Specifications include, but are not limited to: The SECaaS, a Managed Security Services solution, must include the following services: • 24/7 cybersecurity threat and vulnerability monitoring of ongoing and potential threats and vulnerabilities with an expert team who can help identify, isolate and perform forensic analysis to understand any possible impact from cybersecurity attacks or vulnerabilities; • MDR with the ability to quickly triage, investigate, alert and respond to incidents; • Intrusion prevention and detection; • Centralized logging into a SEIM or SEIM like system; • Endpoint monitoring detection for multiple device types including physical / virtual Windows/Linux servers, network appliances and devices, PCs, Laptops and tablets; • Cyber Incident Response Team (“CIRT”) who can support the incident response lifecycle along with the Agency; • Continuous notifications to the Agency concerning latest and ongoing Cybersecurity threats and vulnerabilities; • Threat modelling framework used such as OWASP top 10/ MITRE ATT&CK Framework; • Real-time threat intelligence especially with zero-day or emerging threats; • Up-to-date protection for zero-day or emerging threats within its system(s); • User-friendly dashboard to monitor endpoint threats across multiple data centers and virtual private clouds environments; • Ability and capacity to contain threats on the Agency’s behalf; • Ability to isolate and block known threats; • Ability to stop attackers earlier in the ‘cyber kill chain’ to prevent lateral spread; • Ability to conduct proactive and reactive threat hunting across all the Agency’s environments; • Interaction with the Agency Information Technology team on a continuous basis through the duration of the engagement by means of status reports, meetings and email notifications; • Weekly vulnerability scanning and reporting; • Periodic penetration testing of the Agency’s public facing web applications with a report and debriefing upon completion; • Periodic penetration testing of the Agency’s Wi-Fi with a report and debriefing upon completion; • Periodic firewall reviews with a report and debriefing upon completion; • Periodic network health check reviews with a deliverable report and debriefing upon completion
