Information technology services

Tender description

Driven by the ongoing development of our information security framework and business transformation programmes, EirGrid’s Information Security function has established a security testing and a security risk assessments reporting regime. The aim of the reporting regime is to provide EirGrid with the following: 1) Vulnerability assessment with the associated exposures inherent within their current infrastructure; 2) Comprehensive risk analysis and recommendations, including a remediation plan; 3) Security audit, security reviews and test details, including applied methodology. In keeping with its position in the industry EirGrid maintains a modern IT infrastructure comprising the following technologies: — Servers: physical and virtua, Linux, Unix, Windows, — desktop: Workstation and Laptop, Windows, — databases: oracle and MSQL, — network: routers, switches, firewalls, load balancers and gateways, — cloud services. EirGrid intends to establish a single supplier framework. The Framework Agreement period will be for an initial duration of three (3) years with the option to extend yearly for up to five (5) years, subject always to the satisfactory performance of the member. EirGrid require a security partner to provide the scope of services below. The scope of services is expected to include, but is not limited to: — Provision of Cyber Security Testing Services (CSTS) across EirGrid’s IT Infrastructure to ensure security, confidentiality and integrity, — security testing will be primarily targeted at the externally visible infrastructure but some may be required to be internal, — security testing may be targeted at production and pre-production environments, — some CSTS may require re-testing to confirm the implementation of the remediation plan, — each security testing will be subject to individual scoping determined by EirGrid and agreed with the successful supplier, including “rules of engagement” such as: —— type of security testing, —— targets, —— objectives (what can and cannot be done), —— scope (processes, website options, infrastructure, services that are off limits), —— progress reporting, —— entry points.