Provision of Cyber Security Services

Notice Information

Get alerts for notices like these

Notice Title

Notice Description

South Western Railway has awarded a Framework Services Agreement to Kroll for the provision of integrated cyber security monitoring, detection and response services.

Lot Information

Lot 1

SWRL currently receives a number of cyber security services from Kroll, the current position is that prior to SWR's transition to public ownership, cyber security services were provided under FirstGroup's Master Services Agreement (MSA), with individual services operating as call-off arrangements beneath that overarching contractual structure. As SWR is now a separate legal entity operating independently of FirstGroup, the inherited arrangements must be replaced with SWR-owned contractual mechanisms as the existing agreements expire. This creates the need to establish a compliant contractual structure whilst maintaining continuity of critical cyber security services. The current cyber security solution comprises four interdependent service components: * SOC/SIEM Service * Network Detection and Response (NDR) * CrowdStrike Endpoint Protection * Cyber Risk Retainer Services

Procurement Information

South Western Railway has awarded a Framework Services Agreement to Kroll for the provision of integrated cyber security monitoring, detection and response services. The Framework Services Agreement provides the contractual mechanism through which SWR will manage and align its cyber security service components, including Network Detection and Response services, CrowdStrike Endpoint Protection and Cyber Risk Retainer services. The total estimated value of the Framework Services Agreement is approximately PS1.2 million. The award has been made in accordance with Schedule 5 of the Procurement Act 2023, Additional or Repeat Goods, Services or Works. SWR determined that the services form part of an existing integrated cyber security architecture and that a change of supplier would result in incompatibility with the existing solution and disproportionate technical and operational difficulties in maintaining continuity of service. The award supports continuity of service and provides a contractual framework through which the relevant services can be aligned to a common expiry date whilst future procurement options are assessed.

Notice Details

Get alerts for notices like these

Publication & Lifecycle

Open Contracting ID: ocds-h6vhtk-06b88a
Publication Source: Find A Tender Service
Latest Notice: https://www.find-tender.service.gov.uk/Notice/057802-2026
Current Stage: Award
All Stages: Award

Procurement Classification

Notice Type: Award Notice
Procurement Type: Standard
Procurement Category: Services
Procurement Method: Limited
Procurement Method Details: Award procedure without prior publication of a call for competition
Tender Suitability: Not specified
Awardee Scale: Large

Common Procurement Vocabulary (CPV)

CPV Divisions

48 - Software package and information systems

72 - IT services: consulting, software development, Internet and support

CPV Codes

48760000 - Virus protection software package

72000000 - IT services: consulting, software development, Internet and support

72212730 - Security software development services

Notice Value(s)

Tender Value: Not specified
Lots Value: Not specified
Awards Value: Not specified
Contracts Value: £1,221,192 £1M-£10M

Notice Dates

Publication Date: 18 Jun 20266 days ago
Submission Deadline: Not specified
Future Notice Date: Not specified
Award Date: 17 Jun 20261 weeks ago
Contract Period: Not specified - Not specified
Recurrence: Not specified

Notice Status

Tender Status: Complete
Lots Status: Cancelled
Awards Status: Active
Contracts Status: Active

Buyer & Supplier

Get alerts for notices like these

Contracting Authority (Buyer)

Main Buyer: SOUTH WESTERN RAILWAY LIMITED
Contact Name: Available with D3 Tenders Premium →
Contact Email: Available with D3 Tenders Premium →
Contact Phone: Available with D3 Tenders Premium →

Buyer Location

Locality: LONDON
Postcode: SW1P 4DR
Post Town: South West London
Country: England
Major Region (ITL 1): TLI London
Basic Region (ITL 2): TLI3 Inner London - West
Small Region (ITL 3): TLI35 Westminster and City of London
Delivery Location: TLC North East (England), TLD North West (England), TLE Yorkshire and The Humber, TLF East Midlands (England), TLG West Midlands (England), TLH East (England), TLI London, TLJ South East (England), TLK South West (England)
Local Authority: Westminster
Electoral Ward: Vincent Square
Westminster Constituency: Cities of London and Westminster

Supplier Information

Number of Suppliers: 1
Supplier Name: KROLL ASSOCIATED

Further Information

Notice URLs

https://www.southwesternrailway.com/

Open Contracting Data Standard (OCDS)

View full OCDS Record for this contracting process

JSON Markdown

The Open Contracting Data Standard (OCDS) is a framework designed to increase transparency and access to public procurement data in the public sector. It is widely used by governments and organisations worldwide to report on procurement processes and contracts.

