← Back to Proposal

1. Contract Structure (Section 5.1)

Ref	Requirement	Compliance	Notes
5.1	Contract period: Initial 3 years with two optional 1-year extensions (3+1+1)
5.1.1	End-to-end XDR platform with MXDR managed services
5.1.1	Total 7,500 endpoint licenses required
5.1.2	Phased implementation approach with batch onboarding
5.1.3	License and subscription activation upon RWS written authorization only
5.1.3	MXDR services commence immediately upon any asset onboarding
5.1.4	Stipulated Commissioning Date: On or before 1st June 2026
5.1.4	Full onboarding and operational: By 31st December 2026

2. Protection Modules (Section 5.1.2)

2.1 Mandatory Modules (5.1.2.1)

Ref	Requirement	Compliance	Notes
5.1.2.1.a	Core EPP/EDR/XDR coverage for all physical servers
5.1.2.1.b	Core EPP/EDR/XDR coverage for laptops and workstations
5.1.2.1.c	Core EPP/EDR/XDR coverage for virtual machines and VDI
5.1.2.1.d	Container protection for Kubernetes, AKS, ACK environments
5.1.2.1.e	Cloud workload protection for Azure and Microsoft 365
5.1.2.1.f	Vulnerability management capabilities		Assessment via Defender Vulnerability Management. Attack simulation via built-in BAS (SafeBreach/AttackIQ). Virtual patching via Exploit Protection mitigations (DEP, ASLR, CFG), ASR rules, and Block Vulnerable Applications feature.
5.1.2.1.g	AI for Security features
5.1.2.1.h	Integration with existing security tools

2.2 Optional Modules (5.1.2.2)

Ref	Requirement	Compliance	Notes
5.1.2.2.a	Additional cloud protection (AliCloud, SaaS applications)		Supported as optional add-on without re-architecture
5.1.2.2.b	Mobile device protection (iOS, Android)		Supported as optional add-on without re-architecture
5.1.2.2.c	IoT/OT/Robotics security		Supported as optional add-on without re-architecture
5.1.2.2.d	Email protection and security		Supported as optional add-on without re-architecture
5.1.2.2.e	Network detection and response (NDR)		Supported as optional add-on without re-architecture
5.1.2.2.f	Identity threat protection		Supported as optional add-on without re-architecture
5.1.2.2.g	AI/GenAI security		Supported as optional add-on without re-architecture

3. Agent & Management (Section 5.4.2.1-5.4.2.2)

3.1 General Agent Requirements (5.4.2.1)

Ref	Requirement	Compliance	Notes
5.4.2.1.1	Single lightweight unified agent for all endpoint types
5.4.2.1.2	Role-based access control (RBAC) with user access reviews
5.4.2.1.3	RESTful API for programmatic access
5.4.2.1.4	Custom IOC watchlists capability
5.4.2.1.5	Silent/unattended installation support
5.4.2.1.6	Ring-based staged rollout capability
5.4.2.1.7	Anti-tampering protection
5.4.2.1.8	Self-healing capabilities
5.4.2.1.9	Offline protection when disconnected
5.4.2.1.10	Network isolation capability
5.4.2.1.11	Support for Windows Server 2016 and later
5.4.2.1.12	Support for Windows 10/11
5.4.2.1.13	Support for Red Hat Enterprise Linux 8+
5.4.2.1.14	Support for Ubuntu 20.04+
5.4.2.1.15	Support for macOS (where applicable)
5.4.2.1.16	Centralized cloud-based management console
5.4.2.1.17	Multi-tenant architecture support
5.4.2.1.18	Policy inheritance and override capabilities
5.4.2.1.19	Audit logging of all administrative actions
5.4.2.1.20	Bandwidth throttling for agent updates
5.4.2.1.21	Proxy support for agent communications

3.2 Agent Deployment (5.4.2.2)

Ref	Requirement	Compliance	Notes
5.4.2.2.1	Single universal installer package
5.4.2.2.2	Full functionality across all workload types
5.4.2.2.3	No multi-stage installations required
5.4.2.2.4	SCCM/Intune deployment support
5.4.2.2.5	GPO deployment support

4. EPP Technical Requirements (Section 5.4.2.3)

4.1 Policy and Administration (5.4.2.3.1)

Ref	Requirement	Compliance	Notes
5.4.2.3.1.1	Logical device segmentation by business unit/location
5.4.2.3.1.2	Policy versioning with rollback capability		Native version comparison and one-click rollback not available. Similar functionality via export to JSON, store in git, restore by re-import. Audit trail via Unified Audit Log.
5.4.2.3.1.3	Segregation of duties between IT and Security teams
5.4.2.3.1.4	Detection/monitor-only mode for testing

4.2 Threat Prevention (5.4.2.3.2)

Ref	Requirement	Compliance	Notes
5.4.2.3.2.1	Real-time malware prevention using signatures
5.4.2.3.2.2	Machine learning-based detection
5.4.2.3.2.3	Behavioral analysis engine
5.4.2.3.2.4	Ransomware detection with one-click restore		Ransomware blocking via ASR rules and behavioral detection. One-click restore not native to MDE. File restoration via Windows Volume Shadow Copy, OneDrive/SharePoint versioning.
5.4.2.3.2.5	Fileless attack detection
5.4.2.3.2.6	Zero-day threat detection
5.4.2.3.2.7	Rootkit detection and prevention
5.4.2.3.2.8	Memory exploit prevention
5.4.2.3.2.9	Device control for USB devices
5.4.2.3.2.10	Device control for Bluetooth devices
5.4.2.3.2.11	Virtual patching capability

4.3 Performance Requirements (5.4.2.3.3)

Ref	Requirement	Compliance	Notes
5.4.2.3.3.1	CPU usage 5% or less during on-access scanning
5.4.2.3.3.2	RAM usage 250MB or less under normal operation
5.4.2.3.3.3	VDI support for persistent and non-persistent environments
5.4.2.3.3.4	Emergency safe mode for troubleshooting		CPU throttling configurable for scans. No automatic emergency safe mode. Remediation via MDE Client Analyzer, Passive Mode, manual Intune adjustment.

