Product Specifications.docx

Product Specifications CIO – Microsoft Sentinel Implementation Microsoft Sentinel Implementation For: Army University (AU) / US Army War College (USAWC)

1. Scope: This specification defines the required services for the implementation and managed support of Microsoft Sentinel as the centralized SIEM/SOAR platform for the AU / USAWC Microsoft 365 environment. The awarded vendor shall provide all labor, expertise, and deliverables necessary to meet the requirements outlined below.

2. Required Services:

A. Azure Consumption and Licensing The awarded vendor shall:

· Provision and configure all necessary Azure resources to support Microsoft Sentinel, including but not limited to:

· Azure Log Analytics Workspace

· Azure VPN, Logic Apps (for SOAR playbooks)

· Azure servers, Kubernetes, and data connectors

· Monitor and manage Azure consumption costs, providing monthly usage reports.

· Ensure all Azure resources are billed on actual usage, with estimated monthly costs provided for planning purposes.

· Provide and configure an Exchange Online Plan 1 license for email alerting.

Customer has MS 365 A5 which includes all advanced licensing feature for Defender, Entra, and Intune. No additional licensing from the contractor is expected. If additional licensing is required to execute elements of the PWS, contractor will notify the government who will procure licensing through their current MS support partner.

· Provide Defender for Cloud for storage protection as required for the solution.

B. Microsoft Sentinel Implementation Services The awarded vendor shall:

· Conduct a Discovery Phase to assess the current environment, validate requirements, and document data sources.

· Develop a detailed Solution Design Document (SDD) for Microsoft Sentinel, including architecture diagrams, data source integration, analytics and detection use cases, automation and incident response design, and reporting specifications.

· Implement and configure Microsoft Sentinel, including:

· Onboarding of approximately 350 Intune-managed endpoints

· Integration with Microsoft Entra ID, Intune, Defender, and M365 audit logs

· Configuration of analytics rules, incident workflows, automation playbooks, dashboards, and reporting

· Provide knowledge transfer and administrator training to AU/USAWC personnel.

· Deliver all documentation, including build documentation, operational guides, and runbooks.

3. Performance Requirements

· The solution must align with NIST SP 800-53 and OMB M-21-31 event logging mandates.

· The contractor shall ensure at least a 98% data ingestion success rate for all specified endpoints and data sources.

· All deliverables must be provided in digital format and approved by the Government.

· The contractor shall provide monthly and quarterly performance and ticketing reports during the managed services period.

· Service Level Objectives:

· Critical incidents: 30 min response, 24 hr resolution

· High: 1 hr response, 48 hr resolution

· Medium/Low: 8 hr response, 48 hr resolution

4. Vendor Qualifications

· The contractor must be a Microsoft Solution Partner and Tier-1 (Direct-Bill) Cloud Solution Provider (CSP).

· The contractor must have experience with DoD, NIST, and federal compliance.

· The contractor must be registered and active in SAM.gov.

5. Delivery and Support

· All services shall be delivered remotely unless otherwise specified.

· The contractor shall coordinate with USAWC IT personnel for deployment and activation.

· All onboarding, configuration, and documentation must be completed within the agreed project schedule.

6. Security & Compliance

· The solution must support secure identity, MFA, and comply with DoD and NIST SP 800-53 requirements.

· All data residency and support must be within CONUS.

· All monitoring and response activities must align with CJIS, NIST, CMMC, and HIPAA frameworks.