Prestations d'audits de cybersécurité - Ligne C du métro Toulousain

The contract is for a duration of 21 months, commencing from the Service Order for the start of the services.

Key milestones and phases include:

• T0 - Service Order for the start of project management services:
• Delivery of the Project Management Plan: 1 month from T0.
• T1 (archi) - Service Order for the start of the architecture audit:
• Initialization meeting for the architecture audit: 2 weeks from T1 (archi).
• Start of the architecture audit and availability of input data: 1 month from T1 (archi).
• Closure of the architecture audit: 3 months from T1 (archi).
• T1 (conf) - Service Order for the start of the configuration audit:
• First initialization meeting for the configuration audit: 2 weeks from T1 (conf).
• Start of the configuration audit and availability of input data: 1 month from T1 (conf).
• Final restitution meeting and closure of the configuration audit: 8 months from T1 (conf).
• T1 (intrusion) - Service Order for the start of intrusion tests:
• Initialization meeting for intrusion tests: 2 weeks from T1 (intrusion).
• Final restitution meeting for intrusion tests: 4 months from T1 (intrusion).
• Monthly Progress Reports (RMA): Delivered on the last working day of each month, detailing ongoing tasks, completed actions, consumed and remaining days, and any alerts or points of attention.

Payment milestones are linked to the delivery of the Project Management Plan, the closure of various audits (architecture, configuration, intrusion tests, organizational and physical), and monthly progress based on RMA and meetings.

The core scope of work for this tender involves providing cybersecurity audit services for the "Ligne C" of the Toulouse metro. The services are broadly categorized into project management and various types of audits.

The core statement of work summary includes:

• Project Management: This encompasses the development of a project management plan and conducting monthly progress reviews and meetings.
• Audits:
• Architecture Audit: This involves an initial meeting, data collection, and a comprehensive audit of the system architecture.
• Configuration Audit: This entails auditing the configuration of various assets across specific perimeters, namely SDT, CFA, PCC, and INFRA-GAD. The audits will generate individual reports for each audited equipment and a final synthesis report.
• Organizational and Physical Audit: This type of audit is listed as a mission.
• Penetration Testing (Test d'intrusion): This involves an initial meeting, conducting penetration tests, and providing a global report on the findings.

The deliverables explicitly stated are:

• Project Management Plan.
• Monthly Progress Reports (RMA) and associated meeting minutes.
• Support documentation and minutes for initial and restitution meetings related to architecture, configuration, and penetration testing audits.
• Global Architecture Audit Report.
• Unit Configuration Audit Reports (one per equipment) in Excel format, detailing identification, summary, criteria, results, comments, recommendations, gravity levels, and priority levels for security measures.
• Final Configuration Audit Synthesis Report.
• Global Penetration Test Report.

The overall duration of the market is 21 months from the service order for starting the prestations. The scope also covers specific sub-systems under the CFA perimeter, including data centers, ticketing, video protection, telephony/interphony, radio communication networks, IT networks (outside the transport system), chronometry, station sound systems, passenger counting, access control, and intrusion detection for Line C.