4.4 Telemetry and Reporting (5.4.2.3.4)

Ref	Requirement	Compliance	Notes
5.4.2.3.4.1	Structured JSON event format
5.4.2.3.4.2	Syslog export capability		Syslog and LEEF may require Sentinel configuration or third-party connector.
5.4.2.3.4.3	CEF/LEEF format support
5.4.2.3.4.4	REST API for log export
5.4.2.3.4.5	SIEM mapping documentation
5.4.2.3.4.6	Compliance reports for ISO, PCI-DSS, PDPA		ISO and PCI via Microsoft Compliance Manager. PDPA reporting custom built by Armor.

4.5 Operational Tools (5.4.2.3.5)

Ref	Requirement	Compliance	Notes
5.4.2.3.5.1	Secure local quarantine with admin-controlled restore
5.4.2.3.5.2	Troubleshooting tools (diagnostics, agent repair, API)
5.4.2.3.5.3	Offline update packages and air-gap workflows		Linux supports mirror server for offline updates. Windows supports WSUS. True air-gapped environments have reduced EDR functionality as MDE is cloud-based.
5.4.2.3.5.4	Detailed release notes with every update
5.4.2.3.5.5	Safe file/metadata submission with privacy controls
5.4.2.3.5.6	Immutable audit logs with 90-day retention
5.4.2.3.5.7	Self-service on-demand scanning

5. EDR Technical Requirements (Section 5.4.2.4)

5.1 Telemetry Collection (5.4.2.4.1)

Ref	Requirement	Compliance	Notes
5.4.2.4.1.1	Windows artifact collection (60+ artifact types)
5.4.2.4.1.2	Linux artifact collection
5.4.2.4.1.3	Process execution telemetry with full command line
5.4.2.4.1.4	File system activity monitoring
5.4.2.4.1.5	Network connection telemetry
5.4.2.4.1.6	DNS query logging
5.4.2.4.1.7	Authentication event capture
5.4.2.4.1.8	Registry modification tracking (Windows)
5.4.2.4.1.9	Module/DLL loading activity
5.4.2.4.1.10	Local buffering during network outages
5.4.2.4.1.11	90-day hot storage retention minimum
5.4.2.4.1.12	Data resync upon connectivity restoration

5.2 Detection and Analysis (5.4.2.4.2)

Ref	Requirement	Compliance	Notes
5.4.2.4.2.1	Living-off-the-land (LOTL) technique detection
5.4.2.4.2.2	Multi-stage attack chain correlation
5.4.2.4.2.3	Credential abuse detection
5.4.2.4.2.4	MITRE ATT&CK framework mapping
5.4.2.4.2.5	Dynamic risk scoring per alert
5.4.2.4.2.6	Behavioral analytics engine
5.4.2.4.2.7	Custom detection rule creation		IOC/IOA natively supported. YARA requires Sentinel with YARA-capable data sources.
5.4.2.4.2.8	Continuous rule updates from vendor threat intel

5.3 Investigation and Hunting (5.4.2.4.3)

Ref	Requirement	Compliance	Notes
5.4.2.4.3.1	Visual process trees and timelines
5.4.2.4.3.2	Entity pivot investigation capability
5.4.2.4.3.3	Saved and scheduled hunt queries
5.4.2.4.3.4	Case management with SLA tracking		Covered by Armor Nexus
5.4.2.4.3.5	Remote forensic bundle collection
5.4.2.4.3.6	Advanced query language (SQL/KQL-like)
5.4.2.4.3.7	Query sharing between analysts

5.4 Response and Containment (5.4.2.4.4)

Ref	Requirement	Compliance	Notes
5.4.2.4.4.1	Remote network isolation of endpoints
5.4.2.4.4.2	Remote process termination
5.4.2.4.4.3	Hash-based file blocking
5.4.2.4.4.4	Scripted remediation with dry-run mode		No native dry-run mode. Armor will validate scripts in test environments where required.
5.4.2.4.4.5	Ransomware rollback capability		Relies on Windows Volume Shadow Copy, OneDrive/SharePoint versioning. No agent-based automatic rollback.
5.4.2.4.4.6	Live response shell access
5.4.2.4.4.7	OT/ICS read-only collection mode		Requires Microsoft Defender for IoT add-on. Available as optional module.
5.4.2.4.4.8	File quarantine capability
5.4.2.4.4.9	File deletion capability
5.4.2.4.4.10	Custom script execution across endpoints
5.4.2.4.4.11	Immutable audit trail for all response actions

5.5 Performance and Scale (5.4.2.4.5)

Ref	Requirement	Compliance	Notes
5.4.2.4.5.1	Support 10,000+ endpoints per tenant
5.4.2.4.5.2	60-second maximum ingest latency
5.4.2.4.5.3	30-second isolation execution time
5.4.2.4.5.4	5-second query response for 7-day searches
5.4.2.4.5.5	99.9% API uptime SLA
5.4.2.4.5.6	Horizontal scaling capability

5.6 Noise Reduction & Case Handling (5.4.2.4.6)

Ref	Requirement	Compliance	Notes
5.4.2.4.6.1	Alert noise reduction workflows
5.4.2.4.6.2	Legal hold and evidence retention		Per-case legal hold requires Microsoft Purview eDiscovery or external evidence management.
5.4.2.4.6.3	Secure tenant data segregation
5.4.2.4.6.4	Published telemetry schema
5.4.2.4.6.5	Endpoint identity spoofing detection
5.4.2.4.6.6	Per-host process baselining
5.4.2.4.6.7	Query concurrency/rate limits disclosure
5.4.2.4.6.8	Signed remediation scripts with code review		Script signing not enforced. Armor will implement operational procedures for signing and code review where required.
5.4.2.4.6.9	Memory capture with encryption/integrity
5.4.2.4.6.10	Registry/plist backup before remediation		Backup possible via Live Response. No automatic backup before destructive remediation.
5.4.2.4.6.11	Hash-based evidence cataloguing

