Provision of Cyber Security Services

South Western Railway has awarded a Framework Services Agreement to Kroll for the provision of integrated cyber security monitoring, detection and response services. SWRL currently receives a number of cyber security services from Kroll, the current position is that prior to SWR's transition to public ownership, cyber security services were provided under FirstGroup's Master Services Agreement (MSA), with individual services operating as call-off arrangements beneath that overarching contractual structure.

As SWR is now a separate legal entity operating independently of FirstGroup, the inherited arrangements must be replaced with SWR-owned contractual mechanisms as the existing agreements expire. This creates the need to establish a compliant contractual structure whilst maintaining continuity of critical cyber security services. The current cyber security solution comprises four interdependent service components: • SOC/SIEM Service • Network Detection and Response (NDR) • CrowdStrike Endpoint Protection • Cyber Risk Retainer Services