Leping

5.1 Template for the PDP cost (budget) Programme: OCR Project title: Open Cyber Range Project Promoter: Estonian Ministry of Defence Total project cost: 3 331 765 € Project grant rate: 100% Project duration: 36 months Legend: EST price is 6 500€/per month, for NOR it is 9 000€/per month, combined price is calculated as 8 000€/per month. Number of units Unit price (€) Total cost (€) Unit Type of expenditure Comments/additional information (a) (b) (a) x (b) 1. DIRECT EXPENDITURES - Reg. Art. 8.2 & Art. 8.3 Project management Cost of staff assigned to the OCR Project Manager Month 36,00 5 352,00 192 672,00 1 FTE project - Reg. Art. 8.3.1.a Travel and subsistence 4 travels per year for three people (project manager + any Travel costs Travels 36,00 1 000,00 29 000,00 allowances for staff - Reg. Art. other function supporting the efforts) 8.3.1.b Cost of new or second hand ICT quipment includes computer and smartphone with ICT equipment for OCR Project Manager Kit 1,00 3 000,00 - equipment - Reg. Art. 8.3.1.c software and licenses required to implement the project & Art. 8.3.2 Costs of consumables and Communication costs Month 36,00 30,00 - Mobile and landline costs, includes mobile data supplies - Reg. Art. 8.3.1.e Costs entailed by other OCR visual identity development, this includes wireframe for contracts awarded by PP for OCR identity development Days 800,00 25,00 - the website, presentation background, roll-up design etc. All the purpose of carrying out those include logo, colorschema, fonts etc. the project - Reg. Art. 8.3.1.f Costs entailed by other contracts awarded by PP for OCR website to promote the capability and connect users to OCR website and connectivity to the OCR Days 800,00 60,00 - the purpose of carrying out the OCR capability the project - Reg. Art. 8.3.1.f Costs entailed by other OCR Framework includes legal status, ruleset, business contracts awarded by PP for OCR Framework development Days 1 200,00 20,00 26 000,00 model, contractual relationships with academia, start-ups the purpose of carrying out and enterprises etc. the project - Reg. Art. 8.3.1.f  Costs arising directly from requirements imposed by the Other costs 1,00 14 013,00 86 093,00 Publicity, translation, memorabilia, etc project contract - Reg. Art. 8.3.1.g All outsourcing 168 000,00 - - - Total 1.1: 501 765,00 Output / Activity 1 - Initial hardware and software environment Cost of new or second hand Consists of Dell or Cisco servers, either raw computing or WP1 - Servers Kit 1,00 300 000,00 214 466,40 equipment - Reg. Art. 8.3.1.c with some storage & Art. 8.3.2 Cost of new or second hand Prefered solution is EMC XtremeIO that has proven its WP1 - Fast data storage Kit 1,00 350 000,00 188 896,50 equipment - Reg. Art. 8.3.1.c capability in the Estonian Cyber Range setup or equivalent & Art. 8.3.2 solution, for activity use in live environments Cost of new or second hand Slow data storage is used for storing virtual machines, WP1 - Slow data storage Kit 1,00 100 000,00 140 616,00 equipment - Reg. Art. 8.3.1.c templates, configurations, scenarios etc for on-demand use & Art. 8.3.2 Cost of new or second hand Routers, switches, cables etc needed to connect OCR WP1 - Networking equipment Kit 1,00 150 000,00 43 893,00 equipment - Reg. Art. 8.3.1.c together and to the Internet & Art. 8.3.2 Costs entailed by other Any work (installation, initial setup etc.) or additional contracts awarded by PP for datacenter small equipment (PDU-s, rack blinds, cabling or WP1 - Civil works Days 800,00 50,00 266 836,22 the purpose of carrying out cabling accessories, KVM, monitoring tools etc.) needed to the project - Reg. Art. 8.3.1.f set up the OCR environment Cost of new or second hand E.g. IPS or any other hardwar/software needed to enhance WP1 - Security equipment Kit 1,00 120 000,00 5 291,88 equipment - Reg. Art. 8.3.1.c security of the OCR & Art. 8.3.2 - - - - Total 1.2: 860 000,00 Output / Activity 2 - Software Development  No specific WP - general work to be done under the project - develop and implement OCR specific requirements such as specifications for APIs, minimal security requirements, Development on technical requirements to achive initial Cost of staff assigned to the Month 12,00 8 000,00 97 000,00 requirements for federating technical capabilities, guidelines operational capability project - Reg. Art. 8.3.1.a for