6. XDR Technical Requirements (Section 5.4.2.5)

6.1 Data Ingestion (5.4.2.5.1)

Ref	Requirement	Compliance	Notes
5.4.2.5.1.1	Multi-domain ingestion: endpoint, firewall, DNS, email, identity, cloud, OT/IoT
5.4.2.5.1.2	Endpoint telemetry latency: 15 seconds or less
5.4.2.5.1.3	Identity/email telemetry latency: 60 seconds or less
5.4.2.5.1.4	Cloud telemetry latency: 120 seconds or less
5.4.2.5.1.5	Schema normalization to OCSF-like format
5.4.2.5.1.6	Pre-built integrations for major security vendors

6.2 Context and Enrichment (5.4.2.5.2)

Ref	Requirement	Compliance	Notes
5.4.2.5.2.1	Entity resolution across users, devices, and IPs
5.4.2.5.2.2	Asset inventory with criticality scoring
5.4.2.5.2.3	CMDB and vulnerability data enrichment

6.3 Detection and Analytics (5.4.2.5.3)

Ref	Requirement	Compliance	Notes
5.4.2.5.3.1	Temporal correlation engine
5.4.2.5.3.2	ML-based cross-domain pattern detection
5.4.2.5.3.3	Attack path stitching across domains
5.4.2.5.3.4	User and Entity Behavior Analytics (UEBA) baselining
5.4.2.5.3.5	21 TTP detection categories minimum
5.4.2.5.3.6	Explainable AI (XAI) for detection reasoning		Via Microsoft Copilot for Security and Armor Nexus AIP
5.4.2.5.3.7	Anomaly detection from baselines
5.4.2.5.3.8	Automatic MITRE ATT&CK mapping

6.4 Incident Response (5.4.2.5.4)

Ref	Requirement	Compliance	Notes
5.4.2.5.4.1	Visual playbook editor
5.4.2.5.4.2	Cross-domain orchestration: endpoint actions
5.4.2.5.4.3	Cross-domain orchestration: firewall rule push
5.4.2.5.4.4	Cross-domain orchestration: IdP session revocation
5.4.2.5.4.5	Cross-domain orchestration: email quarantine
5.4.2.5.4.6	Cross-domain orchestration: SaaS app actions
5.4.2.5.4.7	Cross-domain orchestration: cloud resource isolation
5.4.2.5.4.8	Pre-built playbooks with containment objectives
5.4.2.5.4.9	Incident lifecycle management
5.4.2.5.4.10	SLA timers and tracking
5.4.2.5.4.11	Evidentiary bundle creation
5.4.2.5.4.12	Unified incident timeline across domains
5.4.2.5.4.13	Single-console investigation interface
5.4.2.5.4.14	Automated response action logging

6.5 Dashboards and Reporting (5.4.2.5.5)

Ref	Requirement	Compliance	Notes
5.4.2.5.5.1	Role-based dashboards: SOC analysts
5.4.2.5.5.2	Role-based dashboards: leadership/executive
5.4.2.5.5.3	Role-based dashboards: compliance
5.4.2.5.5.4	MTTD/MTTR visualization
5.4.2.5.5.5	MITRE ATT&CK coverage gap analysis
5.4.2.5.5.6	PII minimization in reports

6.6 Threat Intelligence (5.4.2.5.7)

Ref	Requirement	Compliance	Notes
5.4.2.5.7.1	STIX 2.x format support
5.4.2.5.7.2	TAXII 2.x protocol support
5.4.2.5.7.3	MISP integration		Armor can build custom connectors where required
5.4.2.5.7.4	OpenCTI integration		Armor can build custom connectors where required
5.4.2.5.7.5	IOC scoring and deduplication
5.4.2.5.7.6	Retro-hunt on new threat intel
5.4.2.5.7.7	YARA rule support		Requires Sentinel with YARA-capable data sources

6.7 Search and Query (5.4.2.5.10)

Ref	Requirement	Compliance	Notes
5.4.2.5.10.1	Pipeline query language
5.4.2.5.10.2	Schema-on-read capability
5.4.2.5.10.3	Hot-tier query latency: 24h data in 3 seconds
5.4.2.5.10.4	Hot-tier query latency: 7d data in 7 seconds
5.4.2.5.10.5	Hot-tier query latency: 30d data in 15 seconds
5.4.2.5.10.6	Support 50 concurrent analyst queries
5.4.2.5.10.7	Live/streaming queries
5.4.2.5.10.8	Graph queries for attack path visualization
5.4.2.5.10.9	Saved query library
5.4.2.5.10.10	Scheduled query execution
5.4.2.5.10.11	Query result export (CSV, JSON)
5.4.2.5.10.12	Cross-source unified search
5.4.2.5.10.13	API access to query capabilities

7. MXDR Service Requirements (Section 5.4.2.6)

7.1 Service Operations (5.4.2.6.1)

Ref	Requirement	Compliance	Notes
5.4.2.6.1.1	24x7x365 monitoring coverage
5.4.2.6.1.2	In-tenant operation with MFA
5.4.2.6.1.3	Least-privilege access model
5.4.2.6.1.4	Just-in-time (JIT) access provisioning
5.4.2.6.1.5	Singapore-based L2/L3 escalation within 2 hours
5.4.2.6.1.6	Data source health monitoring
5.4.2.6.1.7	100% alert triage coverage

7.2 Threat Hunting (5.4.2.6.3)

Ref	Requirement	Compliance	Notes
5.4.2.6.3.1	Daily scheduled proactive hunts
5.4.2.6.3.2	Retro-hunts within 24h of new TTP intelligence
5.4.2.6.3.3	Detection engineering backlog management
5.4.2.6.3.4	MITRE ATT&CK coverage heatmap
5.4.2.6.3.5	Quarterly playbook testing
5.4.2.6.3.6	Hunt success KPI tracking
5.4.2.6.3.7	Intel-driven hunting
5.4.2.6.3.8	Hypothesis-driven hunting

7.3 Forensics and Containment (5.4.2.6.4)

Ref	Requirement	Compliance	Notes
5.4.2.6.4.1	Remote forensic collection with chain-of-custody
5.4.2.6.4.2	Pre-approved containment actions
5.4.2.6.4.3	Change window coordination
5.4.2.6.4.4	Immutable action audit logs
5.4.2.6.4.5	Evidence preservation procedures

