign, sublicense, subcontract, pledge or otherwise transfer or dispose of its tender, or any of the rights and obligations contained therein or in an associated contract with the UPU, without the prior written consent of the UPU. The approval by the UPU of the engagement of any subcontractor shall not relieve the Vendor of any of its obligations or responsibilities concerning the work performed by such subcontractors. 2.7 Use of the emblem, name and initials of the UPU Bidders shall not advertise or otherwise make public the fact that they intend to provide, are providing or have provided services to the UPU, or use the emblem, name or initials of the UPU in connection with their business for purposes of commercial advantage or goodwill, without prior and explicit permission from the UPU. Bidders shall take all reasonable measures to ensure compliance with this provision by their agents, consultants, employees and subcontractors. 2.8 Collusive bidding, anti-competitive practices and any other similar conduct Without prejudice to the provisions in sections 3 and 4 below, Bidders (including their agents, consultants, employees and subcontractors) shall not engage in any collusive bidding, anti-competitive practices or any other similar conduct in relation to: – the preparation and submission of tenders; – the clarification of tenders; – the conduct and content of any negotiations, including final contract negotiations. For the purposes of this call for tenders, collusive bidding, anti-competitive practices and any other similar conduct may include the disclosure to, or exchange or clarification with, any other Bidder of information (in any form), whether or not such information is confidential to the UPU or to any other Bidder, in order to alter the results of the call for tenders in such a way that would lead to an outcome other than that which would have been obtained through a competitive process. In addition to any other remedies available to it, the UPU may, at its sole discretion, immediately reject any tender submitted by a Bidder that, in the UPU’s opinion, has engaged in any collusive bidding, anti-competitive practices or any other similar conduct with any other Bidder in relation to the preparation or submission of tenders, whether with respect to this call for tenders or other procurement processes conducted by the UPU. 2.9 Intellectual property This call for tenders and all its attached documents, including any content, forms, statements, concepts, pro- jects and procedures explicitly or implicitly forming part of the call for tenders, constitute the exclusive intellec- tual property of the UPU. This call for tenders is communicated to the various Bidders with the sole purpose of assisting them in the preparation of their respective tenders. Any hard copies of this call for tenders shall be destroyed or returned to the UPU by unsuccessful Bidders at the request of the UPU. 2.10 Privileges and immunities Nothing in or relating to this call for tenders, the activities described herein or any potential agreements related thereto shall be deemed as a waiver, expressed or implied, of any of the privileges, immunities and facilities that the UPU enjoys as a specialized agency of the United Nations system, pursuant to the Swiss Host State Act and the Agreement on Privileges and Immunities of the United Nations (on Swiss territory), the Convention on the Privileges and Immunities of the Specialized Agencies (outside Switzerland), and any other conventions and laws recognizing and/or granting such privileges, immunities and facilities to the UPU and its officials (such as the International Organizations Immunities Act in the case of the United States of America). Accordingly, the Vendor shall expressly acknowledge and agree that the property and assets of the UPU, including any archives, data, documents and funds belonging to the UPU or held by it (including, without limi- tation, the data/hosting environments and servers pertaining to or associated with the provision of the services, as well as any data or documents in any form belonging to or held by the UPU on behalf of UPU member countries and their designated operators), are inviolable and shall be immune from search, requisition, confis- cation, expropriation and any other form of interference, whether through executive, administrative, judicial or  7 legislative action. The Vendor shall immediately contact the UPU in the event of any attempt to violate or any violation of the UPU’s privileges and immunities, and shall take all reasonable measures to prevent such vio- lations. In the light of the UPU’s status as a specialized agency of the United Nations (and without prejudice to the observance, by the UPU, of any sanctions established by the United Nations Security Council), Bidders shall expressly certify their legal and operational willingness and ability to provide the services on a non- discriminatory basis for the benefit of all eligible entities established and/or situated in the territory of any UPU member country, irrespective of the existence of diplomatic relations between a Bidder’s country of incorpora- tion and/or operation and any UPU member country (including its designated operators). 2.11 Tax exemption Pursuant to article III, section 9, of the Convention on the Privileges and Immunities of the Specialized Agencies, the UPU is exempt from all direct taxes and from customs restrictions, duties and charges of a similar nature in respect of articles imported or exported for its official use. Furthermore, as an intergovernmental organization and a specialized agency of the United Nations, the UPU is exempt from value-added tax (VAT) in Switzerland (OLTVA, article 22; Instructions 2001 sur la TVA, arti- cles 574, 816 and others), as well as in other countries. Therefore, all prices shall be indicated in “net” form, without VAT or similar taxes. 2.12 Language Bidders must submit all tender documents entirely in English. 