The objective of this contract is to support the ICT Security of the Ministry in the four areas in which it operates:
• Governance, Risk and Compliance.
• Protection, detection and response.
• Security management.
• Training and Awareness
The volume and importance of the information managed by the Ministry of Educational Development and Vocational Training, (hereinafter the Ministry), have made that for years a great effort has been devoted to the security of said information of the various systems that allow its treatment, among which the Seneca system should be highlighted.
The regulatory requirements on this information and its treatment, mainly dictated by Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 regarding the protection of natural persons with regard to the processing of personal data and the free movement of these data, by Organic Law 3/2018, of December 5, Protection of Personal Data and guarantee of digital rights and by Royal Decree 311/2022, of May 3, which regulates the National Security Scheme and the technical instructions that develop it, require a security organization that ensures compliance, analysis and management of risks and the application of appropriate controls.
Additionally, and in accordance with the provisions of the single additional provision of Decree 285/2010, of May 11, which regulates the Seneca Information System and establishes its use for the management of the Andalusian educational system, the Ministry maintains an information security management system (ISMS) that complies with the UNE-ISO / IEC 27001 standard and is certified.
In the organizational field, the Ministry has an ICT Security Unit, which assumes the functions of security management and operation.
The objective of this contract is to support the ICT Security of the Ministry in the following areas:
• Governance, Risk and Compliance.
• Protection, detection and response.
• Security management.
• Training and Awareness.
The contracting follows a service model with a double orientation:
• Security infrastructure maintenance services (SMIS). These services will follow a fixed monthly cost model for each element of infrastructure managed by the successful bidder, based on the catalogue defined below.
• Services on demand (SBD hereinafter): Development of activities based on service requests (which will be executed and certified according to the catalog of on-demand services defined below), effort extensions (which will be executed and certified according to the cost according to their duration defined later) and through the execution of projects (which will be executed and certified in a planned manner according to the estimated efforts by expected profile.