Accelerated Onboarding of Security Feeds into the CSOC

Tender description

Why the Work is Being Done NHS Digital’s Data Security Centre (DSC) is integrating data and threat feeds into its Cyber Security Operations Centre (CSOC) to support the following strategic initiatives: • Supporting the CISOs critical key objective of reducing risk to NHS Digital • Enhancing cross-functional effectiveness - A DSC-wide process model will enable more effective cross-functional collaboration. • Driving resilience for the DSC and the NHS – Having a security services in place will enable the DSC to react more effectively to sudden change • Support for customer and patient outcomes - The health and care system we serve, and its cyber landscape, is not static it changes continuously. Problem to Be Solved NHS Digital require a supplier with significant expertise in data onboarding into Splunk Enterprise Security to append NHS Digital services into the CSOC protective monitoring service. The supplier will provide discovery teams comprising Playbook and Splunk Engineers working with and dependant on inhouse staff, these discovery teams shall inspect and verify each digital services infrastructure and platform. Using NHS Digital Information Security Policy and the CSOC Charter for reference, they shall verify that the necessary audit material is available and captures the necessary event data, determine which CSOC Security Use Cases can be applied and identify data sources to provide a protective monitoring service, reducing risks. Who Are the Users As a Security Use Case Manager, we need Splunk engineering and expertise to onboard new feeds, rules and dashboards, whilst developing and providing continuous improvements to the CSOC onboarding processes so that we can reduce cyber security risks to the NHS across England, drive maturity and optimisation to achieve the CSOC vision. Early Market Engagement Work Already Done NHS Digital’s Data Security Centre (DSC) has been working with a supplier to onboard NHS Digital operated services into the Cyber Security Operations Centre (CSOC) as part of a strategy to reduce risk and mature cyber security resilience. Existing Team You will be working with a full team made up of a Programme director, Programme manager, security architect and security analysts. Current Phase Not applicable Work Location NHS Digital Leeds Offices however remote working is acceptable in line with the current government guidance surrounding COVID-19. Working Arrangments Supplier is expected to supply resources working within a team made up of staff with Splunk specialist skills. The supplier must be flexible to our needs and able to work with a mixed team across the Leeds sites. All Supplier resource assigned to milestone 1 must be SC clearable or Security Cleared, Any personnel working on Milestone 2 must be security cleared. Supplier resource shall be required to abide by the current service operating hours of 8am – 6pm Monday –Friday, excluding Bank Holidays. Working patterns will be agreed with the authority’s representatives. Day rates inclusive of travel and subsistence. Security Clearance Individuals in the supplier’s team assigned to milestone 1 should be SC clearable or Security Cleared, All personnel working on Milestone 2 must be security cleared. Additional T&Cs The initial Statement of Work (SOW) and Draft Order Form/Call-off Terms and Conditions are available at the following link: https://nhsdigital.bravosolution.co.uk/web/login.html Bravo reference: prj_4859 To view the above you must be registered on NHS Digital's e-tendering portal. Suppliers not registered please register using the link above. The Buyer reserves the right to award future SOWs under this Call-off Contract against all charging methods in the framework. Skills & Experience Evidence of expertise in the use of the Splunk and Splunk Enterprise Security at an administrative level to support the development and build of the Protective Monitoring platform. Evidence of Splunk and Playbook engineers with experience of carrying out Discovery work to onboard services security feeds Evidence of proficiency with implementation and maturity of data onboarding model and the onboarding of key data sources Experience of delivery in highly complex, high volume secure data systems Experience of producing a knowledge transfer framework - including end to end document library of documentation covering discovery, including system design and build and ensuring smooth handover into live service Evidence of recent development and onboarding to the Common Information Model, the creation of correlation searches / saved searches and outputs as alerts, reports and dashboards Nice to Haves Strong understanding of the Amazon AWS platform and experience with Microsoft Azure and/or Google Cloud Demonstrable mentoring capabilities for permanent staff during the transition to path to live and live environments Sound understanding of the NHS infrastructure and programmes or equivalent complex environments Experience of customer and end user engagement across varied health care or equivalent complex environments No. of Suppliers to Evaluate 4 Proposal Criteria Approach and methodology How the approach or solution meets user needs Team structure Cultural Fit Cultural Fit Criteria Approach to functioning effectively and collaboratively in a complex multi-supplier environment. Approach to proactive issue management, problem resolution and improving ways of working Approach to leading by example to keep data secure. Approach to leveraging existing supplier knowledge and experience to the benefit of the wider programme Strategy for leaving a sustainable legacy by providing learning opportunities / knowledge transfer events for the CSOC team. Payment Approach Capped time and materials Assessment Method Case study Work history Reference Evaluation Weighting Technical competence 55% Cultural fit 5% Price 40% Questions from Suppliers No questions have been answered yet Budget range budget envelope of £1,500,000 to £2,000,000