2.13 Signature Tender documents shall be signed by a representative (or representatives) duly designated and authorized to act on the Bidder’s behalf and with the authority to legally bind the Bidder and accept the terms and conditions of this call for tenders. 2.14 Participation notification Upon receipt of this call for tenders, Bidders shall send confirmation of participation to the contact person(s) listed in section 2.15 by the deadline indicated in section 2.20. 2.15 Contact persons Secretary of the Tenders and Procurements Committee Universal Postal Union International Bureau Weltpoststrasse 4 3015 BERNE SWITZERLAND E-mail: caa@upu.int 2.16 Further inquiries and questions Bidders must send any questions regarding the content of this call for tenders or any requests for clarification in writing to the contact person(s) listed in section 2.15 by 18 April 2025. Answers to questions submitted by Bidders, as well as any additional information and updates relevant to this call for tenders, shall be published on the UPU website at www.upu.int/en/Universal-Postal-Union/ Procurement.  8 2.17 Delivery of tenders and deadline All tenders must be submitted to the UPU by e-mail only at RFP-2025-009@upu.int with “RFP-2025-009 – UPU security certification system” as the subject line. The deadline for the submission of tenders is 5 May 2025 at 17.00 CEST. The UPU shall not take into consideration any tenders received after this date and time. Furthermore, it shall not accept any tenders sent to any e-mail address other than that specified above or sent by any other means. There shall be no charge to the UPU for the preparation and submission of tender documents by Bidders. 2.18 Evaluation procedure The objective of the UPU’s evaluation process is to ensure the selection of a qualified, reliable and experienced Vendor capable of providing the specialized services and fulfilling the objectives set out in this call for tenders. The UPU shall conduct its evaluation procedure with a view to determining as objectively as possible the tender that best meets its specific requirements. All tenders submitted shall be subject to an in-depth assessment, at the UPU’s sole discretion, in order to enable the UPU to engage the most appropriate service provider. Due consideration will be given to Bidders’ specific backgrounds, qualifications and experience in relation to the required services. The prescribed structure of tenders, as set out in section 3, is mandatory for all Bidders. The UPU shall not take into consideration any tenders that do not fulfil the mandatory criteria. Tenders received by the UPU must address all aspects of this call for tenders, and Bidders should identify any aspects where they envisage modifications being necessary or consider elements to be missing. Tenders shall be evaluated on the basis of the following criteria, in descending order of importance: – Quality of the tender (according to the specifications herein); – Knowledge and experience of the Bidder and its team and/or consultant(s), as applicable to the subject matter; – Price. The winning tender will be selected based on a non-exhaustive list of criteria as set out in section 4. Bidders should therefore consider how their tender corresponds with the criteria listed and clearly indicate this in their response document. The deliberations of the UPU Tenders and Procurements Committee (TPC) are strictly confidential. The TPC shall submit a report on its evaluation of the tenders received to the Director General of the UPU International Bureau, together with its final recommendation, for his assessment and authorization. The UPU is not bound to accept the lowest tender and reserves the right to accept all or part of a tender. In awarding the contract, account will be taken of both the overall costs of the work and of the nature and quality of the services to be provided. The UPU reserves the right to negotiate prices and terms and conditions of contract after receipt of tenders. Bidders will be informed of the outcome of their tender as soon as possible after the UPU has made its final selection. 2.19 Modification, suspension or cancellation of the call for tenders The UPU reserves the right, at its sole discretion and at any time before the conclusion of the tender process (i.e., at any time prior to the signature of the relevant contract with the Vendor), to modify, suspend or cancel all or part of this call for tenders.  9 2.20 Tentative schedule Publication of call for tenders 25 March 2025 Deadline for submission of participation notification 18 April 2025 Deadline for submission of queries 18 April 2025 Deadline for provision of responses to queries 25 April 2025 Deadline for submission of tenders to the UPU 5 May 2025 at 17.00 CEST Estimated start of engagement 26 May 2025 3 Tender structure – Response format All information provided by Bidders must be fully compliant with the terms and conditions set out in section 2 above, as well as the provisions of this section and the service requirements listed in section 4 below. Moreover, the requirements stipulated in this call for tenders must be met in their entirety, according to the structure defined below and following the sequence and numbering provided in this section. The UPU shall evaluate all Bidder responses in accordance with the structure defined herein and shall have the right to reject any tenders that do not fulfil the requirements of this call for tenders. For each of the requirements listed in this call for tenders, Bidders shall answer with one of the following statements: – Covered; – Covered with limitations (explaining relevant limitations); – Not covered. Where the answer is “covered” or “covered with limitations”, Bidders shall provide further details and/or exam- ples of existing implementations of their solution in the field (existing use cases). 