Managed Detection and Response (MDR) Service

“A comprehensive MDR service to support the protection of its users, information, systems and technology environment against cyber security threats. A managed cyber security service providing 24 hours a day, 7 days a week monitoring, detection, investigation and response capability, supported by appropriate security expertise, processes and technologies. The anticipated scope includes:

24/7 Security Operations Centre (SOC) monitoring and response; Endpoint Detection and Response (EDR) and/or Extended Detection and Response (XDR); Integration with and monitoring of Microsoft 365 and Microsoft Entra ID; Identity-based threat detection; Security alert investigation, triage and prioritisation; Proactive threat hunting; Threat intelligence; Incident containment and remediation support; Incident escalation and notification; Digital forensics and incident investigation; Integration with CHS's existing security and technology environment; Onboarding and deployment; Security reporting and service reviews; Vulnerability and exposure insights; Access to security specialists and escalation resources; Support during significant cyber security incidents; and Continual service improvement. Details of the following would also be beneficial: MDR service and operating models, including the division of responsibilities between CHS and the provider. Technologies deployed or integrated with in delivering MDR services. Integration with Microsoft 365, Microsoft Entra ID and other relevant security technologies. Threat detection, investigation, proactive threat hunting, containment and remediation capabilities. Incident response arrangements, including support for serious or high-impact cyber incidents.

24/7 SOC operating models and SOC locations. Relevant security standards, certifications and independent assurance. Security data processing, retention, protection and residency arrangements. Typical severity classifications, response times and service levels. Reporting, customer dashboards, service reviews and security metrics. Onboarding, implementation and transition arrangements. Typical licensing and commercial models.”