CIO_Product_Specs_MS Sentinel Implementation.pdf

Product Specifications CIO – Microsoft Sentinel Implementation

Microsoft Sentinel Implementation For: Army University (AU) / US Army War College (USAWC)

1. Scope: This specification defines the required services for the implementation and managed support of Microsoft Sentinel as the centralized SIEM/SOAR platform for the AU / USAWC Microsoft 365 environment. The awarded vendor shall provide all labor, expertise, and deliverables necessary to meet the requirements outlined below.

2. Required Services:

A. Azure Consumption and Licensing

The awarded vendor shall:

• Provision and configure all necessary Azure resources to support Microsoft Sentinel, including but not limited to:

o Azure Log Analytics Workspace o Azure VPN, Logic Apps (for SOAR playbooks) o Azure servers, Kubernetes, and data connectors

• Monitor and manage Azure consumption costs, providing monthly usage reports.

• Ensure all Azure resources are billed on actual usage, with estimated monthly costs provided for planning purposes.

• Provide and configure an Exchange Online Plan 1 license for email alerting.

• Provide Defender for Cloud for storage protection as required for the solution.

B. Microsoft Sentinel Implementation Services

The awarded vendor shall:

• Conduct a Discovery Phase to assess the current environment, validate requirements, and document data sources.

• Develop a detailed Solution Design Document (SDD) for Microsoft Sentinel, including architecture diagrams, data source integration, analytics and detection use cases, automation and incident response design, and reporting specifications.

• Implement and configure Microsoft Sentinel, including:

o Onboarding of approximately 350 Intune-managed endpoints o Integration with Microsoft Entra ID, Intune, Defender, and M365 audit logs o Configuration of analytics rules, incident workflows, automation playbooks, dashboards, and reporting

• Provide knowledge transfer and administrator training to AU/USAWC personnel.

• Deliver all documentation, including build documentation, operational guides, and runbooks.

3. Performance Requirements

• The solution must align with NIST SP 800-53 and OMB M-21-31 event logging mandates.

• The contractor shall ensure at least a 98% data ingestion success rate for all specified endpoints and data sources.

• All deliverables must be provided in digital format and approved by the Government.

• The contractor shall provide monthly and quarterly performance and ticketing reports during the managed services period.

• Service Level Objectives:

o Critical incidents: 30 min response, 24 hr resolution o High: 1 hr response, 48 hr resolution o Medium/Low: 8 hr response, 48 hr resolution

4. Vendor Qualifications

• The contractor must be a Microsoft Solution Partner and Tier-1 (Direct-Bill) Cloud Solution Provider (CSP).

• The contractor must have experience with DoD, NIST, and federal compliance.

• The contractor must be registered and active in SAM.gov.

5. Delivery and Support

• All services shall be delivered remotely unless otherwise specified.

• The contractor shall coordinate with USAWC IT personnel for deployment and activation.

• All onboarding, configuration, and documentation must be completed within the agreed project schedule.

6. Security & Compliance

• The solution must support secure identity, MFA, and comply with DoD and NIST SP 800-53 requirements.

• All data residency and support must be within CONUS.

• All monitoring and response activities must align with CJIS, NIST, CMMC, and HIPAA frameworks.

7. Payment & Milestones

• Payment milestones shall be as defined in the contract.

• Azure consumption shall be billed monthly on actual usage.

• Implementation and managed services shall be invoiced per the agreed milestone schedule.

Prepared By:

Ryan Grimes

CIO-IT Procurement Analyst