Extended Detection & Response (XDR) – Lösung

The contract timeline includes a base duration of three years, with an option for a unilateral extension by the client for an additional year (Year 4) under the conditions of Year 3. The extension option must be exercised in writing at least three months before the end of the contract.

Key phases and milestones mentioned are:

• Implementation Plan: The total project duration for phases 1-4 should not exceed 6-8 weeks.
• Phase 1 - Project Start and Configuration: (Guideline: 1 week) This includes contract signing, formal project kick-off, naming dedicated project teams, Sophos Central configuration, policy design, and approval of the project and milestone plan.
• Phase 2 - Pilot Rollout: (Guideline: 2 weeks) This involves rolling out to 50 endpoints (mixed clients + servers) as a pilot group, fine-tuning policies, and cleaning up false positives.
• Transitionsphase: At the end of the contract, the contractor is required to actively support the client during the transition to a successor provider for a period of at least three months.

Specific contract start and end dates are not explicitly stated.

The core scope of work for this tender involves the implementation, system service, and further development of an Extended Detection & Response (XDR) solution, specifically a Sophos-based system, for Klinikum Esslingen. The contractor is expected to act as the responsible general contractor for the entire system's creation and ongoing services.

The key deliverables and statement of work summary include:

• Implementation of an XDR Solution: The primary objective is to establish an Extended Detection & Response (XDR) solution.
• Protection of Endpoints: The solution must protect approximately 2,562 endpoints, comprising 1,791 clients (Windows 11/Thin-Client-OS), 421 servers (Windows Server 2019/2022, Linux), and 350 mobile devices (iOS/Android).
• Core Functionalities:
• Endpoint Detection & Response (EDR) functionality within XDR.
• Sophos Synchronized Security.
• Sophos Central Management.
• Cross-Domain Detection & Response (XDR), including various XDR data sources (beyond endpoints) and correlation/analysis capabilities.
• MDR-Readiness (preparatory requirements).
• Integration requirements.
• Implementation Plan: A structured implementation plan is required, with a total project duration for phases 1-4 not exceeding 6-8 weeks, ideally with a staggered rollout. This plan includes:
• Phase 1 (Project Start & Configuration - ~1 week): Kick-off workshop, team nomination, Sophos Central configuration (tenant setup, RBAC, MFA activation), policy design, and approval of the project and milestone plans.
• Phase 2 (Pilot Rollout - ~2 weeks): Rollout on a pilot group of 50 mixed endpoints (clients + servers), fine-tuning of policies, false-positive cleanup, Synchronized Security testing, and formal written approval.
• Contract Duration: The initial contract period is 3 years, with an option for a 1-year extension.
• Ongoing Services: The tender includes provisions for license and service costs for years 1, 2, and 3, which are to be calculated as binding fixed prices. These include Sophos XDR client licenses, Sophos Workload Protection for servers, Sophos Mobile Threat Defense, manufacturer support, partner support, and reports & reviews.