{ "uri": "https://www.find-tender.service.gov.uk/api/1.0/ocdsRecordPackages/ocds-h6vhtk-06f556", "publisher": { "name": "Cabinet Office", "scheme": "GB-GOR", "uid": "D2", "uri": "https://www.gov.uk/government/organisations/cabinet-office" }, "publishedDate": "2026-09-09T10:45:20+01:00", "license": "http://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/", "publicationPolicy": "https://www.gov.uk/government/publications/open-contracting", "version": "1.1", "extensions": [ "https://standard.open-contracting.org/profiles/eu/latest/en/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_amendment_rationale_classifications_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_budget_breakdown_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_contract_completion_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_documentation_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_pagination_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_suitability_extension/master/extension.json", "https://raw.githubusercontent.com/portaledcahn/ocds_Links_extension/main/extension.json", "https://raw.githubusercontent.com/cabinetoffice/ocds_uk_extension/main/extension.json" ], "packages": [ "https://www.find-tender.service.gov.uk/api/1.0/ocdsRecordPackages/ocds-h6vhtk-06f556" ], "records": [ { "ocid": "ocds-h6vhtk-06f556", "releases": [ { "ocid": "ocds-h6vhtk-06f556", "id": "085261-2026", "tag": [ "planning" ], "date": "2026-09-09T10:45:20+01:00", "initiationType": "tender", "parties": [ { "name": "STUDENT LOANS COMPANY", "id": "GB-COH-02401034", "identifier": { "scheme": "GB-COH", "id": "02401034" }, "additionalIdentifiers": [ { "scheme": "GB-PPON", "id": "PMXL-3278-BCWT" } ], "address": { "streetAddress": "Memphis Building Lingfield Point", "locality": "Darlington", "postalCode": "DL1 1RW", "country": "GB", "countryName": "United Kingdom", "region": "UKC13" }, "contactPoint": { "name": "Kenneth McKay", "email": "Kenneth_mckay@slc.co.uk" }, "roles": [ "buyer" ], "details": { "classifications": [ { "scheme": "UK_CA_TYPE", "id": "publicAuthorityCentralGovernment", "description": "Public authority - central government" } ] } } ], "buyer": { "id": "GB-COH-02401034", "name": "STUDENT LOANS COMPANY" }, "planning": { "milestones": [ { "id": "engagement", "type": "engagement", "description": "All communication regarding this questionnaire shall take place via Delta E Sourcing and must state the appropriate contract reference number (2026-TR-0109) in all instances. Your sole contact for the purposes of this questionnaire is:\nContact: \tKenneth McKay\nTitle:\tCommercial Manager\nEmail:\tKenneth_mckay@slc.co.uk\nResponses to this questionnaire must be submitted via Delta Esourcing \nAccess Code: 96G7G98ZY3\nEnd date: 22/10/2026 10:00am.", "dueDate": "2026-10-22T23:59:59+01:00", "status": "scheduled" } ], "documents": [ { "id": "085261-2026", "documentType": "marketEngagementNotice", "noticeType": "UK2", "description": "Preliminary market engagement notice on Find a Tender", "url": "https://www.find-tender.service.gov.uk/Notice/085261-2026", "datePublished": "2026-09-09T10:45:20+01:00", "format": "text/html" } ] }, "tender": { "id": "2026-TR-0109", "legalBasis": { "id": "2023/54", "scheme": "UKPGA", "uri": "https://www.legislation.gov.uk/ukpga/2023/54/contents" }, "title": "Enhanced Security Operations Managed Service", "description": "The Student Loans company (SLC) have an agreement for Enhanced Security Operations Managed Service expiring April 2028. In order to provision for a retender of the agreement SLC are undertaking pre-market engagement with regards to the provision of the following:\n•\tRequirement A: Enhanced Security Operations Managed Service - MXDR Service (2026-TR-0109a)\n•\tRequirement B: Enhanced Security Operations Managed Service - Vulnerability Management (VM) Service (2026-TR-0109b)\n•\tRequirement C: Enhanced Security Operations Managed Service - Breach Attack Simulation (BAS) Service (2026-TR-0109c)\n•\tRequirement D: Enhanced Security Operations Managed Service - Cyber Threat Intelligence (CTI) Service (2026-TR-0109d)\n•\tRequirement E: Enhanced Security Operations Managed Service - Digital Forensics and Incident Response (DFIR) Retainer Service (2026-TR-0109e)\n•\tRequirement F: Enhanced Security Operations Managed Service - Security Architecture and Engineering Support Services (2026-TR-0109f)\nSLC is considering an approach to the market to give the suppliers an option to bid for one or ALL of the contractual requirements. \nRequirement A\nEnhanced Security Operations Managed Service - MXDR Service\nThe Supplier will provide a Managed Extended Detection and Response (MXDR) capability operating on a hybrid customer/supplier model.\nMXDR Service\nThe Supplier will provide:\n•\t24x7x365 monitoring of SLC security telemetry.\n•\tL1 and L2 Security Operations Centre capability (SLC retain L3).\n•\tIncident identification, triage and investigation.\n•\tSecurity use-case monitoring and tuning.\n•\tManagement of Microsoft Sentinel detections.\n•\tSOAR playbook execution and optimisation.\n•\tEscalation management.\n•\tAlert enrichment.\n•\tThreat hunting capability.\n•\tMalicious activity investigation.\n•\tService governance and performance management.\n•\tSecurity reporting at operational, tactical and strategic levels.