IT services: consulting, software development, Internet and support

Tender description

This Notice replaces OJEU Reference: 2016/089/156412. The National Procurement Service (NPS) has awarded a Framework Agreement (Agreement) for the supply of Information Assurance Services. The NPS will deliver ‘All-Wales’ agreements for NPS Members and the Welsh public sector. The list of NPS Members can be found at: http://npswales.gov.uk. This list may be subject to change as members signup to use the NPS, or member orgs are replaced during the life of the agreement. A full list of Organisations that can utilise this Framework is detailed in Section VI.3. The Supplier must have capability to assess a range of Customers systems and services including; Network Penetration Test, Network Vulnerability Assessment, Web Application Security Assessment, Mobile Device Security Assessment, Wireless Security Assessment, Remote Working Assessment. The Supplier must be identified by CESG as an Accredited Supplier of CHECK services. Further details can be found in the tender documentation. The Supplier must have capability to assess a range of Customers systems and services including: Network Penetration Test, Network Vulnerability Assessment, Web Application Security Assessment, Mobile Device Security Assessment, Wireless Security Assessment, Remote Working Assessment. The Supplier must be identified as an Approved and Certified CREST/Cyber Scheme/TIGER Supplier. Further details can be found in the tender documentation. The objective of this Lot is to provide Customers with access to CESG Certified professional Scheme Information Assurance (IA) professionals to provide guidance that is consistent with the latest CESG protocols. The criticality of the security advice is dependent on the expertise and knowledge of the Supplier's staff is such that; — the company and nominated individuals must be listed by a CESG accreditation body. — at least one member of the Company's staff must demonstrate that they meet the criteria to be assessed as a Senior/Lead Practitioner in the required discipline. — all other non-assessed members of the team will be required to be associate CESG members. The Supplier must have capability to validate adherence to Data Security Standards by performing vulnerability scans of the external facing environments of customers' networks. The Supplier must be identified as an Approved Scanning Vendor (ASV) by the Payment Card Industry Security Standards Council. The test team must have sufficient experience to undertake the Service and comprise the necessary mix of expertise for the component technologies of the Customer systems. The objective of the Qualified Security Assessor (QSA) LOT is to provide Customer with access to Payment Card Industry Security Standards Council accredited professionals to provide guidance and validate an organisation's adherence to the Payment Card Industry Data Security Standards (PCI DSS). Security Assessors must have current certification issued by PCI Security Standards Council and be employees of a Qualified Security Assessor (QSA) company qualified by PCI Security Standards Council. The objective of the LOT is to provide Customers with access to Cyber Essential certifiers to provide guidance and validate an organisation's adherence to Cyber Essentials and Cyber Essentials Plus requirements. Assessors must have current certification issued by a CESG approved Accreditation Body.