Security software package

Tender description

Manchester Airport Group PLC (MAG) wishes to commence a procurement process to award a contract for the provision of a Security Operations Centre (SOC) and Security Information and Event Management (SIEM) tool across its Group portfolio including UK airports at Manchester, Stansted, East Midlands and Bournemouth as well as its US operations. The successful supplier will work collaboratively with MAG in order to implement the SIEM tool and provide ongoing SOC services to strengthen MAG's Information Security resilience. Security Information Event Management (SIEM) Tool The SIEM tool is required to be a commercial off-the-shelf (COTS) packaged software product that is readily available to the marketplace. It is proposed that MAG will own the license for the SIEM tool directly. The SIEM tool will be expected to deliver the following capabilities: — Advanced analytics. — Advanced threat defence. — Business context and security intel. — Data and application monitoring. — Deployment and support simplicity. — Incident response and management. — Real time monitoring. — User monitoring. Outsourced Security Operations Centre (SOC) To support the SIEM tool there is also a requirement for an outsourced security operations centre (SOC). The scope of the SOC service offering will include the initial implementation of the tool as well as the ongoing service function. The high level scope of implementation will cover the following areas: — Deployment of SIEM tool including the detailed design and implementation of the tool, — Installation of any on-premise IT infrastructure required to support the service, — Integration of first phase of MAG legacy system reporting and alerts into SIEM tool (including testing with any required third parties), — Detailed use case development, definition and implementation, — SIEM tool configuration and tuning, — Testing, — Go-Live. Ongoing SOC Service Once the SIEM tool has been implemented the successful supplier will be required to deliver ongoing SOC services in the following areas: — SOC to monitor the SIEM tool 24/7, 365 days a year, — Application support, — Ongoing integration of additional MAG legacy system reporting and alerts into SIEM tool, — Real-time analysis of security alerts generated by network and applications, — Established incident response processes, — Risk matrix development and upkeep of service management plan, — Development of Reporting and Compliance outputs, — Vulnerability management reporting, — Defined standard reporting, interaction with MAG internal teams and team support, — MAG internal team access to the raw log data of SIEM tool and have the ability to generate MAG only view reports from the log data. The contract will be procured via a Negotiated procurement process.