C23963 Home Office CSOC Engineering and Transition Support

Tender description

Summary of the work Home Office’s CSOC requires a supplier to support engineering and content activities associated with onboarding and BAU lifecycle management of systems/services/customers in-scope of its protective monitoring service. Expected Contract Length 2 years plus 6 months (Optional Extension) Latest start date Thursday 17 November 2022 Budget Range Circa £4m to £5m excl. VAT for the full two year term. It is expected that the value of the first year will be lower with a possible uplift in year 2 of the contract if the volume of onboarding increases. Why the Work is Being Done The Home Office Cyber Security Operations Centre (CSOC) is responsible for providing protective monitoring services across the Home Office. The CSOC is responsible for ensuring the confidentiality, integrity, and availability of these assets by monitoring malicious activities, identifying, and managing incidents. Problem to Be Solved To successfully provide protective monitoring services to the Home Office the CSOC follows a structured onboarding process. The CSOC requires supplier support to carry out the following onboarding and life-cycle management activities: 1) Engineering Life-Cycle Management – Technical Security Information and Event Management (SIEM) platform onboarding (i.e. Log ingest) and life cycle management of log sources within the SIEM tools (Splunk). 2) Content Life-Cycle Management – Development, implementation and life cycle management of content (e.g. use cases and SIEM rules) 3) Support of interfaces between SIEM tools and other CSOC tooling. Who Are the Users The CSOC service the whole of the Home Office. The onboarding of log sources and development of use cases under this contract will allow Home Office and the business areas they provide security monitoring for to receive early warning of indicators of compromise within their systems. Early detection allows rapid containment, the mitigation of cyber attacks and helps to prevent the loss of patient and other sensitive data and the loss of IT infrastructure which would negatively impact the delivery of patient care. Early Market Engagement There has been no relevant early market engagement. Work Already Done A number of log sources have been onboarded onto the current SIEM and use cases are currently active monitoring for security threats. Existing Team The CSOC has a range of functions including: 1) Threat Intelligence 2) Threat Hunting 3) Dev Ops Content 4) Dev Ops Engineering 5) Protective Monitoring 6) Incident Management 7) Service Management The supplier will be required to complement the existing content, engineering and discovery teams. Current Phase Live Skills & Experience • The supplier must provide evidence of delivering similar capabilities to other SOCs • The supplier should have proficiency working with national security and/or government organisations. • The supplier must provide evidence of working with Splunk products. • The supplier must evidence ability to scale delivery capacity (up as well as down). • The supplier must demonstrate proficiency in agile (sprint based) delivery. • The supplier must evidence SME knowledge & experience in cyber security. • The supplier must evidence SME knowledge & experience with various cloud and on-prem systems to help develop security use cases. • The supplier must evidence knowledge of tools such as Service Now, JIRA/Confluence and SharePoint Nice to Haves • Experience in process optimisation and implementing best practice related to SIEM Engineering and Content life-cycle management. • Providing consultancy support and quality assurance in becoming a Centre of Excellence. • Demonstrable mentoring capabilities for permanent staff during the transition to path to live and live environments. • Sound understanding of the Home Office infrastructure and programmes. Work Location The preferred working location is Manchester, however remote working with visits to Manchester depending on need. Although the preference is for collaborative work in the same location, remote-working is acceptable in line with government COVID-19 guidance. Working Arrangments The CSOC will provide the necessary leadership and project management support (along with other support). All development activities will take place on Home Office’s dedicated development devices (unless otherwise agreed) and all information will be stored on Home Office’s information and knowledge management platforms (Confluence, JIRA, SharePoint etc) Security Clearance Individuals in the supplier’s team that have access to Authority’s data must be SC cleared or clearable. Additional T&Cs Standard contract terms No. of Suppliers to Evaluate 3 Proposal Criteria • Ability to deliver a SIEM Engineering & life-cycle management capability. • Ability to deliver a Content life-cycle management capability. • Ability to deliver a team with demonstrable Splunk