IT-Angriffserkennungssysteme

The contract timeline is as follows:

The obligation to provide contractual services begins upon contract award. The implementation services, as per the service description, must commence no later than 2 weeks after the contract award. The minimum contract term is 3 years from the contract award. After this initial period, the contract automatically extends for successive 12-month periods, unless one of the parties gives 9 months' notice prior to the end of the respective contract year. During the minimum contract term, the contract cannot be ordinarily terminated. The parties will coordinate the detailed schedule and specific service contents through workshops or regular meetings immediately after the contract is concluded. Milestones and sub-goals are defined within this detailed planning.

The core scope of work for this tender is the procurement of a modern, centrally administrable software solution for IT attack detection systems, which includes continuous maintenance, support, and services for implementation, integration, operation, and training throughout the contract duration. The primary objective is to provide a security solution that limits data transmission and processing to essential data and metadata for operation, analysis, protection, and support, while adhering to data minimization principles and applicable data protection requirements. This also ensures the uninterrupted operation of the IT security infrastructure, continuous monitoring and securing of IT systems, protection of endpoints and servers, central monitoring of security-relevant events, detection and evaluation of vulnerabilities, compliance with regulatory requirements, support for incident response processes, and the provision of managed services with 24/7 security monitoring through a Security Operations Center (SOC). The solution must be functionally integrated, with security-relevant components technically and professionally coordinated to provide protection, detection, analysis, reporting, and audit functions without security-relevant integration gaps.

The core deliverables and service components explicitly stated are:

• 24/7 SOC (Security Operations Center) including Managed Service for continuous monitoring, analysis, evaluation, and support in handling security incidents.
• SIEM/Logging/Monitoring for central collection, evaluation, correlation, and provision of security-relevant events and log data.
• Endpoint Protection / XDR.
• Vulnerability Scanner / Schwachstellenmanagement.
• Auditability and Evidence Management.
• Implementation, Integration, and Maintenance including Training.
• Server Protect for Storage.