Optimizing cybersecurity through specification and procurement of a SIEM system
Objective
E-Control's IT leadership identified the introduction of a comprehensive SIEM system for the organization's IT landscape as an important step towards a legally compliant cyber-security landscape. Although the organization already had experience with SIEM systems, it decided to carry out the specification and tendering of such a system and the associated services together with ReqPOOL as an external partner. The goal of the tender was to procure a service provider for the setup and operation of a SIEM system (cloud and/or on-premise) as well as for the operation of a SOC (security operations center) with SIEM analysts.
Approach
ReqPOOL sees two of its strengths in specifying complex IT topics and preparing them for EU-wide tenders according to the relevant legal requirements (such as the federal procurement act, BVergG 2020). Especially for public contracting authorities, a correct specification and a precise, legally compliant definition of suitability, selection and award criteria play a major role. Together with E-Control's stakeholders, the following steps were taken: Specification of the requirements: based on initial research on SIEM, ReqPOOL captured requirements in a “standard requirements catalog for SIEM systems”, validated it with E-Control's stakeholders, compared it with the security processes actually needed and running in-house, and revised it. In addition to the requirements catalog, a service description (“scope document”) for the later tender was written — with the goal of supporting all relevant processes at E-Control with the new system without specifying requirements “past the market”. To make requirements and service description easier to understand, process-like user stories were also captured for the integrators. Request for information: to actively validate the requirements and service description on the market, ReqPOOL conducted an RFI with several dozen possible SIEM service providers. The results were a sharpened requirements catalog, feedback on the user stories and first cost indications, from which a contract value estimate was derived that required an EU upper-threshold tender. The RFI was thus the ideal preparation for an RFQ — an EU-wide tender. EU tender: with the help of a specialized procurement lawyer, the sharpened specification documents were used for an EU tender. Together with this lawyer and ReqPOOL, suitability, selection and award criteria were created, as were a draft service level agreement (SLA) and a project contract. In the later phases of the tender, ReqPOOL also supported the bid evaluation and the bidder presentations.
Result
The result of this procurement for E-Control was the successful selection of the most suitable service provider for the setup and operation of SIEM systems in the public sector, with SOC services in cyber security also available on call. The internal stakeholders of ECA-IT are thus ideally supported in their pursuit of legally compliant cybersecurity. The tender documents, contracts and schedules also form the starting point for the implementation, acceptance and regular operation of the SIEM system — fundamental preparation for deploying the solution.
With ReqPOOL's help, we were able to accelerate our procurement project from the very beginning. From requirements engineering and market research to the actual tender, a structure was introduced that eased our internal work and alignment. The added value lay both in the professional support and in bringing in the right methods. ReqPOOL's moderation, best practices and benchmarks did the rest to make the collaboration valuable. We will continue to involve ReqPOOL in future strategic IT projects.
Thomas Reitinger
Project lead E-Control
Get in touch
Arrange a no-obligation initial conversation with our contact person.
Christian Buchegger
Chief Sales Officer & Authorised Signatory
