Security Operations Center (SOC)

The contract timeline is as follows:

• Contract Start Date: The Framework Agreement (Raamovereenkomst) is set to commence on Monday, January 11, 2027.
• Initial Duration: The Framework Agreement has an initial term of thirty-six (36) months (three years).
• Extension Options: The contracting authority has the option to extend the assignment three (3) times, each for a period of twelve (12) months, under the same conditions.
• Total Potential Duration: With all extensions exercised, the total potential duration of the contract would be 72 months (6 years).
• Key Milestones/Phases: The implementation of the SOC services will proceed in phases per participant, starting with a limited set of use cases and service times, followed by gradual scaling up. This includes an initial build-up period before reaching an effective "mature" operational phase.

The core scope of work for this tender involves the provision of Security Operations Center (SOC) services. This includes the monitoring, detection, analysis, and follow-up of security incidents and threats within IT and, optionally, OT environments. The service delivery is structured into a mandatory basic package and optional additional services, with phased implementation per participant, allowing for scalability and further development over the contract period.

The Statement of Work (SOW) summary details the following core deliverables and services:

Basic SOC Services:

• Security monitoring and detection.
• Incident response, including event management, security incident management, and CSIRT activation.
• Threat intelligence.
• Reporting and dashboarding.
• Use case management.
• Knowledge transfer.

Optional/Additional Services:

• Vulnerability management.
• Situational awareness.
• Threat hunting.
• Forensics.
• Tabletop exercises.
• Rollout of sensors.

Key Deliverables:

• Preparation of a Dossier Afspraken en Procedures (DAP) and a Dossier Financiële Afspraken (DFA) within 30 days of the agreement's effective date, in consultation with the participant and the Steering Organization.
• Escalation overviews providing insight into escalated security incidents, reasons for escalation, actions taken, and remaining risks.
• Participation in periodic consultation sessions, including monthly SOC operational meetings, quarterly strategic meetings, and use-case and detection refinement sessions.
• Security incident reports for each analyzed or handled security incident, including root-cause analysis, impact analysis, timeline, TTPs used, measures taken, and recommendations.
• Transfer reports for relevant security incidents, changes, or contract termination, including all relevant documents, configurations, detection content, and log data in a transferable format.