Pořízení a implementace integrovaného řešení EDR/XDR a SIEM

The contract timeline is structured into several phases with specific durations and milestones:

• Contract Start Date: The contract becomes effective on the day of its publication through the contract register.
• Implementation Phases: The fulfillment of the contract subject is divided into three main phases:
• Fáze 1 (Pre-implementation analysis and Solution Design): To be completed no later than 60 calendar days from the effective date of the Contract.
• Fáze 2 (Delivery, installation, implementation, and integration): To be completed no later than 150 calendar days from the protocol acceptance of Fáze 1.
• Fáze 3 (Trial operation, documentation, and training): To be completed no later than 30 calendar days from the protocol acceptance of Fáze 2.
• Total Implementation Duration: The overall implementation, encompassing Fáze 1 through Fáze 3, will not exceed 240 calendar days from the effective date of the Contract.
• Key Milestones: Specific performance milestones will be detailed within Fáze 1 in the Solution Design, and once approved by the Client, they become binding.
• License Period: The License Period commences upon the acceptance of Fáze 3. The initial license package for EDR/XDR and SIEM is valid for 60 months.
• Contract End Date: The contract is concluded for a definite period, until all obligations arising from it are fulfilled, particularly until the expiration of the License Period and the warranty period.
• Service Agreement Duration: The Service Agreement is for a definite period of 60 months, starting from the initiation of service provision.

The core scope of work for this tender involves the delivery, implementation, and support of an integrated solution for protection against malware and cyberattacks on endpoints and servers. This solution comprises Endpoint Detection & Response (EDR/XDR) and Security Information and Event Management (SIEM) functionalities.

The project includes several key phases and deliverables:

• Analysis and Solution Design: Conducting an analysis of the current state and developing a target concept documented as a Solution Design.
• Technology Delivery and Implementation: Supplying specific EDR/XDR and SIEM products, followed by their implementation, configuration, and integration with the client's existing ICT infrastructure, including directory services, logging tools, and ticketing systems.
• Migration: Transitioning from the current endpoint protection solution to the newly provided EDR/XDR system, ensuring uninterrupted protection during this process.
• Automation: Designing and implementing automation scenarios to streamline operations with the new technology.
• Training: Providing on-site training for administrators (minimum 12 people) and security specialists (minimum 3 people) on the security functions of the solution, along with access to manufacturer's online training materials.

The continuous services for a period of 60 months after the solution's acceptance include:

• Managed Detection & Response (MDR) and Technical Support: This service aims to fulfill the client's obligations under Decree No. 409/2025 Sb. regarding cyber security event evaluation. It encompasses regular monthly technical prophylaxis for tuning, updating, and maintaining all managed components, as well as revising and updating detection and response policies, and consulting on configuration parameters.
• Threat Hunting and Analysis: This involves analyzing and correlating network logs and EDR telemetry to detect lateral movement of attackers, conducting threat hunting to identify advanced persistent threats (APT) and ransomware, and processing MITRE ATT&CK coverage heatmaps every six months to identify gaps and propose new detection rules.
• Incident Response (IR): For critical incidents, the provider must offer on-site expert support to assist in incident management, coordination of investigation, attack containment, system recovery, and activity prioritization. This includes the capability to perform forensic analysis of infected systems, create technical timelines of attacks, secure legal evidence, and assist with reporting cyber security incidents as per Act No. 264/2025 Sb. Detailed incident response reports are required for critical and high-severity incidents.