PROCUREMENT OF SUBSCRIPTION OF CLOUD-NATIVE SECURITY INFORMATION AND EVENT MANAGEMENT (SIEM) SOLUTION FOR CENTRALIZED SECURITY MONITORING, THREAT DETECTION AND CORRELATION, INCIDENT RESPONSE AND COMPL

I. ABOUT THE PROCURING ENTITY The Board of Investments (BOI) is an attached agency of the Department of Trade and Industry (DTI) that is the national government agency responsible for the promotion of investments- both foreign and domestic. It is governed by Executive Order No. 226, also known as the Omnibus Investments Code of 1987 and Republic Act No. 11534, otherwise known as the Corporate Recovery and Tax Incentives for Enterprises (CREATE) Act. The BOI seeks to attract quality investments that will encourage technological innovations and provide support for industries to seize the opportunities and challenges of global demands and competition. The agency envisions itself as a global industry promotion agency by 2028 guided by the core values of integrity, excellence, teamwork, and passion for knowledge. Its mission is to provide investors with opportunities for investments, comprehensive business support services and fair predictable and consistent industry policies. The current state of the economy due to the on-going pandemic makes it more imperative for BOI to continuously aim for work excellence, as it is an agency, which is at the forefront of enticing investments into the country. II. PROJECT OVERVIEW The increasing sophistication of cyber threats highlight the need to implement a centralized security monitoring platform capable of collecting, analyzing, correlating and reporting security events from multiple information sources. These sources include the agency’s critical applications, endpoints, network devices, cloud services, and existing security solutions. By providing real-time visibility into the security posture of the organization, the platform will enable proactive threat detection, rapid incident response, enhanced compliance monitoring, and improved protection of BOI’s information assets and digital services. The growing complexity, volume, and sophistication of cyber threats necessitate the implementation of a centralized Security Information and Event Management (SIEM) solution capable of aggregating, correlating, analyzing, and reporting security events across the Board of Investments' (BOI) ICT environment. The proposed solution will integrate logs and telemetry from critical business applications, endpoints, network infrastructure, cloud platforms, and other security technologies to provide comprehensive, real-time visibility into potential security risks and incidents, network detection and response (NDR), user and entity behavior analytics (UEBA), threat intelligence, and security orchestration, automation and response (SOAR) on one common data model and one console, rather than a collection of loosely integrated products. This capability will strengthen BOI’s cybersecurity posture by enabling faster threat detection, automated incident response, continuous monitoring, and compliance with government cybersecurity standards and regulatory requirements. Furthermore, the solution will support the agency’s digital transformation initiatives by ensuring the confidentiality, integrity, and availability of its information systems and services. Currently, the existing security monitoring and event management capabilities are distributed across multiple systems with limited integration, resulting in fragmented visibility, delayed threat detection, and difficulties in correlating security events across the agency's ICT environment. These limitations hinder the timely identification and response to cybersecurity incidents and reduce the overall effectiveness of security operations. The proposed SIEM solution will address these challenges by providing a centralized, cloud-native security monitoring platform delivered as a vendor-hosted Software-as-a-Service (SaaS), eliminating the need for BOI to manage and maintain dedicated analytics infrastructure. The solution will support the deployment of on-premises and cloud-based sensors and collectors for the ingestion of logs and telemetry from various ICT assets, including endpoints, network devices, servers, applications, cloud services, and security systems. By enabling centralized collection, correlation, analysis, and monitoring of security events across on-premises, cloud, and hybrid environments, the proposed solution will strengthen BOI's cybersecurity posture through enhanced threat detection, accelerated incident response, improved compliance monitoring, and comprehensive visibility into the agency's security landscape. Furthermore, it will support the agency's digital transformation initiatives by ensuring the confidentiality, integrity, and availability of critical information assets and services. The project shall include software licenses/subscriptions, implementation of services, configuration, training, and technical support for the duration of the contract. In support of the agency’s Gender and Development (GAD) commitments, the solution shall promote inclusive and gender-responsive cybersecurity practices by ensuring that reporting mechanisms, access controls, and operational procedures are designed and implemented in a fair, equitable, accessible, and non-discriminatory manner for all authorized users. III. PROJECT OBJECTIVES The project aims to achieve the following objectives: 1. Centralized Security Monitoring and Visibility Establish a single, unified security operations platform, operating on one common data model and one console, for collecting, aggregating, and analyzing security logs and events from various sources across BOI's digital environment. This will provide a unified view of security activities, improve situational awareness, and eliminate visibility gaps caused by disparate, disconnected monitoring systems. 