Basic Information

Reference Number

0000214592

Issuing Organization

Ontario Health

Owner Organization

Ontario Health

Solicitation Type

RFI - Request for Information (Informal)

Solicitation Number

OH_2021_1220

Title

Notice of pending Request for Proposal for Managed Security Service provider

Source ID

PP.HL.CAN.692769.C75504

Details

Location

Canada, Ontario, Toronto

Description

Notice of pending Request for Proposal

for

Managed Security Service providers (up to 4)

Ontario Health was established pursuant to The Connecting Care Act, 2019. Its objectives include:

manage health service needs across Ontario consistent with the Ministry of Health’s strategies to ensure the quality and sustainability of the Ontario health system through digital health, information technology and data management services.
developing or adopting standards respecting digital health products and digital health services and the suppliers of such products and services.
Certifying products, services and suppliers in accordance with the standards developed or adopted.

For additional information about Ontario Health go to: https://www.ontariohealth.ca/

In February 2022, Ontario Health will release a Request for Proposal (RFP) that seeks to establish a Managed Security Service Provider (MSSP) relationship with up to four vendors, to support the broader public health sector with meeting their current and evolving Information and Cyber Security needs within the Ontario Health Provincial Cyber Security Operating Model (CSOM). All successful vendors must commit to partnering with Ontario Health, the Ministry of Government and Community Services (MGCS), and the Broader Public Sector in delivering services within the CSOM as it evolves. Regional Security Operations Centers (RSOCs) and other Healthcare BPS entities will be able to avail themselves of services via Request for Services (RFS) in accordance with their Procurement Directive.

At minimum, all vendors must be able to provide the following services:

Managed Endpoint Detection & Response (EDR) / eXtended Detection & Response (XDR)
Managed SIEM services, including:
- Integration of security control telemetry, threat intelligence
- alert monitoring
- automation (SOAR)

Incident Response
Vulnerability Management
Penetration Testing / Red Teaming

As well, vendors should be prepared to describe additional value-added services that they support, for example:

Security Program, Architecture, Risk Management Consultation
Additional technical control management

e.g. Network Firewalls, Web Application Firewalls, Cloud Application Security Brokers

Identity and Access Management

From the established vendors, Ontario Health will select one vendor to support Ontario Health’s MSSP needs within a Hybrid Security Operations Centre operating model. It is anticipated that perspective vendors will be expected to cover the following aspects in their response:

Service descriptions and service levels in alignment with requested levels
Cost model including pricing structures, fixed and variable cost drivers within the model
Descriptions of how vendors will partner within the model

Anticipated Timeline of the RFP (subject to change)

Planned posting date: Early February 2022
Anticipated submission date: March 2022
Anticipated presentation/demonstration dates: March 2022
Anticipated contract dates: March 2022

Under Non-Disclosure Agreement (NDA), information is planned to be available to the vendor community in support of ensuring a strong bid.

Vendors should monitor this site for additional information.

Dates

Publication

2021/12/20 01:41:48 PM EST

Bid Intent

Not Available

Questions are submitted online

Closing Date

2022/01/31 03:00:00 PM EST

Bid Submission Process

Bid Submission Type

Electronic Bid Submission

Pricing

Lump sum

Bid Documents List

Item Name	Description	Mandatory	Limited to 1 file
Bid Documents	Documents defining the proposal	No	No
No entries

© MERX - All rights reserved. No part of the information on this Web Site may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise without the prior permission of MERX and the Minister of the participating government department (if applicable). MERX, the Minister nor the Contracting Authority will assume responsibility or liability for the accuracy of the information contained in the publication.