7.4 Incident Management (5.4.2.6.5)

Ref	Requirement	Compliance	Notes
5.4.2.6.5.1	Hourly P1 incident updates until containment
5.4.2.6.5.2	Daily critical incident summaries
5.4.2.6.5.3	Weekly security reports
5.4.2.6.5.4	Monthly security reports
5.4.2.6.5.5	Quarterly security reports
5.4.2.6.5.6	Post-incident hardening recommendations

7.5 Service Quality (5.4.2.6.8)

Ref	Requirement	Compliance	Notes
5.4.2.6.8.1	40% noise reduction target
5.4.2.6.8.2	99.99% service availability
5.4.2.6.8.3	Live SLA/case portal access
5.4.2.6.8.4	Surge capacity with auto-routing
5.4.2.6.8.5	Vulnerability intelligence correlation
5.4.2.6.8.6	Weekly vulnerability reports
5.4.2.6.8.7	Real-time dashboard for RWS access
5.4.2.6.8.8	Monthly executive reporting
5.4.2.6.8.9	Quarterly Business Reviews (QBRs)
5.4.2.6.8.10	RACI matrix documentation
5.4.2.6.8.11	Detailed MTTD/MTTR tracking
5.4.2.6.8.12	Incident-to-alert ratio tracking
5.4.2.6.8.13	False positive rate tracking

7.6 Personnel Requirements (5.4.2.6.9-14)

Ref	Requirement	Compliance	Notes
5.4.2.6.9.1	Singapore-based in-house SOC (no outsourcing)		Singapore is the primary location for serving APAC with engineering and incident response staff. Armor's global presence may route some work to other locations.
5.4.2.6.9.2	L1 analyst certifications (BTL1 or equivalent)
5.4.2.6.9.3	L2 analyst certifications (BTL2/GCIH or equivalent)
5.4.2.6.9.4	L3 analyst certifications (BTL3/GCFA/OSCP or equivalent)
5.4.2.6.9.5	Dedicated Technical Account Manager (TAM)
5.4.2.6.9.6	Background checks for all personnel
5.4.2.6.9.7	NDA requirements for all personnel
5.4.2.6.9.8	Backup SOC in separate geographic region
5.4.2.6.9.9	Tiered SOC structure (L1/L2/L3)
5.4.2.6.9.10	Clear escalation paths between tiers
5.4.2.6.9.11	Minimum 40 hours annual training per analyst
5.4.2.6.9.12	Proof of certifications available for audit
5.4.2.6.9.13	Casino regulatory licensing where required
5.4.2.6.9.14	Age 21+ for casino property access
5.4.2.6.9.15	No criminal history for assigned staff
5.4.2.6.9.16	Professional conduct requirements
5.4.2.6.9.17	Role-based, time-bound access with full audit trails
5.4.2.6.9.18	Immutable analyst action logging

8. Timeline & Deliverables (Section 6)

8.1 Project Timeline (6.1)

Milestone	Timeline
Project Kick-off	T (Award Date)
Completion of Design	T + 4 weeks
Completion of Cloud/On-Prem Deployment	T + 8 weeks
Completion of SIT with Sign-Off	T + 10 weeks
Completion of UAT with Sign-Off	T + 12 weeks
Completion of ORT with Sign-Off	T + 14 weeks
System Commissioning with Sign-Off	T + 15 weeks ("C")
Performance Guarantee Period	C + 3 to 6 months
Warranty Period	System Acceptance + 9 months

8.2 Project Management Deliverables (6.3.1)

Ref	Requirement	Compliance	Notes
6.3.1.1	Project Plan
6.3.1.2	Project Deliverables & Schedule
6.3.1.3	Statement of Work (Project Scope)
6.3.1.4	Project Risk, Issue and Change Logs
6.3.1.5	Deployment Plan

8.3 Requirement Deliverables (6.3.2)

Ref	Requirement	Compliance	Notes
6.3.2.1	Functional Requirements Specifications
6.3.2.2	Non-Functional Requirements Specifications
6.3.2.3	Integration Requirements Specifications

8.4 Analysis and Design Deliverables (6.3.3)

Ref	Requirement	Compliance	Notes
6.3.3.1	Architecture & Technical Specifications & Diagram
6.3.3.2	Application, UI & Report Design Specifications
6.3.3.3	Tuning Report
6.3.3.4	Logical Database Model
6.3.3.5	Data Conversion and Migration Design

8.5 Installation & Configuration Deliverables (6.3.4)

Ref	Requirement	Compliance	Notes
6.3.4.1	Environment Configuration Baseline
6.3.4.2	Deployment Guide
6.3.4.3	Operations Guide
6.3.4.4	Backup, Failover & Recovery Guide
6.3.4.5	Housekeeping Configuration Baseline
6.3.4.6	Source code (if applicable)

8.6 Testing Deliverables (6.3.5)

Ref	Requirement	Compliance	Notes
6.3.5.1	SIT Test Strategy/Plan, Scenarios, Cases, RTM, Defect Logs, Summary
6.3.5.2	UAT Test Strategy/Plan, Scenarios, Cases, RTM, Defect Logs, Summary
6.3.5.3	Performance Test Strategy/Plan, Scenarios, Cases, Defect Logs, Summary
6.3.5.4	High Availability (HA) Test Plans, Scenarios, Cases, Defect Logs, Summary
6.3.5.5	Disaster Recovery (DR) Test Plans, Scenarios, Cases, Defect Logs, Summary
6.3.5.6	ORT Test Plans, Scenarios, Cases, Defect Logs, Summary

8.7 Training Deliverables (6.3.6)

Ref	Requirement	Compliance	Notes
6.3.6.1	Training Slides
6.3.6.2	Training Hand-outs
6.3.6.3	Quick Start Guides (How-To)
6.3.6.4	Frequently Asked Questions (FAQ)