2. Threat Detection and Incident Response Enhance BOI’s ability to detect, investigate, and respond to cybersecurity threats through real-time monitoring, event correlation, and automated alerting capabilities. This solution will enable ITD personnel to identify suspicious activities more quickly, reduce response times, and minimize the potential impact of security incidents. 3. Agency-wide Security Event Correlation Enable the automatic correlation of security events across endpoint devices, servers, network devices, applications, cloud services, and security solutions, regardless of source, to identify complex attack patterns and malicious activities that may not be visible from individual systems. This capability will support proactive threat hunting and more effective, explainable cybersecurity investigations. 4. Security Governance and Compliance Support compliance with applicable government laws and regulations, cybersecurity policies, audit requirements, and industry-recognized security frameworks by maintaining comprehensive, tamper-evident audit trails, security logs, and reporting capabilities. The solution will facilitate continuous monitoring and provide needed evidence for security assessments and audits. 5. Security Analytics and Risk Management Leverage advanced analytics, behavioral monitoring, and threat intelligence to identify anomalies, potential insider threats, unauthorized access attempts, and emerging cyber risks. The solution will help the agency make data-driven security decisions and strengthen its overall cybersecurity posture. 6. Operational Efficiency and Cybersecurity Resilience Improve the efficiency of security operations by automating log management, alert triage and prioritization, AI-assisted case investigation, and orchestrated incident response playbooks. This will reduce manual effort, optimize utilization of the agency’s security resources, and enhance the agency’s ability to prevent, detect, and respond to evolving cyber threats. 7. Data Sovereignty and Security In accordance with Executive Order No. 119, s. 2026, otherwise known as the “Updating the Government Data Classification, Establishing a Data Residency Framework, and for Other Purposes”, the solution shall support compliance with data residency, cybersecurity, and information governance requirements – with the Service Provider required to disclose where the platform and any data processing will physically take place and what data residency options are available while providing the agency with greater visibility over its security operations. 8. Promote Inclusive and Gender-Responsive SIEM The solution shall ensure that the security policies are designed, configured, implemented and monitored in a manner that avoids gender bias and supports inclusive, equitable, and gender-responsive SIEM. The solution shall support the protection of all users and data subjects regardless of sex, gender, role, employment status, or use category, and shall ensure that access, monitoring, detection, response, reporting, and policy enforcement mechanisms do not result in discriminatory or exclusionary treatment. IV. SCOPE OF WORK The Service Provider (SP) shall supply, implement, configure, and support a Security Information and Event Management (SIEM) solution which shall include the following: A. Platform Architecture and Unification The SP shall install, configure, and deploy the SIEM within BOI’s ICT environment. 1. Provide Security Information and Event Management (SIEM), Network Detection and Response (NDR) or equivalent network security analytics, User and Entity Behavior Analytics (UEBA), threat intelligence, and Security Orchestration, Automation and Response (SOAR) capabilities. The capabilities may be provided natively, through modules of the proposed platform, or through integrated components included in the bidder’s proposed solution. 2. Provide authorized BOI security personnel with centralized access to alerts, incidents, correlated events, investigation information, entity context, cases, response actions, and reports. Where more than one component or interface is used, the bidder shall describe: • The purpose of each component or interface; • How users navigate between them; • How authentication and authorization are managed; • How data and incident context are preserved; • Whether additional licenses are required; and • Any functional or operational limitations. 3. Enable analysts to perform detection review, event correlation, investigation, evidence gathering, case management, response initiation, documentation, and case closure through an integrated workflow. The solution shall minimize unnecessary manual transfer of data, duplicate data entry, repeated authentication, and loss of investigation context between components. 4. Collect and normalize telemetry from network, endpoint, identity, cloud, application, virtualization, security appliance, and other supported data sources into consistent and searchable fields or schemas. The solution shall support correlation and investigation across these data sources through centralized, federated, or otherwise integrated search capabilities. Where data is maintained in more than one repository, the bidder shall explain: • How cross-source searches and correlations are performed; • How data consistency and timestamps are maintained; • How search results are presented to analysts; • Applicable search or retrieval limitations; • Retention arrangements for each repository; and • Whether data movement or export is required. 