--- title: "Protective Monitoring Transition and Exit" ocid: "ocds-h6vhtk-05f22c" canonical_url: "https://d3tenders.com/contract/?ocid=ocds-h6vhtk-05f22c" markdown_url: "https://d3tenders.com/contract/ocds-h6vhtk-05f22c.md" json_url: "https://d3tenders.com/contract/ocds-h6vhtk-05f22c.json" source: "Find A Tender Service" current_stage: "Award" buyer: "HOME OFFICE" published: "2026-06-11" --- # Protective Monitoring Transition and Exit Buyer: HOME OFFICE Current stage: Award OCID: ocds-h6vhtk-05f22c [View canonical contract page](https://d3tenders.com/contract/?ocid=ocds-h6vhtk-05f22c) [Download OCDS JSON](https://d3tenders.com/contract/ocds-h6vhtk-05f22c.json) ## Summary The public procurement process undertaken by the Home Office, headquartered at 2 Marsham Street, London, is for the "Protective Monitoring Transition and Exit" project in the data security software development services industry. This procurement is classified under services and takes place in the UK Central Government category. Initially, the direct award contract for this project was signed with IBM UK Ltd, a large-scale supplier based in Winchester, to extend the current protective monitoring services mandated by IBM QRadar. This extension was essential to transition to a long-term, in-house protective monitoring solution. The contract began on 1st January 2026 and concluded on 31st March 2026, with a significant gross contract value of GBP 405,197.57. The procurement stage advanced from planning to award with the contract being terminated in June 2026 after completion of its objectives. This procurement creates significant opportunities for businesses involved in data security and monitoring services. Companies with capabilities in delivering seamless and secure solutions for protective monitoring on cloud and on-premises infrastructures are well-suited to compete. The project's requirement to maintain continuity of a critical security service, through the transition to the Home Office's in-house solution, provided IBM UK Ltd with a competitive edge due to their incumbent status and expertise in handling proprietary IBM QRadar log data. Thus, the procurement method was a direct award to manage time, cost, and technical feasibility efficiently, highlighting opportunities for businesses capable of ensuring security assurance during comprehensive transitions. ## Notice The 2-month continuation (plus 1-month contingency) of the current protective monitoring service using IBM QRadar for on-premises and AWS-based Buyer-owned infrastructure and applications, to allow for transition to the in-house, long-term replacement solution. An operational support team monitor, support and patch the Protective Monitoring service and QRadar components including onboarding of new log sources. A Security Operations Centre (SOC) provides analysis of alerts, carries out triage and investigation of any potential security event, and alerts the Buyer. The monitoring service will be delivered from January 1st 2026 until March 31st 2026. An operational support team shall monitor, support and patch the Protective Monitoring service and QRadar components including onboarding of new log sources. A Security Operations Centre (SOC) shall provide analysis of alerts, carries out triage and investigation of any potential security event, and alert the Buyer. The in-house, long-term replacement solution is in the final stages of development and governance with an anticipated go-live of Jan/Feb 2026 with the current IBM QRadar contract terminating on 31st Decmeber 2025 with no further extensions available, this short-term continuation contract is required to support transition. ### Procurement Information IBM is the incumbent provider of the protective monitoring service. The current contract ends on 31 December 2025, and the replacement in-house CSOC solution will not complete early life support until mid-late February 2026. Continuity of service is essential to maintain security assurance. The time and cost of moving to an alternative supplier for a 2-3 month period would pose significant technical and financial risk. Transitioning to a new supplier would require onboarding, data conversion, and configuration, which is not feasible within the timeframe. The current log data is in IBM's proprietary format. Converting this large volume of data to another system within the timeframe is not considerd possible and in any case would require substantial resources and could compromise security monitoring during the transition. ## Key Details | Field | Value | | --- | --- | | Publication source | Find A Tender Service | | Latest notice | https://www.find-tender.service.gov.uk/Notice/055195-2026 | | Notice type | UK11 - Contract Termination Notice | | Procurement type | Standard | | Procurement category | Services | | Procurement method | Direct | | Procurement method details | Direct award | | Tender suitability | Not specified | | Awardee scale | Large | | All stages | Award | ## Dates | Field | Value | | --- | --- | | Publication date | 11 Jun 2026 | | Submission deadline | Not specified | | Future notice date | Not specified | | Award date | 2 Dec 2025 | | Contract period | 13 Jan 2026 - 30 May 2026 | | Recurrence | Not specified | ## Values | Field | Value | | --- | --- | | Tender value | Not specified | | Lots value | Not specified | | Awards value | £337,664 | | Contracts value | £337,664 | ## Status | Field | Value | | --- | --- | | Tender status | Complete | | Lots status | Complete | | Awards status | Active | | Contracts status | Terminated | ## Buyer | Field | Value | | --- | --- | | Main buyer | HOME OFFICE | | Additional buyers | Missing | | Locality | LONDON | | Post town | South West London | | Postcode | SW1P 4DF | | Country | England | | ITL 1 | TLI London | | ITL 2 | TLI3 Inner London - West | | ITL 3 | TLI35 Westminster and City of London | | Local authority | Westminster | | Electoral ward | St James's | | Westminster constituency | Cities of London and Westminster | | Delivery location | Not specified | ## Supplier | Field | Value | | --- | --- | | Number of suppliers | 1 | | Supplier names | IBM | ## CPV Codes ### Divisions - 72 - IT services: consulting, software development, Internet and support ### Codes - 72212732 - Data security software development services ## Release History - 11 Jun 2026 at 11:58 - ContractTermination - UK11 - Contract Termination Notice - https://www.find-tender.service.gov.uk/Notice/055195-2026 - 27 Jan 2026 at 14:46 - Award - UK7 - Contract Details Notice - https://www.find-tender.service.gov.uk/Notice/007165-2026 - 23 Dec 2025 at 16:09 - AwardUpdate - UK6 - Contract Award Notice - https://www.find-tender.service.gov.uk/Notice/085967-2025 - 9 Dec 2025 at 17:20 - Award - UK6 - Contract Award Notice - https://www.find-tender.service.gov.uk/Notice/081235-2025 - 9 Dec 2025 at 16:51 - Award - UK5 - Transparency Notice - https://www.find-tender.service.gov.uk/Notice/081214-2025 ## Documents - https://www.find-tender.service.gov.uk/Notice/055195-2026 11th June 2026 - Contract termination notice on Find a Tender - https://www.find-tender.service.gov.uk/Notice/007165-2026 27th January 2026 - Contract details notice on Find a Tender - https://www.find-tender.service.gov.uk/Notice/085967-2025 23rd December 2025 - Contract award notice on Find a Tender - https://www.find-tender.service.gov.uk/Notice/081235-2025 9th December 2025 - Contract award notice on Find a Tender - https://www.find-tender.service.gov.uk/Notice/081214-2025 9th December 2025 - Transparency notice on Find a Tender ## Notice URLs - https://www.legislation.gov.uk/ukpga/2023/54/contents ## Provenance This Markdown file is an alternate public rendering of the D3 Tenders contract record. The canonical page is https://d3tenders.com/contract/?ocid=ocds-h6vhtk-05f22c. The underlying structured data is available as OCDS JSON at https://d3tenders.com/contract/ocds-h6vhtk-05f22c.json.