\nSecurity Engineering (Operational)\nThe Supplier shall provide:\n•\tL3 Engineering support for Sentinel.\n•\tAnalytics rule development and tuning.\n•\tSOAR playbook management.\n•\tConnector maintenance and health monitoring.\n•\tLogging optimisation.\n•\tOnboarding and validation of agreed log sources.\n•\tDetection engineering support.\n•\tDetection gap analysis and monitoring coverage reviews.\n•\tSecurity use case development and continuous improvement.\n•\tMonitoring health checks.\n•\tMonitoring and remediation of ingestion issues.\n•\tSecurity platform optimisation.\n•\tProactive automation support and development.\n•\tThreat intelligence-led detection improvements.\nData Loss Prevention (DLP) & Phishing\nThe Supplier shall:\n•\tMonitoring, triage and investigation of DLP, phishing, business email compromise (BEC), malicious email, malicious attachment and malicious URL alerts.\n•\tInvestigation of suspected data loss, data exfiltration and policy breach events.\n•\tSupport for user reported phishing submissions.\n•\tEscalation and coordination of confirmed incidents in accordance with agreed response procedures.\n•\tIdentification and analysis of phishing campaigns, attacker infrastructure, indicators of compromise and emerging attack trends.\n•\tRecommendations for improvements to DLP policies, email security controls, detections and response processes.\n•\tMonthly reporting, trend analysis and security improvement recommendations.\nReporting\nThe Supplier shall provide:\n•\tWeekly operational reports.\n•\tMonthly service reports.\n•\tQuarterly service reviews.\n•\tKPI and SLA reporting.\n•\tSecurity metrics and trend analysis.\nRequirement B\nEnhanced Security Operations Managed Service - Vulnerability Management Service\nThe Supplier shall provide Vulnerability Management services Monday to Friday, UK Core Hours (09:00-17:00).\nVulnerability Management\nThe Supplier shall:\n•\tMonitor vulnerability management queues.\n•\tInvestigate vulnerability notifications.\n•\tManage vulnerability triage.\n•\tValidate vulnerability findings.\n•\tPerform exploitability assessments.\n•\tProvide remediation recommendations.\n•\tSupport exposure management activities.\n•\tSupport CTEM activities.\nStakeholder Engagement\nThe Supplier shall:\n•\tConduct monthly technical review meetings.\n•\tSupport resolver teams.\n•\tAssist remediation planning.\n•\tReview remediation performance.\n•\tProvide vulnerability prioritisation guidance.\nDashboarding & Reporting\nThe Supplier shall:\n•\tMaintain executive dashboards.\n•\tEnhance Power BI reporting.\n•\tProduce technical reports.\n•\tProduce executive reports.\n•\tProduce PCI compliance reports.\n•\tProduce risk trending reports.\nTooling\nThe Supplier shall support:\n•\tMicrosoft Defender for Endpoint.\n•\tRapid7.\n•\tSLC PCI ASV Scanning tooling.\n•\tJira.\n•\tPower BI.\nRequirement C\nEnhanced Security Operations Managed Service - Breach Attack Simulation Service\nThe Supplier shall provide a Breach Attack Simulation (BAS) capability, currently using AttackIQ or similar.\nBAS Service\nThe Supplier shall:\n•\tOperate and maintain the BAS platform.\n•\tDeploy and maintain BAS agents.\n•\tConfigure integrations.\n•\tExecute scheduled simulations.\n•\tExecute customer-specific simulations.\n•\tExecute retests following remediation activities.\nAdversary Simulation\nTesting scenarios shall include:\n•\tInitial Access.\n•\tExecution.\n•\tPersistence.\n•\tPrivilege Escalation.\n•\tCredential Access.\n•\tLateral Movement.\n•\tCommand and Control.\n•\tExfiltration.\n•\tMalware.\n•\tRansomware.\n•\tAdvanced Persistent Threat activity.\nSecurity Validation\nThe Supplier shall assess:\n•\tSecurity control effectiveness.\n•\tSecurity monitoring effectiveness.\n•\tDetection coverage.\n•\tResponse capability.\n•\tIncident handling.\n•\tUse-case effectiveness.\nReporting\nThe Supplier shall produce:\n•\tMonthly BAS reports.\n•\tExecutive summaries.\n•\tTechnical findings.\n•\tRemediation recommendations.\n•\tRetest outcomes.\nRequirement D\nEnhanced Security Operations Managed Service - Cyber Threat Intelligence Service\nThe Supplier shall provide strategic, operational and tactical Cyber Threat Intelligence services.\nThreat Intelligence Managed Service\nThe Supplier shall provide:\n•\tThreat Intelligence reporting.\n•\tIntegration into Microsoft Sentinel.\n•\tIndicator of Compromise feeds.\n•\tThreat actor intelligence.\nOperational Intelligence\nThe Supplier shall provide:\n•\tThreat alerts.\n•\tVulnerability intelligence.\n•\tEmerging threat notifications.\n•\tCampaign tracking.\n•\tIndustry specific intelligence.\nStrategic Intelligence\nThe Supplier shall provide:\n•\tThreat landscape assessments.\n•\tQuarterly threat reports.\n•\tExecutive intelligence briefings.\n•\tBoard level threat summaries.\n•\tSector specific threat reporting.\nSecurity Operations Support\nThe Supplier shall provide:\n•\tIntelligence support during incidents.\n•\tThreat hunting support.\n•\tIntelligence driven use-case creation.\n•\tIntelligence enrichment services.\nRequirement E\nEnhanced Security Operations Managed Service - Digital Forensics & Incident Response Retainer Service\nThe Supplier shall provide a DFIR Retainer available 24x7x365.\nCyber Incident Response\nThe Supplier shall provide:\n•\tIncident investigation.\n•\tMalware analysis.\n•\tThreat containment.\n•\tThreat eradication.\n•\tRecovery support.