This thesis and its development project was made for Oulun Tietotekniikka liikelaitos, which is an internal business unit inside the City of Oulu. Oulun Tietotekniikka is responsible for the city ITinfrastructure and IT- services. The purpose of this project was to develop organization ability to provide better services with less technical problems and to prepare for the increase of the information security demands in the future.

Everyday more and more information is stored under different information systems and it’s even more important to be able to secure the confidentiality and integrity of the stored information but also ensure availability to it in all times. The services provided by Oulun Tietotekniikka have in a relatively short period turned out to be even more critical service to the City of Oulu. Improvement of these services is important because every malfunction of the IT-infrastructure and systems provided by it cost money and reduces efficient work time of the city employees.

The base of this thesis was to develop process of the event management and information security by purchasing a solution for cybersecurity. The solution will be purchased from a third-party operator who can provide solutions in the field mentioned before. Obtaining desired results, the buyer should have enough information about the product purchased as well as the process of purchase itself. The result of this thesis is to introduce the knowledge and proper process for the acquisition. The purchase itself takes place as a project and this thesis describes the acts needed in the beginning of the purchase project.