---
title: "Contract extension for provision of SOC/SIEM Managed Service"
ocid: "ocds-h6vhtk-0775ee"
canonical_url: "https://d3tenders.com/contract/?ocid=ocds-h6vhtk-0775ee"
markdown_url: "https://d3tenders.com/contract/ocds-h6vhtk-0775ee.md"
json_url: "https://d3tenders.com/contract/ocds-h6vhtk-0775ee.json"
source: "Find A Tender Service"
current_stage: "Award"
buyer: "Thameslink Southern Great Northern Limited (TSGN)"
published: "2026-09-18"
---

# Contract extension for provision of SOC/SIEM Managed Service

Buyer: Thameslink Southern Great Northern Limited (TSGN)  
Current stage: Award  
OCID: ocds-h6vhtk-0775ee

[View canonical contract page](https://d3tenders.com/contract/?ocid=ocds-h6vhtk-0775ee)  
[Download OCDS JSON](https://d3tenders.com/contract/ocds-h6vhtk-0775ee.json)

## Summary

Thameslink Southern Great Northern Limited (TSGN) procured an extension to its managed security operations capability: a SOC/SIEM managed service. The requirement covers ongoing computer support and consultancy services associated with security operations and security information and event management. It is intended to maintain the organisation’s existing security service, technology integrations and operational effectiveness, while supporting the security licences used across the business. TSGN is a public undertaking in the rail sector, based in London. The work relates to TSGN’s business-wide technology and security environment rather than a discrete construction project or supply of physical goods. Suppliers operating managed SOC and SIEM services, with experience of supporting integrated enterprise technology environments, would find the requirement most relevant.

This procurement is complete and has been awarded through a direct award under the Procurement Act 2023, Schedule 5, item 7, for additional or repeat services. The rationale was to extend the incumbent’s services because changing supplier would require fundamental changes to technology and integrations, creating incompatibility and operational risk. Kroll Associates U.K. Limited was awarded the single lot. The award date was 18 September 2026 and the awarded value is £595,220 excluding VAT, or £714,264 including VAT. The contract period runs from 1 October 2026 to 31 May 2028, with signature scheduled by 30 September 2026. The contract is above the relevant threshold and was evaluated through the direct-award route rather than a competitive tender.

For a supplier assessing future opportunities with TSGN, this award demonstrates an established need for outsourced security operations and SIEM management across a complex rail business. A credible competitor would need to provide a mature managed SOC/SIEM service, maintain continuity with existing security technology and integrations, and work with incumbent licence arrangements. Demonstrable capability in computer support and security consultancy would be important, as would the capacity to support business-wide operations without creating incompatibility or service disruption. The stated justification also shows that transition effort, operational resilience and risk reduction are central commercial considerations. Suppliers able to evidence reliable service continuity, integration management and enterprise-scale security operations would be better placed when this requirement is next reviewed.

## Notice

Contract extension for provision of SOC/SIEM Managed Service. This is to extend the contract services for 20months, to align to our security licences which are in term until May 2028.

### Procurement Information

Under the Procurement Act 2023, under Schedule 5, item 7: Additional or Repeat Goods, Services or Works. The Direct Award is justified under item 7 on the basis that: * The requirement constitutes an extension to existing services currently provided by the incumbent supplier. A change of supplier would also mean a fundamental change to technology and integrations across the whole business which would create inconsistencies and incompatibility. Continuity of service is essential to maintain operational effectiveness and minimise risk to the organisation, a change would take significant time and resource.

## Key Details

| Field | Value |
| --- | --- |
| Publication source | Find A Tender Service |
| Latest notice | https://www.find-tender.service.gov.uk/Notice/088916-2026 |
| Notice type | UK6 - Contract Award Notice |
| Procurement type | Standard |
| Procurement category | Services |
| Procurement method | Direct |
| Procurement method details | Direct award |
| Tender suitability | Not specified |
| Awardee scale | Large |
| All stages | Award |

## Dates

| Field | Value |
| --- | --- |
| Publication date | 18 Sep 2026 |
| Submission deadline | Not specified |
| Future notice date | Not specified |
| Award date | 18 Sep 2026 |
| Contract period | 1 Oct 2026 - 31 May 2028 |
| Recurrence | Not specified |

## Values

| Field | Value |
| --- | --- |
| Tender value | Not specified |
| Lots value | Not specified |
| Awards value | £595,220 |
| Contracts value | Not specified |

## Status

| Field | Value |
| --- | --- |
| Tender status | Complete |
| Lots status | Complete |
| Awards status | Active |
| Contracts status | Not specified |

## Buyer

| Field | Value |
| --- | --- |
| Main buyer | Thameslink Southern Great Northern Limited (TSGN) |
| Locality | LONDON |
| Postcode area | Central London |
| Postcode | EC3R 8AJ |
| Country | England |
| ITL 1 | TLI London |
| ITL 2 | TLI3 Inner London - West |
| ITL 3 | TLI35 Westminster and City of London |
| Local authority | City of London |
| Electoral ward | Bridge |
| Westminster constituency | Cities of London and Westminster |
| Delivery location | Not specified |

## Supplier

| Field | Value |
| --- | --- |
| Number of suppliers | 1 |
| Supplier names | KROLL ASSOCIATES U.K. LIMITED |

## CPV Codes

### Divisions

- 72 - IT services: consulting, software development, Internet and support

### Codes

- 72600000 - Computer support and consultancy services

## Release History

- 18 Sep 2026 at 17:26 - Award - UK6 - Contract Award Notice - https://www.find-tender.service.gov.uk/Notice/088916-2026
- 18 Sep 2026 at 17:23 - Award - UK5 - Transparency Notice - https://www.find-tender.service.gov.uk/Notice/088912-2026

## Documents

- https://www.find-tender.service.gov.uk/Notice/088916-2026
  18th September 2026 - Contract award notice on Find a Tender
- https://www.find-tender.service.gov.uk/Notice/088912-2026
  18th September 2026 - Transparency notice on Find a Tender

## Notice URLs

- https://www.legislation.gov.uk/ukpga/2023/54/contents

## Provenance

This Markdown file is an alternate public rendering of the D3 Tenders contract record. The canonical page is https://d3tenders.com/contract/?ocid=ocds-h6vhtk-0775ee. The underlying structured data is available as OCDS JSON at https://d3tenders.com/contract/ocds-h6vhtk-0775ee.json.