Enhanced Security Operations Managed Service

Description

The Student Loans company (SLC) have an agreement for Enhanced Security Operations Managed Service expiring April 2028. In order to provision for a retender of the agreement SLC are undertaking pre-market engagement with regards to the provision of the following: • Requirement A: Enhanced Security Operations Managed Service - MXDR Service (2026-TR-0109a) • Requirement B: Enhanced Security Operations Managed Service - Vulnerability Management (VM) Service (2026-TR-0109b) • Requirement C: Enhanced Security Operations Managed Service - Breach Attack Simulation (BAS) Service (2026-TR-0109c) • Requirement D: Enhanced Security Operations Managed Service - Cyber Threat Intelligence (CTI) Service (2026-TR-0109d) • Requirement E: Enhanced Security Operations Managed Service - Digital Forensics and Incident Response (DFIR) Retainer Service (2026-TR-0109e) • Requirement F: Enhanced Security Operations Managed Service - Security Architecture and Engineering Support Services (2026-TR-0109f) SLC is considering an approach to the market to give the suppliers an option to bid for one or ALL of the contractual requirements. Requirement A Enhanced Security Operations Managed Service - MXDR Service The Supplier will provide a Managed Extended Detection and Response (MXDR) capability operating on a hybrid customer/supplier model. MXDR Service The Supplier will provide: • 24x7x365 monitoring of SLC security telemetry. • L1 and L2 Security Operations Centre capability (SLC retain L3). • Incident identification, triage and investigation. • Security use-case monitoring and tuning. • Management of Microsoft Sentinel detections. • SOAR playbook execution and optimisation. • Escalation management. • Alert enrichment. • Threat hunting capability. • Malicious activity investigation. • Service governance and performance management. • Security reporting at operational, tactical and strategic levels. Security Engineering (Operational) The Supplier shall provide: • L3 Engineering support for Sentinel. • Analytics rule development and tuning. • SOAR playbook management. • Connector maintenance and health monitoring. • Logging optimisation. • Onboarding and validation of agreed log sources. • Detection engineering support. • Detection gap analysis and monitoring coverage reviews. • Security use case development and continuous improvement. • Monitoring health checks. • Monitoring and remediation of ingestion issues. • Security platform optimisation. • Proactive automation support and development. • Threat intelligence-led detection improvements. Data Loss Prevention (DLP) & Phishing The Supplier shall: • Monitoring, triage and investigation of DLP, phishing, business email compromise (BEC), malicious email, malicious attachment and malicious URL alerts. • Investigation of suspected data loss, data exfiltration and policy breach events. • Support for user reported phishing submissions. • Escalation and coordination of confirmed incidents in accordance with agreed response procedures. • Identification and analysis of phishing campaigns, attacker infrastructure, indicators of compromise and emerging attack trends. • Recommendations for improvements to DLP policies, email security controls, detections and response processes. • Monthly reporting, trend analysis and security improvement recommendations. Reporting The Supplier shall provide: • Weekly operational reports. • Monthly service reports. • Quarterly service reviews. • KPI and SLA reporting. • Security metrics and trend analysis. Requirement B Enhanced Security Operations Managed Service - Vulnerability Management Service The Supplier shall provide Vulnerability Management services Monday to Friday, UK Core Hours (09:00-17:00). Vulnerability Management The Supplier shall: • Monitor vulnerability management queues. • Investigate vulnerability notifications. • Manage vulnerability triage. • Validate vulnerability findings. • Perform exploitability assessments. • Provide remediation recommendations. • Support exposure management activities. • Support CTEM activities. Stakeholder Engagement The Supplier shall: • Conduct monthly technical review meetings. • Support resolver teams. • Assist remediation planning. • Review remediation performance. • Provide vulnerability prioritisation guidance. Dashboarding & Reporting The Supplier shall: • Maintain executive dashboards. • Enhance Power BI reporting. • Produce technical reports. • Produce executive reports. • Produce PCI compliance