Monitoring, analysis, threat hunting and incident response consultancy services

The person complies with the selection criteria applicable to it individually: (a) has the legal and regulatory capacity to pursue the professional activity needed for performing the contract as required in the tender specifications.

For the participants involved in security sensitive activities, the participation in the tender is open to economic operators fulfilling the following three cumulative conditions: (a) legal entities established in a Member State with their executive management structures established in that Member State; (b) economic operators committing to carry out all relevant activities in one or more Member States; and (c) legal entities not being subject to control by a third country or third country entity.

The tenderer, including all members of the group in case of a joint tender, subcontractors and entities on whose capacity the tenderer intends to rely if applicable: (a) fulfil(s) all the selection criteria for which a consolidated assessment will be made as provided in the tender specifications.

The person declares that it: (a) is subject to conflicting interests which may negatively affect the contract performance.

ENISA will designate a contact point to run this contract and it expects the prospective contractor to designate one Contract Manager (and designated backup) to act as the (single) point of contact for all Agency needs. The Contract manager shall be responsible for the overall management and administration of the framework contract including the organisation of appointment schedules, requests from and communication with ENISA, i.e. invoicing, etc. The nominated contract manager having a minimum of three (3) years of professional experience in managing contracts shall be able to communicate fluently in the English language. The contractor must provide its contact details (as minimum an e-mail address and phone number, and also a back-up connection channel) to which all communication will be channeled. The contractor must be able to make use of a ticketing system, and possibly the one proposed by ENISA.

For the performance of the above-mentioned activities, the following skills and knowledge is required and must be demonstrated by the tenderer in the submitted technical offer: · Relevant EU legislation knowledge and compliance. · Practical experience in similar projects. · Knowledge in relevant well known standards, methodologies and good practices.

The successful tenderers shall provide CVs of experts describing their experience in similar projects and possible certifications if available. The team of experts will be selected depending on their experience with regard to the specific requirements related to each project. The team may comprise of a balance of both junior and senior experts. You are required to provide only the CVs of experts deemed relevant and experienced in the above-mentioned topics. For this call in particular, we expect that you should include at least 4 experts; at least 2 'Senior Experts' and at least 2 'Junior Experts'. NOTA BENE: · The proposed team need to be composed by professionals that are holders of at least the following certificates: Azure security operations analyst, Microsoft Azure Security Engineer Associate Professional, Microsoft cybersecurity architect, Splunk Enterprise Certified Admin, Splunk Enterprise Certified Architect and Microsoft Security Engineer and Microsoft Security architect. These certificates must be present in total in the proposed team members, All these certificates is not a requirement to be hold by a single person. · Each proposed team member Junior and Senior must hold at least one certificate.

The Junior Expert must have: · Completed university studies (Bachelor's Degree/Level 6 of the EQF attested by a diploma in Computer Science, Computer Engineering or equivalent; · At least three (3) years of professional experience and expertise in logs monitoring, analysis, threat hunting, threat analysis, threat intelligence, situational awareness reporting and incident response. Extensive knowledge of hardware, software and networking technologies to provide a powerful combination of analysis, implementation and support; · Very good writing and communication skills; · Excellent command of the English language (at least C1 level according to the Common European Framework of Reference for Languages (CEFR)); · Excellent project management skills including quality assurance; · At least one certificate as described in section 3.3.

The Senior Expert must have: · Completed university studies (Bachelor's Degree/Level 6 of the EQF attested by a diploma in Computer Science, Computer Engineering or equivalent; · At least six (6) years of professional experience and expertise in logs monitoring, analysis, threat hunting, threat analysis, threat intelligence, situational awareness reporting and incident response. · Extensive knowledge of hardware, software and networking technologies to provide a powerful combination of analysis, implementation and support; · Very good writing and communication skills; · Excellent command of the English language (at least level C1 according to the Common European Framework of Reference for Languages (CEFR)); · Excellent project management skills including quality assurance; · At least one certificate as described in section 3.3.

The contractor's personnel assigned to these services must possess at least EU CONFIDENTIAL security clearance certificates for the proposed team members.