Gestión del servicio de ciberseguridad (soc)

The initial duration of the contract is 12 months, commencing from the day following its formalization. The contract allows for annual extensions, which can be made by the Contracting Authority for up to a maximum of 4 additional years. Such extensions require a formal notification from the contracting entity to the contractor at least two months prior to the expiration of the current contract or ongoing extension, and these extensions are binding for the contractor. Additionally, a warranty period of 12 months is established, effective from the date of receipt or conformity of the services.

The core scope of work for this tender involves the comprehensive management and monitoring of Gipuzkoako Urak's expanded security infrastructure, encompassing both device-level and cybersecurity aspects. This extends the existing Security Operations Center (SOC) service to integrate newly deployed perimeter security infrastructure, switching, centralized management, security analytics, and network access control.

Key services and deliverables include:

• Security Infrastructure Management and Monitoring: Continuous management and monitoring of existing and newly installed security infrastructure, including firewalls (Palo Alto, Fortinet NGFW/SD-WAN), switches, centralized management platforms (FortiManager), security logging and analytics systems (FortiAnalyzer), Network Access Control (NAC) platforms (FortiNAC), and DNS servers.
• Cybersecurity Event Monitoring and Response: Detection and analysis of security incidents covering threats, vulnerabilities, unusual behaviors, excessive consumption, events in OT/ICS environments (anomalous traffic, unauthorized assets), network access events (failed authentications, non-compliant endpoints, quarantines), and DNS events (malicious domain resolution, DNS tunneling).
• Routine Operations (8x5): Planned management and routine operations for platform maintenance, including modification of security rules and policies, access profile adjustments, and scheduled updates/patches for security configurations. This also includes assistance with VLAN management and operational management of access control policies and deployment templates.
• Incident Response (24x7): Urgent handling of critical or high-priority incidents, including urgent injection of Indicators of Compromise (IoC), resolution of issues affecting the availability or security of Palo Alto firewalls and new NGFWs, and specific containment actions in critical OT/ICS environments.
• Reporting and Compliance: Daily injection of IoC into firewalls to enhance security, monthly reports on security incidents, and quarterly summaries with improvement plans.
• Advisory Services: Provision of CISO advisory services for the development of action plans and security improvements, up to a maximum of 200 hours annually.
• Hardware Support: Support for physical equipment replacement (RMA), with up to 160 annual hours for on-site interventions to replace faulty switches or firewalls.
• Software Development and Documentation Standards: Application of secure coding principles and architecture, avoiding plain text credentials, and encrypting sensitive data. Source code must be maintained in an accessible GIT repository and documented according to ISO software quality standards.

Core deliverables explicitly stated are:

• E1: Technical documentation (PDF/Word)
• E2: Source code (ZIP/GIT)
• E3: Proof of tests (Report)
• E4: User manual (PDF)
• E5: Statement of compliance with requirements (Signed)

The contractor is also required to maintain continuous communication during sprints and document each delivery through acceptance reports or technical acceptance reports.