Germany - Security software with integrated SIEM and SOAR functionality

Description

In order to monitor both its IT assets, which it operates on-premise on its own existing IT infrastructure, and the IT assets that it operates in the Microsoft Azure and AWS clouds that it currently uses, KfW requires standardized software that has the "Security Information and Event Management (SIEM)" and "Security Orchestration, Automation and Response (SOAR)" functions.

SIEM and SOAR functionality must form an architecturally integrated overall solution.

The SIEM/SOAR solution must be able to be operated in two ways: On the one hand, exclusively in KfW's existing on-premise IT environment. Secondly, hybrid, i.e. in parallel both in KfW's on-premise IT environment and simultaneously in the cloud environments used by KfW. The hybrid operating model requires that anomalies, events and alarms can be correlated, analyzed and processed across the various operating instances (federated operation).

For both the "On Premise" and "Hybrid" operating models, the Contractor (hereinafter: "Contractor") must ensure that the information, event and log data of KfW's On Premise IT environment processed by the SIEM/SOAR solution is not stored or processed in a public cloud or in a private cloud of the Contractor.

Should KfW decide to switch from Microsoft Azure and AWS to other clouds or to use additional clouds during the term of the Contract, the Contractor shall enable the operation of the SIEM/SOAR Solution in these cloud environments.

The Contractor owes the following services:
(a)
Purchase or rental of user licenses for the SIEM/SOAR solution.
(b)
Granting of the necessary rights of use to an on-premise version and additionally to cloud versions of the SIEM/SOAR Solution used by KfW.
(c)
Initial installation of the on-premise version and the cloud versions of the SIEM/SOAR solution on KfW's IT infrastructure free of charge. Either by the Contractor virtualizing or dedicatedly installing the SIEM/SOAR software in KfW's existing Linux or OpenShift container operating platforms. Alternatively, the Contractor delivers the SIEM/SOAR solution including the associated operating environment and installs both as a package as a software appliance. In the latter case, the delivered operating environment of the appliance must be dimensioned in such a way that it fulfills all requirements that KfW has defined for the quantity structure during the entire term of the contract.
(d)
Uninstallation of all variants of the SIEM/SOAR solution free of charge at the end of the Contract.
(e)
Provision of product documentation for the SIEM/SOAR Solution.
(f)
Ongoing maintenance and servicing of the SIEM/SOAR solution by providing patches, updates and upgrades as well as new software releases or software versions developed by the manufacturer.
(g)
Support for the SIEM/SOAR solution in the sense of the elimination of any malfunctions occurring ? if necessary with the involvement of the manufacturer ? and the answering of KfW's questions regarding the use of the SIEM/SOAR solution.
(h)
If the Contractor offers the SIEM/SOAR Solution as a software appliance, i.e. including the necessary operating environment, it shall owe maintenance, care and support not only for the SIEM/SOAR Software itself, but also for the operating system and its environment or software components supplied by it. The service for the operating environment then includes patches, regular updates and upgrades as well as technical support in the event of errors in accordance with the agreed service levels.
(i)
Advice and training of KfW as required on questions regarding the implementation or configuration of the SIEM/SOAR solution, the optimization of its use and other technical or professional questions in connection with the use and operation of the SIEM/SOAR solution.

Opportunity closing date

29 July 2024

Value of contract

to be confirmed