26AMSA102 - Red Team & Incident Response Exercises

This Tender is invited by the Issuer. Overview The Australian Maritime Safety Authority (AMSA) is seeking submissions from suitably qualified vendors to design and deliver a practical cyber resilience exercise program comprising Incident Response Tabletop Exercises and Red Team Exercises. This is a three-year engagement requiring the development of realistic scenarios aligned with AMSA's operational environment and cyber security risks. About AMSA is Australia's national maritime safety regulator, responsible for maintaining safety standards across Australian waters and managing critical maritime operations. Purpose These initiatives are essential to support AMSA's operational requirements, test preparedness against cyber threats, and ensure compliance with relevant Australian Government security standards. Objectives Strengthen decision-making under pressure and provide actionable insights to uplift organisational cyber resilience Validate detection, response and decision-making capabilities across selected scenarios through Red Team exercises Deliver meaningful assurance outcomes without unnecessary complexity or disruption to business operations Scope AMSA is seeking a practical and proportionate exercise program suitable for a medium-sized Commonwealth entity of approximately 650 personnel. Exercises should be focused, targeted and designed to validate key controls, incident response processes and decision-making capabilities. The scope of each exercise will be agreed with AMSA prior to delivery and is not intended to represent a full-scale enterprise adversary simulation across the entire ICT environment. The scope includes: Design and delivery of a cyber resilience exercise program comprising Incident Response Tabletop Exercises and Red Team Exercises Development of realistic scenarios aligned with AMSA's operational environment and cyber security risks Delivery of two Red Team exercises per year Delivery of one Incident Response Tabletop Exercise every two years Testing of AMSA's people, processes and technology through practical and targeted exercises Application of a structured approach across both exercise streams, with clear observations and practical recommendations following each exercise Contractor Requirements Vendors must be suitably qualified to design and deliver Red Team and Incident Response Tabletop Exercises Contract Terms and Conditions Three-year engagement