Protective Monitoring Transition and Exit

{
  "awards": [
    {
      "id": "1",
      "items": [
        {
          "additionalClassifications": [
            {
              "description": "Data security software development services",
              "id": "72212732",
              "scheme": "CPV"
            }
          ],
          "id": "1",
          "relatedLot": "1"
        }
      ],
      "mainProcurementCategory": "services",
      "relatedLots": [
        "1"
      ],
      "status": "active",
      "suppliers": [
        {
          "id": "GB-COH-01503908",
          "name": "IBM UK Ltd"
        }
      ]
    }
  ],
  "buyer": {
    "id": "GB-PPON-PWGC-6513-PQLZ",
    "name": "Home Office"
  },
  "contracts": [
    {
      "aboveThreshold": true,
      "awardID": "1",
      "dateSigned": "2026-01-13T00:00:00+00:00",
      "documents": [
        {
          "datePublished": "2026-01-27T14:46:54Z",
          "description": "Contract details notice on Find a Tender",
          "documentType": "contractNotice",
          "format": "text/html",
          "id": "007165-2026",
          "noticeType": "UK7",
          "url": "https://www.find-tender.service.gov.uk/Notice/007165-2026"
        }
      ],
      "id": "1",
      "noAgreedMetricsRationale": "Service levels are included. Further performance indicators not suitable for transition and exit arrangement.",
      "period": {
        "endDate": "2026-05-30T23:59:59+01:00",
        "startDate": "2026-01-13T00:00:00+00:00"
      },
      "status": "active",
      "value": {
        "amount": 337664.64,
        "amountGross": 405197.57,
        "currency": "GBP"
      }
    }
  ],
  "date": "2026-01-27T14:46:54Z",
  "id": "007165-2026",
  "initiationType": "tender",
  "language": "en",
  "ocid": "ocds-h6vhtk-05f22c",
  "parties": [
    {
      "address": {
        "country": "GB",
        "countryName": "United Kingdom",
        "locality": "London",
        "postalCode": "SW1P 4DF",
        "region": "UKI32",
        "streetAddress": "2 Marsham Street"
      },
      "contactPoint": {
        "email": "collaborativeprocurement@homeoffice.gov.uk"
      },
      "details": {
        "classifications": [
          {
            "description": "Public authority - central government",
            "id": "publicAuthorityCentralGovernment",
            "scheme": "UK_CA_TYPE"
          }
        ]
      },
      "id": "GB-PPON-PWGC-6513-PQLZ",
      "identifier": {
        "id": "PWGC-6513-PQLZ",
        "scheme": "GB-PPON"
      },
      "name": "Home Office",
      "roles": [
        "buyer"
      ]
    },
    {
      "address": {
        "country": "GB",
        "countryName": "United Kingdom",
        "locality": "Winchester",
        "postalCode": "SO21 2JN",
        "region": "UKJ36",
        "streetAddress": "Building C, IBM Hursley Office"
      },
      "contactPoint": {
        "email": "jzillessen@uk.ibm.com"
      },
      "details": {
        "publicServiceMissionOrganization": false,
        "scale": "large",
        "shelteredWorkshop": false,
        "vcse": false
      },
      "id": "GB-COH-01503908",
      "identifier": {
        "id": "01503908",
        "scheme": "GB-COH"
      },
      "name": "IBM UK Ltd",
      "roles": [
        "supplier"
      ]
    }
  ],
  "tag": [
    "award",
    "contract"
  ],
  "tender": {
    "coveredBy": [
      "GPA"
    ],
    "description": "The 2-month continuation (plus 1-month contingency) of the current protective monitoring service using IBM QRadar for on-premises and AWS-based Buyer-owned infrastructure and applications, to allow for transition to the in-house, long-term replacement solution. An operational support team monitor, support and patch the Protective Monitoring service and QRadar components including onboarding of new log sources. A Security Operations Centre (SOC) provides analysis of alerts, carries out triage and investigation of any potential security event, and alerts the Buyer.\nThe monitoring service will be delivered from January 1st 2026 until March 31st 2026. An operational support team shall monitor, support and patch the Protective Monitoring service and QRadar components including onboarding of new log sources. A Security Operations Centre (SOC) shall provide analysis of alerts, carries out triage and investigation of any potential security event, and alert the Buyer.  \nThe in-house, long-term replacement solution is in the final stages of development and governance with an anticipated go-live of Jan/Feb 2026 with the current IBM QRadar contract terminating on 31st Decmeber 2025 with no further extensions available, this short-term continuation contract is required to support transition.",
    "documents": [
      {
        "description": "Not published",
        "documentType": "conflictOfInterest",
        "id": "conflictOfInterest"
      }
    ],
    "id": "P_19864",
    "legalBasis": {
      "id": "2023/54",
      "scheme": "UKPGA",
      "uri": "https://www.legislation.gov.uk/ukpga/2023/54/contents"
    },
    "lots": [
      {
        "id": "1",
        "status": "complete"
      }
    ],
    "procurementMethod": "direct",
    "procurementMethodDetails": "Direct award",
    "procurementMethodRationale": "IBM is the incumbent provider of the protective monitoring service. The current contract ends on 31 December 2025, and the replacement in-house CSOC solution will not complete early life support until mid-late February 2026. Continuity of service is essential to maintain security assurance.\nThe time and cost of moving to an alternative supplier for a 2-3 month period would pose significant technical and financial risk. Transitioning to a new supplier would require onboarding, data conversion, and configuration, which is not feasible within the timeframe.\nThe current log data is in IBM\u2019s proprietary format. Converting this large volume of data to another system within the timeframe is not considerd possible and in any case would require substantial resources and could compromise security monitoring during the transition.",
    "procurementMethodRationaleClassifications": [
      {
        "id": "singleSuppliersTechnicalReasons"
      },
      {
        "id": "additionalRepeatExtensionPartialReplacement"
      }
    ],
    "status": "complete",
    "title": "Protective Monitoring Transition and Exit"
  }
}