SaaS-based Data-Centric Security Platform (DSP) for Data and Access Security

Notice title: Bereitstellung und Betrieb einer SaaS-basierten Datenzentrierten Sicherheitsplattform (DSP) zur Analyse, Überwachung und zum Schutz von Daten und Zugriffsberechtigungen

Provision, implementation, and operation of a scalable, cloud-based Data-Centric Security Platform (DSP) for the analysis, monitoring, and protection of data and access permissions in a hybrid IT environment (on-premises and cloud). The solution includes analysis and evaluation of data assets, data accesses, and permission structures, including the identification of potential security and data protection risks; functions for detecting anomalies in user and entity behavior (User and Entity Behavior Analytics); creation of transparency regarding effective accesses and permissions; detection and evaluation of conspicuous, risky, or security-relevant activities; provision of monitoring, reporting, and evidence functions to support audit, compliance, and security requirements, especially in the regulated KRITIS environment; support in deriving and implementing suitable measures for risk reduction (e.g., adjustment of permissions or restriction of access rights); integration into the existing hybrid system landscape (identity services, file and cloud storage, collaboration platforms) via standardized interfaces. The provision and operation of the solution are in a SaaS model, including maintenance, further development, updates, and technical documentation. Additionally, services for continuous evaluation, assessment, and prioritization (Managed Detection and Response) of security-relevant events and the provision of recommendations for action are planned, which may also include operational support services. Continued operation requirements include ensuring an uninterrupted transition from an existing production-like operation, including a suitable migration and transition concept; taking over existing configurations, evaluations, and settings where technically possible; guaranteeing compatibility with existing system landscapes, role, and permission models; minimizing migration, integration, and training efforts while considering cost-effectiveness over the entire lifecycle; and ensuring continuous operational capability during the transition phase. All services related to the client's data or metadata must be provided exclusively within the scope of the EU-GDPR.

Tender documents

Additional details