documentation, KPIs, evaluate existing capabilities (market research), analyse solutions (e.g. proprietary vs open source) etc. The goal is to develop language to define scenarios at an Cost of staff assigned to the WP2 - Scenario Language Development Month 3,00 8 000,00 abstract level. Compilers and generator will follow and allow project - Reg. Art. 8.3.1.a 61 500,00 the automatic generation of low level artifacts Cost of staff assigned to the The goal is to develop language to define artefacts to be WP5 - Language Development for Digital Library Month 4,00 8 000,00 project - Reg. Art. 8.3.1.a stored in Digital Library Cost of staff assigned to the Tools to run and operate activities on the OCR – chat, wiki, WP17 - Collaboration tools on OCR Month 12,00 8 000,00 93 700,00 project - Reg. Art. 8.3.1.a project management tools etc. Develop connections and make available additional external capabilities that supplement OCR capabilities and support OCR activities, this is achieved through integration and/or federation of other capabilities, this might include public Cost of staff assigned to the WP18 - Hybrid systems related to the OCR Month 40,00 8 000,00 152 000,00 cloud services for additional computing power, specialized project - Reg. Art. 8.3.1.a Cyber Ranges/Labs for specific task (ICS, IoT etc.) This activity will be broken down to smaller parts during the project development, currently 3 different hybrid systems are foreseen T.2.5. software development for SDL 1) scenario 88 000,00 management, 2) DL management T.2.6. Digital Library Development (move from 3) 175 000,00 - Total 1.3: 667 200,00 Output / Activity 3 - Research and development on OCR tools Middleware to operate the OCR, in case of Estonian CR vLM is used on top of VMware, in case of Norway OpenStack is Cost of staff assigned to the WP3 - Management system (VMWare) Month 6,00 6 500,00 39 000,00 used. This includes also support systems like git, project - Reg. Art. 8.3.1.a chef/puppet, etc. This also includes potential sanitization and integrity tools Middleware to operate the OCR, in case of Estonian CR vLM is used on top of VMware, in case of Norway OpenStack is Cost of staff assigned to the WP4 - Management system (OpenStack) Month 6,00 9 000,00 54 000,00 used. This includes also support systems like git, project - Reg. Art. 8.3.1.a chef/puppet, etc. This also includes potential sanitization and integrity tools  Component to store and organize artifacts for re-use – Cost of staff assigned to the WP6 - Digital Library development Month 12,00 8 000,00 - scenarios, virtual machines, test cases, configurations etc, project - Reg. Art. 8.3.1.a creating marketplace 3 types of simulation: 1. Simulate a core part of Internet for OCR use (BGP, DNS, Cost of staff assigned to the NTP etc servers „on 6 continents“) WP8 - User Simulation Month 12,00 8 000,00 85 000,00 project - Reg. Art. 8.3.1.a 2. User agents for several operating systems to simulate user behavior (e.g. standard user, admin) 3. Capability to insert noise between any system on OCR In general traffic collection and distribution capability, but Cost of staff assigned to the WP9 – Traffic simulation/generation Month 12,00 8 000,00 92 100,00 also storing console events, snapshots, screenshots and project - Reg. Art. 8.3.1.a video from virtual machines, playback capability In general traffic collection and distribution capability, but Cost of staff assigned to the WP10 - Activity Monitoring Month 12,00 8 000,00 105 000,00 also storing console events, snapshots, screenshots and project - Reg. Art. 8.3.1.a video from virtual machines, playback capability Cost of staff assigned to the Different views for teams (red, blue, green, white) with WP11 - Situational awareness Month 12,00 8 000,00 108 000,00 project - Reg. Art. 8.3.1.a distinct data about exercise or training environment Cost of staff assigned to the Technics and procedures to gather information from OCR in WP12 - Scoring and evalution module Month 12,00 8 000,00 100 300,00 project - Reg. Art. 8.3.1.a order to evaluate and score the activities Cost of staff assigned to the Planning tool with feedback from technical environment, WP13 - Feedback module Month 12,00 8 000,00 87 000,00 project - Reg. Art. 8.3.1.a lessons identified and lessons learned Cost of staff assigned to the Evaluation social aspect in OCR, e.g. behavioral analysis