Enhanced Security Operations Managed Service

Title

Enhanced Security Operations Managed Service

Stage

planning

Buyer

STUDENT LOANS COMPANY

Buyer id

GB-COH-02401034

Status

planning

Category

services

CPV

not on file

CPV in words

not on file

Estimated value

not on file

Currency

not on file

Released

2026-09-09T10:45:20+01:00

Tenders close

not on file

Contract starts

not on file

Contract ends

not on file

Procedure

not on file

Description

The Student Loans company (SLC) have an agreement for Enhanced Security Operations Managed Service expiring April 2028. In order to provision for a retender of the agreement SLC are undertaking pre-market engagement with regards to the provision of the following: • Requirement A: Enhanced Security Operations Managed Service - MXDR Service (2026-TR-0109a) • Requirement B: Enhanced Security Operations Managed Service - Vulnerability Management (VM) Service (2026-TR-0109b) • Requirement C: Enhanced Security Operations Managed Service - Breach Attack Simulation (BAS) Service (2026-TR-0109c) • Requirement D: Enhanced Security Operations Managed Service - Cyber Threat Intelligence (CTI) Service (2026-TR-0109d) • Requirement E: Enhanced Security Operations Managed Service - Digital Forensics and Incident Response (DFIR) Retainer Service (2026-TR-0109e) • Requirement F: Enhanced Security Operations Managed Service - Security Architecture and Engineering Support Services (2026-TR-0109f) SLC is considering an approach to the market to give the suppliers an option to bid for one or ALL of the contractual requirements. Requirement A Enhanced Security Operations Managed Service - MXDR Service The Supplier will provide a Managed Extended Detection and Response (MXDR) capability operating on a hybrid customer/supplier model. MXDR Service The Supplier will provide: • 24x7x365 monitoring of SLC security telemetry. • L1 and L2 Security Operations Centre capability (SLC retain L3). • Incident identification, triage and investigation. • Security use-case monitoring and tuning. • Management of Microsoft Sentinel detections. • SOAR playbook execution and optimisation. • Escalation management. • Alert enrichment. • Threat hunting capability. • Malicious activity investigation. • Service governance and performance management. • Security reporting at operational, tactical and strategic levels. Security Engineering (Operational) The Supplier shall provide: • L3 Engineering support for Sentinel. • Analytics rule development and tuning. • SOAR playbook management. • Connector maintenance and health monitoring. • Logging optimisation. • Onboarding and validation of agreed log sources. • Detection engineering support. • Detection gap analysis and monitoring coverage reviews. • Security use case development and continuous improvement. • Monitoring health checks. • Monitoring and remediation of ingestion issues. • Security platform optimisation. • Proactive automation support and development. • Threat intelligence-led detection improvements. Data Loss Prevention (DLP) & Phishing The Supplier shall: • Monitoring, triage and investigation of DLP, phishing, business email compromise (BEC), malicious email, malicious attachment and malicious URL alerts. • Investigation of suspected data loss, data exfiltration and policy breach events. • Support for user reported phishing submissions. • Escalation and coordination of confirmed incidents in accordance with agreed response procedures. • Identification and analysis of phishing campaigns, attacker infrastructure, indicators of compromise and emerging attack trends. • Recommendations for improvements to DLP policies, email security controls, detections and response processes. • Monthly reporting, trend analysis and security improvement recommendations. Reporting The Supplier shall provide: • Weekly operational reports. • Monthly service reports. • Quarterly service reviews. • KPI and SLA reporting. • Security metrics and trend analysis. Requirement B Enhanced Security Operations Managed Service - Vulnerability Management Service The Supplier shall provide Vulnerability Management services Monday to Friday, UK Core Hours (09:00-17:00). Vulnerability Management The Supplier shall: • Monitor vulnerability management queues. • Investigate vulnerability notifications. • Manage vulnerability triage. • Validate vulnerability findings. • Perform exploitability assessments. • Provide remediation recommendations. • Support exposure management activities. • Support CTEM activities. Stakeholder Engagement The Supplier shall: • Conduct monthly technical review meetings. • Support resolver teams. • Assist remediation planning. • Review remediation performance. • Provide vulnerability prioritisation guidance. Dashboarding & Reporting The Supplier shall: • Maintain executive dashboards. • Enhance Power