Managed Security Operations Center (SOC) und Cisco Security Enterprise Agreement

The contract start date is November 1, 2026. The total duration of the contract is 60 months. Based on a start date of November 1, 2026, and a duration of 60 months, the contract end date would be October 31, 2031.

Key milestones or phases include a "Termin- und Leistungsplan" (Timeline and Performance Plan) that is expected to be detailed in a table or an appendix. Additionally, there are half-yearly "Service-Recap und Innovationsworkshop" (Service Recap and Innovation Workshop) conducted twice per calendar year, specifically at the end of each calendar half-year.

The core scope of work for this tender involves the provision of a Managed Security Operations Center (SOC) as a service, including the necessary software licenses (provision, renewal, and maintenance).

The Statement of Work summary and core deliverables include:

• Service Design & Transition: Building a quality-assured operating model and optimizing the existing architecture for productive operation. This involves analyzing Cisco licenses and configurations, developing an optimization concept, and improving the operational state to ensure a fully operational and documented SOC stack with clear responsibilities and full utilization of licenses.
• License Management - SOC Products: Continuous monitoring of license status and End-of-Life (EOL) situations for all inventoried SOC platform components. The contractor is responsible for monitoring license durations and EOL/EOS announcements, communicating renewals at least 90 days prior to expiration, and initiating them in coordination with the client to prevent unused or expired licenses and ensure planning security.
• Service Operation: This encompasses several key functions:
• Automated detection of security incidents using the Cisco XDR platform, including false-positive filtering and prioritization.
• Incident Response with automated workflows.
• Threat Hunting & Threat Intelligence.
• Monitoring, Reporting, and Control.
• Reporting: Generation of monthly service reports and executive reports, detailing Key Performance Indicators (KPIs), SLA fulfillment, security status, and recommendations to provide transparency and a basis for future investments.
• Continual Service Improvement (CSI): Ongoing improvement of the SOC platform configuration and service quality through formal review processes and measurable optimization efforts. This includes service reviews and innovation workshops based on KPIs, and prioritizing identified optimization measures like new Cisco XDR correlation rules or policy adjustments within the existing platform.
• Half-yearly Service Recap and Innovation Workshop: Conducted twice a year to review past performance based on metrics and service reports, and to discuss further development topics for the Managed SOC and related infrastructure.
• Operation & Integration as Managed Service (Tenable): Providing managed services for the operation, configuration, and onboarding of the Tenable platform, including its integration into the existing SOC toolchain with Cisco XDR and Splunk Enterprise Security.
• Dashboards & Reporting (Tenable One): Ensuring the availability of customizable dashboards and automated reports within the Tenable platform for management and compliance purposes.
• Asset Inventory & Vulnerability Management (Tenable ASM): Enabling the client to identify and evaluate domains, IP addresses, certificates, and cloud resources using Tenable Attack Surface Management (ASM).
• Escalation Processes in the SOC: Establishing and adhering to defined escalation processes for security incidents based on their priority.

The service delivery is primarily remote or at the contractor's premises, with physical access to the client's site provided as needed. All data processing and data center locations must be within the EU.