Question:
Hi Team,

Would Queensland Treasury be open to an alternate SIEM (other than Sentinel) for management of their infrastructure?

Regards,

Answered on 08/Oct/2025 09:37 AM:


Treasury is not open to an alternate SIEM at this time. Only responses utilising Sentinel will be considered.

Question:
1.5 Mandatory Information

Detailed requirements

Local service provision

The SOC, primary operations and core personnel are located within Australia. Follow-the-sun support models are encouraged.

Would primary operations be classed as first point of contact being located within Australia, with escalation to follow-the-sun operations outside of Australia?

Answered on 08/Oct/2025 01:27 PM:


First point of contact, SOC and primary business operations must be located in Australia. Escalation to resources in other geographical locations is allowed, as long as the customer’s data remains onshore.

Question:
Is ISO27001:2022 Mandatory?

Under section "1.5.4 Supplier Certifications" the document states: "The supplier is required to provide responses for the following items in order to provide evidence of ISO/IEC certification. The supplier can provide other certifications in this section if relevant."

under "Section 2 (C): Supplier Response" the document states:

"5. Other requirements

Supplier to Note: The supplier is required to provide responses for the following items in order to provide evidence of ISO/IEC certification. The supplier can provide other certifications in this section if relevant.

ISO/IEC 27001:2022 Mandatory"

Answered on 08/Oct/2025 12:56 PM:


Apologies for any confusion.

ISO27001:2022 certification is a mandatory requirement.

Question:
We have the following clarification questions, if you could advise, please.

• What is the current daily average ingestion for Sentinel, and have all log sources mentioned been onboarded? If no, what will need to be onboarded?

• A multi-tenant Sentinel architecture is mentioned. Could further context and information be provided?

Thanks

Answered on 09/Oct/2025 07:46 AM:


1 - Current daily ingestion is approximately 100GB split between analytics tier (65%) and data lake tier (35%). All core log sources are currently onboarded or in progress and anticipated to be complete prior to service commencement.

2 - Treasury operate multiple tenants comprising Test, Production and multiple b2b tenants with Entra connectors. Sentinel is configured in each tenant and managed internally via MTO.

Question:
Could you please provide the exact number of tenants within the sentinel architecture. Thank you

Answered on 09/Oct/2025 08:39 AM:


Currently 5 tenants incl DEV

Question:
Is the department looking for a VMS service? Does the department have one?

Answered on 09/Oct/2025 08:40 AM:


Treasury has a VMS solution in place, utilising the Whole of Government Rapid7 solution.

Question:
Hi, I am seeking clarity:

1. You are looking for a provider to manage SIEM (SOC) that will be Sentinel.

2. The SOC also asks for more than A SIEM, so would you consider a more comprehensive SOC platform zero trust with SIEM being as is

3 Is there an incumbent who knows the current environment and has staff working now.

4 If there is an incumbent what is the value of their current contract and for how long have they been engaged.

5. What is the approximate budget limit on this engagement so that we can make a decision of whether to bid or not.

Kind regards

Answered on 10/Oct/2025 09:40 AM:


1 - Correct

2 - Our Sentinel SIEM is already in place. We are looking for SOC services only

3 - Incumbent provides both SIEM (Splunk) and SOC services. We are moving away from that model.

4 - That information will not be provided.

5 - That information will not be provided.

Question:
1. What firewall technologies and models are currently deployed, and how many devices of each type are in use?

2. Is there a comprehensive list of all log sources, including custom applications and network devices, that must be integrated or is it a case of like for like and improve over time?

3. Are there any IoT or OT assets, or supporting infrastructure, that would be included in the monitoring scope in the future?

4. What ITSM tool/platform is currently used, and is bi-directional integration expected or in place?

5. Does Treasury possess Microsoft 365 E5 licenses for all users, or should the supplier provision these as part of the service?

