Managed Security Operations Center (SOC) und Cisco Security Enterprise Agreement

The contract timeline is as follows:

• Contract start date: 01.11.2026
• Total duration: 60 months
• Contract end date: Calculated to be 31.10.2031 (60 months after 01.11.2026).

The core scope of work for this tender is the provision of a Managed Security Operations Center (SOC) as a service. This includes the supply, renewal, and maintenance of necessary software licenses.

The Statement of Work (SOW) summarizes several key service areas and deliverables:

• Service Design & Transition: This involves establishing a quality-assured operating model and optimizing the existing architecture for productive use. The contractor will analyze the current Cisco license and configuration, develop an optimization concept, and improve the operational state. The goal is to deliver a fully operational, documented SOC-Stack with clear responsibilities and ensure full utilization of existing licenses.
• License Management - SOC Products: This service ensures continuous monitoring of license status and End-of-Life situations for all inventoried SOC platform components. License renewals will be communicated at least 90 days prior to expiration and initiated in coordination with the client, ensuring no unused or expired licenses, early planning security, and uninterrupted operations.
• Service Operation: This encompasses several critical functions:
• Incident Detection (Cisco XDR): Automated detection of security incidents via the Cisco XDR platform, including false-positive filtering and prioritization, continuously operated and optimized by the contractor.
• Incident Response - Automated Workflows.
• Threat Hunting & Threat Intelligence.
• Monitoring, Reporting, and Control: This includes providing a dashboard for service performance monitoring (e.g., SLA compliance, incident status, license utilization) and generating monthly service reports. This aims to provide full transparency of the SOC platform's security status, measurable SLA fulfillment, and informed decision-making for future investments.
• Escalation Processes: Ensuring security incidents are managed and escalated according to agreed-upon procedures and priority.
• Continual Service Improvement (CSI): This involves the continuous enhancement of the SOC platform configuration and service quality through formal reviews and measurable optimization. Service reviews will be based on KPIs (MTTA, MTTR, False-Positive-Rate, SLA-Compliance-Rate), with identified optimization measures recorded and prioritized. This aims for sustainable quality improvement, regulatory compliance, and proactive adaptation to new threats.
• Semi-annual Service Recap and Innovation Workshop: The contractor will conduct a service recap twice per calendar year to review performance based on key metrics and reports. Immediately following, an innovation workshop will be held to discuss further development of the Managed SOC and related infrastructure topics.
• Data Processing and Location: All processing and data center locations must be within the EU due to the sensitive nature of processed personal data (identity, login, network, and communication metadata of students and employees).
• Tenable Platform Integration: The contractor is responsible for enabling vulnerability scanning, prioritization, and attack surface management using Tenable Attack Surface Management (ASM). This includes providing customizable dashboards and automated reports within the Tenable platform for management and compliance. The operation, configuration, and onboarding of the Tenable platform are provided as a Managed Service, including integration with Cisco XDR and Splunk Enterprise Security.
• Service Location: The service will primarily be delivered remotely or from the contractor's premises, with physical access to the client's site provided as needed or explicitly requested.