ITES-10718 - Fiji - Co-Managed Security Operations Centre Service - Deadline August 10,2026

Vendor needs to provide co–managed security operations centre service. – Establish a continuous (24x7x365) capability to detect, triage, investigate and respond to information security events and incidents across systems.• Provide, host, operate and maintain an enterprise–grade SIEM platform (including underlying infrastructure, licensing, storage and tuning) for the full duration of the contract, at no additional capital cost to agency.• Ingest, normalise, parse, enrich and correlate logs and telemetry from all in–scope sources (Annex A), including the three revenue platforms, WAF, firewalls, Active Directory, AWS/cloud workloads, EDR, email gateway, network devices, servers and databases.• Provide continuous, around–the–clock monitoring of all in–scope sources by qualified SOC analysts, with no gaps in coverage including Fiji public holidays.• Operate a tiered analyst model (L1 triage, L2 investigation, L3 advanced analysis / incident response) with defined escalation paths to agency.• Develop, document and maintain a detection use–case library aligned to a recognised framework (e.g. MITRE ATT&CK), covering at minimum: unauthorised access and broken–access–control exploitation, account takeover and credential abuse, mass enumeration of taxpayer records, insecure file–upload abuse, web–application attacks, malware, data exfiltration and privilege escalation.• Establish and operate a threat–intelligence function that collects, analyses and applies strategic, operational and tactical threat intelligence relevant to revenue authorities, government and the Pacific region.• Integrate threat–intelligence feeds (commercial, open–source and sector/government sources) into the SIEM for automated indicator matching.• Conduct proactive, hypothesis–driven threat hunting across in–scope systems at a defined cadence (at minimum monthly), targeting indicators of compromise and adversary techniques not covered by existing detections.• Provide, during incident response, the proper identification, collection, acquisition and preservation of evidence in a forensically sound manner, maintaining chain of custody suitable for disciplinary, regulatory or legal proceedings.