Dienstverlening SIEM-SOC

The contract timeline is as follows:

Contract Start Date:

• The agreement commences on October 1, 2026, with the implementation phase.
• The ICT Performance and SIEM-SOC service delivery officially begin on January 1, 2027.

Contract End Date:

• The initial contract duration is for 4 years, starting from January 1, 2027, which means the initial end date is December 31, 2030.

Total Duration:

• The initial duration is 4 years.
• There are subsequent extension options of 1 year each.
• The agreement is for an indefinite period due to these extension options, with a maximum of 99 extensions possible.

Key Milestones and Phases:

• July 29, 2026: Publication of the announcement on TenderNed.
• August 17, 2026 (before 10:00 AM): Latest date for asking questions (1st round).
• August 28, 2026 (latest): Publication of the note of information (1st round).
• September 4, 2026 (before 10:00 AM): Latest date for asking questions (2nd round).
• September 15, 2026 (latest): Publication of the note of information (2nd round).
• September 28, 2026 (12:00 PM): Closing date for submitting an offer.
• October 1, 2026: Start of implementation phase.
• Early October 2026: Sending notification of award decision and start of suspension/objection period.
• October 2026: Verification visit to the supplier.
• October 2026: Assignment/signing of the contract.
• 20 days after notification: End of the suspension/objection period.
• From signing: Alignment, setup, and implementation phase begins.
• December 31, 2026: Current Cloud security center service ends.
• January 1, 2027: Implementation must be completed, and the SIEM-SOC service goes live (in use).

The core scope of work for this tender involves the delivery of SIEM-SOC (Security Information and Event Management - Security Operations Center) services to Veiligheidsregio Haaglanden (VRH), starting from January 1, 2027. This includes support and optional functionalities, succeeding the current Cloud Security Center service which concludes on December 31, 2026.

The contractor is responsible for the operational SIEM and SOC service delivery, encompassing the following activities:

• 24/7 monitoring of security events and alerts.
• Analysis, triage, and classification of security events, threats, and incidents.
• Correlation and enrichment of security data within Microsoft Sentinel.
• Execution of threat intelligence activities to enhance detections.
• Execution of proactive threat hunting activities.
• Management, optimization, and further development of detection rules, analytics rules, use cases, and automations.
• Escalation of incidents in accordance with agreed procedures and service levels.
• Reporting on incidents, threats, trends, vulnerabilities, and service delivery.
• Support for incident response within the defined scope.
• Advisory on improvement measures related to information security, monitoring, and detection.

The SOC specifically focuses on the operational execution of monitoring, detection, analysis of security incidents, and initial response actions (e.g., isolating devices or accounts). The aim is to timely identify, analyze, classify, and escalate security threats to minimize risks and ensure the continuity of VRH's services.

The agreement also includes the provision of remote services via the internet, and there is a possibility to integrate future related services or additional modules. The supplier must ensure the timely implementation of the ICT Performance, aligning with the implementation plan, with a firm deadline of January 1, 2027.