3.1 Cover letter Bidders shall submit a cover letter including: – A statement that the Bidder has read, understands and accepts all provisions of this call for tenders; – The Bidder’s name, telephone number, postal address and e-mail address, and the name(s) of its rep- resentative(s); – A statement that the Bidder’s tender documents are valid for a minimum period of 120 days. The cover letter shall be signed by a representative (or representatives) duly designated and authorized to act on the Bidder’s behalf and with the authority to legally bind the Bidder and accept the terms and conditions of this call for tenders, and shall also include a confirmation of such authorization by the Bidder. 3.2 Executive summary Bidders shall provide an executive summary highlighting the most important aspects of their tender. 3.3 Bidder information Bidders must provide the following information: – Company structure, locations/subsidiaries; – Financial data (turnover, profit, etc.); – Partners and equity holders of the company; – Company history; – Market position and share in relevant markets.  10 3.4 Subcontractor information Bidders shall provide a list of any subcontractors to be directly involved in this call for tenders and must specify the exact degree of these subcontractors’ involvement in the provision of the services. 3.5 Technical proposal Bidders shall submit a technical proposal addressing all of the requirements set out in section 4 (Service requirements). This proposal should outline the methodology, processes and timelines, as appropriate, that Bidders intend to implement in order to fulfil the objectives of this call for tenders. The assessment criteria applicable to the technical proposal are outlined in section 4.4. 3.6 Pricing structure Bidders shall provide a financial proposal setting out their pricing structure, as follows: – Daily and annual rate per consultant; – Full-service quotation (all inclusive); – Detailed description of pricing structure and services offered. In the event of the sudden departure of an individual consultant, the Vendor shall provide 10 extra consulting days by the replacement consultant at no additional charge. Bidders shall not include VAT in their pricing structure (see section 2.11 above). All pricing information shall be set out exclusively in Swiss francs (CHF). 3.7 Delivery and payment schedule The target dates for provision of the services are as follows: Start date: 26 May 2025 End date: 25 May 2026 The delivery and payment schedules should be proposed by Bidders in their pricing structures, and must be agreed with the UPU. The services provided by the Vendor shall be invoiced in arrears on a monthly basis. The UPU will make payment within 30 business days of receipt of invoice, subject to its acceptance of the services provided and the Vendor’s transmission to the UPU of any and all documentation clearly detailing the services to which the invoice pertains (in a format to be established by the UPU). 3.8 UPU General Terms and Conditions Bidders shall include in their tender a statement of acceptance of the UPU General Terms and Conditions for the Provision of Services, attached hereto for reference. The final terms of any contract arising from this call for tenders shall be defined by the UPU and accepted by the Vendor. Contract negotiations shall commence only after the final selection of a Vendor by the UPU. 4 Service requirements 4.1 Description of the services The Vendor will be expected to provide the following services: – Delivery of a fully functional future-proof and scalable automated security certification system; – Documentation, including system architecture, user guides and security protocols; – Training for UPU staff and selected security experts on system administration and maintenance; – Ongoing technical support and system updates.  11 The project entails the design, development and deployment of an automated security certification system aligned with the S58/S59 standards, which should be delivered within three to six months from award of the contract. Following handover of the system to the UPU, ongoing technical support and system updates should be provided for a period of six months. The system should allow for various user profiles, namely security focal points, reviewers, administrators and superusers, with role-based access and functionalities. The potential opening up of the UPU security standards to wider postal sector players (WPSPs) should also be taken into consideration. The envisaged tool must automate the security certification process and should meet the business and tech- nical requirements set out below. User access and management – Secure role-based access for users: the four user profiles are defined below. These roles operate in parallel to ensure that postal organizations meet the requirements set out in the S58/S59 security stand- ards, thereby enhancing the security of the global postal network, as follows: • Security focal points: The security focal point is the designated person in a postal organization responsible for overseeing and managing the organization’s compliance with the S58/S59 secu- rity standards. This person acts as the primary contact for security matters and certification- related processes, and ensures the submission of the country commitment form. Key responsi- bilities: coordinate security measures within the organization to ensure adherence to S58/S59 standards; act as the main liaison between the postal organization and external bodies (such as the UPU or certifying authorities); implement and monitor security practices across postal facilities; • Reviewers: A reviewer is an individual tasked with evaluating an organization’s S58/S59 security compliance during the certification or audit process. Reviewers assess the effectiveness of secu- rity measures and validate adherence to the established standards. Key responsibilities: conduct security assessments and audits of the postal organization; review documentation and physical security procedures; provide feedback and recommendations for improvement to ensure full compliance; • Administrators: An administrator is responsible for managing the technical