6. What is the current vulnerability management solution (if any), and what is the scan frequency?

7. Are there any specific security clearance requirements for supplier SOC personnel?

8. What is the anticipated Cyber incident volume per priority (P1–P4) on a monthly or annual basis?

9. Will evidence of organisational ISO/IEC 27001:2022 certification with the SOC included in the scope by March 2026 (and concurrently working towards ISO/IEC 27017:2015) be considered compliant, or is current SOC-specific certification mandatory at contract commencement?

10. Is any physical on-site presence at Treasury facilities ever required, or is a fully remote, Australia-based operation sufficient by cleared personnel?

Answered on 13/Oct/2025 03:37 PM:


1 - Palo Alto - 16 instances including 6 Cloud NGFW

2 - Yes. yes, all log sources have been identified and will be integrated ahead of service consumption. It is expected that environmental understanding is established and log sources validated as part of onboarding.

3 - No

4 - Treasury uses ServiceNow. Bi-directional integration is not in place and not a requirement. Treasury requires notification of triaged alerts by phone and email for P1 & P2 incidents and email only for the rest.

5 - Treasury has M365 E5 licences for all users.

6 - Rapid-7. External sites are scanned daily, everything else is weekly. Laptops run an agent so that is constant, updating the console every 4 hours

7 - No

8 - These figures are from last month’s SOC report, and are typical:

Events processed by SIEM – 4,159,098,215

Security alerts triggered by SIEM – 162

Incident investigations by SOC – 5

Suspected security incidents – 0

Volume per month (Averaged over 12 months)

P1 – 0.7

P2 – 185

P3 – 92.4

P4 – 23.3

9 - ISO/IEC 27001:2013 certification is officially no longer valid at October 31, 2025, so Treasury would expect potential suppliers to have completed their upgrade to 2022. Failure to be able to evidence certification will render the offer non-compliant.

10 - For the SOC service, there is no onsite requirement. For optional ad-hoc services, there may be a requirement for onsite delivery from time-to-time.

Question:
Do SOC services extend to the management of detection rules and alert tuning?

Answered on 10/Oct/2025 02:08 PM:


The SIEM is primarily managed by Treasury staff. However, it is expected that the SOC provider will participate in maintaining analytics rules (1.5), provide support for standard and custom data connectors (1.11), provide recommendations on new capabilities as they pertain to the Sentinel environment (1.12), and assist in continuous improvement (1.17).

Question:
Hi,

we have a few queries if you can please answer for us - many thanks!!


1. What is the current and projected daily log ingestion volume (GB/day) across all data sources?

2. What is the current retention policy for security logs (e.g. 90, 180, or 365 days)?

3. Are all relevant log sources already onboarded into Sentinel, or will onboarding of new sources be part of this engagement?

4. The RFQ specifies SOC Level 1 and Level 2 as supplier responsibilities. Should Level 3 (forensics, threat intel, threat hunting) be costed as part of BAU or on-demand?

5. What is the current average monthly incident volume by severity (P1–P4)?

6. How many alerts are typically generated per day/week from the current Sentinel setup?

7. Are service credits mandatory for all missed SLAs, or only for critical P1–P2 breaches?

8. How many full-time equivalents (FTEs) are currently performing monitoring and response duties internally? What level of engagement or shadowing is expected from Treasury’s in-house team?

9. What clearance level (e.g., Baseline, NV1) is required for SOC personnel?

10. What is the expected timeline for full service transition (e.g., 3, 6, or 12 months)?

11. What is the expected number of use cases/analytics rules in Sentinel.

Answered on 13/Oct/2025 03:40 PM:


1 - Current daily ingestion is approximately 100GB split between analytics tier (65%) and data lake tier (35%).

