Splunk Enterprise Security

The contract timeline is as follows:

The performance start date is with the award of the contract, which is presumably in calendar week 42 of 2026.

The contract has a minimum duration of 36 months. After this initial period, an annual extension of licenses takes place, provided that neither party terminates the contract. The maintenance services are terminated if the EVB-IT Überlassungsvertrag Typ B is terminated.

Key milestones and phases during the first three years are described by three scenarios:

• Scenario 1 (Minimum): Upon contract signing, positions 1 and 2 from the price sheet are called. There are no optional extensions during the first three years.
• Scenario 2 (Example): Positions 1 and 2 are called upon contract signing. Position 3 is called after 6 months, position 4 after 18 months, and position 5 after 24 months.
• Scenario 3 (Maximum): Positions 1, 2, and 3 are called upon contract signing. Positions 4 and 5 are called at the beginning of the second contract year, and positions 6 and 7 at the beginning of the third contract year.

In all scenarios, after the third contract year, an annual renewal of licenses occurs for the respective utilized options, unless one party terminates the contract.

The core scope of work for this tender primarily involves the delivery, integration, and maintenance of a Security Information and Event Management (SIEM) system with integrated Security Orchestration, Automation and Response (SOAR) capabilities. The specific product is "Splunk Core + Enterprise Security (ES) Premier Edition" by Cisco/Splunk, intended for the internal Security Operations Center (SOC) of Techniker Krankenkasse (TK).

The high-level summary of the Statement of Work and core deliverables includes:

• Delivery of SIEM and SOAR System: Provision of the "Splunk Core + Enterprise Security (ES) Premier Edition" software licenses.
• System Integration: Ensuring close integration between SIEM and SOAR components from installation, allowing seamless operation within the same user interface for incident management, and enabling SOAR automation to access SIEM data.
• On-Premise Operation: The application must be fully operable on-premise within TK's IT infrastructure, specifically on virtualized Red Hat Enterprise Linux 9 servers, and integrated into TK's standardized server management.
• System Requirements: The solution must support high availability in "Active-Active" mode, with components running simultaneously on multiple servers and load distribution, and must be scalable and cluster-capable.
• Core SIEM Functionalities: Implementation and configuration of SIEM features including log delivery, log normalization, query language and detection rules, logging and audit capabilities, and workload management.
• Core SOAR Functionalities: Implementation and configuration of SOAR features such as case management, automation, and integrations.
• Software Maintenance and Support: Ensuring software maintenance and support by the manufacturer, which includes permanent provision of new program versions and bug fixing for the "Splunk Core + Enterprise Security (ES) Premier Edition" software.
• Documentation: The contractor must document maintenance services, including an overview of provided program versions and accompanying documents (e.g., license key). If agreed, updated Software Bill of Materials (SBOMs) must be provided.
• Notification Obligations: The contractor is required to inform the client about the consequences of new program versions for the software's intended use and to promptly notify the client of any significant deviations from requirements or contractual obligations.