Public procurement notice: Contract Award Notice
Published: 2017-12-23
Buyer: Statsbygg Hovedkontor
Country: NO
Contract type: Services
Procedure: Open procedure
CPV classification: 32235000 | 35120000: Surveillance and security systems | 35125000: Surveillance system | 71700000 | 72600000
Estimated value: 5000000 NOK
Award criteria: The most economic tender

Technical requirements: Statsbygg is responsible for the firewall (Cisco ASA), but would like 24/7/365 monitoring and co-management of Cisco FirePower module. Statsbygg envisages joint administrative responsibility for the Cisco unit, where the operational supplier administers the IPS part, including signature updates. The contract shall include the operation, maintenance and service of the necessary components and systems for the IPS system in Statsbygg. The aim is to monitor and log agreed traffic in Statsbygg's computer network, as well as uncover and prevent possible misuse, data thefts, hacking and other types of data attacks. The service shall be monitored by a 24 hours staffed service centre, 24 hours a day, 365 days a year. In the case of events, named persons in Statsbygg shall be notified by email, sms or telephone, depending on the criticality of the event. The events /notifications must be categorised into different categories, e.g. unauthorised access, denial of service, spam, wrong use, port /network scan, other.
In addition, an option is wanted for 24/7/365 monitoring and security analysis of correlated indexed log data from Statsbygg's Splunk system, which includes firewall logs from Cisco ASA, as well as any other relevant log sources in the long run, if there is a need for this. Tenderers are to come up with a system for the best way to solve this. There is a need for an engine that can analyse real time logs and an engine that can analyse big data. It will be seen as a big advantage if inquiries in real time can use the export format JSOB, as this uses less resources and is quicker than other formats such as raw, csv and xml. We would like volume dependent monitoring/analysis of log data, which can be priced per 10 Gb (without a Splunk licence) per month. We envisage starting with 30 Gb if the option for this is taken up.
Statsbygg shall be able to get all the log data directly from the sensors to its own internal log server.
In addition, an option is wanted for 24/7/365 monitoring and security analysis of correlated indexed log data from Statsbygg's Splunk system, which includes firewall logs from Cisco ASA, as well as any other relevant log sources in the long run, if there is a need for this. Tenderers are to come up with a system for the best way to solve this. There is a need for an engine that can analyse real time logs and an engine that can analyse big data. It will be seen as a big advantage if inquiries in real time can use the export format JSOB, as this uses less resources and is quicker than other formats such as raw, csv and xml. We would like volume dependent monitoring /analysis of log data, which can be priced per 10 Gb (without a Splunk licence) per month. We envisage starting with 30 Gb if the option for this is taken up.


Winner: NTT Security Norway
Award value: 5000000
Number of bids: 3