WP14 - Social aspect module Month 12,00 8 000,00 90 400,00 project - Reg. Art. 8.3.1.a connected to OCR activities Federating EE (OCR) and NO Ranges – connectivity, Cost of staff assigned to the WP15 - Federation of Cyber Ranges Month 6,00 8 000,00 48 000,00 command and control, information sharing, resource project - Reg. Art. 8.3.1.a sharing etc. Costs entailed by other Security testing of the hardware and software environment Outsourced - Security testing and validation of the OCR contracts awarded by PP for Days 100,00 1 200,00 - set up during the project, security testing is conducted in capability the purpose of carrying out multiple iterations the project - Reg. Art. 8.3.1.f Total 1.4: 808 800,00 Output / Activity 4 - Populating OCR with content This includes research and development on content requirements. Populate OCR library with sample software, virtual machines, attack simulations, scenarios, trainings, exercises, Cost of staff assigned to the WP7 - Populating the digital library Month 24,00 8 000,00 319 000,00 test environments and other artifacts, document the use of project - Reg. Art. 8.3.1.a forenamed items in a way that they are reusable by the OCR users This might be broken down into subprojects during the execution  Technics and procedures to test, experiment and evaluate Cost of staff assigned to the new software and solutions in X number of different WP16 - Testing facility Month 12,00 8 000,00 100 000,00 project - Reg. Art. 8.3.1.a configurations; possible tiered sertification system for software that has gone through the testing Costs entailed by other Malicious content is usually in a form of exerciseware that contracts awarded by PP for differs from actual malware in the ways of built in security Custom malicious content for the Digital Library Days 30,00 1 600,00 75 000,00 the purpose of carrying out measures (e.g. Works only in dedicated environments and the project - Reg. Art. 8.3.1.f on specific conditions) - - - - Total 1.5: 494 000,00 Total 1: 3 331 765,00 2. INDIRECT COSTS - Reg. Art. 8.5 Total 2: - TOTAL PDP COST (1 + 2): 3 331 765,00 Total project management cost (€): 501 765,00 Total output related cost (€): 2 830 000,00  PROJEKTILEPINGU MUUTMISE KOKKULEPE NR 1 Majandus- ja Kommunikatsiooniministeerium, registrikood 70003158, asukoht Suur- Ameerika 1, 10122 Tallinn, mida esindab majandus- ja infotehnoloogiaminister Tiit Riisalo, kes tegutseb põhimääruse alusel (edaspidi ka Programmioperaator), Ettevõtluse ja Innovatsiooni Sihtasutus, registrikood 90006012, asukoht Lasnamäe 2, 11412 Tallinn, mis on Ettevõtluse Arendamise Sihtasutuse õigusjärglane ja mida esindab juhatuse liige Sigrid Harjo, kes tegutseb SAS § 18 lg 1 alusel (edaspidi Programmi elluviija), ja Kaitseministeerium, registrikood 70004502, asukoht Sakala 1, 15094 Tallinn, mida esindab innovatsiooni osakonna juhataja Miiko Peris, kes tegutseb kaitseministri 01.07.2019 käskkirjaga nr 186 antud volituse alusel (edaspidi Projekti elluviija), edaspidi eraldi Pool ja koos Pooled, arvestades Projekti elluviija 20.02.2024 taotluses nr 2-8/24/1 esitatud vajadust muuta projekti eelarvet ning pikendada projekti elluviimise tähtaega kuni 30.04.2024, muudavad Pooled 19.03.2021 sõlmitud projektilepingut (edaspidi Leping) selle punktist 5.2 lähtuvalt tagasiulatuvalt alates 29.02.2024 järgmiselt: 1) sõnastavad punkti 1.6 järgmiselt: „1.6. Projekti abikõlblikkuse perioodi lõppkuupäev on 30.04.2024.“; 2) sõnastavad punkti 1.7.3. järgmiselt: „1.7.3. Projekti elluviija – Projekti teostamise eest vastutav isik, Open Cyber Range projektijuht, Heidi Raudsepp, tel:+372 53435486, e-post: [email protected].“; 3) sõnastavad punkti 3.2.9. järgmiselt: „3.2.9. säilitama taotluse, toetuse ja Projekti teostamisega seonduvat originaaldokumentatsiooni vähemalt 31. detsembrini 2031. a;“; 4) sõnastavad punkti 3.2.19.9. järgmiselt: „3.2.19.9. 31.05.2024 (kulud 01.11.2023–30.04.2024);“; 5) sõnastavad punkti 3.2.20. järgmiselt: „3.2.20. esitama Projekti lõpparuande ja maksetaotluse e-toetuste infosüsteemi hiljemalt 30.06.2024;“; 6) asendavad Lepingu lisa 2, mis kannab pealkirja „5.1 Template for the PDP (budget)“ käesoleva kokkuleppe lisaga. POOLTE ALLKIRJAD: Programmioperaator: (allkirjastatud digitaalselt) Tiit Riisalo Programmi elluviija: (allkirjastatud digitaalselt) Sigrid Harjo Projekti elluviija: (allkirjastatud digitaalselt) Miiko Peris 2