Product_Specs_CIO MS Sentinel Implementation.docx

Product Specifications CIO – Microsoft Sentinel Implementation Microsoft Sentinel Implementation For: Army University (AU) / US Army War College (USAWC)

1. Scope: This specification defines the required services for the implementation and managed support of Microsoft Sentinel as the centralized SIEM/SOAR platform for the AU / USAWC Microsoft 365 environment. The awarded vendor shall provide all labor, expertise, and deliverables necessary to meet the requirements outlined below.

2. Required Services:

A. Azure Consumption and Licensing The awarded vendor shall:

· Provision and configure all necessary Azure resources to support Microsoft Sentinel, including but not limited to:

· Azure Log Analytics Workspace

· Azure VPN, Logic Apps (for SOAR playbooks)

· Azure servers, Kubernetes, and data connectors

· Monitor and manage Azure consumption costs, providing monthly usage reports.

· Ensure all Azure resources are billed on actual usage, with estimated monthly costs provided for planning purposes.

· Provide and configure an Exchange Online Plan 1 license for email alerting.

· Provide Defender for Cloud for storage protection as required for the solution.

B. Microsoft Sentinel Implementation Services The awarded vendor shall:

· Conduct a Discovery Phase to assess the current environment, validate requirements, and document data sources.

· Develop a detailed Solution Design Document (SDD) for Microsoft Sentinel, including architecture diagrams, data source integration, analytics and detection use cases, automation and incident response design, and reporting specifications.

· Implement and configure Microsoft Sentinel, including:

· Onboarding of approximately 350 Intune-managed endpoints

· Integration with Microsoft Entra ID, Intune, Defender, and M365 audit logs

· Configuration of analytics rules, incident workflows, automation playbooks, dashboards, and reporting

· Provide knowledge transfer and administrator training to AU/USAWC personnel.

· Deliver all documentation, including build documentation, operational guides, and runbooks.

3. Performance Requirements

· The solution must align with NIST SP 800-53 and OMB M-21-31 event logging mandates.

· The contractor shall ensure at least a 98% data ingestion success rate for all specified endpoints and data sources.

· All deliverables must be provided in digital format and approved by the Government.

· The contractor shall provide monthly and quarterly performance and ticketing reports during the managed services period.

· Service Level Objectives:

· Critical incidents: 30 min response, 24 hr resolution

· High: 1 hr response, 48 hr resolution

· Medium/Low: 8 hr response, 48 hr resolution

4. Vendor Qualifications

· The contractor must be a Microsoft Solution Partner and Tier-1 (Direct-Bill) Cloud Solution Provider (CSP).

· The contractor must have experience with DoD, NIST, and federal compliance.

· The contractor must be registered and active in SAM.gov.

5. Delivery and Support

· All services shall be delivered remotely unless otherwise specified.

· The contractor shall coordinate with USAWC IT personnel for deployment and activation.

· All onboarding, configuration, and documentation must be completed within the agreed project schedule.

6. Security & Compliance

· The solution must support secure identity, MFA, and comply with DoD and NIST SP 800-53 requirements.

· All data residency and support must be within CONUS.

· All monitoring and response activities must align with CJIS, NIST, CMMC, and HIPAA frameworks.