Gestión del servicio de ciberseguridad (soc)

The contract has an initial duration of 12 months, commencing the day after its formalization date. The contract can be extended annually by the Contracting Authority for a maximum of 4 additional years. Key milestones or specific phases are not mentioned.

The core scope of work for this tender involves the management and monitoring of Gipuzkoako Urak's expanded security infrastructure, encompassing both device and cybersecurity levels. This service expands the existing Security Operations Center (SOC) to integrate new perimeter security, switching, centralized management, security analytics, and network access control (NAC) infrastructure.

The service covers a range of existing and newly installed security equipment, including:

• Palo Alto PA-820 firewalls (2 units)
• Fortinet Firewall (partial scope) at Euskaltel (1 unit)
• NGFW/SD-WAN FortiGate 70G in HA active-passive configuration at 27 plants (ETAP/EDAR) (54 units)
• NGFW/SD-WAN FortiGate 70G in HA active-passive configuration at 13 remote offices (26 units)
• Manageable access switches (44 units: 42 x S124FN 24-port, 2 x S148FN 48-port)
• Centralized management platform (FortiManager) (1 unit)
• Security logging and analytics system (FortiAnalyzer) (1 unit)
• NAC / network access control platform (FortiNAC) (1 unit)
• DNS servers (2 units)

The Statement of Work summary and core deliverables include:

• Incident Detection and Analysis (24x7x365): Monitoring for threats, unpermitted applications, vulnerabilities, strange behaviors, excessive consumption, anomalous traffic in industrial protocols, unauthorized assets in OT/ICS environments, failed authentications, non-compliant endpoints, quarantines, malicious domain resolution, DNS tunneling, and anomalous DNS queries.
• Urgent Injection of Indicators of Compromise (IoC): Into firewalls as required by incident criticality.
• Routine Management and Operation (8x5): This includes modifying security rules and policies, changing access profiles, and applying programmed updates and configuration patches.
• Incident Response and Containment (24x7x365 for Critical/High priority incidents): Actions such as VLAN/segment isolation, disabling accounts/ports, endpoint quarantine via NAC, urgent IoC injection, resolving Palo Alto/NGFW incidents affecting availability or security, specific containment in critical OT/ICS environments, and escalation/coordination with Gipuzkoako Urak until incident closure.
• Reporting: Monthly reports on security incident status and quarterly summaries with improvement plans.
• Assistance: For problems and incidents with the Euskaltel Fortinet.
• CISO Advisory Service: Provision of CISO advisory services for developing action plans and improvements.

Deliverables for development tasks (if applicable) include:

• Technical documentation (PDF/Word)
• Source code (ZIP/GIT)
• Evidence of tests (Report)
• User manual (PDF)
• Declaration of compliance with requirements (Signed)

The contractor must also apply secure coding principles, integrate security into all architecture layers, avoid storing credentials in plain text, and encrypt sensitive data both in transit and at rest. Source code must be maintained in a GIT repository accessible to Gipuzkoako Urak.