Ransomware Containment Solution

AI-generated analysis of the documents. Check the official notice and any amendments for current submission details.

1. At a glance

2. Scope of Work

Iarnród Éireann-Irish Rail (IE) seeks a Ransomware Containment (RC) solution. The contract will provide capabilities for detecting, containing, responding to, and recovering from ransomware incidents. The solution must support industry best practices and integrate with IE's existing infrastructure.

Key capabilities required include:

• Detection: Behavioural analysis of suspicious activities and attack patterns, moving beyond signature-based detection.
• Containment: Automatic isolation of affected endpoints to prevent the spread of malicious activity across the network.
• Response and Investigation: Tools and processes to manage and investigate security incidents.
• Recovery: Mechanisms to restore systems and data following an incident.
• Monitoring and Alerting: Continuous oversight of the environment with timely notifications of potential threats.
• Reporting: Generation of reports on security status, incidents, and system performance.
• Automation: Capabilities to automate detection, containment, and response workflows.
• Platform Architecture: Requirements for the overall system design, including endpoint agents and a management console/dashboard.
• System Requirements: Technical specifications for the solution's operation.
• Integration: Seamless integration with IE's Security Information and Event Management (SIEM) system.
• User and Access Management: Control over user privileges and access to the RC platform.
• Compliance and Audit: Features to support regulatory compliance and audit trails.
• Deployment and Support: Services related to the initial setup and ongoing maintenance of the solution.

The contract duration is for 3 years, with an option for IE to extend by two additional 24-month periods at its discretion. The form of contract will be provided at the Invitation to Tender (ITT) stage.

3. Background & buyer context

Iarnród Éireann-Irish Rail (IE) is procuring this Ransomware Containment (RC) solution as a utility operating within the transport sector. Its procurement procedures are governed by the Utilities Directive (2014/25/EU) and the European Union (Award of Contracts by Utility Undertakings) Regulations 2016. IE is a designated activity company, limited by shares, registered in Ireland. The procurement process is structured in two stages: a pre-qualification questionnaire (PQQ) stage, followed by an invitation to tender (ITT) stage for shortlisted applicants. This procurement aims to ensure IE aligns with industry best practices in cybersecurity.

4. Eligibility & selection criteria

To be considered for this tender, applicants must meet the following minimum qualification and selection criteria:

• Turnover requirement: A minimum average annual turnover of €400,000 (exclusive of VAT) for the last three audited financial year ends. Evidence must be provided via signed auditor's statements and audited accounts.
• Insurance: Not specified for this tender.
• Certifications:
• Management System certified as compliant with EN ISO 9001:2000 or equivalent.
• Information Security Management System certified as compliant with ISO 27701:2019 or equivalent.
• ISO 14001 or equivalent.
• Past experience: Applicants must demonstrate experience in implementing a Ransomware Containment (RC) solution through at least 3 relevant, current, or recently completed contracts within the last 5 years. These contracts should include deployments within Critical National Infrastructure (CNI) environments and support organisations with at least 2000 users, showcasing the required capabilities.
• Personnel: Not specified for this tender.
• Geographic / facility constraints: Not specified for this tender.

5. Award criteria & scoring

The award of the contract will be based on a two-stage evaluation process: pre-qualification and tender. For the tender stage, the following criteria will be used to evaluate shortlisted applicants:

Criterion Weighting Sub-criteria