and administrative aspects of the S58/S59 security certification process. Administrators maintain certification rec- ords, facilitate communications and provide operational support for certification activities. Key responsibilities: manage security certification applications and schedules; oversee the security management system (e.g. compliance tracking, record keeping); support security focal points and reviewers by ensuring that proper documentation and processes are in place; • Superusers: This is a high-level administrative role with extensive access and control over the platform’s functionalities. Superusers are responsible for managing the system, overseeing secu- rity certification processes and ensuring compliance with established protocols. Their key respon- sibilities are as follows: – User management • Create, modify and deactivate user accounts • Assign and manage roles and permissions for other users • Monitor user activity logs to ensure compliance – System administration • Configure and maintain platform settings • Troubleshoot and resolve technical issues • Implement updates and security patches  12 – Certification process oversight • Monitor the progress of security certification applications • Approve or escalate certification requests as needed • Ensure adherence to certification requirements and standards – Data security and compliance • Enforce data protection policies and user access controls • Conduct audits and generate security reports • Address potential security threats or breaches – Reporting and analytics • Generate and review reports on certification status, compliance and system performance • Provide insights and recommendations for process improvement – Integration and support • Coordinate with IT teams for platform integrations and maintenance • Provide support and training to users on the platform’s functionalities – Multi-level access control management: different access rights should be implemented for each user profile, taking into account the following: • Superuser rights must be limited to authorized personnel within the UPU and actively monitored, following zero-trust security principles; • Multi-factor authentication must be implemented for superusers and administrators; • Audit logs must record all actions performed by superusers and administrators, including login attempts, data access, configuration changes and user privilege modifications; • Rights assignment should follow the principle of least privilege to prevent unauthorized access; • The system should be accessible only to the authorized personnel or security focal points of des- ignated operators, and WPSPs if applicable, with individual credentials granted by the UPU through account activation; • Individual datasheets should be created providing various details specific to the designated oper- ator(s) of each UPU member country, and for the restricted unions and their security action groups. Monitoring, auditing and maintenance – Implement a continuous monitoring system for administrative and superuser activities using real-time security information and event management tools – Create periodic access reviews and audits to verify appropriate rights allocation and identify unauthor- ized access attempts – Integrate security alerts for sensitive actions, such as rights elevation, unauthorized access attempts and failed login attempts – Maintain an automated maintenance schedule for rights updates, deactivation of inactive accounts and periodic system checks to ensure compliance with S58/S59 standards Hosting and infrastructure security – The certification platform may be hosted on the UPU’s servers or in the cloud, with infrastructure managed by the UPU International Bureau and maintained by the UPU’s Postal Technology Centre – The servers must comply with international cybersecurity standards, such as ISO 27001 (Information security, cybersecurity and privacy protection – Information security management systems) – Implement network segmentation to protect sensitive data and services from unauthorized access or breaches  13 Digitalization of certification tools – Digitalize the current tools used for the certification process, including the self-assessment and certifi- cation assessment workbooks used by designated operators and reviewers / – Enable uploading and secure storage of supporting required documents (as per Annex 2) and additional photographic evidence / – Automate the certification scoring system on the basis of the information provided in Annex 3: reviewers will assess designated operators using the digitalized certification workbook, with standardized certifi- cation points generated on the basis of each section and sub-section thereof. The scores achieved for each section will collectively determine the final certification level achieved by the designated operator. Automated workflow and notifications / – Automate the certification process workflow, including self-assessment submissions (as per Annex 4), reviews and certificate issuance – Prepare and provide automated notifications for key stakeholders (i.e. member countries, their desig- nated operators and the UPU), including reminders for recertification and task updates – the UPU will provide template letters for incorporation in the automated system Monitoring and reporting – Provide a dashboard for real-time tracking of certification status (ongoing, due for renewal, expired) – Log user activities and budget expenditure, and provide audit trails Multilingual support In addition to English, ensure localization of the system in Arabic, French, Spanish, Portuguese and Russian. Security and scalability – Implement robust security measures to protect sensitive data – Support scalability to accommodate all UPU member countries and their designated operators, and WPSPs if applicable – Integration of additional certification frameworks: the application should support the incorporation of new security and safety certification modules as they become available, ensuring