BuyICT Incident Response Simulation Testing and Reporting

Overview The Digital Transformation Agency (DTA) requires a suitably experienced and qualified supplier to deliver a BuyICT-specific incident response tabletop exercise. Scope The scope includes: Planning, facilitating and reporting on a BuyICT-specific incident response tabletop exercise Testing incident response activation, escalation pathways, ServiceNow coordination, evidence handling, communications, stakeholder coordination, recovery decision-making and operational response activities Preparing an exercise plan, scenario narrative, injects and participant pre-read material reflecting realistic BuyICT operational, security, supplier and stakeholder conditions, including a cyber security incident affecting BuyICT services, data, workflows, privileged access, monitoring, logging or supplier-supported services Facilitating the tabletop exercise, guiding participants through scenario injects, recording decisions, actions, observations and issues, and leading a structured debrief Including relevant DTA, security, technical and supplier roles in the exercise, supported by a responsibility matrix and attendance record Providing a final report and evidence pack within 5 business days of the exercise, comprising the exercise plan, scenario and injects, attendance record, session notes, decision log, action register, debrief summary, responsibility matrix and final report Preparing a final report covering objectives, scope, scenario summary, key outcomes, findings, risks, lessons learned, recommendations and an action register, identifying strengths, improvement opportunities, recommended updates to plans, procedures or coordination arrangements, exercise limitations and any caveats on assurance claims, and clearly distinguishing findings, observations, assumptions and recommendations Contractor Requirements Suitably experienced and qualified to plan, facilitate and report on a BuyICT-specific incident response tabletop exercise Contract Terms and Conditions Exercise materials must be handled in accordance with DTA security, confidentiality and information management requirements Approved storage and communication channels must be used for all exercise materials Materials, findings and evidence must not be shared outside approved DTA participants without prior written approval Deliverables must be provided in Microsoft Word, PDF or another DTA-approved format Deliverables will not be considered complete until accepted by DTA Enquiries Buyer contact: corporate.procurement@dta.gov.au