Lot n°1 Prestation de détection et réponse à incident

The contract is concluded for a duration of 12 months, starting from January 1, 2027. For Lot 1, the effective date is upon notification for reversibility, with execution beginning on January 1, 2027. The contract is tacitly renewable three times for a maximum of 12 months each.

Key milestones and phases mentioned include:

• Start of transfer phase / MOM (Début de phase de transfert / MOM)
• Start of exploitation phase / VA (Début de phase d’exploitation / VA)

The core scope of work for this tender primarily involves security services, divided into distinct components. The overall objective is to acquire and implement security solutions.

The general scope encompasses solutions for governance, risk management and compliance, identity management, data leak detection/prevention, vulnerability scans, and various security solutions for agents or workstations, such as file analysis and password managers. However, it explicitly excludes active protection equipment or software like proxy servers, reverse proxies, NAC solutions, and firewalls.

The market is structured with a firm tranche dedicated to continuous detection services, ensuring ongoing coverage of defined perimeters. Additionally, there is a conditional tranche for ad-hoc penetration testing campaigns, which can be activated as needed.

The initial perimeter includes:

• 62 public IP addresses exposed by hosting infrastructures.
• 50 DNS domain names owned by the collectivity.
• 120 websites, primarily hosted on public IPs via a reverse proxy infrastructure.
• 30 external websites hosted by collectivity providers.
• 1 Microsoft tenant.
• Continuous audit functionalities.

Key deliverables and services include:

• Acquisition and Implementation: Participation in identifying needs, analyzing market offers, and providing a complementary catalog of license prices/subscriptions (including maintenance) for selected solutions, along with a fixed price for their implementation.
• Project Management: Managing the deployment of security solutions, from defining needs to project evaluation.
• Single Point of Contact: Offering assistance and operational maintenance (MCO) and security maintenance (MCS) services.
• Multi-editor Solutions and Integration (Lot 3): Providing a multi-editor catalog of security solutions and integration services.
• Information System Security Audit Services (Lot 4): Conducting security audits of information systems.
• SOC and Incident Response: Taking over the existing Security Operations Center (SOC) service and providing specialized incident response services for cyber crises, including mobilization of human and technical resources (confinement, forensic analysis, crisis communication) through an annual subscription.
• Continuous Improvement: Provisions for evolving detection perimeters and technology changes to align with infrastructure developments and emerging threats.

The nature of the overall service is a service contract.