\n•\tCrisis management support.\n•\tRegulator support.\n•\tOn-site support\nDigital Forensics\nThe Supplier shall provide:\n•\tEvidence acquisition.\n•\tChain of custody management.\n•\tEndpoint forensics.\n•\tServer forensics.\n•\tNetwork forensics.\n•\tCloud forensics.\n•\tForensic reporting.\nReadiness Services\nThe Supplier shall provide access to:\n•\tTabletop exercises.\n•\tIncident simulations.\n•\tExecutive workshops.\n•\tCSIRT training.\n•\tLessons learned reviews.\nRetained Consultancy\nThe Supplier shall provide specialist support including:\n•\tSecurity strategy input.\n•\tAudit support.\n•\tMajor incident reviews.\n•\tRegulatory engagement support.\n•\tRansomware negotiation services.\nRequirement F\nEnhanced Security Operations Managed Service - Security Architecture & Engineering Support Services\nThe Supplier shall provide specialist Security Architecture and Engineering services on a call-off basis.\nSecurity Architecture\nThe Supplier shall provide:\n•\tSecurity architecture reviews.\n•\tSecurity design authority support.\n•\tSecure by Design reviews.\n•\tSolution security reviews.\n•\tThreat modelling.\n•\tArchitecture governance.\n•\tSecurity requirements definition.\n•\tArchitectural risk assessments.\nSecurity Engineering\nThe Supplier shall provide:\n•\tTechnical security engineering.\n•\tSecurity tool implementation.\n•\tSecurity configuration reviews.\n•\tSecurity hardening activities.\n•\tTechnical control implementation.\nStrategy & Transformation\nThe Supplier shall provide:\n•\tSecurity roadmap development.\n•\tTarget operating model development.\n•\tControl framework assessments.\n•\tSecurity maturity reviews.\n•\tImprovement planning.\nGovernance & Assurance\nThe Supplier shall provide:\n•\tSecurity assessments.\n•\tRisk management support.\n•\tAudit support.\n•\tKPI development.\n•\tBoard reporting support.\n•\tSecurity governance support.\n•\tIndependent design and control assurance.\n•\tSecurity exception and risk acceptance reviews.\n•\tThird party and supplier security assessments.", "items": [ { "id": "1", "additionalClassifications": [ { "scheme": "CPV", "id": "72000000", "description": "IT services: consulting, software development, Internet and support" } ], "deliveryAddresses": [ { "region": "UK", "country": "GB", "countryName": "United Kingdom" } ], "relatedLot": "1" } ], "mainProcurementCategory": "services", "aboveThreshold": false, "lots": [ { "id": "1", "suitability": { "sme": true }, "contractPeriod": { "startDate": "2028-04-14T00:00:00+01:00", "endDate": "2030-04-30T23:59:59+01:00", "maxExtentDate": "2031-04-30T23:59:59+01:00" }, "hasRenewal": true, "status": "planning" } ], "communication": { "futureNoticeDate": "2027-05-07T23:59:59+01:00" }, "status": "planning" }, "language": "en", "extensions": [ "https://standard.open-contracting.org/profiles/eu/latest/en/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_amendment_rationale_classifications_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_budget_breakdown_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_contract_completion_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_documentation_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_pagination_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_suitability_extension/master/extension.json", "https://raw.githubusercontent.com/portaledcahn/ocds_Links_extension/main/extension.json", "https://raw.githubusercontent.com/cabinetoffice/ocds_uk_extension/main/extension.json" ] } ], "compiledRelease": { "tag": [ "compiled" ], "id": "ocds-h6vhtk-06f556-2026-09-09T10:45:20+01:00", "date": "2026-09-09T10:45:20+01:00", "ocid": "ocds-h6vhtk-06f556", "initiationType": "tender", "parties": [ { "id": "GB-COH-02401034", "name": "STUDENT LOANS COMPANY", "identifier": { "scheme": "GB-COH", "id": "02401034" }, "additionalIdentifiers": [ { "scheme": "GB-PPON", "id": "PMXL-3278-BCWT" } ], "address": { "streetAddress": "Memphis Building Lingfield Point", "locality": "Darlington", "postalCode": "DL1 1RW", "country": "GB", "countryName": "United Kingdom", "region": "UKC13" }, "contactPoint": { "name": "Kenneth McKay", "email": "Kenneth_mckay@slc.co.uk" }, "roles": [ "buyer" ], "details": { "classifications": [ { "scheme": "UK_CA_TYPE", "id": "publicAuthorityCentralGovernment", "description": "Public authority - central government" } ] } } ], "buyer": { "id": "GB-COH-02401034", "name": "STUDENT LOANS COMPANY" }, "planning": { "milestones": [ { "id": "engagement", "type": "engagement", "description": "All communication regarding this questionnaire shall take place via Delta E Sourcing and must state the appropriate contract reference number (2026-TR-0109) in all instances. Your sole contact for the purposes of this questionnaire is:\nContact: \tKenneth McKay\nTitle:\tCommercial Manager\nEmail:\tKenneth_mckay@slc.co.uk\nResponses to this questionnaire must be submitted via Delta Esourcing \nAccess Code: 96G7G98ZY3\nEnd date: 22/10/2026 10:00am.", "dueDate": "2026-10-22T23:59:59+01:00", "status": "scheduled" } ], "documents": [ { "id": "085261-2026", "documentType": "marketEngagementNotice", "noticeType": "UK2", "description": "Preliminary market engagement notice on Find a