5. Provide network security visibility using NDR, network traffic analytics, flow analysis, packet-derived metadata, firewall and network-device telemetry, or equivalent capabilities sufficient to identify suspicious network activity. Network detections and associated context shall be available for correlation with endpoint, identity, cloud, application, and other security telemetry. The bidder shall disclose whether the network analytics capability is: • Native to the proposed platform; • Supplied as a module; • Integrated through a component included in the proposal; or • Dependent on an existing BOI or third-party product. 6. Ingest, normalize, enrich, and correlate data from supported third-party endpoint, firewall, WAF, network, identity, cloud, virtualization, application, and security products. The solution shall not require BOI to replace supported existing security products solely with products from the proposed solution vendor. A proprietary endpoint agent shall not be mandatory for ingestion of logs or telemetry already made available through supported, secure, and documented protocols, APIs, agents, connectors, or collection mechanisms. Where an agent is technically necessary, the bidder shall identify its purpose, resource requirements, supported operating systems, security controls, and licensing implications. 7. Provide prebuilt or configurable connectors for commonly used security and IT data sources, including those identified in the BOI log-source inventory. Connectors shall use supported methods such as syslog, CEF, LEEF, Windows Event Forwarding, APIs, webhooks, database interfaces, secure file transfer, or other documented standards. Configuration through supported tools, mappings, parsers, low-code facilities, or vendor-provided templates shall be acceptable and shall not be considered custom software development. 8. For BOI in-house, legacy, or other sources without an existing connector, the bidder shall describe: • The proposed integration method; • The party responsible for connector, parser, or integration development; • Information and access required from BOI; • The proposed delivery period; • Testing and acceptance procedures; • Maintenance and update responsibilities; • Applicable fees or licensing costs; and • Any limitations affecting normalization, enrichment, correlation, or support. Any proposed delivery period shall be subject to BOI review and inclusion in the approved implementation plan. 9. The solution shall be offered as a secure hosted or Software-as-a-Service deployment that minimizes BOI-managed analytics infrastructure. A functionally equivalent cloud-hosted, managed, or hybrid architecture may also be proposed, provided that it satisfies BOI’s requirements for security, availability, scalability, data residency, data sovereignty, privacy, performance, support, business continuity, and total cost of ownership. The bidder shall disclose: • The hosting provider and relevant service locations; • The location where BOI data is processed, stored, backed up, and archived; • All BOI-managed infrastructure required; • All vendor-managed infrastructure required; • Capabilities unavailable or limited under the proposed deployment; • Shared-responsibility arrangements; • Service availability commitments; and • Data extraction, transition, and secure deletion arrangements upon contract expiration or termination. 10. Support deployment in on-premises, cloud, or hybrid environments. 11. Deliver next-generation SIEM, Network Detection and Response (NDR), User and Entity Behavior Analytics (UEBA), threat intelligence, and Security Orchestration, Automation, and Response (SOAR) capabilities on a unified platform, operating on a single common data model and administered through a single console. 12. Enable an analyst to move from detection through correlation, investigation, and case closure without leaving the platform console. 13. Support secure communication and data transmission mechanisms. 14. Allow scalability to accommodate future growth in event volume, log sources, and monitoring requirements. B. Log Collection, Ingestion, Aggregation, and Security Monitoring The solution shall provide centralized security event monitoring and log management capabilities which shall: 1. Collect, aggregate, normalize, and process security logs and telemetry from multiple sources which shall include but not be limited to: servers, workstations, network devices, security appliances, databases, applications, cloud platforms, identity and access management (IAM) systems, endpoint security solutions, collaboration and productivity platforms, operating systems, and virtualization platforms. 2. Support industry-standard protocols and formats including but not limited to Syslog, Delimited Text Formats (CSV, TSV, and Pipe-Separated Values), APIs, Windows Event Logs, CEF, LEEF, JSON, and XML. 3. Support agent-based and/or agentless log collection methods. 4. Provide network security visibility and analytics capabilities that may be delivered natively or through integrated components. Network-derived telemetry, detections, and investigative evidence shall be available for correlation, investigation, and incident management alongside other relevant security data sources. 5. Receive a copy of network traffic from a local switch (SPAN/mirror/TAP) and from a remote switch across a network hop (RSPAN/ERSPAN/GRE, or equivalent), and receive traffic copies from workloads hosted in public cloud environments. 6. Accept flow-based records (NetFlow, sFlow, IPFIX, and cloud flow logs). 7. Perform deep packet inspection to identify the applications running within network traffic and not merely count connections with the service provider stating the number of applications recognized. 8. Track the state of network connections (established, closed, half-open, aborted, expired) and their duration. 9. Detect lateral movement between internal machines and provide visibility into unmanaged, IoT, and operational-technology (OT) devices that carry no agent. 