System Operator for the

Technical Requirements:

System Operator for the Internet Firewall and External Applications

The contractor is required to provide a system operator to operate all services requested in the RFP, in addition to the services and systems available within Health Affairs.

A system operator must be provided to operate cybersecurity systems at King Abdulaziz Medical City in Riyadh, affiliated with the Ministry of National Guard Health Affairs (MNGHA), to support MNGHA in maintaining all security operations. The system operator will work onsite during official Health Affairs working hours to accomplish security operational tasks and will be hosted at a Ministry of National Guard Health Affairs facility.

Below is a detailed description of the operator’s tasks at the site during the contract period, including but not limited to:

• Working with the team to manage all cybersecurity systems (e.g., EDR, AV, SIEM, WAF, Firewall, Proxy, etc.).
• Continuous monitoring of security alerts and incidents.
• Classifying incidents into appropriate categories.
• Taking actions based on the severity of the incident, such as:
• • Notifying system owners.
  • Following the incident response plan.
  • Escalating incidents according to incident response procedures.
  • Properly documenting incidents.
• Documenting and reporting incidents.
• Resolving Service Requests related to users.
• Tracking cyberattacks.
• Creating or updating use cases for new systems and applications.
• Analyzing events and incidents.
• Handling cybersecurity incidents reported through the National Cybersecurity Authority and obtaining required approvals from management.
• Monitoring the system’s compliance level with HA-MNG technical security standards, to be approved by the IT Department after evaluation.
• Communicating with other departments during incident investigations.
• Preparing a monthly report summarizing the incidents handled, especially major incidents.
• Maintaining and operating the latest available versions of systems within Health Affairs cybersecurity infrastructure.
• Collecting, identifying, classifying, prioritizing, and investigating events gathered from firewalls, network devices, IPS/IDS systems, antivirus systems, databases, servers, and endpoints.

The table below outlines the details of the operator (as per the BOQ and upon request), including classification criteria for engineers based on experience and certifications: