Tender

Ask AI about this notice

Summarise, research or assess it with AI

View Markdown

Share this notice

Send this contract to a colleague

Managed Security Operations Centre (SOC) and Incident Response Services Agreement

NATIONAL NUCLEAR LABORATORY LIMITED

This public procurement record has 2 releases in its history.

Tender

23 Jul 2026 at 19:29

UK4 - Tender Notice
Planning

21 May 2026 at 09:10

UK2 - Preliminary Market Engagement Notice
Summary of the contracting process

The United Kingdom National Nuclear Laboratory Limited is procuring managed Security Operations Centre and incident response services to strengthen protection of its IT estate, digital assets and sensitive information. The requirement covers a comprehensive 24/7 service combining people, processes and technology. Activities include continuous monitoring, threat detection, incident response and remediation, digital forensic investigation, threat intelligence and SOC management. The appointed supplier will identify, analyse, contain and escalate cyber threats and incidents across the network, while improving operational and response maturity. The service is delivered across the United Kingdom. This is a cyber security services opportunity, including security operations, incident response, digital forensics, threat intelligence and related security support. The procurement is for one lot and is identified under CPV codes 48730000, 72000000 and 79710000.

The process has reached tender: UKNNL invited offers through an open competitive flexible procedure under the Procurement Act 2023. Suppliers submit the Procurement Specification Questionnaire by 10:00 on 17 August 2026; clarification questions are due by 23:59 on 10 August 2026. The award decision is due by 23:59 on 20 August 2026. The procedure shortlists five suppliers, followed by demonstrations and presentations, then final tenders; the final tender return date is 22 September 2026, with the Invitation to Tender issued on 28 August 2026. Negotiation with the highest-ranked supplier may follow. The single lot has an estimated value of £2,500,000 excluding VAT and £3,000,000 including VAT. The contract runs from 1 November 2026 to 31 October 2029, with discretionary extensions to 31 October 2031. Award is based on the Most Advantageous Tender, considering commercial cost, technical quality and social value.

This opportunity suits cyber security providers with the operational depth to run a managed SOC and deliver incident response at all times. Relevant capability includes continuous security monitoring, detection engineering, threat hunting, incident containment and escalation, digital forensics, threat intelligence and specialist response support. Suppliers should be able to manage the people, processes and technologies needed to protect a complex IT estate and sensitive information, and to improve the maturity of security operations over the service term. The requirement also accommodates additional SecOps, DFIR, consultancy, advisory, engineering, optimisation, tool support, monitoring and integration services. Participation requires suppliers to demonstrate technical capability and meet legal and financial conditions through the Procurement Specification Questionnaire and associated procurement documents. Small and medium-sized enterprises are identified as suitable for the opportunity.

How relevant is this notice?

Notice Information

Notice Title

Managed Security Operations Centre (SOC) and Incident Response Services Agreement

Notice Description

UKNNL is seeking to procure a Managed Security Operations Centre (SOC) and Incident Response service to enhance its cyber security capability and support the protection of its IT estate, digital assets, and sensitive information. UKNNL requires a new partner to manage its Security Operations Centre, to monitor, detect, respond to, and remediate cyber threats across its network. The SOC incorporates people, process, and technology to provide a detect-and-respond capability that better protects the Authority's digital assets and data. The requirement is for a comprehensive Security Operations Centre service, delivering 24/7 monitoring, incident detection, incident response, digital forensic investigation, threat intelligence, and SOC management services. The service will support the identification, analysis, containment, and escalation of cybersecurity threats and incidents affecting the environment, whilst continuously improving security operations and response maturity.

Lot Information

Lot 1

Options: The contract may include the option for UKNNL to procure additional cyber security services during the contract term where required. Such services may include, but are not limited to: * Enhanced Security Operations (SecOps) services; * Additional threat hunting capabilities; * Enhanced threat intelligence services; * Additional Digital Forensics and Incident Response (DFIR) support; * Additional incident response retainer hours and specialist support; * Cyber security consultancy and advisory services; * Security engineering, optimisation and security tool support; * Additional monitoring, detection and response capabilities; and * Onboarding, integration and support for new systems, networks and security technologies. The exercise of any option will be subject to UKNNL's operational requirements, available funding, the terms of the contract and all applicable procurement legislation.

Renewal: The contract will be awarded for an initial period of three (3) years, with the option to extend for up to two (2) further periods of twelve (12) months each. Any extension will be exercised at UKNNL's sole discretion and in accordance with the contract terms and applicable legislation.

Planning Information

UKNNL will be holding a virtual market engagement event on Friday 5th June at 10:00am. This session will provide an overview of the proposed service scope, delivery model, and procurement approach, and will give suppliers an opportunity to better understand UKNNL's requirements and provide feedback. Suppliers interested in attending should confirm their attendance by emailing gemma.slocombe@uknnl.com, and a Microsoft Teams invitation will be issued. Due to the anticipated level of supplier interest, please allow 48-72 hours for a response to enquiries and registration requests. All information presented during the session will be shared as part of the tender pack for those unable to attend.

Notice Details

Publication & Lifecycle

Open Contracting ID
ocds-h6vhtk-069e64
Publication Source
Find A Tender Service
Latest Notice
https://www.find-tender.service.gov.uk/Notice/069975-2026
Current Stage
Tender
All Stages
Planning, Tender

Procurement Classification

Notice Type
UK4 - Tender Notice
Procurement Type
Standard
Procurement Category
Services
Procurement Method
Open
Procurement Method Details
Competitive flexible procedure
Tender Suitability
SME
Awardee Scale
Not specified

Common Procurement Vocabulary (CPV)

CPV Divisions

48 - Software package and information systems

72 - IT services: consulting, software development, Internet and support

79 - Business services: law, marketing, consulting, recruitment, printing and security

CPV Codes

48730000 - Security software package

72000000 - IT services: consulting, software development, Internet and support

79710000 - Security services

Notice Value(s)

Tender Value
£2,500,000 £1M-£10M
Lots Value
£2,500,000 £1M-£10M
Awards Value
Not specified
Contracts Value
Not specified

Notice Dates

Publication Date
23 Jul 20262 months ago
Submission Deadline
17 Aug 2026Expired
Future Notice Date
Not specified
Award Date
Not specified
Contract Period
1 Nov 2026 - 31 Oct 2029 3-4 years
Recurrence
Not specified

Notice Status

Tender Status
Active
Lots Status
Active
Awards Status
Not Specified
Contracts Status
Not Specified

Buyer & Supplier

Contracting Authority (Buyer)

Main Buyer
NATIONAL NUCLEAR LABORATORY LIMITED
Contact Name
Available with D3 Tenders Premium →
Contact Email
Available with D3 Tenders Premium →
Contact Phone
Available with D3 Tenders Premium →

Buyer Location

Locality
WARRINGTON
Postcode
WA3 6AE
Postcode Area
Warrington
Country
England
Major Region (ITL 1)
TLD North West (England)
Basic Region (ITL 2)
TLD6 Cheshire
Small Region (ITL 3)
TLD61 Warrington
Delivery Location
Not specified
Local Authority
Warrington
Electoral Ward
Birchwood
Westminster Constituency
Warrington North

Further Information

Notice Documents

Open Contracting Data Standard (OCDS)

View full OCDS Record for this contracting process

JSON Markdown

The Open Contracting Data Standard (OCDS) is a framework designed to increase transparency and access to public procurement data in the public sector. It is widely used by governments and organisations worldwide to report on procurement processes and contracts.

Loading OCDS record...