10. Detect command-and-control and malicious-domain behavior from network traffic. 11. Support correlation of network, endpoint, identity, cloud, application, and other relevant security telemetry to assist analysts in investigating potentially related security activity across multiple data sources. 12. Where file-analysis or sandboxing capabilities are provided, the solution shall support submission, analysis, enrichment, and review of potentially suspicious files and shall make available relevant investigation results, findings, indicators, or behavioral observations to authorized analysts. 13. Provide secure storage, retention, archival, and retrieval capabilities for logs, alerts, incidents, investigations, and related security records. The bidder shall clearly identify retention periods, searchable data periods, archival arrangements, retrieval methods, applicable limitations, and any associated licensing, storage, or service costs. 14. Continuously and automatically discover devices, assign each a unique identity, and maintain a live device inventory with no manual registration. 15. Provide searchable repositories for investigation and audit purposes, supporting centralized visibility across BOI's ICT infrastructure. C. Threat Detection, Correlation and Security Analytics The proposed solution shall provide advanced threat detection and event correlation capabilities to support proactive cybersecurity monitoring. 1. Must provide a combination of detection techniques, including machine learning, behavioral baselining, relationship-based correlation, and curated detection rules, rather than relying on a single detection method or signatures alone. 2. Support real-time or near real-time event analysis and monitoring, and correlate events from multiple sources to identify suspicious activities and attack patterns. 3. Generate alerts, notifications, and incidents based on predefined and configurable detection rules, and support configurable use cases, correlation rules, and detection content that BOI/ITD can write and tune without vendor engineering. 4. Where User and Entity Behavior Analytics (UEBA) capabilities are proposed, the solution shall support behavioral analysis of users, systems, applications, devices, accounts, or other relevant entities and assist in identifying unusual or potentially suspicious activity. The bidder shall clearly identify any licensing, architectural, operational, or deployment prerequisites associated with these capabilities. 5. Detect unusual sign-in behavior, including impossible travel, brute-force attempts, and password spraying, and support detection of unauthorized access, compromised accounts, insider threats, and suspicious operational activities. 6. Support detection of known and emerging cybersecurity threats, and generate risk indicators and risk-based alert prioritization/event scoring. 7. Apply threat-intelligence enrichment as data arrives, from several independent sources, with the source and confidence of each match visible to the analyst; accept BOI-supplied threat intelligence and enrichment credentials, managed centrally. 8. Map every detection to the MITRE ATT&CK framework (or equivalent recognized industry catalogue of attacker techniques) and present it as a step-by-step view of how the attack is progressing. 9. Support mechanisms that assist in reducing unnecessary or duplicate alerts, prioritizing significant security events, and improving analyst efficiency. The bidder shall describe the techniques used to reduce alert fatigue and improve detection quality. 10. Update detection content on an ongoing basis with no action required from BOI/ITD. 11. Ensure every detection is explainable, allowing the analyst to see which data and which techniques produced it. D. Triage Prioritization and Alert Management The solution shall reduce the analyst’s workload through automated triaging. 1. Prioritize the analyst's queue by risk, surfacing the highest-risk cases first, so analysts spend their time where it matters most. 2. Reduce noise by automatically grouping related alerts into a single case, so analysts are not triaging the same incident multiple times. 3. Automatically enrich each alert by checking reputation and threat intelligence and gathering relevant context across process, identity, network, and file and present that evidence to the analyst to speed up decision-making. 4. Present enrichment evidence as an itemized list of what was checked and what each check found, in plain language, so the analyst can reach a decision quickly. 5. Ensure that classifying or closing a case consistently updates related alerts and is reflected across the platform, so the queue stays accurate. 6. Allow BOI/ITD to tune what is prioritized and how alerts are grouped through the platform interface, without requiring vendor engineering. E. Incident Investigation, Response and Security Operations Support The solution shall include support for security operations and incident response. 1. Automatically group related alerts into a single case representing one attack scenario, without an analyst manually assembling it. 2. Bring alerts that share any related item such as a host, an address, a hostname, a cloud resource, or a user into one case, so that a multi-machine or spreading attack is seen as one incident rather than scattered across many. 3. Support user, account, identity, or entity enrichment and correlation capabilities that assist analysts in relating activity across multiple identifiers, accounts, or data sources where such relationships can be established. 4. Provide contextual summaries, investigative overviews, or equivalent analytical capabilities that assist analysts in understanding the scope, severity, affected assets, entities, and potential impact of an incident or investigation. 