Award

External Security Incident and Event Management (SIEM) & Security Operations Centre (SOC) Support Monitoring Service

O F W A T

This public procurement record has 1 release in its history.

Award

28 Jan 2026 at 10:47

Award Notice
Summary of the contracting process

The public procurement process led by Ofwat, based in Birmingham, invites businesses to provide an External Security Incident and Event Management (SIEM) & Security Operations Centre (SOC) Support Monitoring Service. This procurement falls under the information technology services industry category and aims to enhance Ofwat's current capabilities with round-the-clock security operations. The award phase of this process was completed on 5 December 2025, with the contract commencing on 1 February 2026 and running through to 31 January 2027. The procurement method used was a limited competitive quotation, an approach often employed for projects below specific financial thresholds, which encourages competition among suppliers.

This tender presents significant opportunities for tech companies, particularly those with capabilities in threat detection, analytics, and incident response. Small and medium-sized enterprises (SMEs) specializing in security monitoring services are well-positioned to potentially expand their business by aligning their services with Ofwat's needs. The selection of Phoenix Software Limited as the supplier highlights the competitive nature of this procurement, offering insights into the level of expertise required. Businesses that can integrate advanced threat intelligence and compliance reporting into their service offerings stand to benefit greatly from such government contracts.

Find more tenders on our Open Data Platform.
How relevant is this notice?

D3 Tenders Premium

Win More Public Sector Contracts

AI-powered tender discovery, pipeline management, and market intelligence — everything you need to grow your public sector business.

Start Free Trial Book a Demo
All Features Pricing

Notice Information

Notice Title

External Security Incident and Event Management (SIEM) & Security Operations Centre (SOC) Support Monitoring Service

Notice Description

Ofwat currently operates an internal Security Operations Centre (SOC) within its security team, responsible for monitoring the organisation's SIEM (Security Incident and Event Management) platform. The internal SOC operates during business hours Monday to Friday 9-5pm. To strengthen resilience and deliver comprehensive round-the-clock coverage, enabling full 24/7 security operations, Ofwat now requires a Managed external SIEM and SOC capability to deliver threat detection, analysis, and incident response. This service will operate as an extension of Ofwat's internal security team, offering advanced analytics, threat intelligence, and compliance reporting.

Notice Details

Publication & Lifecycle

Open Contracting ID
ocds-b5fd17-4698dc31-b7df-4c55-b769-c3ce83556e86
Publication Source
Contracts Finder
Latest Notice
https://www.contractsfinder.service.gov.uk/Notice/9b0ad156-a66c-4028-907e-35ab54c4c969
Current Stage
Award
All Stages
Award

Procurement Classification

Notice Type
Award Notice
Procurement Type
Standard
Procurement Category
Services
Procurement Method
Limited
Procurement Method Details
Competitive quotation (below threshold)
Tender Suitability
SME
Awardee Scale
Large

Common Procurement Vocabulary (CPV)

CPV Divisions

72 - IT services: consulting, software development, Internet and support

CPV Codes

72222300 - Information technology services

Notice Value(s)

Tender Value
Not specified
Lots Value
Not specified
Awards Value
£95,390 Under £100K
Contracts Value
Not specified

Notice Dates

Publication Date
28 Jan 20263 weeks ago
Submission Deadline
2 Dec 2025Expired
Future Notice Date
Not specified
Award Date
5 Dec 20252 months ago
Contract Period
1 Feb 2026 - 31 Jan 2027 6-12 months
Recurrence
Not specified

Notice Status

Tender Status
Complete
Lots Status
Not Specified
Awards Status
Active
Contracts Status
Not Specified

Buyer & Supplier

Contracting Authority (Buyer)

Main Buyer
O F W A T
Contact Name
The Procurement Team
Contact Email
procurement@ofwat.gov.uk
Contact Phone
Not specified

Buyer Location

Locality
BIRMINGHAM
Postcode
B5 4UA
Post Town
Birmingham
Country
England
Major Region (ITL 1)
TLG West Midlands (England)
Basic Region (ITL 2)
TLG3 West Midlands
Small Region (ITL 3)
TLG31 Birmingham
Delivery Location
Not specified
Local Authority
Birmingham
Electoral Ward
Ladywood
Westminster Constituency
Birmingham Ladywood

Supplier Information

Number of Suppliers
1
Supplier Name

PHOENIX SOFTWARE

Further Information

Notice Documents

Open Contracting Data Standard (OCDS)

View full OCDS Record for this contracting process

Download

The Open Contracting Data Standard (OCDS) is a framework designed to increase transparency and access to public procurement data in the public sector. It is widely used by governments and organisations worldwide to report on procurement processes and contracts. 

