Provision of Cyber Security Services

Location

London

Description

South Western Railway has awarded a Framework Services Agreement to Kroll for the provision of integrated cyber security monitoring, detection and response services.

Total Quantity or Scope

SWRL currently receives a number of cyber security services from Kroll, the current position is that prior to SWR's transition to public ownership, cyber security services were provided under FirstGroup's Master Services Agreement (MSA), with individual services operating as call-off arrangements beneath that overarching contractual structure. As SWR is now a separate legal entity operating independently of FirstGroup, the inherited arrangements must be replaced with SWR-owned contractual mechanisms as the existing agreements expire. This creates the need to establish a compliant contractual structure whilst maintaining continuity of critical cyber security services. The current cyber security solution comprises four interdependent service components: • SOC/SIEM Service • Network Detection and Response (NDR) • CrowdStrike Endpoint Protection • Cyber Risk Retainer Services

Award Detail

Award Criteria

CPV Codes

• 72000000 - IT services: consulting, software development, Internet and support
• 48760000 - Virus protection software package
• 72212730 - Security software development services

Indicators

• Award on basis of price.

Legal Justification

South Western Railway has awarded a Framework Services Agreement to Kroll for the provision of integrated cyber security monitoring, detection and response services. The Framework Services Agreement provides the contractual mechanism through which SWR will manage and align its cyber security service components, including Network Detection and Response services, CrowdStrike Endpoint Protection and Cyber Risk Retainer services. The total estimated value of the Framework Services Agreement is approximately £1.2 million. The award has been made in accordance with Schedule 5 of the Procurement Act 2023, Additional or Repeat Goods, Services or Works. SWR determined that the services form part of an existing integrated cyber security architecture and that a change of supplier would result in incompatibility with the existing solution and disproportionate technical and operational difficulties in maintaining continuity of service. The award supports continuity of service and provides a contractual framework through which the relevant services can be aligned to a common expiry date whilst future procurement options are assessed.