AwardedFind a Tender · award

Security Operations Centre Services

BuyerFinancial Ombudsman Service

StatusAwarded

DeadlineNot published

ValueValue not published

Published12 Dec 2024

What is being bought

Contract for the provision of a managed Security Operations Centre (SOC) service to provide the following: 1. Provision of a modern and fit-for-purpose SOC capability operating 24 hours a day, 7 days a week, 365 days a year (working in concert with the Financial Ombudsman Service’s cyber security team); 2. Undertake standard security operations functions including: a) Performing triage of security incidents, core security incident response, and escalation activities (we refer to these as level 1 and 2 activities); b) Tuning/configuration of the Security Information & Event Management (SIEM) solution and associated Security Orchestration, Automation & Response (SOAR) capabilities; c) Responding to threat intelligence and performing proactive threat hunting; d) Management, investigation, and resolution of critical/major security incidents including digital forensics as required; and e) Conducting process improvement activities to improve the effectiveness of the SOC. 3. Provision of cyber security resources on demand to augment the Financial Ombudsman Service's team on an ad-hoc basis. These resources maybe involved in project or business as usual activities.

Delivery location

Lot details

Lot 1

Contract for the provision of a managed Security Operations Centre (SOC) service to provide the following: 1. Support of the existing SOC team to enable a modern and fit-for-purpose SOC capability operating 24 hours a day, 7 days a week, 365 days a year. We are looking for a supplier that can provide a SOC capability that functions over a 24-hour period, 7 days a week, 365 days a year. 2. Undertake standard security operations functions including: a) Performing triage of security incidents, core security incident response, and escalation activities (we refer to these as level 1 and 2 activities); b) Tuning/configuration of the Security Information & Event Management (SIEM) solution and associated Security Orchestration, Automation & Response (SOAR) capabilities; and c) Responding to threat intelligence and performing proactive threat hunting. The SOC service will tune and configure our SIEM tool on an ongoing basis. We expect the supplier to maintain an up to date knowledge of industry best practices and threat intelligence sources to inform the tuning and configuration process. In addition to this, we require the SOC capability to monitor and respond to alerts from the SIEM solution and manage any related incidents, liaising with the Financial Ombudsman Service team where required. 3. Management, investigation, and resolution of critical/major security incidents, including digital forensics as required. If we suffer a major security incident, we may ask the supplier to assist with the management, investigation, and resolution of it. This may involve attending the Financial Ombudsman Service’s offices. 4. Conducting agreed ongoing process improvement activities that will strengthen and improve the SOC’s ability to effectively detect and respond to the changing landscape of threats faced by the Financial Ombudsman Service and the financial services industry. 5. Provision of cyber security resources on demand to augment the Financial Ombudsman Service's team on an ad-hoc basis. These resources maybe involved in project or business as usual activities. Provision of information security resources to augment our existing information security team, as called-off by us on an ad-hoc basis. These resources may be involved in project or business as usual activities in the Cyber Security area. 

Statuscancelled

Award criteria
SOC Services — 55
Implementation — 15
Critical Incident Support — 10
Security Services — 5
Knowledge Transfer — 5
Team and Structure — 5
Values and CSR — 5
price — 70% Quality - 30% Price

What is included

Item	Category	Quantity
1	Not published	Not published

Comparable-procurement analytics

Benchmarked against retained Find a Tender procedures with CPV division 72. The category anchor is IT services: consulting, software development, Internet and support (72000000); this is a deliberately broad market comparator. The comparison is shown at several levels rather than pretending one company or region is always the best benchmark.

Comparison set	Procedures	Reported bids per procedure	Named award suppliers	Price evidence
Market: CPV division 72	10,539	2 median · 15.4 average (4,161 of 10,539 with a bid count)	2 average (5,053 of 10,539 with named award suppliers)	Not published
Same buyer	4	5 median · 5 average (2 of 4 with a bid count)	1 average (4 of 4 with named award suppliers)	Not published
Delivery region: UK	3,323	2 median · 33.9 average (1,171 of 3,323 with a bid count)	2.8 average (1,501 of 3,323 with named award suppliers)	Not published

“Reported bids” is an official aggregate, sometimes reported per lot; it is the closest available competition measure. “Named award suppliers” are winners, not all applicants.

Price-outcome signal

Not enough comparable procedures currently publish both a GBP tender value and a usable lowest-valid-bid value to calculate a responsible price-reduction benchmark. Tenderline deliberately does not infer a saving from named award suppliers or from missing award values.

Procurement strategy & market signals

Framework agreementNot published

Dynamic purchasing systemNot published

Competitive procurementNot published

Recurring requirementNot published

Procurement method rationaleNot published

Rationale classificationsNot published

Special regimeNot published

Covered byNot published

Submission policyNot published

Selection criteriaNot published

Risk detailsNot published

Planning & early market engagement

BudgetNot published

No-engagement rationaleNot published

Planning documents0

Planning milestones0

No planning milestones published.

Related procurements

No linked framework, prior procurement or reprocurement published.

Awards