Direktoratet for forvaltning og økonomistyring (DFØ) would like to procure a 24 hour (24/7/365) service for security monitoring and support with dealing with security incidents in the contracting authority's IT environment.

This involves entering into a cooperation with a tenderer that provides a MDR service that sees to security monitoring, vulnerability control, follow-up and dealing with incidents, where the tenderer will also give DØF quick access to expertise for assistance in the event of larger security incidents.

Direktoratet for forvaltning og økonomistyring (DFØ) would like to procure a 24 hour (24/7/365) service for security monitoring and support with dealing with security incidents in the contracting authority's IT environment.

This involves entering into a cooperation with a tenderer that provides a MDR service that sees to security monitoring, vulnerability control, follow-up and dealing with incidents, where the tenderer will also give DØF quick access to expertise for assistance in the event of larger security incidents.

Proactive monitoring and dealing with vulnerabilities is expected, not only reactive dealing with larger unwanted incidents.

The following mustl be included as part of the MDR service:

Surveillance and monitoring - The tenderer is to receive and facilitate logs from the contracting authority's IT environment and carry out automated and manual processes to monitor the logs. We would like the tenderer to have responsibility for establishing and maintaining sufficient visibility in the contracting authority's IT environment.

Threat detection - The tenderer is to work continuously to detect threats and security incidents, and notify the contracting authority of them.

Analysis - The tenderer is to present analyses of incidents and malware, and offer analysis possibilities for tactical investigations of incidents for the contracting authority. The chosen tenderer must also offer an option for data visualisation and incident analysis for the contracting authority.

Support for incident management - The tenderer must offer incident management functions that enable incident response to be managed in collaboration with the contracting authority, or, if needed, with the contracting authority's collaboration partners and suppliers.

Threat Intelligence - The tenderer is to collect relevant threat information, threat analyses and management, and for threat modelling. It will also be necessary for the tenderer to be able to consume threat intelligence delivered by contracting authority.