2 - 90 days in analytics tier and 2 years in Data Lake tier

3 - Yes, all log sources have been identified and will be integrated ahead of service consumption. It is expected that environmental understanding is established and log sources validated as part of onboarding

4 - Threat hunting & intel - BAU. Forensics on-demand

5 - These figures are from last month’s report, and are typical:

Events processed by SIEM – 4,159,098,215

Security alerts triggered by SIEM – 162

Incident investigations by SOC – 5

Suspected security incidents – 0

Volume per month (Averaged over 12 months)

P1 – 0.7

P2 – 185

P3 – 92.4

P4 – 23.3

6 - These figures are from last month’s report, and are typical:

Events processed by SIEM – 4,159,098,215

Security alerts triggered by SIEM – 162

Incident investigations by SOC – 5

Suspected security incidents - 0

7 - Service Credits will be mandatory for P1 and P2 incidents. We will consider modest credits for other failures, or imposing service credits only when a threshold number of performance failures is exceeded.

8 - 2 FTEs, additional capacity mobilised on-demand. No expectation on SOC to action this at this time, only on escalation.

9 - No specific clearances. All Treasury personnel require clear Criminal History Check and would expect supplier the require the same.

10 - Please refer to timeframes quoted in document in section 1.4

11 - We currently have 269 active Analytics Rules in sentinel. It is expected that, as specific use cases are identified, further analytics rules will be created.

It is expected that the Supplier will contribute to these based on threat intel and IOCs and as a result of Threat Hunting.

It is expected that the Supplier will support Treasury in onboarding new logging sources and configuring appropriate analytics on the data ingested, especially if the vendor provides OOTB analytics for a common source of data.

Question:
What is Queensland Treasury's current and expected log ingestion volume

What is the amount of data generated by systems, applications, and security tools that need to be processed, analysed, and stored?

Answered on 13/Oct/2025 02:53 PM:


Current daily ingestion is approximately 100GB split between analytics tier (65%) and data lake tier (35%).

Question:
Hi Team,

Can we please confirm the correct submission closing date and time as there are a few variations listed on VendorPanel and in several locations within the RFQ document.

Thanks,

Sam

Answered on 13/Oct/2025 09:41 AM:


The closing time and date is 4:00pm, 31 October 2025.

Question:
Please confirm if the contract terms will be based on standard QITC contract.

Answered on 13/Oct/2025 03:41 PM:


Yes. Section 2 b – Supplier Response states: Any contract arising from this RFQ process will be governed by the General Contract Conditions - ICT Products and Services – Version 5.0.0, and associated Contract Details. This is the current QITC version.

Question:
Thank you in advance for responding to our questions below.

1. Which CTI feeds are currently integrated into Treasury's Sentinel instance?

2. Treasury has noted that its staff will be responsible for initial response, containment and resolution of cyber incidents. With respect to the creation of automation rules and playbooks, is it intended that that automations and playbooks developed will be used (initiated) by Treasury staff?

3. In 1.5.1-2 it is stated that "The initial response, containment and resolution of P1 and P2 incidents will be overseen by the Treasury Cyber Security team, with the option to leverage the SOC’s assistance with the response, containment and resolution of P1 and P2 incidents as necessary." , however in the performance metrics listed in 1.5.3, MTTR refers to " When the Supplier either: Executes an approved containment action (e.g., isolating a device, blocking an IP) Or Escalates the case to the Customer Cyber Security team (Level 3).” – This potentially creates confusion, depending on whether Treasury requires response to be performed by its own staff or by the supplier. Is it possible to clarify this SLA in a way that it can be more easily understood depending on the context of whether response should be performed by Treasury or the supplier?

4. Containment/Escalation Timestamp: When the Supplier either: Executes an approved containment action (e.g., isolating a device, blocking an IP) Or Escalates the case to the Customer Cyber Security team (Level 3)." - The latter implies that some responses are to be performed by the supplier. Can you please clarify which responses will be performed by the supplier and which will be performed by Treasury?

Answered on 16/Oct/2025 06:06 PM:


1. None

2. Treasury will leverage their own cyber response playbooks. The references to playbooks refers to these. There is an expectation that automation riles and Sentinel playbooks are developed as part of ongoing operational improvements.

3. Initially it is intended that MTTR refers to the triage, correlation and alert management, with escalation to Customer Cyber Security team (Level 3).

4. Initially it is intended that this refers to the triage, correlation and alert management, with escalation to Customer Cyber Security team (Level 3).

