Contratación de servicios de ciberseguridad y SOC de la Empresa Nacional de Innovación, S.M.E., S.A.

The contract timeline is as follows:

• Contract Start Date: December 17, 2026.
• Total Duration: 36 months.

Key milestones and phases mentioned include:

• Deadline for Offer Submission: Until September 21, 2026, at 08:00.
• Opening of electronic file nº 1 (Administrative envelope): September 21, 2026, at 10:00.
• Opening of electronic file nº 2 (Technical offer envelope): September 25, 2026, at 10:00 (approximate date and time).
• Opening of electronic file nº 3 (Economic offer envelope): October 15, 2026, at 10:00 (approximate date and time).

The core scope of work for this tender is the contracting of managed cybersecurity services and security operations through a Security Operations Center (SOC) for the National Innovation Company, S.M.E., S.A..

The statement of work summary and core deliverables explicitly include:

• Service takeover and initial environment analysis.
• Identification of assets and information sources.
• Integration of SOC tools.
• Configuration of rules, use cases, IoC/IoA indicators, playbooks, thresholds, exclusions, and escalation procedures.
• Implementation of a pre-production validation model.
• 24x7 ordinary operation.
• Management of alerts, including classification, escalation, containment, and support for remediation.
• Documentation of all actions.
• Description of the service delivery, reversibility, and closure model.
• Support for the transition to Enisa or a new service provider, including the transfer of documentation, evidence, incident history, rules, use cases, integrations, and relevant configurations.
• Development of a technical plan for the SOC service covering initiation, provision, operation, monitoring, delivery, and reversibility.
• A technical plan for managed cybersecurity services and technical audit, including planning of audit actions, vulnerability monitoring, execution methodology, evidence management, classification of findings, communication of critical risks, report quality, and proposed follow-up or validation of corrective measures.
• Integration of the SOC solution with ENISA's corporate EDR/XDR.
• Obtaining ENS High Category certification.
• Implementation of a playbook to integrate SOC alerts/incidents with ENISA's corporate ticketing tool.
• Inclusion of grey box testing within the managed cybersecurity audit service.
• The proposed technical solution must demonstrate adequacy to ENISA's environment, encompassing various assets and systems such as servers, workstations, cloud services, Microsoft 365, identity, email, firewalls, VPN, published services, critical applications, corporate log sources, SIEM/SOAR, and EDR/XDR.
• The solution also needs to describe the model for alert, vulnerability, and incident management, covering classification, prioritization, escalation, containment, remediation, evidence, traceability, and coordination with Enisa.