8.8 Managed Security Services Deliverables (6.3.10)

Ref	Requirement	Compliance	Notes
6.3.10.1	Monthly and Quarterly Security Monitoring Reports
6.3.10.2	Incident Reports (per incident)
6.3.10.3	Threat Hunting Reports (as conducted)
6.3.10.4	Role and Access Review Reports (periodically)
6.3.10.5	Use Case Review and Improvement Recommendations
6.3.10.6	Configuration Baseline Review and Recommendations
6.3.10.7	Security Landscape Review Reports
6.3.10.8	System Platform Health and Performance Reports
6.3.10.9	Customized Dashboards and Alert Definitions
6.3.10.10	Incident Response Playbooks and Runbooks
6.3.10.11	Recommendations for Security Posture Improvement

9. Acceptance Tests (Section 11)

Ref	Requirement	Compliance	Notes
11.2	Submit comprehensive test plan, acceptance criteria, procedure 1 week prior to testing
11.4	Provide all tools and testing equipment at Supplier's cost
11.8.1	Installation Test: Walk-through with RWS to check installation quality
11.9	System Integration Test (SIT): All components end-to-end verification
11.9.5	SIT Exit Criteria: All scenarios executed, no Medium/High defects outstanding		Performance observations will be reported but not guaranteed as SLO commitments
11.10	User Acceptance Test (UAT): Business user verification
11.10.6	UAT Exit Criteria: All scenarios executed, no Medium/High defects outstanding		Performance observations will be reported but not guaranteed as SLO commitments
11.11	Operational Readiness Test (ORT): Production environment verification
11.11.5	ORT Exit Criteria: All acceptance criteria met, no Medium/High defects		Performance observations will be reported but not guaranteed as SLO commitments
11.12	Performance Test: Demonstrate conformance to Section 17.10 requirements
11.13	Failover Test: Verify failover and failback with minimum interruption
11.14	HA and DR Tests: High Availability and Disaster Recovery verification
11.15	Support RWS-initiated security validation/assurance activities

10. Warranty & Maintenance (Sections 15-16)

10.1 Warranty Requirements (Section 15)

Ref	Requirement	Compliance	Notes
15.3	Warranty Period: 9 calendar months from System Acceptance Date
15.4.1	Adhere to SLA during Warranty Period
15.4.2	Responsible for satisfactory operation at no additional cost
15.4.3	Render replacements, investigations, services at no cost
15.4.4	Corrective maintenance, troubleshooting, defect isolation
15.5.1	Normal patches within 5 working days
15.5.2	Critical patches within 24 hours

10.2 Maintenance Requirements (Section 16)

Ref	Requirement	Compliance	Notes
16.1	Maintenance includes platform software, configuration updates, managed-service sustainment
16.2	Maintenance for duration of Contract Period (3+1+1 years)
16.4.1	Maintenance in accordance with SLA
16.4.2	Maintain properly skilled, trained, qualified staff
16.5.2.2	Support Hours: 0830 to 1800, Monday to Friday
16.5.2.3	After-hours support for P2+ incidents
16.5.3.1	Support during disaster recovery exercises
16.5.3.3	Deliver software updates and documentation promptly

11. SLA Requirements (Section 17)

11.1 Service Level Objectives (17.4)

Ref	Requirement	Compliance	Notes
17.4.1	Platform Availability: 99.9% monthly (excluding maintenance)
17.4.2	Ingestion Latency: 10 seconds average		Performance observations will be reported but not guaranteed as SLO commitments
17.4.3	Action Execution: 30 seconds		Performance observations will be reported but not guaranteed as SLO commitments
17.4.4	False-Positive Rate: 2% monthly maximum

11.2 Cybersecurity Incident Response SLAs (17.6.2)

Severity	Identification	Analysis	Containment	Eradication	Preliminary Report	Final Report
P1 Critical	15 min	1 hour	4 hours	36 hours	24 hours (hourly flash)	3 business days
P2 High	30 min	2 hours	24 hours	2 days	48 hours (2-hourly flash)	5 business days
P3 Medium	3 hours	8 hours	2 days	4 days	5 days	7 business days
P4 Low	1 day	-	-	10 days	Periodic summaries	Periodic summaries

11.3 Threat Hunting SLAs (17.7)

Ref	Requirement	Compliance	Notes
17.7.2	Ad-hoc request acknowledgment: 4 hours
17.7.3.1	Critical IoC sweep completion: 4 hours
17.7.3.1	Standard IoC sweep completion: 24 hours
17.7.4	Complex hypothesis-driven hunt: 72 hours
17.7.5	Proactive intel-led hunt initiation: 24 hours
17.7.5.2	Retro-hunt minimum 30-90 days of telemetry
17.7.6	Hunt report delivery: 24 hours post-completion

11.4 System Availability and Performance (17.10-17.12)

Ref	Requirement	Compliance	Notes
17.10.2	Redundancies for high availability (failover clustering, load balancing)
17.10.3	Dual data center failover between primary and secondary sites
17.10.4	99.9% availability per calendar month
17.10.5	24x7 operation availability
17.10.6	Minimal performance impact during backup/housekeeping
17.12.1	Response time: 3 seconds for 80%, 5 seconds for 90% of transactions		Performance observations will be reported but not guaranteed as SLO commitments
17.12.1	Maximum response time: 15 seconds		Performance observations will be reported but not guaranteed as SLO commitments
17.12.3	Static reports: 15 seconds or less
17.12.4	Parameter-based reports: 30 seconds or less

12. Security Requirements (Section 18)

12.1 Application Security (18.4)

Ref	Requirement	Compliance	Notes
18.4.1	Software security framework for code development/customization
18.4.2	Follow OWASP SAMM or equivalent framework
18.4.3	Scan for vulnerabilities and rectify before deployment
18.4.4	Use fixed TCP/UDP ports
18.4.5	Use secure protocols (SSH, SFTP)
18.4.6	Store credentials as hashed or encrypted
18.4.7	No remote access or backdoors without RWS approval
18.4.8	Document remote support implementation and security measures
18.4.9	No functions that change security configuration of operating environment
18.4.10	Submit architecture and dataflow diagrams for approval
18.4.11	Comply with RWS change control process
18.4.12	Control measures to prevent malicious code introduction
18.4.13	Harden UAT, production, DR environments to RWS standards
18.4.14	Implement sufficient security controls for CIA protection