5. Support identification, visualization, correlation, or analysis of related attack activity, attack paths, event sequences, tactics, techniques, and procedures (TTPs), including available supporting evidence and contextual information. 6. Present the events in a case on a timeline, in true time order across time zones, with notes explaining the significance of each key event so the analyst can follow the story. 7. The solution may provide natural-language, guided-query, assisted-search, visual investigation, or equivalent capabilities that simplify access to investigative functions for authorized users. 8. Limit any AI assistant strictly to reading and explaining data; the AI assistant shall not be able to carry out response actions, change a case's status, or alter an analyst's classification. 9. Show the relationships between hosts, users, processes, files, and network activity for a case in one interactive view, with the ability to move from any item to related ones. 10. Allow analysts to run proactive threat hunts across the stored data, save and re-use them, schedule them, and convert a useful hunt into an ongoing detection rule. 11. Allow analysts to search the full stored data directly from the investigation screen, with no need to export to another tool; case records shall support notes, assignment, status, and shift handover. 12. Provide investigation dashboards and workspaces; maintain audit trails and historical event records; and facilitate collaboration among authorized security personnel during incident handling activities. 13. Support event analysis, forensic investigation and incident tracking. 14. Maintain audit trails and historical event records. 15. Support case management and incident documentation capabilities. 16. Enable configurable notification, escalation, and response procedures. 17. Facilitate collaboration among authorized security personnel during incident handling activities. F. Response, Orchestration, and Automation 1. Allow authorized analysts to initiate and manage response actions, including but not limited to endpoint isolation, account suspension or disablement, and network address blocking, through an integrated investigation and case management workflow. The solution shall preserve investigation context and auditability throughout the response process. 2. Provide security orchestration, automation, and response (SOAR) capabilities that integrate with detection, investigation, incident management, and case handling functions. The solution shall enable coordinated response activities while maintaining visibility, traceability, and operational continuity for analysts. 3. Provide prebuilt response playbooks, workflows, templates, or equivalent automation content for common cybersecurity scenarios, including phishing, malware, suspicious authentication activity, potential data exfiltration, and command-and-control related activity. Such content shall be available for configuration and use without requiring custom software development. 4. Support configurable automated, semi-automated, and manual response workflows. The solution shall allow BOI to define triggering conditions, approval requirements, escalation procedures, response actions, and execution controls based on organizational requirements and risk tolerance. 5. Support integration with BOI's existing security, identity, endpoint, network, cloud, productivity, and IT service management systems through supported interfaces or connectors. Where technically supported by the integrated system, the solution shall enable the exchange of information and execution of response actions appropriate to the incident or investigation context. 6. Record response actions, workflow activities, approvals, automated executions, and administrative changes in auditable records that are protected against unauthorized modification or deletion and can be exported for reporting, compliance, investigation, or audit purposes. 7. Allow authorized BOI personnel to create, modify, disable, test, and manage response workflows, automation logic, rules, and playbooks through supported administrative tools and interfaces, without requiring vendor-developed code changes. 8. Support updating incident status, risk level, severity, priority, or classification based on newly correlated events, alerts, intelligence, or investigation findings. The solution shall allow authorized users to reopen, reclassify, or continue investigations when appropriate. 9. Support configurable notification, routing, escalation, approval, assignment, and response procedures based on defined organizational policies, risk criteria, incident attributes, user roles, and operational requirements. G. Multi-Tenancy, Scalability, and Availability 1. Support logical separation of multiple BOI sites, environments, business units, or operational domains with configurable access controls, detection content, and policies applicable to each environment while maintaining appropriate separation of data and administrative functions. 2. Where behavioral analytics or UEBA capabilities are provided, the solution shall maintain appropriate separation of tenant or site data and ensure that access controls, detections, risk calculations, and analytical results are governed in accordance with BOI-defined administrative and security requirements. 3. Support authorized centralized administration, monitoring, correlation, and search across applicable sites, environments, or organizational units, subject to configured access controls and segregation requirements. 4. Enforce role-based or attribute-based access controls consistent with the principle of least privilege. Administrative and security-sensitive actions shall be auditable and protected against unauthorized modification or deletion. 