Cyber Security Operations Centre CSOC

Overview Energy Queensland Limited is seeking information from established suppliers for a managed Cyber Security Operations Centre (CSOC) service across its corporate IT and Operational Technology (OT) environments. This is a Request for Information (RFI) and is not a request for tender or a commitment to procure. About Energy Queensland (EQL) currently uses a hybrid managed CSOC service across its corporate IT and OT environments. EQL retains responsibility for cyber security strategy, governance, risk acceptance, incident command and operational decisions, with the managed service providing specialist capability and continuous operational coverage. The current arrangement is approaching the end of its contracted term. The current environment includes Palo Alto XSOAR for enrichment, workflows, threat intelligence integration and approved response playbooks. EQL is considering future platform changes, and other than Microsoft Sentinel, the listed platforms provide context and do not commit EQL to retaining every component. Purpose This RFI seeks market information on available capabilities, service models, technologies, commercial approaches and transition practices to inform EQL's future sourcing strategy. It is an information-gathering and capability-screening activity, not a request for tender or a commitment to procure. Responses will inform EQL's future service requirements and sourcing approach. Scope The indicative scope includes: 24x7 security monitoring Alert triage and investigation Incident notification and escalation Threat hunting Threat intelligence Detection and security platform engineering OT security monitoring On-demand incident response and digital forensics Service management Incident exercises Knowledge transfer Transition and exit support, including monitoring and response continuity during transition and exit, with service records, detection content, playbooks and documentation remaining portable The service will operate alongside EQL's internal teams, with EQL retaining incident command, risk acceptance and operational decisions. Contractor Requirements Must support Microsoft Sentinel as EQL's target security information and event management (SIEM) platform Must integrate with Microsoft Defender, ServiceNow and other EQL-owned security platforms Security incident records must be maintained in EQL's ServiceNow environment or supported through bidirectional integration with supplier tooling Must support enterprise IT and passive OT monitoring while working with EQL teams and other service providers and preserving EQL's operational control An operational Australian-based 24x7 CSOC Brisbane-based engagement and access to incident response, forensic and OT specialists Proven managed monitoring capability across both IT and OT environments Relevant electricity-sector or Australian critical infrastructure experience, supported by two comparable customer references Capacity to keep all EQL data handling within Australia, with no offshore access Willingness to use the Queensland Information Technology Contracting (QITC) framework for a future engagement Eligibility This request is not intended for software-only, advisory-only, penetration testing or staff augmentation offerings.