Tender", "url": "https://www.find-tender.service.gov.uk/Notice/085261-2026", "datePublished": "2026-09-09T10:45:20+01:00", "format": "text/html" } ] }, "tender": { "id": "2026-TR-0109", "legalBasis": { "id": "2023/54", "scheme": "UKPGA", "uri": "https://www.legislation.gov.uk/ukpga/2023/54/contents" }, "title": "Enhanced Security Operations Managed Service", "description": "The Student Loans company (SLC) have an agreement for Enhanced Security Operations Managed Service expiring April 2028. In order to provision for a retender of the agreement SLC are undertaking pre-market engagement with regards to the provision of the following:\n•\tRequirement A: Enhanced Security Operations Managed Service - MXDR Service (2026-TR-0109a)\n•\tRequirement B: Enhanced Security Operations Managed Service - Vulnerability Management (VM) Service (2026-TR-0109b)\n•\tRequirement C: Enhanced Security Operations Managed Service - Breach Attack Simulation (BAS) Service (2026-TR-0109c)\n•\tRequirement D: Enhanced Security Operations Managed Service - Cyber Threat Intelligence (CTI) Service (2026-TR-0109d)\n•\tRequirement E: Enhanced Security Operations Managed Service - Digital Forensics and Incident Response (DFIR) Retainer Service (2026-TR-0109e)\n•\tRequirement F: Enhanced Security Operations Managed Service - Security Architecture and Engineering Support Services (2026-TR-0109f)\nSLC is considering an approach to the market to give the suppliers an option to bid for one or ALL of the contractual requirements. \nRequirement A\nEnhanced Security Operations Managed Service - MXDR Service\nThe Supplier will provide a Managed Extended Detection and Response (MXDR) capability operating on a hybrid customer/supplier model.\nMXDR Service\nThe Supplier will provide:\n•\t24x7x365 monitoring of SLC security telemetry.\n•\tL1 and L2 Security Operations Centre capability (SLC retain L3).\n•\tIncident identification, triage and investigation.\n•\tSecurity use-case monitoring and tuning.\n•\tManagement of Microsoft Sentinel detections.\n•\tSOAR playbook execution and optimisation.\n•\tEscalation management.\n•\tAlert enrichment.\n•\tThreat hunting capability.\n•\tMalicious activity investigation.\n•\tService governance and performance management.\n•\tSecurity reporting at operational, tactical and strategic levels.\nSecurity Engineering (Operational)\nThe Supplier shall provide:\n•\tL3 Engineering support for Sentinel.\n•\tAnalytics rule development and tuning.\n•\tSOAR playbook management.\n•\tConnector maintenance and health monitoring.\n•\tLogging optimisation.\n•\tOnboarding and validation of agreed log sources.\n•\tDetection engineering support.\n•\tDetection gap analysis and monitoring coverage reviews.\n•\tSecurity use case development and continuous improvement.\n•\tMonitoring health checks.\n•\tMonitoring and remediation of ingestion issues.\n•\tSecurity platform optimisation.\n•\tProactive automation support and development.\n•\tThreat intelligence-led detection improvements.\nData Loss Prevention (DLP) & Phishing\nThe Supplier shall:\n•\tMonitoring, triage and investigation of DLP, phishing, business email compromise (BEC), malicious email, malicious attachment and malicious URL alerts.\n•\tInvestigation of suspected data loss, data exfiltration and policy breach events.\n•\tSupport for user reported phishing submissions.\n•\tEscalation and coordination of confirmed incidents in accordance with agreed response procedures.\n•\tIdentification and analysis of phishing campaigns, attacker infrastructure, indicators of compromise and emerging attack trends.\n•\tRecommendations for improvements to DLP policies, email security controls, detections and response processes.\n•\tMonthly reporting, trend analysis and security improvement recommendations.\nReporting\nThe Supplier shall provide:\n•\tWeekly operational reports.\n•\tMonthly service reports.\n•\tQuarterly service reviews.\n•\tKPI and SLA reporting.\n•\tSecurity metrics and trend analysis.\nRequirement B\nEnhanced Security Operations Managed Service - Vulnerability Management Service\nThe Supplier shall provide Vulnerability Management services Monday to Friday, UK Core Hours (09:00-17:00).\nVulnerability Management\nThe Supplier shall:\n•\tMonitor vulnerability management queues.\n•\tInvestigate vulnerability notifications.\n•\tManage vulnerability triage.\n•\tValidate vulnerability findings.\n•\tPerform exploitability assessments.\n•\tProvide remediation recommendations.\n•\tSupport exposure management activities.\n•\tSupport CTEM activities.\nStakeholder Engagement\nThe Supplier shall:\n•\tConduct monthly technical review meetings.\n•\tSupport resolver teams.\n•\tAssist remediation planning.\n•\tReview remediation performance.\n•\tProvide vulnerability prioritisation guidance.\nDashboarding & Reporting\nThe Supplier shall:\n•\tMaintain executive dashboards.\n•\tEnhance Power BI reporting.\n•\tProduce technical reports.\n•\tProduce executive reports.\n•\tProduce PCI compliance reports.\n•\tProduce risk trending reports.\nTooling\nThe Supplier shall support:\n•\tMicrosoft Defender for Endpoint.\n•\tRapid7.\n•\tSLC PCI ASV Scanning tooling.\n•\tJira.\n•\tPower BI.\nRequirement C\nEnhanced Security Operations Managed Service - Breach Attack Simulation Service\nThe Supplier shall provide a Breach Attack Simulation (BAS) capability, currently using AttackIQ or similar.\nBAS Service\nThe Supplier shall:\n•\tOperate and maintain the BAS platform.\n•\tDeploy and maintain BAS agents.\n•\tConfigure integrations.