Computer-related services

Tender description

For the purposes of enhancing the Universities IT security operation, the University wish to purchase specialist Security Operations Centre (SOC) Services. As part of the ongoing Cyber Security Programme, the University of Manchester wishes to enhance the capabilities of the current IT Security Operations team and evolve it towards a Security Operations Centre (SOC) Service. The University wishes to deploy a hybrid operating model where the capabilities of the SOC are provided jointly between internal University staff and service providers. The services provided by the SOC, and the operating model desired for each of them, have been defined by the University as the output of a current state assessment. The SOC is a part of the target operating model of both Information Governance Office (IGO) and transformed IT Services. A Security Operations Centre (SOC) is a central management facility that acts as a focal point for operational security management and platform monitoring, from an Information Security perspective, within an organisation. (It is also sometimes referred to as a Cyber SOC or CSOC). The core business function of a SOC is to enable security incident reporting, detection, investigation, and response; using data from endpoint devices, logs, security systems, and network flows; in conjunction with clearly defined processes and specialist staff. An effective SOC can build robust situational awareness and prioritize the deployment of enterprise resources to address security issues. In addition to the core capabilities, a mature SOC also assists wider organisational security processes. These range from feeding into business risk assessment, compliance or internal audit through to technical control management and secure system architecture. The SOC integrates with wider technology platform monitoring. The University of Manchester wishes to improve the confidentiality, integrity, availability and authenticity of its systems and infrastructure by implementing a Security Operations Centre. The Security Operation Centre will act as a central management facility to provide a continuous service to prevent, record, respond and manage cyber-security incidents.