experience. • Ability to deliver a team with demonstrable cloud experience. • Ability to deliver a team with demonstrable SOC experience. • Ability to deliver using Agile delivery methodology to Government Standards (including: Government Digital Service Standards) • Ability to mobilise a team to start of the contract term. • Social Value - Deliver additional environmental benefits in the performance of the contract including working towards net zero greenhouse gas emissions. Cultural Fit Criteria • Raising issues early and learning lessons from past work. Collaboration with the CSOC team working as part of a single team. • Approach to leveraging existing supplier knowledge and experience to the benefit of the wider programme. Also, approach to proactive issue management, problem resolution and improving ways of working • Value for money. Strategy for leaving a sustainable legacy by providing learning opportunities / knowledge transfer events for the CSOC team. Supporting the setup of a Centre of Excellence. Payment Approach Fixed price Assessment Method • Case study • Work history • Reference • Presentation Evaluation Weighting Technical competence 60% Cultural fit 10% Price 30% Questions from Suppliers 1. Can the Authority give an indication as to the number of resources required to complement their existing teams and if possible, broken down into role type & expected SFIA levels. The project is in detailed planning stage at the current time. An estimate of resources required will be based on two factors(1) The Authority's planning and scheduling(2) Proposed resources required by the supplier for each agreed statement of works.As an estimate, the Authority would expect the following resources to be in the region of the following. The majority are expected to be in SFIA levels 3 or 4 with a small number at 5.FY 2022/23 - upto 5 FY 2023/24 - upto 13FY 2024/25 - upto 7 2. Is the Authority specifically seeking to use Splunk as the tool for this project or is it open to other solutions? Splunk is the selected tool. 3. Has an evaluation of the business requirements been made directing the authority towards Splunk and if so will it be available to potential suppliers A summary of project including strategy will be presented by the Authority at Stage 2 of this procurement. 4. Is The Home Office considering a single supplier only for this requirement or potentially multiple suppliers providing resources? The contract will be awarded to a prime service provider. The prime service provider may choose to sub contract elements of the requirement to other service providers, where the prime service provider may not have the capacity to delivery such a requirement. Please identify your intent to use sub-contractors and name them in your bid.All sub-contractor appointments will be subject to the Authority's approval. 5. What size of team does The Home Office require to complement the existing content, engineering and discovery teams? The project is in detailed planning stage at the current time. An estimate of resources required will be based on two factors(1) The Authority's planning and scheduling(2) Proposed resources required by the supplier for each agreed statement of works.As an estimate, the Authority would expect the following resources to be in the region of the following. The majority are expected to be in SFIA levels 3 or 4 with a small number at 5.FY 2022/23 - upto 5 FY 2023/24 - upto 13FY 2024/25 - upto 7 6. Does The Home Office require dedicated, named resources for the duration of the engagement, or does a pool of suitably qualified and screened resources meet the requirement? The winning bidder can supply a pool of suitably qualified and security cleared resources in line with provision of a contracted out service. Bidders should however note the lead time for onboarding individuals to Home Office systems, including the transfer of security clearance must be taken into account in terms of their ability to deliver against the requirement. Clearance can take up to 2 months and longer in some circumstances. 7. Who does the Home Office require the supplier to interface with for both day to day operations and periodic management reviews? This will be agreed as part of the contract award process with the winning bidder. 8. How often should the supplier plan for their team to be on site with The Home Office in Manchester? There is no specific amount of time required, bidders are encouraged to consider how they would work collaboratively both with the CSOC team in Manchester and remotely. This will contribute to scoring on cultural fit. The CSOC team work on shifts 24/7, as well as non-shift resources spending approximately 40% of their time in the office. 