1. Summary of Requirements
L&Q intends to procure a hybrid Out‑of‑Hours Security Operations Centre service to operate as an extension of the internal L&Q SOC. The service will provide protective monitoring, triage, and incident response outside of core operating hours.
The OOH SOC partner will be responsible for:
Continuous monitoring, triage, and incident escalation during defined out‑of‑hours periods.
Supporting L&Q's internal SOC with investigations, analysis, and agreed incident response actions.
Operating in alignment with L&Q playbooks, processes, and security tooling (including Microsoft Sentinel, Microsoft Defender XDR, and others).
Providing structured shift handovers, monthly reporting, and ongoing collaboration with L&Q SOC staff.
This work is critical for maintaining security oversight during nights, weekends, and bank holidays, reducing the risk of compromise during periods where internal analysts are unavailable.
2. High‑Level Scope of Services
The procurement will cover the following high‑level areas extracted from the previous specification:
Service Operating Hours
Mon-Fri: 17:0-09:0
Weekends & Bank Holidays: 24/7 coverage
Service Performance Expectations
Availability: 99.5% across operating hours
Incident Acknowledgement & Escalation Times:
High: 15 minutes to start incident triage, 75 minutes or end of shift to escalate
Medium: 2 hours to start incident triage, 4 hours or end of shift to escalate
Low: 5 hours to start incident triage, 8 hours or end of shift to escalate
Key Functions
Triage of all alarms generated within Microsoft Sentinel/Microsoft Defender XDR.
Use of L&Q-provided tooling (Sentinel, Defender family, Azure, email analysis tools).
Remote host investigations as required.
Triage of reported suspicious/malicious emails.
Blocking of malicious IPs on host and/or network (as per playbook direction).
Ad‑hoc investigatory support to defined timescales.
Incident Response support for security incidents that are detected or reported through channels outside of the SIEM.
Detection engineering support in collaboration with the L&Q Group SOC, enhancing existing detections and developing new analytics and rule logic as needed
Reporting & Governance
Monthly service performance reporting.
Written handovers at shift boundaries.
Quarterly account management meetings.
Documented change‑control processes aligned with L&Q practice.
Security & Compliance Requirements
Supplier must be headquartered in the UK or EU, or otherwise demonstrate GDPR‑compliant operating arrangements.
Analysts must be proficient in Microsoft Sentinel, KQL, Defender product suite.
Proven experience delivering SOC services for organisations of similar scale (4,000-5,000 staff).
L&Q require a contractor who is a member of the Lift and Escalators Industry Association to carry out servicing, repairs and maintenance of domestic mobility lifts and lift equipment in the North West and South West region which has estimated 223 assets. The estimated value is £46,751 per annum
Provision of financial inclusion services to social housing residents, addressing significant financial issues (debt, welfare benefits and energy advice) that may result in the risk of eviction. This will be a two pronged approach which will focus on low level debt advice and guidance that will be provided by the procured partner (directly or through a supply chain), and higher level vulnerability support that will be managed in-house. Triaging of customers for both will be done by the external partner. We would be looking at around 7000 referrals per year to be triaged and helped through this service.
The Contractor must provide:
• Planned Preventative Maintenance (PPM):
Full annual servicing of all NIBE and Heat Pump systems according to manufacturer specifications and industry best practices.
• Reactive Maintenance:
Emergency and non-emergency repairs, faults diagnosis, and first-time fix focus, within defined SLAs.
• Parts and Materials Management:
Supply and fit genuine or approved replacement parts with warranty.
• Asset Management and Reporting:
Maintain an up-to-date asset register including maintenance history, service outcomes, and lifecycle condition grading.
• Resident Engagement:
High standard of resident communication and support, including pre-appointment notifications and satisfaction follow-ups.
Communal and Car Park Ventilation - Service and Maintenance
Planned Preventative Maintenance (PPM):
Annual inspections and servicing of all communal and car park ventilation systems.
Testing airflow rates, duct pressure, CO/NO2 sensor calibration (car parks), control panel integrity, and motor/fan functionality.
Inspection and cleaning of grills, extract points, filters, and ducts.
Reactive Maintenance:
Fault diagnosis and resolution.
Emergency and non-emergency repairs (e.g. motor failures, fan belt replacements, control system resets).
Asset Management:
Maintain and update an asset register including serial numbers, component condition, and service dates.
Provide an annual report on asset health and lifecycle planning.
Resident and Site Communication:
Provide advance notice for planned servicing.
Maintain minimal disruption to residents and site users (e.g., noise management in car parks).
Requirement for likely 2-4 appropriately certified Contractors to undertake both reactive remedial works; regular service and maintenance visits and Compliance inspections to Lightning Protection Systems and Equipment. Systems are required to be serviced and maintained at a minimum of twice per annum.
Service and Maintenance and reactive works will be expected to be delivered within appropriate SLA's and performance to be monitored through appropriate KPI's.
Lot allocations and breakdowns currently being considered. (Area and/or workstream considerations)
NW area to be included.
Contractors will be responsible for ensuring both L&Q and statutory compliance requirements are maintained.
Requirement for likely 2-3 appropriately Certified Contractors to undertake both reactive remedial works; regular service and maintenance visits and Compliance inspections to Water Pump Systems including Cold Water Storage Pumps, Sewage Pumps, Ground Water Pumps and Surface Water Pumps. Systems are required to be serviced and maintained at a minimum of twice per annum.
Service and Maintenance and reactive works will be expected to be delivered within appropriate SLA's and performance to be monitored through appropriate KPI's.
Lot allocations and breakdowns currently being considered. (Area and/or workstream considerations)
NW area to be included.
Contractors will be responsible for ensuring both L&Q and statutory compliance requirements are maintained.
Requirement for likely 2 appropriately Certified Contractors to undertake Certified Fire Door Replacements (Predominantly Front Entrance Doors) on a reactive basis, with the requirement generally due to emergency services forced access or vandalism.
Reactive works will be expected to be delivered within appropriate SLA's and performance to be monitored through appropriate KPI's.
Lot allocations and breakdowns currently being considered. (Area considerations)
NW area to be included.