Integrated cloud email security solution, licensing, and support for airports company south africa (36-Month contract)

Scope: Provision of an Integrated Cloud Email Security (ICES) Solution for Airports Company South Africa (ACSA), integrating with existing M365 Email Security for 4,600 users over 6 months.

In-Scope Requirements:

• Email Security Capabilities:

• Comprehensive protection against Business Email Compromise (BEC), ransomware, and phishing attacks.
• High-profile user (executive/special classified) monitoring and protection.
• POPIA compliance for safeguarding personal information in email systems.
• Automated real-time threat detection and response.

• Advanced Threat Protection:

• AI/ML-driven detection of sophisticated impersonation attacks.
• Support for all standard web browsers and device types.

• DMARC Management:

• Implementation and maintenance of DMARC protocol for sender authentication.
• Integration with existing SPF and DKIM protocols.
• Reporting mechanisms for email validation and disposition.

• Protection Against Malicious Attachments:

• Attachment-type blocking, encrypted file blocking (MS Office/PDF), quarantining, anti-virus, archive unpacking, threat intelligence sharing, and sandboxing.

• Protection Against Malicious Links:

• Spear-phishing detection, behavior-based phishing link detection, URL reputation bolstering, look-alike detection, shortened URL scanning, vendor URL IOCs, URL disarm/rewriting/redirection.

• Protection Against Impersonation:

• Reputational/content-based spam blocking, anomaly detection (volumetric), sender domain reputation, own-domain spoof detection, granular DMARC policies, IP address analysis, anomaly-based impersonation detection, smart tag control, and account takeover/BEC protection.

• Management, Operations, and Reporting:

• Role-based administration, MFA admin login, quarantine management, message customization, alerting, troubleshooting support, email search, policy propagation latency, clicked-link reporting, sandbox reporting, log retention/export, block/allow lists, availability SLA, DMARC configuration support, IOC export/sharing, and privacy-enabled/strategic threat intelligence reporting.

• Deployment and Integration:

• Inbound/outbound gateways, privacy/data residency, cross-customer threat intelligence sharing, API/SIEM/identity provider/CASB/ticketing system/EPP/EDR integration, and ICES/DMARC implementation services.

• Governance Alignment:

• Adherence to ACSA’s Enterprise, Cyber, and Information Security governance, policies, standards, and guidelines.

• Continuous Improvement:

• Advisory services for strategy, framework, policy, or other improvements.

Out of Scope:

• Costing for M365-related email security components unless tied to integration via partner APIs to satisfy business requirements.

Mandatory Compliance:

• POPIA: Solution must safeguard personal information processed via email systems, preventing unauthorized access, loss, or misuse.
• ACSA Governance: Adherence to ACSA’s Enterprise, Cyber, and Information Security governance, policies, standards, and guidelines.
• Data Residency: Privacy and data residency requirements must be met.

Service Level Agreements (SLAs):

• Incident Priorities and Response Times:

• P1 (Total system failure): Response in 15 min, restoration in 2 hrs, update in 30 min.
• P2 (Partial system failure): Response in 30 min, restoration in 4 hrs, update in 1 hr.
• P3 (Non-critical fault): Response in 2 hrs, restoration in 8 hrs, update in 2 hrs.
• P4 (Minor incidents): Response in 4 hrs, restoration in 24 hrs, update in 8 hrs.

• Penalties for SLA Breaches:

• P1: 20% of monthly fee deducted per lapse (up to 60% annually) for unresolved incidents within 1 hr after SLA time for two consecutive times in a month.
• P2: 30% of monthly fee deducted (up to 60% annually) for unresolved incidents within 2 hrs after SLA time for three consecutive times in a month.
• 50% of monthly fee deducted for missing SLA’s in 3 consecutive months across any site.
• Material breach (4 consecutive months): Contract referred for termination.
• 20% of monthly fee deducted per invoice for 5+ missed SLA’s across all sites in a measuring period.
• 10% of contract capital value withheld for failure to comply with agreed SLAs.
• No payment for maintenance not performed or proof not submitted.

Reporting Requirements:

• Daily/Weekly/Monthly reports on service requests, incidents, maintenance, system availability (99.9% uptime target), and preventative work.
• Ad-hoc reports as requested by ACSA.

Meeting Requirements:

• Weekly progress meetings and monthly project board meetings with ACSA’s Information Security team, IT PMO, and other stakeholders.