Cyber Threat Monitoring and Response Services

Summary

The procurement is for 36 months of cyber-threat monitoring and response services for a state forestry enterprise. The supplier must install and configure a SIEM system in the buyer’s infrastructure, collect and analyse logs, identify and report cyber incidents, investigate them and provide technical support for their resolution. The supplier provides the software and licences, while collected logs remain in the buyer’s infrastructure. The system must process at least 3,500 events per second; where licensing is based on the number of data sources, it must cover at least 200 source objects. Automated data collection runs 24/7, while analysis and incident notifications are provided on working days during the hours specified in the tender documents. Collected logs must be retained for 6 months and analysis data for 12 months; system availability must be at least 99.8% per year. The supplier performs an initial assessment, migrates data and rules from the existing LogRhythm solution, provides at least 8 hours of free remote training and submits monthly and quarterly reports. Installation and unrestricted service commencement are due within one month of contract entry into force and no later than 11 December 2026. Response times for high, medium and low priorities are 1, 2 and 4 hours respectively; resolution times are 2, 4 and 8 hours. The award is based on price alone, and the procurement is not divided into lots. A bid must include the signed offer form, the European Single Procurement Document and the required declarations; qualification evidence will be requested from the prospective winner. At least four specialists with the required security and SIEM expertise are required, with experience and certificates specified in the qualification criteria. The successful bidder must provide performance security equal to 2% of the initial contract value. National-security restrictions also apply: the bidder, relevant subcontractors and entities relied upon must meet the tender’s registration and location requirements, and neither the service nor the proposed products may threaten national security.