Security Operations Centre (SOC)

The Financial Ombudsman Service intends to place a contract for the provision of a managed Security Operations Centre (SOC) service to provide the following:

1) Provision of a modern and fit-for-purpose SOC capability operating 24 hours a day, 7 days a week, 365 days a year (working in concert with the Financial Ombudsman Service's cyber security team);

2) Undertake standard security operations functions including:

a. Performing triage of security incidents, core security incident response, and escalation activities (we refer to these as level 1 and 2 activities);

b. Tuning/configuration of the Security Information & Event Management (SIEM) solution and associated Security Orchestration, Automation & Response (SOAR) capabilities;

c. Responding to threat intelligence and performing proactive threat hunting;

d. Management, investigation, and resolution of critical/major security incidents including digital forensics as required; and

e. Conducting process improvement activities to improve the effectiveness of the SOC.

3) Provision of cyber security resources on demand to augment the Financial Ombudsman Service's team on an ad-hoc basis. These resources maybe involved in project or business as usual activities.