adaptability to evolving regulatory and operational requirements – Plug-in compatibility: the solution must facilitate seamless integration of optional plug-ins or expansion packs that enhance functionality, such as risk assessment tools, compliance reporting modules and AI- driven threat detection capabilities – Interoperability: the system must be capable of integrating with other security and safety applications through standardized APIs, ensuring compatibility with emerging technologies and third-party solutions – User-configurable features: the architecture should allow for configuration and customization by superusers and administrators to accommodate future certification schemes without requiring significant redevelopment – Scalable infrastructure: the application should be designed to support increasing certification volumes and expanding datasets without compromising performance Other IT requirements The solution shall rely on the UPU’s Active Directory database for authentication of users. 4.2 Bidder requirements Bidders shall demonstrate a record of satisfactory performance in similar activities (i.e., reference letters and/or work completion certificates). The business transactions and activities carried out by the Bidder must be com- pliant with the mandates and principles of the UPU.  14 Bidders must present in their tender their proposed methodology, work plan and approach to organizing the work. The business transactions and activities carried out by the Bidder must be compliant with the mandates and principles of the UPU. Bidders (and their consultants) should meet the criteria set out below: – Experience: • Experience in developing automated systems – Skills and capabilities: • Strong technical and development skills • Strong interpersonal and communication skills • Strong analytical, reporting and writing abilities • Ability to plan, organize, implement and report on work • Ability to work under pressure and to tight deadlines • Proficiency in the use of office IT applications and the Internet to conduct research • Outstanding communication, project management and organizational skills • Excellent presentation and facilitation skills • High level of integrity and ethical standards • Positive and constructive attitude to work • Sensitivity and adaptability with regard to culture, gender, religion, race, nationality and age • Fluency in English 4.3 Consultant requirements Bidders not operating as an independent consultant should propose at least three individual consultants in accordance with the requirements specified in this call for tenders for the performance of the services and activities described herein. Bidders are required to provide the CVs and diplomas of the said consultants, as well as a letter of motivation and a brief write-up (maximum 1,000 words) of the consultants’ approach and methodology with regard to the project, for further verification and evaluation by the UPU. The UPU shall have the right to reject a proposed consultant if the individual does not fulfil the UPU’s requirements as defined in this call for tenders. Bidders not operating as an independent consultant should describe any relevant procedures concerning the replacement of individual consultants if so, requested by the UPU. 4.4 Assessment criteria Bidders will be assessed on the basis of a scoring system of up to 70 points for their technical proposal and 30 points for their pricing structure. The technical proposal shall be assessed on the basis of the following criteria: Criteria Points obtainable Technical solution and alignment with requirements 25 Experience with similar projects in the postal or certification domain 15 Project timeline and implementation plan 20 Support and maintenance services 10 Cost effectiveness and total cost of ownership 30 Bidders shall provide evidence of their ability to meet these requirements by means of a list of references.  15 4.5 Duration of services The services are scheduled to commence in mid-May 2025 for a total contract term not exceeding one year. 4.6 Location of the services The Vendor or its assigned consultant shall in principle work from its own premises or his/her home office. The Vendor or its assigned consultant shall liaise and work closely with the UPU (as instructed by the latter) and may be required from time to time to carry out certain tasks from the headquarters of the UPU in Berne, Switzerland. 4.7 Reporting The Vendor shall provide the UPU with weekly reports setting out the relevant services performed by the Vendor during that time frame. Such reports shall be prepared in accordance with a structure and format defined by the UPU (i.e., time sheets). The UPU may contest the Vendor’s time sheets within 10 business days of receipt thereof. If the time sheets are not contested by the UPU within the said time frame, the services detailed therein may be deemed as duly provided by the Vendor and accepted by the UPU. 4.8 Other requirements Bidders shall describe any relevant procedures for ensuring the continuity of the services provided and for appropriate backup and retraining, as well as any relevant procedures pertaining to project management and communication. Bidders shall also confirm that their tender covers all costs associated with the provision of the services referred to herein. Any other costs to be incurred by the Vendor, including any travel and subsistence costs incurred in the provision of the services at locations other than its own premises and specifically designated by the UPU, shall be subject to the prior written consent of the UPU. No other fees shall be paid, with the exception of reimbursement of other unavoidable costs incurred for successful delivery of the services, which shall also be subject to the prior written consent of the UPU. 4.9 Additional information Bidders may include any additional information that they deem necessary or relevant in order for the UPU to gain a clear and detailed understanding of the services being offered.