1 PSN Services Service Descriptions - Government Procurement ...

The CCND Service automates the collection, analysis, assessment, response and archiving of security
related events in the customer’s ICT estate. It provides the Service Consumer with a reliable, central
monitoring and escalation/response service, comprising a mixture of automated processing and expert
analyst support, based at the Cassidian Security Operations Centres. It provides the foundation on which
to build a coherent and responsive security compliance regime for all Service Consumers.
The CCND core service provides the following capabilities to the Service Consumer:
509
Collection, filtering, normalisation and reporting of security events generated by network,
server, workstation and security devices in a complex heterogeneous environment.
Integration of event collection from a multitude of existing 3 rd party and legacy infrastructure
devices through a combination of custom collection agents and standard interfaces such as
Syslog or Microsoft WMI interface.
Incident analysis and management by the Cassidian Secure Operation Centres through near realtime
event correlation to group seemingly different individual events into valuable threat
intelligence. This enables focused use of resources to respond to serious issues in a timely
fashion.
Reports based on key incident metrics to facilitate the visualisation and tuning of security
policies and procedures.
An archive of data for subsequent post incident re-analysis.
The CCND optional enhancement services provide the following optional integrated security
measures with integrated policy compliance reporting:
Custom Log Retention