12.2 Access Management (18.5)

Ref	Requirement	Compliance	Notes
18.5.2	Authorization at operating system and application level
18.5.3	Support Microsoft Active Directory authentication
18.5.4	Support automated user account provisioning via AD sync
18.5.5	Least privilege and segregation of duties design
18.5.6	Clear segregation of roles for Privileged Users
18.5.7	Role-based user account configuration
18.5.8	User account management: create, modify, disable, delete, search
18.5.9	Interface with RWS Access Right Management System
18.5.11	Restrict security admin role to essential functions
18.5.12	Menu display based on user security profile
18.5.13	Multi-factor authentication for administrative accounts
18.5.14	Provide base role and functional matrix
18.5.15	Proper approval and tracking for all system access
18.5.16	Secure communication during authentication and communication
18.5.17	URL access control for different roles (web-based)
18.5.18	Inactive session auto logout

12.3 Audit and Logging (18.6)

Ref	Requirement	Compliance	Notes
18.6.2.1	Audit trail: User login/logout activities
18.6.2.2	Audit trail: Privileged user and admin activities
18.6.2.3	Audit trail: Failed login attempts
18.6.2.4	Audit trail: Data updates (create/modify/delete)
18.6.2.5	Audit trail: Confidential/sensitive data maintenance
18.6.2.6	Audit trail: Exceptional transactions
18.6.2.7	Audit trail: Account and role changes
18.6.2.8	Audit trail: Audit log access attempts
18.6.3	Protect audit trails from unauthorized modification/deletion

12.4 Encryption Standards (18.8)

Ref	Requirement	Compliance	Notes
18.8.1	AES with 256-bit keys minimum
18.8.1	RSA with 2048-bit keys minimum
18.8.1	SHA-256 hashing
18.8.2.1	TLS version 1.2 minimum
18.8.2.2	AES with GCM or CCM mode preferred
18.8.2.3	SSH version 2
18.8.2.4	No clear text password storage
18.8.3	WPA2 with AES for wireless
18.8.4	Avoid unknown proprietary encryption
18.8.5	X.509 version 3 digital certificates

13. Integration Requirements (Section 20)

Ref	Requirement	Compliance	Notes
20.1.1	Active Directory single sign-on integration
20.1.2	Develop authentication APIs for AD log-in
20.1.3	Testing with simulated users and basic penetration tests
20.2.1	IDAS integration via web services or batch file
20.2.1.1	IDAS: User Profile creation/maintenance
20.2.1.2	IDAS: User to Role list generation
20.2.1.3	IDAS: Role to Function list generation
20.2.1.4	IDAS: Active user list generation
20.2.1.5	IDAS: Privilege account list generation
20.3	Flexibility to integrate with existing/new 3rd party systems
21.1	Migrate existing configurations to new system (rules, settings, dashboards, integrations, alerts)
21.2	Redirect alerts from existing system if onboarding delayed

14. Technology Stacks (Section 22)

14.1 Platform Requirements (22.1-22.4)

Ref	Requirement	Compliance	Notes
22.1.1	Deploy on RWS IT-supported platforms
22.1.1	Align with RWS technology stacks
22.1.1	Written RWS approval before deployment
22.2.1	OS/DB within vendor mainstream support for 2+ years from commissioning
22.2.2	Not within 2 years of published EOS date at commissioning
22.3.1	All software within active support lifecycle
22.4.1	Ongoing compliance warranty for contract term
22.4.2	Upgrade/replace components approaching EOS at Supplier cost

14.2 RWS Standard Technology Stack (22.6.1)

Category	RWS Standard
Operating Systems	Windows Server 2022+, RHEL 9+
Database	Azure SQL Database, Azure SQL Managed Instance
Cloud Platform	Microsoft Azure
Container	AKS
Backup	Azure Backup
Automation	Azure Functions, Azure Logic Apps
Directory Services	Microsoft Entra ID
Log Management	Azure Log Analytics
Monitoring	Azure Monitor
Storage	Azure Storage Accounts
Load Balancer	Azure Application Gateway
Client Browser	Edge, Chrome (internal); Edge, Chrome, Firefox, Safari (external)
Client OS	Windows, iOS, Android

15. Key Performance Indicators (Appendix B3)

15.1 Platform Health & Detection Effectiveness

KPI	Target	Compliance	Notes
Endpoint Sensor Health & Coverage	98%+ of licensed endpoints online and reporting
Telemetry & Log Ingestion Coverage	95%+ of defined sources actively ingesting, 95% parsing success
System Availability & Performance	99.5%+ uptime, 60s alert latency, 10s average query
Detection Rule Effectiveness	95% execution, TPR 90%+, FPR 10%-, quarterly tuning

15.2 SOC Operations & Response Performance

KPI	Target	Compliance	Notes
Mean Time to Detect (MTTD)	15 minutes or less
Mean Time to Acknowledge (MTTA)	15 minutes or less
Mean Time to Respond (MTTR)	60 minutes (High/Critical)
Incidents Closed Within SLA	90%+
Triage FPR/TPR	FPR 15%-, TPR 85%+
Escalation Rate	20%- to Tier 2/3
Proactive Threat Hunts	2+ per month
New Use Cases from Hunts	1+ per quarter

15.3 Service Delivery & Continuous Improvement

KPI	Target	Compliance	Notes
Overall SLA Compliance	98%+
Critical SLA Breaches	0 per month
Customer Satisfaction (CSAT)	4+/5
Critical Issues Raised	5- per quarter
Log Source Onboarding Time	10 working days per source
Ticket Resolution Within SLA	95%+
Reports Delivered On Schedule	100%
MTTD/MTTR Improvement	10%+ QoQ for 2 consecutive quarters

16. Functional Requirements: EPP (Appendix E)

16.1 Core Antivirus & Anti-Malware

Ref	Requirement	Compliance	Notes
EPP-1.1	Static and dynamic ML analysis for malware detection (trojans, ransomware, spyware, viruses)
EPP-1.2	Not solely reliant on signature-based detection
EPP-1.3	Real-time on-access scanning on execution, creation, modification
EPP-1.4	On-demand scanning (full or quick) on single or groups of endpoints
EPP-1.5	Auto-quarantine malicious files to secure encrypted holding area
EPP-1.6	Clear audit log for every detection (path, hash, process, action, timestamp)

16.2 Exploit Prevention

Ref	Requirement	Compliance	Notes
EPP-2.1	Dedicated module for memory corruption vulnerability prevention
EPP-2.2	Protect MS Office, web browsers, PDF readers, media players, Java runtimes
EPP-2.3	Detect/block shellcode injection (process hollowing, atom bombing, DLL sideloading)

16.3 Behavioral Prevention (IoAs)

Ref	Requirement	Compliance	Notes
EPP-3.1	Real-time process behavior analysis
EPP-3.2.1	Detect fileless attacks (PowerShell, WMI, WSH)
EPP-3.2.2	Detect ransomware encryption behavior
EPP-3.2.3	Detect credential access and dumping (LSASS, etc.)
EPP-3.2.4	Detect lateral movement (WMIexec, PsExec, RDP)
EPP-3.2.5	Detect persistence mechanisms (registry, services, scheduled tasks)
EPP-3.3	Custom IOA rule creation

16.4 Device Control

Ref	Requirement	Compliance	Notes
EPP-4.1	Granular policy for removable media and peripherals
EPP-4.2	Control by device class, vendor ID, product ID, serial number
EPP-4.3	Options: read-only, write-only, block-all, full read/write
EPP-4.4	Log all device access attempts

16.5 Host Firewall & Management

Ref	Requirement	Compliance	Notes
EPP-5.1	Host-based firewall for Windows and macOS
EPP-5.2	Centrally managed firewall rules
EPP-5.3	Rules by app path, hash, direction, IP, port, protocol
EPP-5.4	Pre-configured rule sets for common services
EPP-6.1	Single web-based management console
EPP-6.2	Different policy sets for endpoint groups
EPP-6.3	Real-time and historical reporting
EPP-6.4	Pre-built compliance reports (NIST, CIS)

16.6 Performance & Resilience

Ref	Requirement	Compliance	Notes
EPP-7.1	Minimal predictable performance impact
EPP-7.2	Max 5% CPU during on-access scan
EPP-7.3	Max 250MB memory under normal operation
EPP-7.4	No noticeable boot/logon delay
EPP-7.5	Granular scheduling of resource-intensive activities
EPP-7.6	Low-power mode on battery
EPP-9.1	Self-protecting anti-tampering (even with local admin)
EPP-9.2	No tampering via OS tools, registry, GPO, PowerShell
EPP-9.3	Kernel-level protection, works in Safe Mode
EPP-9.4	Autonomous self-healing
EPP-9.5	Protection active offline, in Safe Mode, under attacker control
EPP-9.6	Cryptographic integrity enforcement
EPP-9.7	Real-time alerts on tampering attempts

17. Functional Requirements: EDR (Appendix E)

17.1 Data Collection and Telemetry

Ref	Requirement	Compliance	Notes
EDR-1.1	Continuous chronological timeline recording (not reliant on Windows Event Logs)
EDR-1.2.1	Process execution data (name, path, hash, args, parent/child, user, integrity)
EDR-1.2.2	File system activity (create, read, write, move, delete, attributes)
EDR-1.2.3	Network connections (source/dest IP, ports, protocol, domain, process)
EDR-1.2.4	Registry modifications (keys, values)
EDR-1.2.5	Module/DLL loading activity
EDR-1.2.6	User logon/authentication events
EDR-1.3	90-day minimum hot searchable retention
EDR-1.4	Local caching and resilient transmission on reconnect

17.2 Detection and Response

Ref	Requirement	Compliance	Notes
EDR-2.1	Correlate telemetry into IOA-based alerts
EDR-2.2	Auto-map to MITRE ATT&CK tactic/technique/sub-technique
EDR-2.3	Dynamic severity scoring (Critical/High/Medium/Low)
EDR-2.4	Pre-tuned detection rules, continuously updated
EDR-2.5	Custom detection rule creation
EDR-3.1	Advanced query language (SQL/KQL-like)
EDR-3.2	Save, schedule, share queries
EDR-3.3	Graphical investigation tool with attack chain mapping
EDR-3.4	Pivot from alerts to raw telemetry
EDR-3.5	Timeline view of related activity

17.3 Response Capabilities

Ref	Requirement	Compliance	Notes
EDR-4.1	Remote response from management console
EDR-4.2.1	Remote shell access
EDR-4.2.2	Kill running processes
EDR-4.2.3	Delete or quarantine files
EDR-4.2.4	Network isolation (full or selective)
EDR-4.2.5	Upload and execute custom scripts across endpoints
EDR-4.3	Immutable audit trail for all response actions

17.4 Integration

Ref	Requirement	Compliance	Notes
EDR-5.1	Documented RESTful API for SIEM, SOAR, ITSM integration
EDR-5.2	API retrieval of alerts, endpoints, investigation data
EDR-5.3	API-initiated response actions
EDR-5.4	External threat intel ingestion (STIX/TAXII)

18. Functional Requirements: XDR (Appendix E)

18.1 Data Integration

Ref	Requirement	Compliance	Notes
XDR-1.1	Native integration beyond endpoint (no custom parsing)
XDR-1.2.1	Pre-built integrations: Cloud Platform
XDR-1.2.2	Pre-built integrations: Identity and Access Management
XDR-1.2.3	Pre-built integrations: Email Solution
XDR-1.2.4	Pre-built integrations: Network Infrastructure
XDR-1.2.5	Pre-built integrations: EDR Tools
XDR-1.3	Normalize all data to unified queryable schema

18.2 Cross-Domain Correlation

Ref	Requirement	Compliance	Notes
XDR-2.1	Auto-analyze across endpoint, cloud, identity, email, network
XDR-2.2	Auto-stitch related events into unified incident
XDR-2.3	ML/behavioral analytics for baseline deviation detection
XDR-2.4	MITRE ATT&CK mapping across kill chain

18.3 Unified Investigation

Ref	Requirement	Compliance	Notes
XDR-3.1	Single unified view for all incidents
XDR-3.2	Unified timeline merging all domains
XDR-3.3	Single query language across all normalized data
XDR-3.4	Pivot from identity to endpoint to cloud within console

