Nástroj pro bezpečnostní monitoring technologické sítě ii

The contract timeline is structured around several key phases, with durations relative to the day a partial contract becomes effective (T).

The phases are:

1. Cílový koncept (Target Concept): To be completed and signed within T + 2 months, including time for the comments process.

2. Realizace a Příprava produktivního provozu (Realization and Preparation for Productive Operation): To be completed and signed within T + 2 months, including time for testing.

3. Produktivní provoz a podpora (Productive Operation and Support): To be completed and signed within T + 3 months.

"T" is defined as the day the partial contract becomes effective, and "M" denotes a month.

The document does not explicitly state a fixed contract start date, end date, or overall total duration in calendar days or months, only the relative durations of the phases from the effectiveness of a partial contract.

The core scope of work for this tender is centered around "NÁSTROJ PRO BEZPEČNOSTNÍ MONITORING TECHNOLOGICKÉ SÍTĚ II" (Tool for Security Monitoring of Technology Network II), specifically for the security monitoring of operational technology (OT) environments.

The high-level summary of the Statement of Work and core deliverables includes:

Main Objective:

The primary goal is the continuous detection of threats and ensuring detailed visibility of the operational network. The solution must allow for passive monitoring of operations and analysis of network communication without disrupting the normal functioning of the OT/ICS environment.

Key Functionalities:

The system is required to provide an overview of all active devices, detect security threats, vulnerabilities, and anomalies in network traffic, and ensure effective integration with existing security tools such as log management and SIEM.

Core Phases and Activities:

• Pre-implementation Analysis: This involves creating a detailed technical specification that covers all planned implementation procedures. The output will be a document containing descriptions of the technical solution and its components, a proposed architecture for the client's environment, detailed implementation steps, specific technical requirements (e.g., location, power, network segments, IP addressing, hardware for virtualization platforms, network pass-throughs, internet access, remote access, system monitoring, additional necessary hardware like TAPs, active network elements, SFP modules), mutual integration procedures, required client cooperation, proposed acceptance tests, a project risk catalog with mitigation proposals, and a detailed implementation schedule.
• Implementation and Preparation for Productive Operation / Installation and Configuration: This phase includes the delivery, installation, and configuration of all technical solution components that meet the tender's requirements and the specifics outlined in the pre-implementation analysis document. The outcome is a functional technical solution that includes all necessary licenses, subscriptions, and manufacturer technical support. It also involves the delivery of essential hardware, specifically one central analytical component, ten network probes with a computing platform, and the required number of SFP modules for optical connectivity. The solution must be deployed in all specified locations, conform to the approved architecture, and be fully functional for OT security monitoring, passing defined acceptance tests.
• Productive Operation and Support / Optimization of Security/Detection Policy: During this stage, the supplier will evaluate the effectiveness of the deployed solution, adjust the security/detection policy, and document all configuration changes aimed at enhancing detection efficiency for the client's future SOC analytical team. This includes incorporating the client's actual IP addresses into detection policies, specifying valid assets (such as DNS, SMTP, WEB, NTP, PROXY, MS AD) crucial for detection rules, and applying exceptions recommended by the client. All modified configurations will be documented and submitted as an output of this project phase.
• Ongoing Supplier Services: These services are essential for maintaining the long-term functionality and effectiveness of the implemented solution, covering comprehensive service support for all delivered technologies, which includes both reactive problem resolution and proactive maintenance.

Key Deliverables (Hardware and Documentation):

• Computing platform
• Network probe
• SFP module
• Target Concept (CK) document
• As-built documentation (DSP)
• Detailed technical specification document
• A functional technical solution
• Documented configuration adjustments
• Maintenance services including new software versions/updates, helpdesk support, bug fixes, functional enhancements, legal compliance, and technical support.

The overall subject of the public contract is the establishment of a Framework Agreement for the supply of technology for security monitoring of the operational technological environment.