---
title: "Provision of Cyber Security Services"
ocid: "ocds-h6vhtk-06b88a"
canonical_url: "https://d3tenders.com/contract/?ocid=ocds-h6vhtk-06b88a"
markdown_url: "https://d3tenders.com/contract/ocds-h6vhtk-06b88a.md"
json_url: "https://d3tenders.com/contract/ocds-h6vhtk-06b88a.json"
source: "Find A Tender Service"
current_stage: "Award"
buyer: "SOUTH WESTERN RAILWAY LIMITED"
published: "2026-06-18"
---

# Provision of Cyber Security Services

Buyer: SOUTH WESTERN RAILWAY LIMITED  
Current stage: Award  
OCID: ocds-h6vhtk-06b88a

[View canonical contract page](https://d3tenders.com/contract/?ocid=ocds-h6vhtk-06b88a)  
[Download OCDS JSON](https://d3tenders.com/contract/ocds-h6vhtk-06b88a.json)

## Summary

South Western Railway Limited, operating from London, has completed the procurement process under the title "Provision of Cyber Security Services," focussing within the IT services sector. The procurement pertained to services in cyber security, comprising monitoring, detection, and response components. The procurement falls under the services category, with the contract having been awarded on 18th June 2026 to Kroll Associated LTD. A Framework Services Agreement under a limited procurement method, thus avoiding a prior call for competition, has been established to manage the integration and alignment of existing cyber service elements across various UK regions, ensuring continuity and compliance with the established cyber security architecture.

The tender offers significant business opportunities, particularly for large enterprises specialising in IT security and cyber protection services. The contract, valued at approximately £1.2 million, embodies a substantial scope, integrating several critical cyber security services already in operation, thereby offering a stable and extended engagement for businesses in the field. Firms with capabilities in Network Detection, Endpoint Protection, and cyber risk management would find this tender well-suited, especially those able to maintain and enhance existing systems. This contract represents an ideal growth opportunity for entities looking to cement their presence in the strategic field of digital security services.

## Notice

South Western Railway has awarded a Framework Services Agreement to Kroll for the provision of integrated cyber security monitoring, detection and response services.

### Lot Information

Lot 1

SWRL currently receives a number of cyber security services from Kroll, the current position is that prior to SWR's transition to public ownership, cyber security services were provided under FirstGroup's Master Services Agreement (MSA), with individual services operating as call-off arrangements beneath that overarching contractual structure. As SWR is now a separate legal entity operating independently of FirstGroup, the inherited arrangements must be replaced with SWR-owned contractual mechanisms as the existing agreements expire. This creates the need to establish a compliant contractual structure whilst maintaining continuity of critical cyber security services. The current cyber security solution comprises four interdependent service components: * SOC/SIEM Service * Network Detection and Response (NDR) * CrowdStrike Endpoint Protection * Cyber Risk Retainer Services

### Procurement Information

South Western Railway has awarded a Framework Services Agreement to Kroll for the provision of integrated cyber security monitoring, detection and response services. The Framework Services Agreement provides the contractual mechanism through which SWR will manage and align its cyber security service components, including Network Detection and Response services, CrowdStrike Endpoint Protection and Cyber Risk Retainer services. The total estimated value of the Framework Services Agreement is approximately PS1.2 million. The award has been made in accordance with Schedule 5 of the Procurement Act 2023, Additional or Repeat Goods, Services or Works. SWR determined that the services form part of an existing integrated cyber security architecture and that a change of supplier would result in incompatibility with the existing solution and disproportionate technical and operational difficulties in maintaining continuity of service. The award supports continuity of service and provides a contractual framework through which the relevant services can be aligned to a common expiry date whilst future procurement options are assessed.

## Key Details

| Field | Value |
| --- | --- |
| Publication source | Find A Tender Service |
| Latest notice | https://www.find-tender.service.gov.uk/Notice/057802-2026 |
| Notice type | Award Notice |
| Procurement type | Standard |
| Procurement category | Services |
| Procurement method | Limited |
| Procurement method details | Award procedure without prior publication of a call for competition |
| Tender suitability | Not specified |
| Awardee scale | Large |
| All stages | Award |

## Dates

| Field | Value |
| --- | --- |
| Publication date | 18 Jun 2026 |
| Submission deadline | Not specified |
| Future notice date | Not specified |
| Award date | 17 Jun 2026 |
| Contract period | Not specified |
| Recurrence | Not specified |

## Values

| Field | Value |
| --- | --- |
| Tender value | Not specified |
| Lots value | Not specified |
| Awards value | Not specified |
| Contracts value | £1,221,192 |

## Status

| Field | Value |
| --- | --- |
| Tender status | Complete |
| Lots status | Cancelled |
| Awards status | Active |
| Contracts status | Active |

## Buyer

| Field | Value |
| --- | --- |
| Main buyer | SOUTH WESTERN RAILWAY LIMITED |
| Locality | LONDON |
| Post town | South West London |
| Postcode | SW1P 4DR |
| Country | England |
| ITL 1 | TLI London |
| ITL 2 | TLI3 Inner London - West |
| ITL 3 | TLI35 Westminster and City of London |
| Local authority | Westminster |
| Electoral ward | Vincent Square |
| Westminster constituency | Cities of London and Westminster |
| Delivery location | TLC North East (England), TLD North West (England), TLE Yorkshire and The Humber, TLF East Midlands (England), TLG West Midlands (England), TLH East (England), TLI London, TLJ South East (England), TLK South West (England) |

## Supplier

| Field | Value |
| --- | --- |
| Number of suppliers | 1 |
| Supplier names | KROLL ASSOCIATED |

## CPV Codes

### Divisions

- 48 - Software package and information systems
- 72 - IT services: consulting, software development, Internet and support

### Codes

- 48760000 - Virus protection software package
- 72000000 - IT services: consulting, software development, Internet and support
- 72212730 - Security software development services

## Release History

- 18 Jun 2026 at 22:50 - Award - Award Notice - https://www.find-tender.service.gov.uk/Notice/057802-2026

## Notice URLs

- https://www.southwesternrailway.com/

## Provenance

This Markdown file is an alternate public rendering of the D3 Tenders contract record. The canonical page is https://d3tenders.com/contract/?ocid=ocds-h6vhtk-06b88a. The underlying structured data is available as OCDS JSON at https://d3tenders.com/contract/ocds-h6vhtk-06b88a.json.