\n•\tExecute scheduled simulations.\n•\tExecute customer-specific simulations.\n•\tExecute retests following remediation activities.\nAdversary Simulation\nTesting scenarios shall include:\n•\tInitial Access.\n•\tExecution.\n•\tPersistence.\n•\tPrivilege Escalation.\n•\tCredential Access.\n•\tLateral Movement.\n•\tCommand and Control.\n•\tExfiltration.\n•\tMalware.\n•\tRansomware.\n•\tAdvanced Persistent Threat activity.\nSecurity Validation\nThe Supplier shall assess:\n•\tSecurity control effectiveness.\n•\tSecurity monitoring effectiveness.\n•\tDetection coverage.\n•\tResponse capability.\n•\tIncident handling.\n•\tUse-case effectiveness.\nReporting\nThe Supplier shall produce:\n•\tMonthly BAS reports.\n•\tExecutive summaries.\n•\tTechnical findings.\n•\tRemediation recommendations.\n•\tRetest outcomes.\nRequirement D\nEnhanced Security Operations Managed Service - Cyber Threat Intelligence Service\nThe Supplier shall provide strategic, operational and tactical Cyber Threat Intelligence services.\nThreat Intelligence Managed Service\nThe Supplier shall provide:\n•\tThreat Intelligence reporting.\n•\tIntegration into Microsoft Sentinel.\n•\tIndicator of Compromise feeds.\n•\tThreat actor intelligence.\nOperational Intelligence\nThe Supplier shall provide:\n•\tThreat alerts.\n•\tVulnerability intelligence.\n•\tEmerging threat notifications.\n•\tCampaign tracking.\n•\tIndustry specific intelligence.\nStrategic Intelligence\nThe Supplier shall provide:\n•\tThreat landscape assessments.\n•\tQuarterly threat reports.\n•\tExecutive intelligence briefings.\n•\tBoard level threat summaries.\n•\tSector specific threat reporting.\nSecurity Operations Support\nThe Supplier shall provide:\n•\tIntelligence support during incidents.\n•\tThreat hunting support.\n•\tIntelligence driven use-case creation.\n•\tIntelligence enrichment services.\nRequirement E\nEnhanced Security Operations Managed Service - Digital Forensics & Incident Response Retainer Service\nThe Supplier shall provide a DFIR Retainer available 24x7x365.\nCyber Incident Response\nThe Supplier shall provide:\n•\tIncident investigation.\n•\tMalware analysis.\n•\tThreat containment.\n•\tThreat eradication.\n•\tRecovery support.\n•\tCrisis management support.\n•\tRegulator support.\n•\tOn-site support\nDigital Forensics\nThe Supplier shall provide:\n•\tEvidence acquisition.\n•\tChain of custody management.\n•\tEndpoint forensics.\n•\tServer forensics.\n•\tNetwork forensics.\n•\tCloud forensics.\n•\tForensic reporting.\nReadiness Services\nThe Supplier shall provide access to:\n•\tTabletop exercises.\n•\tIncident simulations.\n•\tExecutive workshops.\n•\tCSIRT training.\n•\tLessons learned reviews.\nRetained Consultancy\nThe Supplier shall provide specialist support including:\n•\tSecurity strategy input.\n•\tAudit support.\n•\tMajor incident reviews.\n•\tRegulatory engagement support.\n•\tRansomware negotiation services.\nRequirement F\nEnhanced Security Operations Managed Service - Security Architecture & Engineering Support Services\nThe Supplier shall provide specialist Security Architecture and Engineering services on a call-off basis.\nSecurity Architecture\nThe Supplier shall provide:\n•\tSecurity architecture reviews.\n•\tSecurity design authority support.\n•\tSecure by Design reviews.\n•\tSolution security reviews.\n•\tThreat modelling.\n•\tArchitecture governance.\n•\tSecurity requirements definition.\n•\tArchitectural risk assessments.\nSecurity Engineering\nThe Supplier shall provide:\n•\tTechnical security engineering.\n•\tSecurity tool implementation.\n•\tSecurity configuration reviews.\n•\tSecurity hardening activities.\n•\tTechnical control implementation.\nStrategy & Transformation\nThe Supplier shall provide:\n•\tSecurity roadmap development.\n•\tTarget operating model development.\n•\tControl framework assessments.\n•\tSecurity maturity reviews.\n•\tImprovement planning.\nGovernance & Assurance\nThe Supplier shall provide:\n•\tSecurity assessments.\n•\tRisk management support.\n•\tAudit support.\n•\tKPI development.\n•\tBoard reporting support.\n•\tSecurity governance support.\n•\tIndependent design and control assurance.\n•\tSecurity exception and risk acceptance reviews.\n•\tThird party and supplier security assessments.", "items": [ { "id": "1", "additionalClassifications": [ { "scheme": "CPV", "id": "72000000", "description": "IT services: consulting, software development, Internet and support" } ], "deliveryAddresses": [ { "region": "UK", "country": "GB", "countryName": "United Kingdom" } ], "relatedLot": "1" } ], "mainProcurementCategory": "services", "aboveThreshold": false, "lots": [ { "id": "1", "suitability": { "sme": true }, "contractPeriod": { "startDate": "2028-04-14T00:00:00+01:00", "endDate": "2030-04-30T23:59:59+01:00", "maxExtentDate": "2031-04-30T23:59:59+01:00" }, "hasRenewal": true, "status": "planning" } ], "communication": { "futureNoticeDate": "2027-05-07T23:59:59+01:00" }, "status": "planning" }, "language": "en", "extensions": [ "https://standard.open-contracting.org/profiles/eu/latest/en/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_amendment_rationale_classifications_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_budget_breakdown_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_contract_completion_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_documentation_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_pagination_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_suitability_extension/master/extension.json", "https://raw.githubusercontent.com/portaledcahn/ocds_Links_extension/main/extension.json", "https://raw.githubusercontent.com/cabinetoffice/ocds_uk_extension/main/extension.json" ] }, "versionedRelease": { "ocid": "ocds-h6vhtk-06f556", "initiationType": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "tender" } ], "parties": [ { "id": "GB-COH-02401034", "name": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "STUDENT LOANS COMPANY" } ], "identifier": { "scheme": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "GB-COH" } ], "id": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "02401034" } ] }, "additionalIdentifiers": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": [ { "scheme": "GB-PPON", "id": "PMXL-3278-BCWT" } ] } ], "address": { "streetAddress": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "Memphis Building Lingfield Point" } ], "locality": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "Darlington" } ], "postalCode": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "DL1 1RW" } ], "country": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "GB" } ], "countryName": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "United Kingdom" } ], "region": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "UKC13" } ] }, "contactPoint": { "name": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "Kenneth McKay" } ], "email": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "Kenneth_mckay@slc.co.uk" } ] }, "roles": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": [ "buyer" ] } ], "details": { "classifications": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": [ { "scheme": "UK_CA_TYPE", "id": "publicAuthorityCentralGovernment", "description": "Public authority - central government" } ] } ] } } ], "buyer": { "id": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "GB-COH-02401034" } ], "name": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "STUDENT LOANS COMPANY" } ] }, "planning": { "milestones": [ { "id": "engagement", "type": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "engagement" } ], "description": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "All communication regarding this questionnaire shall take place via Delta E Sourcing and must state the appropriate contract reference number (2026-TR-0109) in all instances. Your sole contact for the purposes of this questionnaire is:\nContact: \tKenneth McKay\nTitle:\tCommercial Manager\nEmail:\tKenneth_mckay@slc.co.uk\nResponses to this questionnaire must be submitted via Delta Esourcing \nAccess Code: 96G7G98ZY3\nEnd date: 22/10/2026 10:00am." } ], "dueDate": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "2026-10-22T23:59:59+01:00" } ], "status": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "scheduled" } ] } ], "documents": [ { "id": "085261-2026", "documentType": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "marketEngagementNotice" } ], "noticeType": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "UK2" } ], "description": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "Preliminary market engagement notice on Find a Tender" } ], "url": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "https://www.find-tender.service.gov.uk/Notice/085261-2026" } ], "datePublished": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "2026-09-09T10:45:20+01:00" } ], "format": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "text/html" } ] } ] }, "tender": { "id": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "2026-TR-0109" } ], "legalBasis": { "id": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "2023/54" } ], "scheme": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "UKPGA" } ], "uri": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "https://www.legislation.gov.uk/ukpga/2023/54/contents" } ] }, "title": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "Enhanced Security Operations Managed Service" } ], "description": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "The Student Loans company (SLC) have an agreement for Enhanced Security Operations Managed Service expiring April 2028. In order to provision for a retender of the agreement SLC are undertaking pre-market engagement with regards to the provision of the following:\n•\tRequirement A: Enhanced Security Operations Managed Service - MXDR Service (2026-TR-0109a)\n•\tRequirement B: Enhanced Security Operations Managed Service - Vulnerability Management (VM) Service (2026-TR-0109b)\n•\tRequirement C: Enhanced Security Operations Managed Service - Breach Attack Simulation (BAS) Service (2026-TR-0109c)\n•\tRequirement D: Enhanced Security Operations Managed Service - Cyber Threat Intelligence (CTI) Service (2026-TR-0109d)\n•\tRequirement E: Enhanced Security Operations Managed Service - Digital Forensics and Incident Response (DFIR) Retainer Service (2026-TR-0109e)\n•\tRequirement F: Enhanced Security Operations Managed Service - Security Architecture and Engineering Support Services (2026-TR-0109f)\nSLC is considering an approach to the market to give the suppliers an option to bid for one or ALL of the contractual requirements. \nRequirement A\nEnhanced Security Operations Managed Service - MXDR Service\nThe Supplier will provide a Managed Extended Detection and Response (MXDR) capability operating on a hybrid customer/supplier model.