reports. • Produce risk trending reports. Tooling The Supplier shall support: • Microsoft Defender for Endpoint. • Rapid7. • SLC PCI ASV Scanning tooling. • Jira. • Power BI. Requirement C Enhanced Security Operations Managed Service - Breach Attack Simulation Service The Supplier shall provide a Breach Attack Simulation (BAS) capability, currently using AttackIQ or similar. BAS Service The Supplier shall: • Operate and maintain the BAS platform. • Deploy and maintain BAS agents. • Configure integrations. • Execute scheduled simulations. • Execute customer-specific simulations. • Execute retests following remediation activities. Adversary Simulation Testing scenarios shall include: • Initial Access. • Execution. • Persistence. • Privilege Escalation. • Credential Access. • Lateral Movement. • Command and Control. • Exfiltration. • Malware. • Ransomware. • Advanced Persistent Threat activity. Security Validation The Supplier shall assess: • Security control effectiveness. • Security monitoring effectiveness. • Detection coverage. • Response capability. • Incident handling. • Use-case effectiveness. Reporting The Supplier shall produce: • Monthly BAS reports. • Executive summaries. • Technical findings. • Remediation recommendations. • Retest outcomes. Requirement D Enhanced Security Operations Managed Service - Cyber Threat Intelligence Service The Supplier shall provide strategic, operational and tactical Cyber Threat Intelligence services. Threat Intelligence Managed Service The Supplier shall provide: • Threat Intelligence reporting. • Integration into Microsoft Sentinel. • Indicator of Compromise feeds. • Threat actor intelligence. Operational Intelligence The Supplier shall provide: • Threat alerts. • Vulnerability intelligence. • Emerging threat notifications. • Campaign tracking. • Industry specific intelligence. Strategic Intelligence The Supplier shall provide: • Threat landscape assessments. • Quarterly threat reports. • Executive intelligence briefings. • Board level threat summaries. • Sector specific threat reporting. Security Operations Support The Supplier shall provide: • Intelligence support during incidents. • Threat hunting support. • Intelligence driven use-case creation. • Intelligence enrichment services. Requirement E Enhanced Security Operations Managed Service - Digital Forensics & Incident Response Retainer Service The Supplier shall provide a DFIR Retainer available 24x7x365. Cyber Incident Response The Supplier shall provide: • Incident investigation. • Malware analysis. • Threat containment. • Threat eradication. • Recovery support. • Crisis management support. • Regulator support. • On-site support Digital Forensics The Supplier shall provide: • Evidence acquisition. • Chain of custody management. • Endpoint forensics. • Server forensics. • Network forensics. • Cloud forensics. • Forensic reporting. Readiness Services The Supplier shall provide access to: • Tabletop exercises. • Incident simulations. • Executive workshops. • CSIRT training. • Lessons learned reviews. Retained Consultancy The Supplier shall provide specialist support including: • Security strategy input. • Audit support. • Major incident reviews. • Regulatory engagement support. • Ransomware negotiation services. Requirement F Enhanced Security Operations Managed Service - Security Architecture & Engineering Support Services The Supplier shall provide specialist Security Architecture and Engineering services on a call-off basis. Security Architecture The Supplier shall provide: • Security architecture reviews. • Security design authority support. • Secure by Design reviews. • Solution security reviews. • Threat modelling. • Architecture governance. • Security requirements definition. • Architectural risk assessments. Security Engineering The Supplier shall provide: • Technical security engineering. • Security tool implementation. • Security configuration reviews. • Security hardening activities. • Technical control implementation. Strategy & Transformation The Supplier shall provide: • Security roadmap development. • Target operating model development. • Control framework assessments. • Security maturity reviews. • Improvement planning. Governance & Assurance The Supplier shall provide: • Security assessments. • Risk management support. • Audit support. • KPI development. • Board reporting support. • Security governance support. • Independent design and control assurance. • Security exception and risk acceptance reviews. • Third party and supplier security assessments.