Award GB CF

External Security Incident and Event Management (SIEM) & Security Operations Centre (SOC) Support Monitoring Service

O F W A T

Stage: Award

the latest stage the buyer has published
Buyer: O F W A T
Supplier: Phoenix Software Limited

named in the award notice
Value: £95.4K

net · GBP
Awarded: 5 Dec 2025

the award date on the notice
End date: For subscribers only
Where: West Midlands, England
First published: 28 Jan 2026

last seen 28 Jan 2026

What the buyer published

Ofwat currently operates an internal Security Operations Centre (SOC) within its security team, responsible for monitoring the organisation's SIEM (Security Incident and Event Management) platform. The internal SOC operates during business hours Monday to Friday 9-5pm. To strengthen resilience and deliver comprehensive round-the-clock coverage, enabling full 24/7 security operations, Ofwat now requires a Managed external SIEM and SOC capability to deliver threat detection, analysis, and incident response. This service will operate as an extension of Ofwat's internal security team, offering advanced analytics, threat intelligence, and compliance reporting.

View the original notice ↗

History of this contract

An empty stage is useful. For example, no tender stage usually means the buyer used a framework or gave the contract directly.

◌ Planning none

◌ Tender none

● Award on record

● End date For subscribers only

Why we call this SOC, detection and response

Judged against the rules we publish. How we decide.

SOC, detection and response An ongoing service that watches an organisation's systems and responds to attacks.

Bought on its own, as a separate contract The cyber work is a separate contract.