9. Broadly, how many existing and new use cases does The Home Office require the supplier to develop and maintain? Similarly how many existing and new log sources does The Home Office envisage the supplier onboarding? More detail on this element will be shared with shortlisted bidders in stage 2. The supplier will be required to both migrate and improve existing log sources and use cases, and onboard new log sources and use cases from a large number of systems of varying scale and complexity. Some use case development will be carried out by the existing CSOC team. 10. What Splunk and ServiceNow components are The Home Office using currently, and are there further components likely to be in scope going forward? This information will be shared with shortlisted bidders in Stage 2. 11. What DevOps and Threat Intelligence platforms are currently in place that the supplier will have to be skilled in? Both Azure and AWS DevOps platforms are in use. Threat intelligence is held both in MISP and TruSTAR. 12. "We note that one of the nice to have skills is “Sound understanding of the Home Office infrastructure and programmes.”. This specific criteria would tend to restrict applicants to be existing suppliers of the Home Office which we assume is not the case. Can we assume that what is meant here is “Sound understanding of complex infrastructure and programmes similar to those at the Home Office” and that evidenced examples from these similar clients will be evaluated to the same level as Home Office examples?" This is a nice to have, not essential criteria and will not restrict bidders to be existing or historic suppliers. Evidence of equivalent experience of similar organisations will also be considered. 13. Can some of the engineering / development team’s work be completed off-shore on the proviso that they do not have direct access to HO systems? No. Engineering and development will take place on Home Office systems which are not permitted to be accessed off-shore. 14. Could you please provide the anticipated wider procurement timetable so that we can plan resources accordingly i.e. • when successful bidders to stage-2 are notified• when stage-2 documents will be released• stage-2 response deadline• anticipated contract date Whilst we will be working towards these dates, these dates are tentative and can be subject to change at short notice• when successful bidders to stage-2 are notified - from 23/09/2022• when stage-2 documents will be released - 28/09/2022• stage-2 response deadline - 12/10/2022• anticipated contract date - 09/11/2022 15. How many log sources are to be on-boarded ? More detail on this element will be shared with shortlisted bidders in stage 2. The supplier will be required to both migrate and improve existing log sources and use cases, and onboard new log sources and use cases from a large number of systems of varying scale and complexity. Some use case development will be carried out by the existing CSOC team. 16. Will the on-boarding be phased i.e monthly, if so how many per month ? or will it be an initial ‘big bang approach’ ? On-boarding will be phased. 17. What type of log sources are to be on-boarded i.e. Servers / Clients / Applications ? More detail on this element will be shared with shortlisted bidders in stage 2. The supplier will be required to both migrate and improve existing log sources and use cases, and onboard new log sources and use cases from a large number of systems of varying scale and complexity. Some use case development will be carried out by the existing CSOC team. 18. How many Use Cases and what type i.e based on Syslog, SysMon, Azure, Office 365 or Windows Event IDs ? More detail on this element will be shared with shortlisted bidders in stage 2. The supplier will be required to both migrate and improve existing log sources and use cases, and onboard new log sources and use cases from a large number of systems of varying scale and complexity. Some use case development will be carried out by the existing CSOC team. 19. What is the ask or requirements for the, Support of interfaces between SIEM tools and other CSOC tooling? More detail on this element will be shared with shortlisted bidders in stage 2. 20. How would we access Home Office tooling to complete on-boarding and Use Case management? Would this be via VPN ? Via Home Office provided devices. 21. Is the SIEM via Splunk Cloud or Splunk Enterprise ? Splunk Cloud 22. How much time would you expect us to spend at the Manchester site? ie Weekly or Monthly workshops ? There is no specific amount of time required, bidders are encouraged to consider how they would work collaboratively both with the CSOC team in Manchester and remotely. This will contribute to scoring on cultural fit. The CSOC team work on shifts 24/7, as well as non-shift resources spending approximately 40% of their time in the office. 23. We understand the SIEM is Splunk, what other security devices are utilised and fed into the SIEM ? Detail on this will be shared with the winning bidder after contract award. 24. What hours are you expecting us to have cover. During office hours only 8 till 5 or would you expect on call cover ? No on-call cover will be required.