BIG – Security Operations Center (SOC) – Auslagerung des Security Monitorings & Betrieb des zentralen Security-Technologie-Stacks

The contract timeline specifies a start date of April 1, 2027, or presumably the second quarter of 2027. The initial duration of the contract, which is a framework agreement, is 60 months (5 years). This contract can be extended multiple times in two-year increments, with a maximum of 4 extensions. The award procedure itself is structured in several consecutive phases, with a maximum of 5 and a minimum of 3 participants invited to the second phase. In the second phase, a comprehensive overall concept must be submitted, and the best bidder is determined based on criteria including the offer price, the overall concept, and a presentation.

The core scope of work for this tender, titled "Security Operations Center (SOC) – Outsourcing of Security Monitoring & Operation of the central Security Technology Stack," aims to establish a robust and continuously evolving Security Monitoring and Incident Response model.

The high-level summary of the Statement of Work and core deliverables includes:

• Establishment, operation, and continuous development of Security Monitoring.
• Implementation of Security Monitoring: This encompasses defining the target architecture, connecting relevant data sources, and creating Use Cases, Playbooks, Escalation Paths, and Rules of Engagement.
• Setup and expansion of a Log Management solution.
• Setup and operation of the SOC platform, including a continuous improvement process.
• Execution of a tuning and acceptance phase prior to transitioning into regular operation.
• Monitoring, triage, and analysis of security-relevant events, along with the implementation of defined first-response measures and the escalation of critical security incidents.
• Consulting and implementation services for technical and organizational SOC implementation, as well as SOC operation and further development.
• Threat Detection: Continuous monitoring, real-time alerting, triage, analysis, investigation of security events, initiation of containment measures, and escalation of incidents.
• Incident Response Support: Assisting with security incidents in close cooperation with the client and an Incident Response partner.
• Platform and Detection Engineering: Engineering, deployment, operation, and maintenance of SOC technologies; development, optimization, and maintenance of detection use cases and rules; and ongoing improvement of detection capabilities and security monitoring quality.
• The scope of Security Monitoring covers core domains such as Cloud, Endpoints, Identities, E-mail, Networks, and Business Applications.
• The contractor has the flexibility to either utilize the client's existing technology stack or provide their own.