18.4 Automated Response

Ref	Requirement	Compliance	Notes
XDR-4.1.1	Playbook: Force logoff and password reset on compromised identity
XDR-4.1.2	Playbook: Revoke cloud session/permissions
XDR-4.1.3	Playbook: Push firewall block rules
XDR-4.1.4	Built-in orchestration engine (no separate SOAR required)
XDR-4.2	Central audit trail for all automated actions

18.5 API and Ecosystem

Ref	Requirement	Compliance	Notes
XDR-5.1	Documented RESTful API for all core functions
XDR-5.2	OAuth 2.0 authentication
XDR-5.3	JSON, CEF, OCSF format support
XDR-5.4	Pre-built integrations for SIEM, SOAR, ITSM

19. Functional Requirements: MXDR (Appendix E)

19.1 Service Foundation

Ref	Requirement	Compliance	Notes
MXDR-1.1	24x7x365 managed service with SOC primary responsibility
MXDR-1.2	Detailed RACI matrix for all operational phases
MXDR-1.3.1	Analysts hold GCIH, GCFA, GNFA, GCFE, OSCP, CISSP or equivalent
MXDR-1.3.2	Minimum 40 hours annual training per analyst
MXDR-1.3.3	Tiered teams (T1/T2/T3) with clear escalation
MXDR-1.3.4	Dedicated TAM with deep RWS environment knowledge

19.2 Platform Integration

Ref	Requirement	Compliance	Notes
MXDR-2.1.1	Native multi-tenant sensors for EDR, CWPP, identity
MXDR-2.1.2.1	Third-party ingestion: Network infrastructure (firewalls, proxies, flow, DNS, NDR)
MXDR-2.1.2.2	Third-party ingestion: Cloud environments (audit logs, config, posture)
MXDR-2.1.2.3	Third-party ingestion: Email security systems
MXDR-2.1.2.4	Third-party ingestion: IAM (auth events, audit, directory)
MXDR-2.1.2.5	Third-party ingestion: Application sources (web, DB, SaaS)
MXDR-2.2.1	Real-time cross-source correlation
MXDR-2.2.2	90-day minimum retention, 365-day option
MXDR-2.2.3	Auto MITRE ATT&CK mapping

19.3 Detection and Analysis

Ref	Requirement	Compliance	Notes
MXDR-3.1.1	Monitor and triage 100% of alerts
MXDR-3.1.2	Proprietary and open-source threat intel feeds
MXDR-3.2.1	Continuous hypothesis-driven hunting
MXDR-3.2.2.1	Intel-driven hunting (industry TTPs)
MXDR-3.2.2.2	Analytics-driven hunting (anomalies)
MXDR-3.2.2.3	Suspicion-driven hunting (weak signals)
MXDR-3.2.3	Document all hunting activities
MXDR-3.3.1	Full kill-chain analysis mapped to MITRE
MXDR-3.3.2	Determine scope (endpoints, users, cloud, data)
MXDR-3.3.3	Confidence level with evidence

19.4 Response and Remediation

Ref	Requirement	Compliance	Notes
MXDR-4.1.1	Develop pre-approved response playbook during onboarding
MXDR-4.1.2	Define actions for ransomware, credential compromise, exfiltration
MXDR-4.1.3	Granular action specifications (commands, tools, sequences)
MXDR-4.2.1	Immediate execution of pre-approved actions without sign-off
MXDR-4.2.2	24/7 hotline and secure messaging for escalation
MXDR-4.3.1	Comprehensive Incident Report within 24 hours of containment
MXDR-4.3.2	Post-incident review for high-severity incidents
MXDR-4.3.3	Supply IOCs and custom rules (YARA, SIGMA)

19.5 Reporting and Compliance

Ref	Requirement	Compliance	Notes
MXDR-5.1.1	Certifications per Section 9
MXDR-5.1.2	Role-based, time-bound, logged analyst access
MXDR-5.2.1	Real-time dashboard (MTTD, MTTR, incidents, SLA)
MXDR-5.2.2	Monthly executive report
MXDR-5.2.3	Quarterly Business Reviews (QBRs)

19.6 Onboarding and Offboarding

Ref	Requirement	Compliance	Notes
MXDR-6.1.1	Documented phased onboarding plan with milestones
MXDR-6.1.2	Day 0-2 coverage for critical data sources
MXDR-6.1.3	Assist with sensor/agent deployment and configuration
MXDR-6.2.1	Formal training for RWS IT Security Team
MXDR-6.2.2	Complete documentation of technologies, integrations, SOPs
MXDR-6.3.1	Permanent data purge or return upon termination
MXDR-6.3.2	Orderly transition assistance with data export

19.7 Technology Flexibility

Ref	Requirement	Compliance	Notes
MXDR-7.1.1	Full documented API access
MXDR-7.1.2	OCSF support for data normalization
MXDR-7.1.3.1	Custom detection rule creation and tuning
MXDR-7.1.3.2	RWS-specific baselines and allow-lists
MXDR-7.1.4.1	Effective service with existing EDR/NDR vendors
MXDR-7.1.4.2	Robust integrations with 2+ vendors per category

19.8 Strategic Services

Ref	Requirement	Compliance	Notes
MXDR-8.1.1	Contextual vulnerability prioritization with threat intel correlation
MXDR-8.1.2	Security misconfiguration identification and alerting
MXDR-8.1.3.1	Periodic security posture assessments
MXDR-8.1.3.2	Prioritized actionable recommendations

20. Certification Requirements (Section 9)

Party	Requirement	Compliance	Notes
Partner/SI (Day-1)	Valid ISO/IEC 27001 ISMS certification
MXDR Provider (Day-2)	Valid SOC 2 Type II or ISO/IEC 27001 certification
MXDR Provider (Day-2)	Valid CSRO license (Singapore)
Technology Platform	SOC 2 Type II certification
Technology Platform	ISO/IEC 27001 certification
All Parties	Provide complete certification documents and audit reports
All Parties	Furnish documents to RWS upon request
All Parties	Maintain valid certifications for entire contract period
All Parties	Immediately notify RWS of any certification status changes