Denmark – Safety consultancy services – Managed Detection and Response (MDR)

In order to protect Statens IT (the Purchaser) from current and future cyber threats, the Purchaser employs a range of security technologies, including an Extended Detection and Response (XDR) platform. The XDR platform supports the collection, correlation, and analysis of security-related events across the Purchaser's IT environment with the aim of protecting systems, services, and data, as well as ensuring the confidentiality, integrity, and availability of data. In this regard, the Purchaser is offering a contract whose purpose is to support and strengthen the Purchaser's own operational IT security through the delivery of a Managed Detection and Response (MDR) service from a Security Operations Center (SOC). The MDR service is to apply and supplement the Purchaser's XDR platform with round-the-clock monitoring, analysis, detection, validation, escalation, and handling of security incidents. The service is to be delivered 24 hours a day, 365 days a year, and contribute to the rapid identification, assessment, and handling of cyber threats and security incidents. The services constitute an essential element in the Purchaser's continued maturation and development process in the field of cybersecurity, with a focus on technology, processes, competencies, and collaboration across internal and external stakeholders. With the tender, the Purchaser wishes to gain access to a professional MDR service that can meet the Purchaser's high demands for quality, robustness, and efficiency, as well as a supplier who can continuously engage in dialogue with the Purchaser about developments in the field of cybersecurity, including the threat landscape, technological possibilities, automation, competence development, and continuous improvements to the security level. The supplier is to carry out a technical, organisational, and process-related Transition In, ensuring that the ongoing MDR services can be delivered from the transition to the operational phase. The Purchaser notes that the Purchaser has entered into a contract with two (2) suppliers for the management of the Purchaser's existing XDR platform, with whom the supplier is to collaborate in connection with the Transition In. As part of this, the supplier is to establish and configure the necessary integrations between the Purchaser's XDR platform and other relevant security sources, as well as the supplier's tools and platforms used to fulfill the contract. The supplier is to deliver Continuous MDR Services, including continuous monitoring, analysis, correlation, validation, and detection of alerts and security incidents. The supplier is to carry out triage and qualification of alerts with the aim of identifying real security incidents and ensuring timely escalation and advice in accordance with agreed processes and service levels. These continuous MDR services include: • Continuous SOC monitoring of security-related incidents and alerts. • Analysis, correlation, and qualification of incidents across relevant data sources. • Identification, detection, and validation of security incidents. • Development, implementation, and continuous optimisation of detection rules, use cases, and analysis models. • Use of relevant Threat Intelligence to support detection and analysis work. • Continuous assessment of the threat landscape and its relevance to the Purchaser's environment. • Proactive identification of potential security incidents and security risks, including through Threat Hunting activities. • Escalation, advice, and reporting of security incidents in accordance with agreed processes and service levels. • Maintenance of existing integrations, as well as establishment of new integrations as needed. • Optimisation and further development of the Purchaser's XDR platform and other security solutions. • Advice regarding the development and maturation of the Purchaser's security organisation, security processes, and governance. • Conducting targeted Threat Hunting activities and analyses of suspicious activities. • Incident Response assistance in the event of security incidents upon request from the Purchaser, including analysis, containment, handling, remediation, and recovery. • Assistance in the event of major security incidents, cyber crises, and coordination with relevant stakeholders. • Security expertise and strategic sparring on developments in the field of cybersecurity. The contract also includes cross-cutting services, including documentation, reporting, governance, quality assurance, and information security, which are delivered throughout the contract period. Furthermore, the contract includes obligations upon contract termination (Transition Out), which must ensure a controlled, secure, and documented transfer of knowledge, data, processes, integrations, and other contract-related deliveries to the Purchaser or a subsequent supplier.