5. Allow new sites/tenants to be added without redesigning the existing deployment. 6. Allow scalability to accommodate future growth in event volume, log sources, and monitoring requirements, and support high availability, redundancy, and business continuity capabilities where applicable. H. Reporting, Compliance Monitoring, and Data Governance The solution shall provide reporting, compliance, and governance capabilities that support BOI’s operational, security, and regulatory requirements. 1. Provide customizable dashboards and reports for executive, management, and technical users; generate scheduled, ad hoc, and compliance reports; and support visualization of security trends, incidents, and operational metrics. 2. Maintain audit logs for monitoring and compliance purposes, including an exportable, tamper-evident log of all analyst and administrator activities. 3. Ensure raw logs and full traffic are not sent outside the platform; where AI is used, the SP shall document exactly what data is sent to it, what is masked, and the reason for any deliberate exception. 4. Ensure BOI data is never used to train AI models, is processed one request at a time, and is not retained by any AI provider afterward; this shall be confirmed contractually. 5. Ensure that where the platform checks an indicator against an outside reputation or threat-intelligence service, only the specific item (an address, a domain, or a file fingerprint) is sent (never raw logs or operational data). 6. Keep BOI's data fully separate within any AI processing, with nothing shared or re-used between other customers/tenants of the Service Provider. 7. Disclose where the platform and any AI processing physically take place, and what data-residency options are available, in support of compliance with Executive Order No. 119, s. 2026 and related data governance and data sovereignty requirements. 8. Hold current, independent security certification for the platform, with evidence available upon request, and encrypt all data in transit and at rest, with the service provider disclosing the encryption standards used. 9. Protect the Confidentiality, Integrity, and Availability of data and assets; support secure retention, storage, and access control of security logs and event data. 10. Support alignment with relevant government cybersecurity policies, standards, and regulatory requirements. I. Integration and Interoperability Requirements The solution shall support interoperability with existing and future ICT systems. 1. Support integration with network security devices, endpoint security platforms, vulnerability management solutions, identity and access management systems, cloud services, email security systems and other cybersecurity tools. 2. Support open standards and APIs for future integrations. 3. Permit ingestion and analysis of data from 3rd party systems, including BOI in-house or legacy applications; where no ready-made connector exists, the SP shall disclose who builds it, the turnaround time, and whether it is chargeable. 4. Support data export, backup, and migration capabilities using widely accepted formats. 5. Not require proprietary components that would unnecessarily restrict future migration or integration initiatives. 6. The solution must have the capability to integrate and forward relevant logs and artifacts to the SIEM solution of the Department of Information and Communications Technology (DICT). J. Technical Support 1. Twenty-four (24) hours a day, seven (7) days a week technical support through onsite and/or remote assistance throughout the one (1)-year contract period. 2. Unlimited phone and email support. 3. Troubleshooting and resolutions of problems related to the SIEM solution. K. Training The Winning Bidder shall conduct four (4) days of Knowledge Transfer and Training on Incident Handling and an additional one (1) day dedicated to the demonstration of the proposed solution for ten (10) FAS-ITD personnel. V. DATA PRIVACY AND CONFIDENTIALITY The Service Provider shall comply with all applicable laws, regulations, and government issuances relating to data protection, privacy, information security, and cybersecurity, including but not limited to Republic Act No. 10173 (Data Privacy Act of 2012), its Implementing Rules and Regulations, and issuances of the National Privacy Commission (NPC). The Service Provider shall implement appropriate organizational, physical, and technical security measures to protect BOI data against accidental or unlawful destruction, alteration, disclosure, loss, misuse, unauthorized access, processing, or transfer. The Service Provider shall ensure that all personnel, subcontractors, and third parties who may have access to BOI data are bound by appropriate confidentiality and non-disclosure obligations. BOI data shall be processed solely for the purpose of providing the contracted services and shall not be sold, shared, disclosed, mined, profiled, analyzed for commercial purposes, or otherwise used for any purpose not expressly authorized by the BOI. The Service Provider shall not use BOI data, logs, telemetry, incidents, alerts, reports, metadata, or any derivative information for training, testing, improving, or developing artificial intelligence, machine learning, analytics, or commercial products without the prior written approval of the BOI. In the event of a personal data breach, cybersecurity incident, or unauthorized disclosure affecting BOI data, the Service Provider shall notify the BOI within twenty-four (24) hours from discovery and provide all necessary information, assistance, forensic evidence, mitigation measures, and remedial actions required by law and government regulations. A. Ownership of Data All logs, telemetry, alerts, incidents, investigations, reports, configurations, threat intelligence entries, audit trails, and other