The scope of Services is to provide ICT Security Resources into the NTA's Security Function to manage and operate Information and Data Security activities and responsibilities on behalf of the NTA. The NTA’s Security Function manages and operates the following high-level Information and Data Security activities and responsibilities on behalf of the NTA, which include, but are not limited to: • Security Governance, Risk and Compliance Management; • Security Budgeting; • Security Policy (development, drafting, enforcement, etc.); • Security Architecture and Strategy (security strategy development, security design, control frameworks and control objectives defence in depth, business needs assessments, security and operational risk impact assessments, etc.); • Security Operations (security management, vulnerability scanning, analysis and mitigation management, coordinating penetration testing, security incident management, etc.); • Security Monitoring (threat detection and response, Level 3 security analysis and handling, etc.); • Solution and Platform Security Management and Assessment; • Supplier/Vendor Security Management and Assessment; • Security Privacy and Information Security; • Raising and submitting Requests for Security Change (RFCs) as needed to address security and service operation issues inclusive of back out plans; • Participating in the Technical Advisory Board (TAB) prior to the Change Advisory Board (CAB) or Emergency Change (EC) meetings to ensure that service operation risks (including security risks), issues and views are taken into account • Security Awareness; and • Data Security (Data Leakage Protection, Data Classification, Data handling, etc.).

The scope of Services is to provide ICT Security Resources into the NTA’s Security Function to manage and operate Information and Data Security activities and responsibilities on behalf of the NTA. The NTA’s Security Function manages and operates the following high-level Information and Data Security activities and responsibilities on behalf of the NTA, which include, but are not limited to: • Security Governance, Risk and Compliance Management; • Security Budgeting; • Security Policy (development, drafting, enforcement, etc.); • Security Architecture and Strategy (security strategy development, security design, control frameworks and control objectives defence in depth, business needs assessments, security and operational risk impact assessments, etc.); • Security Operations (security management, vulnerability scanning, analysis and mitigation management, coordinating penetration testing, security incident management, etc.); • Security Monitoring (threat detection and response, Level 3 security analysis and handling, etc.); • Solution and Platform Security Management and Assessment; • Supplier/Vendor Security Management and Assessment; • Security Privacy and Information Security; • Raising and submitting Requests for Security Change (RFCs) as needed to address security and service operation issues inclusive of back out plans; • Participating in the Technical Advisory Board (TAB) prior to the Change Advisory Board (CAB) or Emergency Change (EC) meetings to ensure that service operation risks (including security risks), issues and views are taken into account • Security Awareness; and • Data Security (Data Leakage Protection, Data Classification, Data handling, etc.).