{
    "tag": [
        "compiled"
    ],
    "id": "ocds-h6vhtk-06b88a-2026-06-18T23:50:33+01:00",
    "date": "2026-06-18T23:50:33+01:00",
    "ocid": "ocds-h6vhtk-06b88a",
    "initiationType": "tender",
    "tender": {
        "id": "ocds-h6vhtk-06b88a",
        "legalBasis": {
            "id": "32014L0024",
            "scheme": "CELEX"
        },
        "title": "Provision of Cyber Security Services",
        "status": "complete",
        "classification": {
            "scheme": "CPV",
            "id": "72000000",
            "description": "IT services: consulting, software development, Internet and support"
        },
        "mainProcurementCategory": "services",
        "description": "South Western Railway has awarded a Framework Services Agreement to Kroll for the provision of integrated cyber security monitoring, detection and response services.",
        "lots": [
            {
                "id": "1",
                "description": "SWRL currently receives a number of cyber security services from Kroll, the current position is that prior to SWR's transition to public ownership, cyber security services were provided under FirstGroup's Master Services Agreement (MSA), with individual services operating as call-off arrangements beneath that overarching contractual structure. As SWR is now a separate legal entity operating independently of FirstGroup, the inherited arrangements must be replaced with SWR-owned contractual mechanisms as the existing agreements expire. This creates the need to establish a compliant contractual structure whilst maintaining continuity of critical cyber security services. The current cyber security solution comprises four interdependent service components: * SOC/SIEM Service * Network Detection and Response (NDR) * CrowdStrike Endpoint Protection * Cyber Risk Retainer Services",
                "awardCriteria": {
                    "criteria": [
                        {
                            "type": "price"
                        }
                    ]
                },
                "hasOptions": false,
                "status": "cancelled"
            }
        ],
        "items": [
            {
                "id": "1",
                "additionalClassifications": [
                    {
                        "scheme": "CPV",
                        "id": "48760000",
                        "description": "Virus protection software package"
                    },
                    {
                        "scheme": "CPV",
                        "id": "72212730",
                        "description": "Security software development services"
                    }
                ],
                "deliveryAddresses": [
                    {
                        "region": "UKC"
                    },
                    {
                        "region": "UKD"
                    },
                    {
                        "region": "UKE"
                    },
                    {
                        "region": "UKF"
                    },
                    {
                        "region": "UKG"
                    },
                    {
                        "region": "UKH"
                    },
                    {
                        "region": "UKI"
                    },
                    {
                        "region": "UKJ"
                    },
                    {
                        "region": "UKK"
                    }
                ],
                "relatedLot": "1"
            }
        ],
        "procurementMethod": "limited",
        "procurementMethodDetails": "Award procedure without prior publication of a call for competition",
        "procurementMethodRationaleClassifications": [
            {
                "id": "D_OUTSIDE_SCOPE",
                "scheme": "TED_PT_AWARD_CONTRACT_WITHOUT_CALL",
                "description": "The procurement falls outside the scope of application of the directive"
            }
        ],
        "procurementMethodRationale": "South Western Railway has awarded a Framework Services Agreement to Kroll for the provision of integrated cyber security monitoring, detection and response services. The Framework Services Agreement provides the contractual mechanism through which SWR will manage and align its cyber security service components, including Network Detection and Response services, CrowdStrike Endpoint Protection and Cyber Risk Retainer services. The total estimated value of the Framework Services Agreement is approximately PS1.2 million. The award has been made in accordance with Schedule 5 of the Procurement Act 2023, Additional or Repeat Goods, Services or Works. SWR determined that the services form part of an existing integrated cyber security architecture and that a change of supplier would result in incompatibility with the existing solution and disproportionate technical and operational difficulties in maintaining continuity of service. The award supports continuity of service and provides a contractual framework through which the relevant services can be aligned to a common expiry date whilst future procurement options are assessed."
    },
    "awards": [
        {
            "id": "057802-2026-C2026001074-1",
            "relatedLots": [
                "1"
            ],
            "status": "active",
            "suppliers": [
                {
                    "id": "GB-COH-02020412",
                    "name": "Kroll Associated LTD"
                }
            ]
        }
    ],
    "parties": [
        {
            "id": "GB-COH-2026-000062",
            "name": "SOUTH WESTERN RAILWAY LIMITED",
            "identifier": {
                "legalName": "SOUTH WESTERN RAILWAY LIMITED",
                "id": "2026-000062",
                "scheme": "GB-COH"
            },
            "address": {
                "locality": "London",
                "region": "UKI32",
                "postalCode": "SW1P4DR",
                "countryName": "United Kingdom"
            },
            "contactPoint": {
                "email": "judith.madubuko@swrailway.com"
            },
            "roles": [
                "buyer"
            ],
            "details": {
                "url": "https://www.southwesternrailway.com/",
                "classifications": [
                    {
                        "id": "BODY_PUBLIC",
                        "scheme": "TED_CA_TYPE",
                        "description": "Body governed by public law"
                    },
                    {
                        "scheme": "COFOG",
                        "description": "Train Operating Company"
                    }
                ]
            }
        },
        {
            "id": "GB-COH-02020412",
            "name": "Kroll Associated LTD",
            "identifier": {
                "legalName": "Kroll Associated LTD",
                "id": "02020412",
                "scheme": "GB-COH"
            },
            "address": {
                "locality": "London",
                "region": "UK",
                "countryName": "United Kingdom"
            },
            "roles": [
                "supplier"
            ],
            "details": {
                "scale": "large"
            }
        },
        {
            "id": "GB-FTS-1091",
            "name": "N/A",
            "identifier": {
                "legalName": "N/A"
            },
            "address": {
                "locality": "N/A",
                "countryName": "United Kingdom"
            },
            "roles": [
                "reviewBody"
            ]
        }
    ],
    "buyer": {
        "id": "GB-COH-2026-000062",
        "name": "SOUTH WESTERN RAILWAY LIMITED"
    },
    "contracts": [
        {
            "id": "057802-2026-C2026001074-1",
            "awardID": "057802-2026-C2026001074-1",
            "status": "active",
            "value": {
                "amount": 1221192.5,
                "currency": "GBP"
            },
            "dateSigned": "2026-06-18T00:00:00+01:00"
        }
    ],
    "bids": {
        "statistics": [
            {
                "id": "1",
                "measure": "bids",
                "relatedLot": "1",
                "value": 1
            },
            {
                "id": "2",
                "measure": "smeBids",
                "relatedLot": "1",
                "value": 0
            }
        ]
    },
    "language": "en"
}