Question:
1. We are currently in the process of finalizing our ISO/IEC 27001:2022 certification with an accreditation date being achieved towards the end of November.

2. What is the driver for mandatory ISO/IEC 27001:2022 certification? Is it driven by the IS18 information security framework or is it specific to QLD Treasury?

3. Can an IRAP accreditation be treated as an equivalent?

Answered on 16/Oct/2025 06:22 PM:


1. Noted

2. Both. Treasury Information Services maintains ISO/IEC 27001:2022 certification and expects key suppliers in the information security domain to also be accredited.

3. Treasury will accept IRAP accreditation if the supplier also provides a roadmap for achievement of ISO certification prior to commencement of the contract.

Question:
Has alert automation and SOAR capability been enabled in Sentinel? Would the SOC provider be permitted to pull alerts from Sentinel into their own SOC SOAR analysis platform (hosted in Australia) for automated triage, alert processing and correlation with the provider’s threat intelligence and customer alert observables, and for integration with the Queensland Treasury SNow platform to create incident tickets for escalation to identified resolvers?

Answered on 16/Oct/2025 06:14 PM:


No - no alert automation or SOAR is configured.

For alert integration to SOAR, vendors should refer to the compliance requirement below from section 1.5.2. Integration of alerts to 3rd party SOAR platforms will be considered however subject to confirmation of 3rd party risk assessments and validation that no sensitive information is contained within alerts.

Compliance

The provider must agree that Treasury SIEM data must remain within the Queensland Treasury Infrastructure at all times. Security logs must not be copied or moved outside of our environment. The Supplier shall ensure all data and information generated during provision of these services remains within Australia.

Question:
Hi,

Q1: - Queensland Treasury has confirmed “Current technology” in point 1.3

- are all these technologies are currently being ingested into the SIEM

- are there any technologies, systems not included that is foreseen to be ingested in the near future



Q2: - Queensland Treasury please confirm the current average volume of data within the SIEM?



Q3: - Does Queensland Treasury have a frequency of threat hunting over the platform/logs and systems?



Q4: - Vulnerability Remediation: Does Queensland Treasury want the SOC provider to perform the patching as part of vulnerability remediation or only provide information and expertise about the vulnerabilities.

Answered on 16/Oct/2025 06:18 PM:


1. 1.3 states:

Current Technology: Microsoft Defender for Endpoint, Microsoft Defender for Identity, Sentinel, Azure Data Explorer, Azure Data Explorer Cluster, Sentinel Data Lake, NetScope, ProofPoint, Syslog, Azure, AWS. Multi-tenant Sentinel architecture.

All log sources have been identified and will be integrated ahead of service consumption. It is expected that environmental understanding is established and log sources validated as part of onboarding

2. Current daily ingestion is approximately 100GB split between analytics tier (65%) and data lake tier (35%).

3. This is considered bau. Proactive threat hunting should be continual and ongoing as the landscape of threat intelligence and IOC develops.

4. No

Question:
Hi Team, please provide clarifications on below questions,

1 Onsite Requirement: Is any physical onsite presence required at Treasury offices, or is a fully Australia-based remote SOC team acceptable for meeting the "primary operations" requirement?

2 Follow-the-Sun Model: What is the acceptable geographic breakdown for follow-the-sun support?

3 L3 Resource Model: For L3 activities (threat hunting, forensics), is the expectation for the supplier to provide dedicated resources, on-demand specialists or purely advisory support to the internal Treasury team?

4 Process Definition: Should the supplier operate and mature Treasury's existing security processes, or are we expected to define and implement new processes?

5 Asset & Log Scope: Are logs from all network assets (firewalls, load balancers) and full cloud audit logs (AWS CloudTrail, Azure Activity) currently in scope and integrated into Sentinel?

6 New Data Source Integration: Are there any data sources planned for integration that are not currently implemented? Is the integration of new log sources part of the supplier's duties?

7 Security Tool Access: Will the SOC team have direct read-access to security tool consoles (e.g., Microsoft 365 Defender portal, Azure Security Center) or is access limited to the data ingested within Sentinel?