BI reporting. • Produce technical reports. • Produce executive reports. • Produce PCI compliance reports. • Produce risk trending reports. Tooling The Supplier shall support: • Microsoft Defender for Endpoint. • Rapid7. • SLC PCI ASV Scanning tooling. • Jira. • Power BI. Requirement C Enhanced Security Operations Managed Service - Breach Attack Simulation Service The Supplier shall provide a Breach Attack Simulation (BAS) capability, currently using AttackIQ or similar. BAS Service The Supplier shall: • Operate and maintain the BAS platform. • Deploy and maintain BAS agents. • Configure integrations. • Execute scheduled simulations. • Execute customer-specific simulations. • Execute retests following remediation activities. Adversary Simulation Testing scenarios shall include: • Initial Access. • Execution. • Persistence. • Privilege Escalation. • Credential Access. • Lateral Movement. • Command and Control. • Exfiltration. • Malware. • Ransomware. • Advanced Persistent Threat activity. Security Validation The Supplier shall assess: • Security control effectiveness. • Security monitoring effectiveness. • Detection coverage. • Response capability. • Incident handling. • Use-case effectiveness. Reporting The Supplier shall produce: • Monthly BAS reports. • Executive summaries. • Technical findings. • Remediation recommendations. • Retest outcomes. Requirement D Enhanced Security Operations Managed Service - Cyber Threat Intelligence Service The Supplier shall provide strategic, operational and tactical Cyber Threat Intelligence services. Threat Intelligence Managed Service The Supplier shall provide: • Threat Intelligence reporting. • Integration into Microsoft Sentinel. • Indicator of Compromise feeds. • Threat actor intelligence. Operational Intelligence The Supplier shall provide: • Threat alerts. • Vulnerability intelligence. • Emerging threat notifications. • Campaign tracking. • Industry specific intelligence. Strategic Intelligence The Supplier shall provide: • Threat landscape assessments. • Quarterly threat reports. • Executive intelligence briefings. • Board level threat summaries. • Sector specific threat reporting. Security Operations Support The Supplier shall provide: • Intelligence support during incidents. • Threat hunting support. • Intelligence driven use-case creation. • Intelligence enrichment services. Requirement E Enhanced Security Operations Managed Service - Digital Forensics & Incident Response Retainer Service The Supplier shall provide a DFIR Retainer available 24x7x365. Cyber Incident Response The Supplier shall provide: • Incident investigation. • Malware analysis. • Threat containment. • Threat eradication. • Recovery support. • Crisis management support. • Regulator support. • On-site support Digital Forensics The Supplier shall provide: • Evidence acquisition. • Chain of custody management. • Endpoint forensics. • Server forensics. • Network forensics. • Cloud forensics. • Forensic reporting. Readiness Services The Supplier shall provide access to: • Tabletop exercises. • Incident simulations. • Executive workshops. • CSIRT training. • Lessons learned reviews. Retained Consultancy The Supplier shall provide specialist support including: • Security strategy input. • Audit support. • Major incident reviews. • Regulatory engagement support. • Ransomware negotiation services. Requirement F Enhanced Security Operations Managed Service - Security Architecture & Engineering Support Services The Supplier shall provide specialist Security Architecture and Engineering services on a call-off basis. Security Architecture The Supplier shall provide: • Security architecture reviews. • Security design authority support. • Secure by Design reviews. • Solution security reviews. • Threat modelling. • Architecture governance. • Security requirements definition. • Architectural risk assessments. Security Engineering The Supplier shall provide: • Technical security engineering. • Security tool implementation. • Security configuration reviews. • Security hardening activities. • Technical control implementation. Strategy & Transformation The Supplier shall provide: • Security roadmap development. • Target operating model development. • Control framework assessments. • Security maturity reviews. • Improvement planning. Governance & Assurance The Supplier shall provide: • Security assessments. • Risk management support. • Audit support. • KPI development. • Board reporting support. • Security governance support. • Independent design and control assurance. • Security exception and risk acceptance reviews. • Third party and supplier security assessments.

Open Contracting ID

ocds-h6vhtk-06f556

Cite as

Find a Tender (UK above-threshold notices) (UK Cabinet Office, Find a Tender Service), pages.json, sha256 3fa091d38652, published 2026-10-04

Copy