---
title: "External Security Incident and Event Management (SIEM) & Security Operations Centre (SOC) Support Monitoring Service"
ocid: "ocds-b5fd17-4698dc31-b7df-4c55-b769-c3ce83556e86"
canonical_url: "https://d3tenders.com/contract/?ocid=ocds-b5fd17-4698dc31-b7df-4c55-b769-c3ce83556e86"
markdown_url: "https://d3tenders.com/contract/ocds-b5fd17-4698dc31-b7df-4c55-b769-c3ce83556e86.md"
json_url: "https://d3tenders.com/contract/ocds-b5fd17-4698dc31-b7df-4c55-b769-c3ce83556e86.json"
source: "Contracts Finder"
current_stage: "Award"
buyer: "O F W A T"
published: "2026-01-28"
---

# External Security Incident and Event Management (SIEM) & Security Operations Centre (SOC) Support Monitoring Service

Buyer: O F W A T  
Current stage: Award  
OCID: ocds-b5fd17-4698dc31-b7df-4c55-b769-c3ce83556e86

[View canonical contract page](https://d3tenders.com/contract/?ocid=ocds-b5fd17-4698dc31-b7df-4c55-b769-c3ce83556e86)  
[Download OCDS JSON](https://d3tenders.com/contract/ocds-b5fd17-4698dc31-b7df-4c55-b769-c3ce83556e86.json)

## Summary

The public procurement process led by Ofwat, based in Birmingham, invites businesses to provide an External Security Incident and Event Management (SIEM) & Security Operations Centre (SOC) Support Monitoring Service. This procurement falls under the information technology services industry category and aims to enhance Ofwat's current capabilities with round-the-clock security operations. The award phase of this process was completed on 5 December 2025, with the contract commencing on 1 February 2026 and running through to 31 January 2027. The procurement method used was a limited competitive quotation, an approach often employed for projects below specific financial thresholds, which encourages competition among suppliers.

This tender presents significant opportunities for tech companies, particularly those with capabilities in threat detection, analytics, and incident response. Small and medium-sized enterprises (SMEs) specializing in security monitoring services are well-positioned to potentially expand their business by aligning their services with Ofwat's needs. The selection of Phoenix Software Limited as the supplier highlights the competitive nature of this procurement, offering insights into the level of expertise required. Businesses that can integrate advanced threat intelligence and compliance reporting into their service offerings stand to benefit greatly from such government contracts.

## Notice

Ofwat currently operates an internal Security Operations Centre (SOC) within its security team, responsible for monitoring the organisation's SIEM (Security Incident and Event Management) platform. The internal SOC operates during business hours Monday to Friday 9-5pm. To strengthen resilience and deliver comprehensive round-the-clock coverage, enabling full 24/7 security operations, Ofwat now requires a Managed external SIEM and SOC capability to deliver threat detection, analysis, and incident response. This service will operate as an extension of Ofwat's internal security team, offering advanced analytics, threat intelligence, and compliance reporting.

## Key Details

| Field | Value |
| --- | --- |
| Publication source | Contracts Finder |
| Latest notice | https://www.contractsfinder.service.gov.uk/Notice/9b0ad156-a66c-4028-907e-35ab54c4c969 |
| Notice type | Award Notice |
| Procurement type | Standard |
| Procurement category | Services |
| Procurement method | Limited |
| Procurement method details | Competitive quotation (below threshold) |
| Tender suitability | SME |
| Awardee scale | Large |
| All stages | Award |

## Dates

| Field | Value |
| --- | --- |
| Publication date | 28 Jan 2026 |
| Submission deadline | 2 Dec 2025 |
| Future notice date | Not specified |
| Award date | 5 Dec 2025 |
| Contract period | 1 Feb 2026 - 31 Jan 2027 |
| Recurrence | Not specified |

## Values

| Field | Value |
| --- | --- |
| Tender value | Not specified |
| Lots value | Not specified |
| Awards value | £95,390 |
| Contracts value | Not specified |

## Status

| Field | Value |
| --- | --- |
| Tender status | Complete |
| Lots status | Not specified |
| Awards status | Active |
| Contracts status | Not specified |

## Buyer

| Field | Value |
| --- | --- |
| Main buyer | O F W A T |
| Locality | BIRMINGHAM |
| Post town | Birmingham |
| Postcode | B5 4UA |
| Country | England |
| ITL 1 | TLG West Midlands (England) |
| ITL 2 | TLG3 West Midlands |
| ITL 3 | TLG31 Birmingham |
| Local authority | Birmingham |
| Electoral ward | Ladywood |
| Westminster constituency | Birmingham Ladywood |
| Delivery location | Not specified |

## Supplier

| Field | Value |
| --- | --- |
| Number of suppliers | 1 |
| Supplier names | PHOENIX SOFTWARE |

## CPV Codes

### Divisions

- 72 - IT services: consulting, software development, Internet and support

### Codes

- 72222300 - Information technology services

## Release History

- 28 Jan 2026 at 10:47 - Award - Award Notice - https://www.contractsfinder.service.gov.uk/Notice/9b0ad156-a66c-4028-907e-35ab54c4c969

## Documents

- https://www.contractsfinder.service.gov.uk/Notice/9b0ad156-a66c-4028-907e-35ab54c4c969
  28th January 2026 - Awarded contract notice on Contracts Finder

## Provenance

This Markdown file is an alternate public rendering of the D3 Tenders contract record. The canonical page is https://d3tenders.com/contract/?ocid=ocds-b5fd17-4698dc31-b7df-4c55-b769-c3ce83556e86. The underlying structured data is available as OCDS JSON at https://d3tenders.com/contract/ocds-b5fd17-4698dc31-b7df-4c55-b769-c3ce83556e86.json.