IT Security Services

The Development Bank of Wales undertook a competitive flexible procedure, this notice is to notify that we have entered into a contract with the successful supplier. The Scope:

The Development Bank of Wales currently operate a security operation model that is split across multiple providers and technologies. To help reduce the complexity of this approach and improve our ability to effectively monitor, respond to, and mitigate security threats, the

Banc are investigating the feasibility of implementing a unified Microsoft security operations platform, the day-to-day management of which would be supported by a single provider. This transition will not only streamline our processes and technology, but also increase the efficiency of our incident response efforts and reduce the potential for gaps in our security

posture caused by the fragmentation of tools and services. Currently, our Azure services are handled by Service Provider A, which focuses on optimising our cloud infrastructure. Service Provider B is responsible for managing our Microsoft 365 environment and on-premises infrastructure, ensuring that both are configured and maintained to meet our operational needs. Additionally, our managed detection and response (MDR) services are provided by Service Provider C, which utilises their own proprietary platform to deliver continuous monitoring, threat detection, and incident response across our IT estate. The Banc is investigating replacing Service Provider C with a new Service Provider that will take over the managed detection and response function, utilising the Microsoft unified security platform. They will be responsible for the implementation, configuration and on going management of the platform, and providing proactive advice and recommendations to

improve the security of our Microsoft estate, drawing on Microsoft’s insights, but will not be responsible for any configuration outside of the security platform. The new provider will collaborate closely with Service Providers A and B to align security practices ensuring that our entire IT environment remains protected against emerging threats.