8 Threat Intelligence: Is third-party threat intelligence currently procured and integrated into the SIEM, or is the supplier expected to recommend/procure threat intelligence subscription?

9 OEM Support for Connectors: Does Treasury have OEM support agreements in place to assist with the creation of custom data connectors if any support is required?

10 Advisory vs. Hands-On: For maintaining the "evergreen" state of the Sentinel environment, is the supplier's role limited to providing advisory recommendations or does it include the implementation of those recommendations?

11 Team Mobilization Timeline: What is the expected timeline for team mobilization and achieving full operational handover?

12 Transition SLA: Is there a cooling or stabilization period during the transition phase where SLAs are not enforced?

13 On-Demand Resource Location: For temporary, on-demand cyber security resources, is onsite or remote work required?

Answered on 20/Oct/2025 01:59 PM:


1 - For the SOC service, there is no onsite requirement. For optional ad-hoc services, there may be a requirement for onsite delivery from time-to-time.

2 - The only constraints are that Treasury data does not leave Australia.

Compliance

The provider must agree that Treasury SIEM data must remain within the Queensland Treasury Infrastructure at all times. Security logs must not be copied or moved outside of our environment. The Supplier shall ensure all data and information generated during provision of these services remains within Australia.

3 - Advisory services to the Treasury team.

4 - There's no expectation to mature QT's security processes. There is an expectation that alert management will be part of a continuous improvement cycle.

5 - Yes

6 - Not at this time.

7 - No immediate requirement for containment

8 - No

9 - Yes Treasury has support agreements in place with all key vendors. It is expected that all log sources are ingested prior to service commencement.

10 - Advisory

11 - Refer to RFQ Section 1.4 Indicative timetable

12 - No

13 - Either. No specific expectation for on-site availability.

Question:
H Team,

Please help in addressing the below queries -

1. Does QT have any commercial tool being utilised for threat Intelligence? If yes, please share the tool name.

2. What are the sources and the types of threat feeds are being consumed by QT currently?

3. Does QT have any particular model of advanced threat hunting, like hypothesis based or data driven? Please provide high level details.

4. Has QT enabled and able to utilise MS Sentinel UEBA module?

5. Does QT have a retainer based Digital Forensics services currently?

6. How many events/incidents requiring Digital Forensics has been encountered in last 12 months?

7. We understand that QT has an independent Vulnerability management team. Also, that VM activities are not a part of scope but only the remediation governance support aspect. Please confirm

8. We understand that Rapid7 tool is integrated to MS sentinel tool. Please confirm.

9. We understand that Logic Apps might be in use for automating security response workflows. Please confirm.

10. How many such workflows are deployed in current state?

11. As a part of ""Purpose"" section, supplier understands that QT also wants to safeguard its identities and data. However, there is no particular detail on these requirements in the specification document. Will this be published by QT later on in their cyber journey?

12. How many user identities are being managed under ENTRA by QT?

Thanks

Answered on 20/Oct/2025 12:56 PM:


1 - Currently we leverage only the out of the box Sentinel Fusion intelligence and Microsoft Defender Threat Intelligence. We are investigating linking ACSC CTIS if possible and we are open to consider any suggestions from our chosen partner.

2 - Sentinel OOTB

3 - Data driven based on threat intelligence, IoCs, UEBA. QT also undertakes ongoing Threat Hunting via Defender for Experts Hunting. Ad-hoc basis, we review case studies and actor data released by ASD and ACSC and implementing hunting based on our findings.

4 - Yes - OOTB

5 - QT leverage CSU (Qld Govt Cyber Security Unit) contracts for DFIR

6 - There have been two (2) such incidents in the last 12 months

7 - Confirmed

8 - Yes

9 - Yes

10 - We would expect the vendor to create automations for us based on approved processes. Currently our only automation is alerting out internal security team when an incident occurs.

