Denmark – Safety consultancy services – Managed Detection and Response (MDR)

To protect Statens IT (the Client) from current and future cyber threats, the Client employs a range of security technologies, including an Extended Detection and Response (XDR) platform. The XDR platform supports the collection, correlation, and analysis of security-related events across the Client's IT environment to protect systems, services, and data and ensure the confidentiality, integrity, and availability of data. To this end, the Client offers a contract whose purpose is to support and strengthen the Client's own operational IT security through the delivery of a Managed Detection and Response (MDR) service from a Security Operations Center (SOC). The MDR service will use and supplement the Client's XDR platform with 24/7 monitoring, analysis, detection, validation, escalation, and handling of security incidents. The service will be delivered 24 hours a day, 365 days a year, and contribute to the rapid identification, assessment, and handling of cyber threats and security incidents. The service components constitute a significant element in the Client's continued maturity and development process in the field of cybersecurity, with a focus on technology, processes, competencies, and collaboration across internal and external stakeholders. With this tender, the Client seeks access to a professional MDR service that can meet the Client's high demands for quality, robustness, and efficiency, as well as a supplier who can continuously engage in dialogue with the Client about developments in cybersecurity, including the threat landscape, technological possibilities, automation, competence development, and continuous improvements in the level of security. The supplier must carry out a technical, organizational, and process-related Transition In, which ensures that the ongoing MDR services can be delivered from the transition phase to the operational phase. The Client notes that the Client has entered into a contract with two (2) suppliers for the management of the Client's existing XDR platform, with whom the supplier must collaborate in connection with the Transition In. As part of this, the supplier must establish and configure the necessary integrations between the Client's XDR platform and other relevant security sources as well as the supplier's tools and platforms used to fulfill the contract. The supplier must deliver Continuous MDR Services, including continuous monitoring, analysis, correlation, validation, and detection of alarms and security incidents. The supplier must perform triage and qualification of alarms to identify real security incidents and ensure timely escalation and advice in accordance with agreed processes and service levels. These continuous MDR services include, among other things: • Continuous SOC monitoring of security-related incidents and alarms. • Analysis, correlation, and qualification of incidents across relevant data sources. • Identification, detection, and validation of security incidents. • Development, implementation, and continuous optimization of detection rules, use cases, and analysis models. • Use of relevant Threat Intelligence to support detection and analysis work. • Continuous assessment of the threat landscape and its relevance to the Client's environment. • Proactive identification of potential security incidents and security risks, including through Threat Hunting activities. • Escalation, advice, and reporting of security incidents in accordance with agreed processes and service levels. • Maintenance of existing integrations as well as establishment of new integrations as needed. • Optimization and further development of the Client's XDR platform and other security solutions. • Advice on the development and maturity of the Client's security organization, security processes, and governance. • Conducting targeted Threat Hunting campaigns and analysis of suspicious activities. • Incident Response assistance in security incidents upon request from the Client, including analysis, containment, handling, remediation, and recovery. • Assistance in major security incidents, cyber crises, and coordination with relevant stakeholders. • Expert security advice and strategic sparring on developments in cybersecurity. The contract also includes cross-cutting services, including documentation, reporting, governance, quality assurance, and information security, delivered throughout the contract period. Furthermore, the contract includes obligations at contract termination (Transition Out), which must ensure a controlled, secure, and documented handover of knowledge, data, processes, integrations, and other contract-related deliveries to the Client or a subsequent supplier.