R6140 Cyber Security Managed SIEM

This is a services Contract for a Managed Cyber Security Operations Centre to cover some of the additional cybersecurity protection required to further harden the Tower Hamlets estate against cyber-attacks.

Requirements of the service:

• Initial health assessment and configuration of the Council’s in-house Security Event and Incident Management (SIEM) solution (Microsoft Sentinel).
• Secure log collection from both on-premises and cloud systems, with logs transmitted to an externally hosted intelligence platform for advanced threat analysis.
• Adaptable detection policies, leveraging automated intelligence, supplier expertise, and council-provided threat intelligence.
• Support for log ingestion from a wide range of infrastructure components, including Windows and Linux servers, firewalls, routers, Azure Active Directory, Microsoft Defender, and Office 365.
• No disruption to business operations during implementation.
• 24x7x365 managed SOC service with incident response capabilities and access to subject matter experts.
• Endpoint detection and response (EDR / XDR)
• Incident detection, analysis, response and escalation.
• Threat intelligence and threat hunting.
• Monthly executive risk reporting and KPIs.
• Ongoing threat detection and investigation support, drawing on previous incident data.
• Secure portal access for council staff to incident and management information, with all operational data and SOC personnel based in the UK and cleared to BPSS as a minimum.
• Demonstrated security accreditations.
• Full onboarding, deployment, and initial tuning of the solution, with clear cost breakdowns for setup.