Managed Detection and Response (MDR)

… shall be provided 24 hours a day, 365 days a year, and shall contribute to the rapid identification, assessment and management of cyber threats and security incidents. The services constitute an essential element of the contracting entity’s continued cybersecurity maturation and development process, focusing on technology, processes, competencies and collaboration across internal and external stakeholders. With the tender, the Contracting Authority wishes to have access to a professional MDR service that can meet the Contracting Authority's high requirements for quality, robustness and efficiency, as well as a supplier that can continuously engage in dialogue with the Contracting Authority on developments in cybersecurity, including the threat landscape, technological opportunities, automation, competence development and continuous improvement of the security level. The supplier must implement a technical, organisational and procedural Transition Ind that ensures that the ongoing MDR services can be provided from the transition to the operational phase. The Contracting Authority points out that the Contracting Authority has entered into a contract with two (2) suppliers for the performance of the Contracting Authority's existing XDR platform, with which the supplier must cooperate in connection with Transition Ind. As part of this, the Supplier shall establish and configure the necessary integrations between the Contracting Entity’s XDR platform and other relevant security sources, as well as the Supplier’s tools and platforms used for the performance of the Contract. The Supplier shall provide Continuous MDR Services; including continuous monitoring, analysis, correlation, validation and detection of alarms and security incidents. The supplier shall triage and qualify alarms to identify real security incidents, as well as ensure timely escalation and alerting in accordance with agreed processes and service levels. These ongoing MDR services include: • Continuous SOC monitoring of security-related incidents and alarms. • Analysis, correlation and qualification of events across relevant data sources. • Identification, detection and validation of security incidents. • Preparation, implementation and continuous optimization of detection rules, use cases and analysis models. • Use of relevant Threat Intelligence to support detection and analysis work. • Continuous assessment of the threat landscape and its relevance to the contracting entity’s environment. • Proactive identification of potential security incidents and security risks, including through Threat Hunting activities. • Escalation, notification and reporting of security incidents according to agreed processes and service levels. • Maintenance of existing integrations and establishment of new integrations as needed. • Optimization and further development of the Client’s XDR platform and other security solutions. • Advice on the development and maturation of the Contracting Authority’s security organisation, security processes and governance. • Conducting targeted Threat Hunting courses and analysis of suspicious activities. • Incident Response assistance for security incidents upon requisition from the Client, including analysis, scoping, handling, disposing of