11 - Yes. It is included in Treasury’s current cyber security uplift program

12 - 2118 guests, 2977 members

Question:
1. Is Treasury’s existing Sentinel deployment managed in-house or outsourced?

2. Please provide details of all Microsoft licensing owned by Treasury.

3. Treasury has stated that “Security logs must not be copied or moved outside of our environment”. Due to this requirement, please confirm that where the relevant and necessary Microsoft license is unavailable, Treasury will be responsible for acquiring the required license. As an example, if Treasury requires integration with 3rd parties for automated remediation and response (SOAR), Treasury will acquire the necessary Microsoft license, i.e. Microsoft Logic Apps.

4. Data sources and data connectors:

a. Please list all data sources and corresponding data connectors currently deployed/supported in Treasury’s Sentinel tenant (include endpoints, mobiles and tech stack), including any additional that are to be onboarded as part of this RFQ. Please include details – (a) name, (b) quantity, (c)out-of-the-box (available in content hub) or custom, and (d) log type e.g. analytics, auxiliary

b. It appears that Treasury foresees the addition of connectors throughout the term of the contract. If so, what is the scope for expansion, e.g. one connector per month, custom/out-of-the-box etc?

5. Please confirm the following details - does Treasury’s Sentinel instance currently ingests OS logs from endpoints e.g. laptops, mobiles, servers? Please provide details including OS type e.g. Windows; log type(s) ingested

6. What is the current interactive/online log retention duration for analytics and auxiliary logs (and basic logs, if in use)?

7. Does Treasury currently use SOAR capabilities and is this in scope for this project? If so, please provide details.

Answered on 20/Oct/2025 11:42 AM:


1 - In-house

2 - Treasury provides E5 licences for all users. It is our understanding that Logic Apps are PAYG based on triggers, billed directly to Azure and do not require any additional licensing

3 - Confirmed

4 - AWS

• Azure Activity

• Azure Key Vault

• Azure Logic Apps

• Azure SQL Databases

• Azure Storage Accounts

Microsoft

• M365 Insider Risk

• MDfCA

• MDfE

• MDfI

• MDfO365

• MDXDR

• Entra ID Protection

• Microsoft Purview Information Protection

Netskope

NSG

ProofPoint TAP

Syslog

DNS

Windows Forwarded Events

Security Events



We expect the vendor to work with us to onboard as many log sources as we require. If it has a security or incident response ability, it should be logged and included.

5 - Yes – we import security event log data, but all other data remains in Defender and is not currently in Sentinel.

6 - 90 days in analytics tier and 2 years in Data Lake tier

7 - No

Question:
Will Treasury provide a transition period for the incoming SOC provider to engage with the incumbent service provider to facilitate a handover

Does Treasury anticipate the incoming SOC provider will play a role in assessing or recommending opportunities for technology stack consolidation in the existing security environment?

Answered on 17/Oct/2025 11:51 AM:


1. No

2. Provider can recommend opportunities for improvements and consolidation, but this is not an expectation

Question:
• The transaction under this RFQ process will be governed by the General Contract Conditions - ICT Products and Services – Version 5.0.0, and associated Contract Details. There are no Contract Details to ICT Products and Services provided by Queensland Treasury yet, Can we submit the departures to the General Contract Conditions - ICT Products and Services – Version 5.0.0 in the Supplier Response- Part C RFQ submission?

Answered on 17/Oct/2025 03:01 PM:


General Contract Details – ICT Products and Services can be found at this location Queensland Government Publications Portal - https://www.publications.qld.gov.au/dataset/qitc-framework/resource/dd1c7871-bd75-477a-8e4a-8c9e426c7ca9



As stated in Section 2 (B): Supplier Response

Departures - Suppliers may list any Departures (changes) they wish to propose to the Contract Terms and Conditions however Queensland Treasury reserves the right not to accept or negotiate any contractual conditions.



As stated in Section 2 (C) Supplier Response

Departures - If the Supplier is unable to agree to any of the terms in the Contract Details, the Supplier must complete the table below, however Queensland Treasury reserves the right not to accept or negotiate any contractual conditions.