Extended Detection & Response (XDR) – Lösung

The contract for system serviceleistungen has an initial duration of 36 months. The client has an option to extend the contract for an additional 12 months. If this option is exercised, the contract will extend by another 12 months repeatedly, unless terminated with a 3-month notice period. Specifically, the client can unilaterally extend the contract for a 4th year under the conditions of year 3, and this extension must be requested in writing at least 3 months before the contract's end.

The start date for the system serviceleistungen is the day after the acceptance of the overall system.

Key milestones and phases for implementation include:

• The total project duration for phases 1-4 is not to exceed 6-8 weeks.
• Phase 1 - Project Start and Konfiguration: This phase has a guideline duration of 1 week and includes contract signing, formal project kickoff, designation of project teams, Sophos Central configuration, policy design, and approval of the project and milestone plan.
• Phase 2 - Pilot Rollout: This phase has a guideline duration of 2 weeks and involves rolling out to a pilot group of 50 endpoints, fine-tuning policies, and addressing false positives.
• Transitionsphase: The contractor is required to support the client during the transition to a successor provider for a minimum period of 3 months.

The core scope of work for this tender involves the creation of a comprehensive system based on a work contract, which may also include system service after acceptance and/or further development and adaptation of the overall system. The overall system comprises services and deliveries provided by the contractor, as specified in the EVB-IT System Contract, including system components to be provided by the client.

Specifically, the services for creating the overall system can encompass:

• Sale of hardware
• Rental of hardware
• Provision of standard software for a one-time fee on a permanent basis (sale)
• Provision of standard software on a temporary basis (rental)
• Development and provision of individual software on a permanent basis
• Creation of the overall system and establishment of operational readiness (e.g., setup, installation, customizing, and integration of system components)
• Training
• Documentation
• Project management
• Migration services, such as taking over old data
• System service after acceptance, including maintaining and/or restoring operational readiness
• Further development and adaptation of the overall system after acceptance

The project objectives highlight the strategic and operational goals:

• Replacing existing signature-based endpoint security with an XDR solution that includes behavioral analysis, machine learning, and forensic analysis capabilities.
• Achieving complete endpoint visibility and control for all IT endpoints (clients, servers, and mobile devices).
• Activating Sophos Synchronized Security for real-time communication between endpoint agents and the existing Sophos XGS Firewall to enable automated network isolation of compromised endpoints.
• Establishing forensic analysis capabilities, including continuous endpoint telemetry recording, root-cause analysis, and threat hunting across all endpoints.
• Activating cross-domain correlation (XDR) by linking endpoint events with firewall, email, cloud, and identity data sources, and preparing for MDR service connection.
• Meeting regulatory requirements of NIS-2 and GDPR concerning endpoint security and adhering to the state of the art (B3S Gesundheit).
• Supporting vulnerability management through endpoint-based vulnerability visibility.

Key deliverables and phases of implementation include:

• Phase 1 - Project Start and Configuration (approx. 1 week): Kick-off, planning, coordination, Sophos Central configuration & tenant setup (RBAC, MFA, basic configuration), and policy design & configuration for 5 groups (Server, Clients Admin, Clients Station, Mobile Endpoints, IT-Admin).
• Phase 2 - Pilot Rollout (approx. 2 weeks): Rollout to 50 endpoints, fine-tuning, false-positive cleanup, Synchronized Security test, and written approval before production rollout.
• Phase 3 - Production Rollout in Waves (approx. 2-3 weeks): Rollout to Servers (421 endpoints), then Clients Administration, then Clients Stations (clinical workstations), and mobile devices. A documented rollback plan is required.
• Phase 4 - Integration, Test, and Acceptance (approx. 1 week): Synchronized Security activation with full Heartbeat integration with XGS Firewall, creation and handover of ISMS-compliant acceptance documentation, functional tests, integration tests, security checks, administrator training (min. 1 day), security analyst training (min. 1 day), provision of German training materials and access to Sophos training content, and acceptance protocol.

Ongoing services (OPEX) include:

• Sophos XDR Client licenses for PCs, Thin Clients, and Sophos Workload Protection for Servers.
• Sophos Mobile Threat Defense licenses.
• Sophos Enhanced Plus Manufacturer Support.
• Implementation Partner Support (P1-P4 according to SLA table).
• Monthly Reports & Quarterly Reviews.

Optional positions include:

• MDR-Readiness package (configuration, RBAC, documentation).
• MDR-Service (monthly price indication).
• Year 4 extension for OPEX.
• Transition costs at contract end (data export, handover, deletion protocol).
• Extended Data-Lake retention for 1 year (from 90 to 365 days).
• Identity-Integration as XDR detection source (Microsoft 365 / Entra ID / local Active Directory).
• IoMT-NDR Network data integration as XDR data source, including Log-Collector-Appliance (VM).

The scope explicitly excludes the installation of EDR-Agents on medical devices (IoMT) or GLT-endpoints, as these are monitored by a separately procured NDR-Security solution. The procurement or operation of a Managed Detection & Response (MDR) Service is also explicitly not part of this tender.