{
    "tag": [
        "compiled"
    ],
    "id": "ocds-b5fd17-4698dc31-b7df-4c55-b769-c3ce83556e86-2026-01-28T10:47:04Z",
    "date": "2026-01-28T10:47:04Z",
    "ocid": "ocds-b5fd17-4698dc31-b7df-4c55-b769-c3ce83556e86",
    "language": "en",
    "initiationType": "tender",
    "tender": {
        "id": "PROC.0205",
        "title": "External Security Incident and Event Management (SIEM) & Security Operations Centre (SOC) Support Monitoring Service",
        "description": "Ofwat currently operates an internal Security Operations Centre (SOC) within its security team, responsible for monitoring the organisation's SIEM (Security Incident and Event Management) platform. The internal SOC operates during business hours Monday to Friday 9-5pm. To strengthen resilience and deliver comprehensive round-the-clock coverage, enabling full 24/7 security operations, Ofwat now requires a Managed external SIEM and SOC capability to deliver threat detection, analysis, and incident response. This service will operate as an extension of Ofwat's internal security team, offering advanced analytics, threat intelligence, and compliance reporting.",
        "status": "complete",
        "classification": {
            "scheme": "CPV",
            "id": "72222300",
            "description": "Information technology services"
        },
        "items": [
            {
                "id": "1",
                "deliveryAddresses": [
                    {
                        "postalCode": "B5 4UA"
                    }
                ]
            }
        ],
        "procurementMethod": "limited",
        "procurementMethodDetails": "Competitive quotation (below threshold)",
        "tenderPeriod": {
            "endDate": "2025-12-02T17:00:00Z"
        },
        "contractPeriod": {
            "startDate": "2026-02-01T00:00:00Z",
            "endDate": "2027-01-31T23:59:59Z"
        },
        "suitability": {
            "sme": true,
            "vcse": false
        },
        "mainProcurementCategory": "services"
    },
    "parties": [
        {
            "id": "GB-GOR-D240",
            "name": "O F W A T",
            "identifier": {
                "legalName": "O F W A T",
                "scheme": "GB-GOR",
                "id": "D240"
            },
            "address": {
                "streetAddress": "7 Hill Street",
                "locality": "BIRMINGHAM",
                "postalCode": "B54UA",
                "countryName": "England"
            },
            "contactPoint": {
                "name": "The Procurement Team",
                "email": "procurement@ofwat.gov.uk"
            },
            "roles": [
                "buyer"
            ]
        },
        {
            "id": "GB-COH-02548628",
            "name": "Phoenix Software Limited",
            "identifier": {
                "legalName": "Phoenix Software Limited",
                "scheme": "GB-COH",
                "id": "02548628"
            },
            "address": {
                "streetAddress": "Blenheim House, York Road, Pocklington, York. YO42 1NS"
            },
            "details": {
                "scale": "large",
                "vcse": false
            },
            "roles": [
                "supplier"
            ]
        }
    ],
    "buyer": {
        "id": "GB-GOR-D240",
        "name": "O F W A T"
    },
    "awards": [
        {
            "id": "ocds-b5fd17-4698dc31-b7df-4c55-b769-c3ce83556e86-1",
            "status": "active",
            "date": "2025-12-05T00:00:00Z",
            "datePublished": "2026-01-28T10:47:03Z",
            "value": {
                "amount": 95390.95,
                "currency": "GBP"
            },
            "suppliers": [
                {
                    "id": "GB-COH-02548628",
                    "name": "Phoenix Software Limited"
                }
            ],
            "contractPeriod": {
                "startDate": "2026-02-01T00:00:00Z",
                "endDate": "2027-01-31T23:59:59Z"
            },
            "documents": [
                {
                    "id": "1",
                    "documentType": "awardNotice",
                    "description": "Awarded contract notice on Contracts Finder",
                    "url": "https://www.contractsfinder.service.gov.uk/Notice/9b0ad156-a66c-4028-907e-35ab54c4c969",
                    "datePublished": "2026-01-28T10:47:03Z",
                    "format": "text/html",
                    "language": "en"
                }
            ]
        }
    ]
}