Procurement of Network Threat Detection and Response System (Cybersecurity) Solution for NSRC Systems Co-Located at UP Manila IMS Office for Three (3) Years

Procurement of Network Threat Detection and Response System (Cybersecurity) Solution for NSRC Systems Co-Located at UP Manila IMS Office for Three (3) Years

TERMS OF REFERENCE

Procurement of Network Detection and Response System (Cybersecurity) Solution

I. Overview
The Newborn Screening Reference Center (NSRC) is mandated by Republic Act 9288, otherwise known as the Newborn Screening Act of 2004, to maintain the national testing database and patient registries, and other critical information systems supporting the implementation of the national newborn screening program.

To ensure continuity, availability, and security of these systems, NSRC maintains information technology infrastructure both at the NSRC Office and within systems co-located at the UP Manila IMS Office. As part of its continuing cybersecurity enhancement initiatives, NSRC previously procured and implemented the same Network Detection and Response (NDR) cybersecurity solution in 2025 for the systems located at the NSRC office.

To further strengthen the cybersecurity posture of the newborn screening network infrastructure, NSRC intends to procure the same Network Detection and Response System (Cybersecurity) Solution for the systems co-located at the UP Manila IMS Office. The solution shall provide intelligent threat detection, monitoring, analysis, and response capabilities to proactively identify and mitigate cybersecurity threats affecting mission-critical systems and databases.

II. Objective
To procure a Network Threat Detection and Response System (Cybersecurity) Solution for the NSRC systems co-located at the UP Manila IMS Office in order to strengthen cybersecurity monitoring, threat detection, incident analysis, and response capabilities for the newborn screening program’s critical information systems and databases.

III. Funding Source
The total amount for acquisition chargeable against Trust Fund 142-B is Eight Million and Nine Hundred Thousand Pesos only (PHP8,900,000.00).

IV. Minimum Specifications
Network Detection and Response System Solution (Cybersecurity) Requirements
1. Performance
a. It must be capable of processing at least 5,000 events or alerts per second to ensure real-time threat detection and response.
b. The solution should include a sensor capable of sustaining a network throughput of 3 Gbps.
2. Hardware Component
a. The solution must have the following:
i. Minimum of 8 GB memory
ii. A system disk with a minimum of 480 GB
b. The solution must be able to run in the organization’s existing HCI system.
c. The solution must have a sensor that will provide at a minimum of 6*10/100/1000 Base-T and 2*10G Fiber SFP+ interface.
3. Monitoring
a. It should provide a comprehensive view of security events, including incident status and event-level distribution. It highlights security information such as security incidents, events with the largest threat surface, event type, and high-risk endpoints.
b. It should be able to monitor outbound connections with insights into external risks, threats, and threat trends by region. It supports real-time threat monitoring with an independent switch between international and domestic map views.
c. It should display a lateral threat situation that includes business and user access, the top initiated threat host, the top risk business, and an access trend chart. It displays security information using color coding for lateral attacks, illegal access, suspicious behavior, risk access, and other behaviors.
4. Asset Management
a. It must support query, editing and management of asset information, including asset type, geographic location, responsible person, audit status, host name, operating system, domain name, service and port, application, manufacturer, device model, vendor serial number, source device etc.
5. Weakness and Vulnerability Management
a. It should have a weak password detection mechanism that enables passive discovery and supports the detection of at least 62 common protocols such as FTP, IMAP, LDAP, POP3, SMTP, TELNET, and WEB. It should utilize rule matching and user and entity behavior analytics (UEBA) learning technology to detect weak passwords and anomalies in both user and network behavior.
6. Response
a. It must provide a business-oriented view of security risks, including attack phase distribution, risk level trends, event descriptions, external attacks, vulnerability risks, behavioral analysis, and open ports.
b. It should offer a host-based perspective, displaying key details such as host IP, branch, host group, risk level, security event labels, processing status, and linkage status. Risk levels include compromised, high, medium, and low.
c. It must support a security domain perspective to display security risks, including security domain list, security domain score, top event type, IP address, IP type, risk level and critical risk.
7. Correlated Response
a. It should support the Security Orchestration, Automation, and Response (SOAR) strategy based on asset type, event type, and risk level. It should be able to correlate data across components, including next-generation firewall, secure web gateway and endpoint detection and response (EDR) solutions. The asset type should include host, servers, and IPs within a specified range; The risk level should be categorized as compromised, high, medium or low. Event types should cover threats like Botnet, Phishing, Trojans, with a minimum detection capability of 20 distinct event types.
b. It should support integration with EDR components, enabling automated correlation policies for blocking traffic, threat scanning, and process termination. Additionally, it should provide feedback on virus information and details of the malicious domain name communication process.

V. Terms and Conditions
1. Price quotation shall be inclusive of product cost, taxes, shipping, and handling cost (Manila), freight, insurance and other overhead cost.
2. Delivery of the product and license shall be 60 to 90 days upon acceptance of the Notice to Proceed.
3. The Network Detection and Response System (Cybersecurity) Solution should have support for at least three (3) years for the software components of the project, which includes bi-annually preventive maintenance service.

VI. Provider requirement
1. The principal/vendor of the solutions must have a local office and local engineers in the Philippines to provide 24x7 onsite or remote support whenever necessary.
2. The principal/vendor of the offered solutions shall be in charge of the deployment, configuration and knowledge transfer of the solutions offered.
3. The principal/vendor of the offered solutions must be able to provide a dedicated technical account manager and real-time communication and proactive after-sales support.
4. The partner or reseller of the proposed solution for cybersecurity must have a technical certification from the principal/vendor.
5. The principal must be CMMI L5 certified.
Pre-bid Conference
Date : 21/10/2026
Time : 1:30 PM
Venue : The University of the Philippines-Manila, will hold a Pre-Bid Conference on 21 October 2026, the meeting will start at 01:30 p.m. and will follow the agenda for the day at the Procurement Management Office Conference Room at 2nd Floor Joaquin Gonzales Bui
Reference Number: 13281645
Area of Delivery: Metro Manila
Trade Agreement: Implementing Rules and Regulations
Procurement Mode: Public Bidding
Classification: Goods
Category: Information Technology
Bid Supplements: 1
Document Request List: 19