information generated, collected, processed, stored, or maintained under the contract shall remain the exclusive property of the BOI. Nothing in the contract shall be construed as transferring ownership, intellectual property rights, possessory rights, or control over BOI data to the Service Provider. The BOI shall retain unrestricted rights to access, export, copy, preserve, archive, analyze, transfer, and use its data throughout the term of the contract and after its expiration or termination. B. Data Residency and Sovereignty The bidder shall disclose the physical locations where BOI data is processed, stored, replicated, archived, backed up, or otherwise maintained. The Service Provider shall ensure compliance with Executive Order No. 119, s. 2026, and all applicable government data residency, sovereignty, information governance, and cybersecurity requirements. Any transfer of BOI data outside the declared hosting environment or approved jurisdictions shall require the prior written approval of the BOI. C. Exit Management and Transition Assistance Upon expiration, termination, non-renewal, or completion of the contract, the Service Provider shall provide transition assistance to ensure the orderly transfer of services, records, and data to the BOI or its designated replacement provider. The Service Provider shall, upon request of the BOI: 1. Deliver all BOI-owned data, logs, alerts, incidents, cases, reports, configurations, playbooks, audit trails, and other relevant records in industry-standard, usable, and machine-readable formats; 2. Provide complete documentation necessary to facilitate migration, transition, or continued operation of the BOI's security monitoring environment; 3. Support the secure migration or transfer of data for a period of not less than sixty (60) calendar days following contract expiration or termination; 4. Cooperate with BOI personnel and any replacement service provider to ensure a smooth transition with minimal disruption to operations; 5. Certify in writing the complete deletion, destruction, or return of all BOI data remaining in its possession, custody, or control, including copies, backups, archives, temporary files, and replicated data, except where retention is required by law. The Service Provider shall not withhold BOI data due to contractual disputes, unpaid claims, proprietary limitations, licensing restrictions, or any other reason that may prevent the BOI from accessing or recovering its data. D. Vendor Lock-In Prevention The proposed solution shall support data export, backup, migration, and transfer through documented and industry-recognized formats, application programming interfaces (APIs), or other interoperable mechanisms. The Service Provider shall not impose technical, licensing, contractual, or proprietary restrictions that would unreasonably prevent the BOI from migrating to another solution or service provider. Any tools, connectors, scripts, parsers, configurations, workflows, playbooks, dashboards, reports, or documentation developed specifically for the BOI under this project shall be made available to the BOI without additional charges upon project completion or contract termination. VI. CONTRACT PERIOD The contract period shall cover one (1) year and upon acceptance of the BOI Security Information and Event Management solution. VII. QUALIFICATIONS OF THE SERVICE PROVIDER The service provider must have necessary eligibility, experience and expertise in configuring, deploying the SIEM solution and compliance with relevant Government procurement requirements in accordance with Republic Act No. 12009, otherwise known as the “New Government Procurement Act, and its Implementing Rules and Regulations (IRR) which includes the following: • At least three (3) years of experience in deploying SIEM solutions. • The service provider must have at least one (1) Certificate of Completion and Acceptance of similar projects within the last five (5) years from date of submission and receipt of bid. • The service provider must submit a certificate issued by the manufacturer that confirms that they are authorized to sell the licenses being procured by the BOI. • Provide Certificate from the Manufacturer of the proposed solution stating that the Bidder is at least a Certified Partner/Reseller. • Service Level Agreement (SLA) • Non-Disclosure Agreement (NDA) • Platinum PhilGEPS Membership VIII. MANPOWER REQUIREMENTS The service provider must submit respective resumes of each team member, which shall form an integral part of the bid documents. • At least one (1) Certified Solution Engineer of the system that will be involved in the project. The bidder must submit documentary proof such as a copy of relevant valid Certified Solution Engineer or equivalent certification from the manufacturer/vendor of the proposed solution and the engineer’s curriculum vitae or resume. • At least one (1) Certified Project Manager with three (3) years of experience who will handle the project. The bidder must submit documentary proof such as Project Management Training certifications or similar and the Project Manager’s curriculum vitae or resume. • At least one (1) Certified Support Engineer with relevant valid certifications to ensure effective end-to-end delivery of support. The bidder must submit documentary proof such as relevant valid certification/s and the engineer’s curriculum vitae or resume. All certifications must be valid and current at the time of bid submission. The submitted resumes shall clearly indicate the relevant certifications, professional experience, and the role of each team member in the project. IX. MODE OF PROCUREMENT The Procurement of Subscription of Cloud-Native Security Information and Event Management (SIEM) Solution for Centralized Security Monitoring, Threat Detection and