Delivery of Security Feeds into the CSOC

Tender description

Why the Work is Being Done NHS Digital’s Data Security Centre (DSC) is integrating additional data and threat feeds into its Cyber Security Operations Centre (CSOC) to support two critical strategic initiatives: • Supporting the healthcare sector’s response to COVID-19 to counter related ransomware and phishing efforts and other malicious activity. • Supporting the Government Security Group to strengthen the security of Critical National Infrastructure (CNI) assets owned and operated by the Arm's Length Bodies (ALBs) of the Department of Health and Social Care (DHSC). This work will deliver improvements in the DSC’s ability to deliver enhanced threat hunting and to mitigate and remediate identified risks and vulnerabilities. Problem to Be Solved NHS Digital require a supplier with significant expertise in Splunk Enterprise Security to enhance the critical operations of the Data Security Centre, CSOC. This enables Key national services to be onboarded onto CSOC Splunk ES providing a view of how services are performing for end users along with the ability to better identify when user impacting issues are occurring and provide the ability to increase the SCOC maturity score. The impact and consequences of this consultancy requirement not being achieved could reduce the threat hunting capabilities of the CSOC jeopardising the security of systems and may impact front line services. Who Are the Users As a Security Use Case Manager, I need Splunk engineering and expertise to onboard new feeds, rules and dashboards, whilst developing and providing continuous improvements to the CSOC onboarding processes so that I can reduce cyber security risks to the NHS across England, drive maturity and optimisation to achieve the CSOC vision. Early Market Engagement Not Applicable Work Already Done Onboarding of security feeds for NHSD Programmes into Splunk ES Existing Team You will be working with a full team made up of a Programme director, Programme manager, various CSOC team members Current Phase Not applicable Work Location NHS Digital Leeds Offices however remote working is acceptable in line with the current government guidance surrounding COVID-19. Working Arrangments The supplier is expected to supply resources working within a team made up of staff with Splunk specialist skills. We expect the supplier to be flexible to our needs and able to work with a mixed team across the Leeds sites. The resources must be co-located with the Authority in Leeds and must be Security Cleared (SC) Day rates to be inclusive of travel and subsistence Security Clearance Individuals in the supplier’s team must be SC cleared or clearable Additional T&Cs Draft Order Form, the initial Statement of Work (SOW) and Draft Order Form/Call-off Terms and Conditions are available at the following link: https://nhsdigital.bravosolution.co.uk/web/login.html Bravo reference: pre_220 - Delivery of Security Feeds into the CSOC To view the above you must be registered on NHS Digital's e-tendering portal. Suppliers not registered please register using the link above. The Buyer reserves the right to award future SOWs under this Call-off Contract against all charging methods in the framework. Skills & Experience Evidence of expertise in the use of the Splunk and Splunk Enterprise Security at an administrative level to support the development and build of the Protective Monitoring platform. Evidence of proficiency with implementation and maturity of data onboarding model and the onboarding of key data sources Experience of delivery in highly complex, high volume secure data systems Experience of producing a knowledge transfer framework - including end to end document library of documentation covering discovery, including system design and build and ensuring smooth handover into live service The supplier must provide evidence of the ability to create a Centre of Excellence comprising a dedicated in-house onboarding function for the CSOC during the transition to inhouse onboarding. Evidence of recent development and onboarding to the Common Information Model, the creation of correlation searches / saved searches and outputs as alerts, reports and dashboards Nice to Haves Strong understanding of the Amazon AWS platform and experience with Microsoft Azure and/or Google Cloud Demonstrable mentoring capabilities for permanent staff during the transition to path to live and live environments Sound understanding of the NHS infrastructure and programmes. Experience of customer and end user engagement across varied health care Programmes No. of Suppliers to Evaluate 3 Proposal Criteria Written Proposal Case Study Work History Reference Cultural Fit Criteria Approach to functioning effectively and collaboratively in a complex multi-supplier environment. Approach to proactive issue management, problem resolution and improving ways of working Approach to leading by example to keep data secure. Approach to leveraging existing supplier knowledge and experience to the benefit of the wider programme Strategy for leaving a sustainable legacy by providing learning opportunities / knowledge transfer events for the CSOC team. Payment Approach Fixed price Assessment Method Evaluation Weighting Technical competence 55% Cultural fit 5% Price 40% Questions from Suppliers No questions have been answered yet Budget range