---
title: "UKRI-6251 Cyber Security - Managed Service and Detection Response & Security Operations Centre service"
ocid: "ocds-h6vhtk-06e9f0"
canonical_url: "https://d3tenders.com/contract/?ocid=ocds-h6vhtk-06e9f0"
markdown_url: "https://d3tenders.com/contract/ocds-h6vhtk-06e9f0.md"
json_url: "https://d3tenders.com/contract/ocds-h6vhtk-06e9f0.json"
source: "Find A Tender Service"
current_stage: "Planning"
buyer: "UK Research & Innovation (UKRI)"
published: "2026-08-21"
---

# UKRI-6251 Cyber Security - Managed Service and Detection Response & Security Operations Centre service

Buyer: UK Research & Innovation (UKRI)  
Current stage: Planning  
OCID: ocds-h6vhtk-06e9f0

[View canonical contract page](https://d3tenders.com/contract/?ocid=ocds-h6vhtk-06e9f0)  
[Download OCDS JSON](https://d3tenders.com/contract/ocds-h6vhtk-06e9f0.json)

## Summary

UK Research and Innovation (UKRI), through the Science and Technology Facilities Council (STFC), intends to procure a cyber security managed service. The requirement is for a managed security service provider to deliver managed detection and response and Security Operations Centre (SOC) services, working collaboratively with the existing STFC cyber security team. The service will provide continuous cyber security monitoring, threat detection and incident response across the United Kingdom. The initial service is for STFC, with potential to extend or scale provision to other UKRI councils during the contract. This is a cyber security and computer support consultancy service, including security services and security software development support. The procurement is suitable for small and medium-sized enterprises.

This procurement is at the planning stage and is not an invitation to tender. UKRI expects to issue a subsequent notice on 1 October 2026. It is undertaking pre-market engagement through a Request for Information questionnaire, with responses requested by 11 September 2026. Selected suppliers may then be invited to structured one-to-one Microsoft Teams meetings. The anticipated contract is for three years, with mobilisation expected to begin on 1 February 2027 and the service expected to be operational by 1 May 2027; the stated contract period runs to 1 February 2030. The estimated value is £1.25 million excluding VAT, or £1.5 million including VAT. There is one planned lot.

The planned requirement will suit established cyber security providers able to operate a managed detection and response service and SOC on a continuous 24/7, 365-day basis. Suppliers should be prepared to work closely with an existing public-sector cyber security team, supporting collaborative monitoring, detection, investigation and response rather than providing an isolated service. Relevant operational capability includes service mobilisation, transition into live operations, incident handling and the ability to scale delivery beyond the initial STFC requirement to other UKRI councils. Providers with the capacity to support a multi-organisation environment and develop a scalable commercial and technical model should monitor the next procurement stage. Participation in the market engagement will not form part of any later evaluation or give participants an advantage.

## Notice

UKRI-6251 Cyber Security - Managed Service and Detection Response & Security Operations Centre service. A Cyber Security provider to deliver collaborative SOC services, working with the existing STFC cyber security team.

### Planning Information

Pre-Market Engagement – Cyber Security Managed Service Detection and Response
UK Research and Innovation (UKRI) and the Science and Technology Facilities Council (STFC) is undertaking a pre-market engagement to inform an upcoming procurement for a Managed Security Service Provider to deliver a cyber security managed detection and response / Security Operations Centre service.
The initial requirement is for the Science and Technology Facilities Council for an anticipated three-year contract, with an estimated value of approximately £1.25 million excluding VAT. The service is expected to provide 24/7 x 365 cyber security detection and response, with mobilisation commencing from February 2027 and the service operational by 1 May 2027.
STFC is also exploring the potential to scale the service to additional UKRI councils during the lifetime of the contract.
STFC is seeking feedback from the market to help inform the proposed service requirements, mobilisation and transition arrangements, scalability and commercial approach.
Engagement Activities
STFC intends to undertake: Request for Information (RFI): Suppliers are invited to complete the questionnaire. 
To request a copy of the RFI, please email STFCProcurement@UKRI.org 
STFC may invite a limited number of suppliers to participate in structured one-to-one MS Teams meetings following review of the RFI responses. More information on this and the proposed route to market can be found in the RFI.
Participation in this pre-market engagement does not form part of any subsequent procurement evaluation and will not provide suppliers with an advantage in any future competition.

## Key Details

| Field | Value |
| --- | --- |
| Publication source | Find A Tender Service |
| Latest notice | https://www.find-tender.service.gov.uk/Notice/080084-2026 |
| Notice type | UK2 - Preliminary Market Engagement Notice |
| Procurement type | Standard |
| Procurement category | Services |
| Procurement method | Not Specified |
| Procurement method details | Not specified |
| Tender suitability | SME |
| Awardee scale | Not specified |
| All stages | Planning |

## Dates

| Field | Value |
| --- | --- |
| Publication date | 21 Aug 2026 |
| Submission deadline | Not specified |
| Future notice date | 1 Oct 2026 |
| Award date | Not specified |
| Contract period | 1 Feb 2027 - 1 Feb 2030 |
| Recurrence | Not specified |

## Values

| Field | Value |
| --- | --- |
| Tender value | £1,250,000 |
| Lots value | Not specified |
| Awards value | Not specified |
| Contracts value | Not specified |

## Status

| Field | Value |
| --- | --- |
| Tender status | Planning |
| Lots status | Planning |
| Awards status | Not specified |
| Contracts status | Not specified |

## Buyer

| Field | Value |
| --- | --- |
| Main buyer | UK Research & Innovation (UKRI) |
| Locality | SWINDON, WILTSHIRE |
| Postcode area | Swindon |
| Postcode | SN2 1FL |
| Country | England |
| ITL 1 | TLK South West (England) |
| ITL 2 | TLK7 Gloucestershire and Wiltshire |
| ITL 3 | TLK71 Swindon |
| Local authority | Swindon |
| Electoral ward | Rodbourne Cheney |
| Westminster constituency | Swindon North |
| Delivery location | Not specified |

## CPV Codes

### Divisions

- 72 - IT services: consulting, software development, Internet and support
- 79 - Business services: law, marketing, consulting, recruitment, printing and security

### Codes

- 72212730 - Security software development services
- 72600000 - Computer support and consultancy services
- 79710000 - Security services

## Release History

- 21 Aug 2026 at 16:36 - Planning - UK2 - Preliminary Market Engagement Notice - https://www.find-tender.service.gov.uk/Notice/080084-2026

## Documents

- https://www.find-tender.service.gov.uk/Notice/080084-2026
  21st August 2026 - Preliminary market engagement notice on Find a Tender

## Notice URLs

- https://www.legislation.gov.uk/ukpga/2023/54/contents
- https://www.ukri.org/

## Provenance

This Markdown file is an alternate public rendering of the D3 Tenders contract record. The canonical page is https://d3tenders.com/contract/?ocid=ocds-h6vhtk-06e9f0. The underlying structured data is available as OCDS JSON at https://d3tenders.com/contract/ocds-h6vhtk-06e9f0.json.