The contracting authority wants to enter into a contract for security monitoring and support for incident management of security incidents in the Client's computing environment. The service shall be operative 24/7/365

The Client wishes to establish a model for security monitoring and incident management where the Supplier and the Client have a clear distribution of tasks related to the operational ICT service.

This means partnership with a Supplier that provides a Managed SOC service that ensures security monitoring while the Client undertakes vulnerability control and follow-up, and incident management.

The object of the procurement

The following shall be included in the Managed SOC service:

- Surveillance and monitoring - The Supplier receives and facilitates logs from the Client's computing environment and implements automated and manual processes to monitor the logs. 

- Threat detection - The Supplier works continuously to detect threats and security incidents, and notifies the Client thereof.

- Analysis - The Supplier presents analysis of incidents and malware, and offers analysis possibilities for tactical investigations of incidents to the Client. The chosen tenderer must also offer an option for data visualisation and incident analysis for the contracting authority.

Support to Incident Management - The suppler must offer incident management functions that enable incident response to be managed in collaboration with the Client, or, if needed, with the Client's collaboration partners and suppliers.

- Threat Intelligence - The tenderer must have capabilities to collect relevant threat information, threat analyses and management, and for threat modelling. It will also be necessary for the tenderer to be able to consume threat intelligence delivered by contracting authority. The Client also wants the Supplier to provide the following services when needed:

- Consultancy - The supplier must be able to provide consultancy services connected to best practice for security monitoring and incident management. The consultancy services shall be related to further development of the Client's security operations.

- Courses and skills upgrading - the Suppler must provide courses and skills upgrading connected to best practice for security monitoring and incident management.