\nMXDR Service\nThe Supplier will provide:\n•\t24x7x365 monitoring of SLC security telemetry.\n•\tL1 and L2 Security Operations Centre capability (SLC retain L3).\n•\tIncident identification, triage and investigation.\n•\tSecurity use-case monitoring and tuning.\n•\tManagement of Microsoft Sentinel detections.\n•\tSOAR playbook execution and optimisation.\n•\tEscalation management.\n•\tAlert enrichment.\n•\tThreat hunting capability.\n•\tMalicious activity investigation.\n•\tService governance and performance management.\n•\tSecurity reporting at operational, tactical and strategic levels.\nSecurity Engineering (Operational)\nThe Supplier shall provide:\n•\tL3 Engineering support for Sentinel.\n•\tAnalytics rule development and tuning.\n•\tSOAR playbook management.\n•\tConnector maintenance and health monitoring.\n•\tLogging optimisation.\n•\tOnboarding and validation of agreed log sources.\n•\tDetection engineering support.\n•\tDetection gap analysis and monitoring coverage reviews.\n•\tSecurity use case development and continuous improvement.\n•\tMonitoring health checks.\n•\tMonitoring and remediation of ingestion issues.\n•\tSecurity platform optimisation.\n•\tProactive automation support and development.\n•\tThreat intelligence-led detection improvements.\nData Loss Prevention (DLP) & Phishing\nThe Supplier shall:\n•\tMonitoring, triage and investigation of DLP, phishing, business email compromise (BEC), malicious email, malicious attachment and malicious URL alerts.\n•\tInvestigation of suspected data loss, data exfiltration and policy breach events.\n•\tSupport for user reported phishing submissions.\n•\tEscalation and coordination of confirmed incidents in accordance with agreed response procedures.\n•\tIdentification and analysis of phishing campaigns, attacker infrastructure, indicators of compromise and emerging attack trends.\n•\tRecommendations for improvements to DLP policies, email security controls, detections and response processes.\n•\tMonthly reporting, trend analysis and security improvement recommendations.\nReporting\nThe Supplier shall provide:\n•\tWeekly operational reports.\n•\tMonthly service reports.\n•\tQuarterly service reviews.\n•\tKPI and SLA reporting.\n•\tSecurity metrics and trend analysis.\nRequirement B\nEnhanced Security Operations Managed Service - Vulnerability Management Service\nThe Supplier shall provide Vulnerability Management services Monday to Friday, UK Core Hours (09:00-17:00).\nVulnerability Management\nThe Supplier shall:\n•\tMonitor vulnerability management queues.\n•\tInvestigate vulnerability notifications.\n•\tManage vulnerability triage.\n•\tValidate vulnerability findings.\n•\tPerform exploitability assessments.\n•\tProvide remediation recommendations.\n•\tSupport exposure management activities.\n•\tSupport CTEM activities.\nStakeholder Engagement\nThe Supplier shall:\n•\tConduct monthly technical review meetings.\n•\tSupport resolver teams.\n•\tAssist remediation planning.\n•\tReview remediation performance.\n•\tProvide vulnerability prioritisation guidance.\nDashboarding & Reporting\nThe Supplier shall:\n•\tMaintain executive dashboards.\n•\tEnhance Power BI reporting.\n•\tProduce technical reports.\n•\tProduce executive reports.\n•\tProduce PCI compliance reports.\n•\tProduce risk trending reports.\nTooling\nThe Supplier shall support:\n•\tMicrosoft Defender for Endpoint.\n•\tRapid7.\n•\tSLC PCI ASV Scanning tooling.\n•\tJira.\n•\tPower BI.\nRequirement C\nEnhanced Security Operations Managed Service - Breach Attack Simulation Service\nThe Supplier shall provide a Breach Attack Simulation (BAS) capability, currently using AttackIQ or similar.\nBAS Service\nThe Supplier shall:\n•\tOperate and maintain the BAS platform.\n•\tDeploy and maintain BAS agents.\n•\tConfigure integrations.\n•\tExecute scheduled simulations.\n•\tExecute customer-specific simulations.\n•\tExecute retests following remediation activities.\nAdversary Simulation\nTesting scenarios shall include:\n•\tInitial Access.\n•\tExecution.\n•\tPersistence.\n•\tPrivilege Escalation.\n•\tCredential Access.\n•\tLateral Movement.\n•\tCommand and Control.\n•\tExfiltration.\n•\tMalware.\n•\tRansomware.\n•\tAdvanced Persistent Threat activity.\nSecurity Validation\nThe Supplier shall assess:\n•\tSecurity control effectiveness.\n•\tSecurity monitoring effectiveness.\n•\tDetection coverage.\n•\tResponse capability.\n•\tIncident handling.\n•\tUse-case effectiveness.\nReporting\nThe Supplier shall produce:\n•\tMonthly BAS reports.\n•\tExecutive summaries.\n•\tTechnical findings.\n•\tRemediation recommendations.\n•\tRetest outcomes.\nRequirement D\nEnhanced Security Operations Managed Service - Cyber Threat Intelligence Service\nThe Supplier shall provide strategic, operational and tactical Cyber Threat Intelligence services.\nThreat Intelligence Managed Service\nThe Supplier shall provide:\n•\tThreat Intelligence reporting.\n•\tIntegration into Microsoft Sentinel.\n•\tIndicator of Compromise feeds.\n•\tThreat actor intelligence.\nOperational Intelligence\nThe Supplier shall provide:\n•\tThreat alerts.\n•\tVulnerability intelligence.\n•\tEmerging threat notifications.\n•\tCampaign tracking.\n•\tIndustry specific intelligence.