Correlation, Incident Response and Compliance Management shall be undertaken through Competitive Bidding pursuant to R.A. No. 12009, otherwise known as the “New Government Procurement Act, and its Implementing Rules and Regulations (IRR). X. APPROVED BUDGET COSTS A budget ceiling of FIVE MILLION PESOS (PHP 5,000,000.00) has been approved and earmarked for the Procurement of Subscription of Cloud-Native Security Information and Event Management (SIEM) Solution for Centralized Security Monitoring, Threat Detection and Correlation, Incident Response and Compliance Management, including all incidental expenses for the duration of the project. Prices are in PHP Peso and are VAT inclusive. XI. SOURCE OF FUNDS The budget authorized for the Procurement of Subscription of Cloud-Native Security Information and Event Management (SIEM) Solution for Centralized Security Monitoring, Threat Detection and Correlation, Incident Response and Compliance Management shall be sourced from the 2026 MOOE. XII. DELIVERABLES Delivery of the solution and other necessary licenses must be completed within thirty (30) days upon receipt of Notice to Proceed. Conduct of Knowledge Transfer/Training on Incident Handling and demonstration of the solution being offered must be completed within thirty (30) days after the delivery of the solution and other necessary licenses. The winning bidder must provide six (6) hardbound copies and soft copies of project documentation, containing the following: a. Project Completion Certificate b. Notice of Award c. Notice to Proceed d. Notarized Contract e. Non-Disclosure Agreement (NDA) f. Terms of Reference and Bid Bulletins g. BAC Resolution h. Training Materials i. Training Attendance Certificate j. Order Confirmation k. Maintenance and Support Agreement l. User Acceptance Test Plan m. Installation and Configuration Manual n. Incident and project escalation procedure with list of designated technical support engineers o. Service Level Agreement (SLA) p. Delivery Receipt and Sales Order XIII. LIQUIDATED DAMAGES If the Service Provider fails to satisfactorily deliver the goods, perform the services, or complete any contractual obligation within the period specified in the Contract, including any duly approved extension thereof, the Service Provider shall be liable for liquidated damages, not by way of penalty, in an amount equivalent to one-tenth (1/10) of one percent (1%) of the cost of the unperformed portion of the Contract for every calendar day of delay until the required goods are delivered, services are performed, and accepted by the Board of Investments (BOI). The BOI shall not be required to prove actual damages to be entitled to recover liquidated damages. The assessment and collection of liquidated damages shall be without prejudice to the BOI's right to pursue other remedies available under the Contract, Republic Act No. 12009, its Implementing Rules and Regulations (IRR), and applicable laws. Once the cumulative amount of liquidated damages reaches ten percent (10%) of the total Contract Price, the BOI may rescind or terminate the Contract, forfeit the Performance Security, and undertake such other remedies as may be authorized under the Contract and applicable procurement laws, rules, and regulations. The imposition of liquidated damages shall not relieve the Service Provider from its obligation to complete performance of the Contract unless otherwise directed by the BOI. Any delay that materially affects BOI's cybersecurity operations, security monitoring capability, incident detection, incident response, regulatory compliance, or protection of government information assets shall be considered a material breach of the Contract and may constitute a ground for contract termination, without prejudice to the imposition of liquidated damages and other remedies available under applicable laws and regulations. XIV. PAYMENT All services rendered for this project by the Service Provider shall be paid only upon approval, signing, and issuance of the Project Completion and Acceptance Certificate by the BOI management. Payment shall be made in accordance with the agreed payment scheme and subject to existing government accounting and auditing rules and regulations. XV. GROUNDS FOR CONTRACT TERMINATION • Failure to deliver or perform contractual obligation. • Substantial delay/non-performance or negative slippage of ten (10%) percent. • Abandonment or refusal to continue work. • Failure to correct defective/rejected work. • Unauthorized sub-contracting. • Unlawful acts such as corrupt fraudulent, collusive or coercive practices. Forged documents. XVI. RESERVATION CLAUSE The BOI reserves the right to reject any and all bids, declare a failure of bidding, or not award the contract at any time prior to contract award, without thereby incurring any liability to the affected bidder or bidders. Pre-bid Conference Date Time Venue 04/11/2026 1:00 PM MS TEAMS Other Information Please register for the Pre-Bid Conference for the Procurement of a Security Information and Event Management (SIEM) Solution, scheduled on November 4, 2026, at 1:00 PM via Microsoft Teams, by completing the registration form below. Registration Form: https://forms.cloud.microsoft/r/1zyYViKdXY?origin=lprLink The Microsoft Teams meeting link and details will be provided upon successful registration. Thank you, and we look forward to your participation! Created by Jerry Rojas Pajarillo Date Created 26/10/2026 The PhilGEPS team is not responsible for any typographical errors or misinformation presented in the system. PhilGEPS only displays information provided for by its clients, and any queries regarding the postings should be directed to the contact person/s of the concerned party. ©&nbsp2004-2026 DBM Procurement Service. All rights reserved. Help | Contact Us | Sitemap