Managed and Extended Detection and Response Solution

The contract timeline is as follows:

The contract commencement date is 1st January 2027. The contract is for a period of 3 years with an option to extend for a further 2 years, making it a 3+2 year contract.

Key milestones and phases of the tender process include:

• Issue UK4 Notice and Invitation to Tender: 24th July 2026
• Final date for submission of tender queries: 7th August 2026
• GLF Schools to respond to tender queries: 17th August 2026
• Final date for tender submissions: 10th September 2026, 10 am
• Supplier presentations and demonstrations: week commencing 5th October 2026
• Contract Award and issue UK6 Notice: 16th October 2026
• Issue assessment summaries to tenderers: 19th October 2026
• Standstill period: 20th to 29th October 2026
• Contract signature: 30th October 2026

The core scope of work for this tender, GLF-0028, is to procure a Managed Detection and Response (MDR) service, supported by Extended Detection and Response (XDR) capabilities. This service aims to provide continuous threat monitoring, investigation, detection, and response capabilities across the Trust's digital estate.

The Statement of Work summary and core deliverables include:

• Managed Detection and Response (MDR) and Extended Detection and Response (XDR) Service: This is the primary requirement, focusing on continuous threat monitoring, investigation, detection, and response.
• Implementation, Onboarding, and Transition: This covers the deployment, configuration, and optimization of the service within the Trust's environment. Deliverables include discovery and mobilisation activities, integration, configuration and testing, project governance, defined roles and responsibilities, customer resource requirements, key milestones, estimated implementation timescales, and proposed service acceptance and go-live criteria.
• Service Acceptance and Go-Live Criteria: Specific criteria for service readiness include integrated and monitored data sources, configured and tested alerting, escalation, and notification routes, agreed incident severity definitions and communication processes, documented roles and responsibilities, agreed response actions and containment permissions, initial detection use cases and tuning, established reporting and governance arrangements, validated access controls and security requirements, and completed documentation and knowledge transfer.
• Incident Response and Threat Management: The service must support the full incident response lifecycle, including detection, investigation, containment, and response for high-severity cyber security incidents.
• Early-Life Support Arrangements: Plans for support during the initial operational phase are required.
• Solution Description and Service Model: Tenderers must provide a description of their proposed MDR/XDR solution and service model, including recommended architecture and design based on the Trust's environment.
• Service Level Commitments and Support Arrangements: Details on service levels and support are expected.