\nStrategic Intelligence\nThe Supplier shall provide:\n•\tThreat landscape assessments.\n•\tQuarterly threat reports.\n•\tExecutive intelligence briefings.\n•\tBoard level threat summaries.\n•\tSector specific threat reporting.\nSecurity Operations Support\nThe Supplier shall provide:\n•\tIntelligence support during incidents.\n•\tThreat hunting support.\n•\tIntelligence driven use-case creation.\n•\tIntelligence enrichment services.\nRequirement E\nEnhanced Security Operations Managed Service - Digital Forensics & Incident Response Retainer Service\nThe Supplier shall provide a DFIR Retainer available 24x7x365.\nCyber Incident Response\nThe Supplier shall provide:\n•\tIncident investigation.\n•\tMalware analysis.\n•\tThreat containment.\n•\tThreat eradication.\n•\tRecovery support.\n•\tCrisis management support.\n•\tRegulator support.\n•\tOn-site support\nDigital Forensics\nThe Supplier shall provide:\n•\tEvidence acquisition.\n•\tChain of custody management.\n•\tEndpoint forensics.\n•\tServer forensics.\n•\tNetwork forensics.\n•\tCloud forensics.\n•\tForensic reporting.\nReadiness Services\nThe Supplier shall provide access to:\n•\tTabletop exercises.\n•\tIncident simulations.\n•\tExecutive workshops.\n•\tCSIRT training.\n•\tLessons learned reviews.\nRetained Consultancy\nThe Supplier shall provide specialist support including:\n•\tSecurity strategy input.\n•\tAudit support.\n•\tMajor incident reviews.\n•\tRegulatory engagement support.\n•\tRansomware negotiation services.\nRequirement F\nEnhanced Security Operations Managed Service - Security Architecture & Engineering Support Services\nThe Supplier shall provide specialist Security Architecture and Engineering services on a call-off basis.\nSecurity Architecture\nThe Supplier shall provide:\n•\tSecurity architecture reviews.\n•\tSecurity design authority support.\n•\tSecure by Design reviews.\n•\tSolution security reviews.\n•\tThreat modelling.\n•\tArchitecture governance.\n•\tSecurity requirements definition.\n•\tArchitectural risk assessments.\nSecurity Engineering\nThe Supplier shall provide:\n•\tTechnical security engineering.\n•\tSecurity tool implementation.\n•\tSecurity configuration reviews.\n•\tSecurity hardening activities.\n•\tTechnical control implementation.\nStrategy & Transformation\nThe Supplier shall provide:\n•\tSecurity roadmap development.\n•\tTarget operating model development.\n•\tControl framework assessments.\n•\tSecurity maturity reviews.\n•\tImprovement planning.\nGovernance & Assurance\nThe Supplier shall provide:\n•\tSecurity assessments.\n•\tRisk management support.\n•\tAudit support.\n•\tKPI development.\n•\tBoard reporting support.\n•\tSecurity governance support.\n•\tIndependent design and control assurance.\n•\tSecurity exception and risk acceptance reviews.\n•\tThird party and supplier security assessments." } ], "items": [ { "id": "1", "additionalClassifications": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": [ { "scheme": "CPV", "id": "72000000", "description": "IT services: consulting, software development, Internet and support" } ] } ], "deliveryAddresses": [ { "region": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "UK" } ], "country": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "GB" } ], "countryName": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "United Kingdom" } ] } ], "relatedLot": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "1" } ] } ], "mainProcurementCategory": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "services" } ], "aboveThreshold": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": false } ], "lots": [ { "id": "1", "suitability": { "sme": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": true } ] }, "contractPeriod": { "startDate": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "2028-04-14T00:00:00+01:00" } ], "endDate": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "2030-04-30T23:59:59+01:00" } ], "maxExtentDate": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "2031-04-30T23:59:59+01:00" } ] }, "hasRenewal": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": true } ], "status": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "planning" } ] } ], "communication": { "futureNoticeDate": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "2027-05-07T23:59:59+01:00" } ] }, "status": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "planning" } ] }, "language": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": "en" } ], "extensions": [ { "releaseID": "085261-2026", "releaseDate": "2026-09-09T10:45:20+01:00", "releaseTag": [ "planning" ], "value": [ "https://standard.open-contracting.org/profiles/eu/latest/en/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_amendment_rationale_classifications_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_budget_breakdown_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_contract_completion_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_documentation_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_pagination_extension/master/extension.json", "https://raw.githubusercontent.com/open-contracting-extensions/ocds_suitability_extension/master/extension.json", "https://raw.githubusercontent.com/portaledcahn/ocds_Links_extension/main/extension.json", "https://raw.githubusercontent.com/cabinetoffice/ocds_uk_extension/main/extension.json" ] } ] } } ] }