Common Digital Platform Services and Hosting

Tender description

Summary of the work Post Office Limited (POL) has a Common Digital Platform (CDP) that is used to provide online web presence to customers and to enable third party integration services. POL are seeking a technology partner to undertake service hosting, application development and application management services for CDP. Expected Contract Length 2 years with the option to extend by 6 months Latest start date Tuesday 16 January 2018 Why the Work is Being Done The contract with the existing supplier expires in January 2018 and POL intends to procure a replacement contract. Problem to Be Solved POL is seeking a partner to provide hosting, application management and application development services for CDP. POL is intending to enhance CDP and requires continuous improvement of the platform capabilities through partner innovation and leverage of digital technology assets, techniques, tools and thought leadership. Manage the current capabilities and operate CDP efficiently, provide secure hosting, effective service management for the applications and focused Agile change delivery for the development of applications. Further information on the problem to be solved is found in the linked document - https://docs.google.com/document/d/1dMw8MnhIHwU-o4zEBcUC6x1abhHrJe7KG8eod2GDrOU/edit?usp=sharing Who Are the Users POL digital team needs to publish new online content; POL product management need to develop new products for branch and online; POL information and security management need to be assured that the platform is secure, data is managed safely, securely and properly protected in accordance with all applicable regulations.; POL service management need to be assured that the digital platform is being effectively hosted; and POL customers need a performant, robust and reliable web presence including mobile. Further information on the users and what they need is found in the linked document - https://docs.google.com/document/d/1dMw8MnhIHwU-o4zEBcUC6x1abhHrJe7KG8eod2GDrOU/edit?usp=sharing Early Market Engagement Preliminary market testing has been conducted. Work Already Done CDP is live and there are multiple ongoing developments taking place on the platform. Existing Team The existing supplier of CDP, who will support the transition process and knowledge transfer as part of its contract exit obligations. POL operates a SIAM model and CDP operates within this IT supply chain and operational framework. Current Phase Live Skills & Experience • The supplier will have extensive experience in managing a live web site for tens of thousands of unique visitors per hour • Maturity and experience in managing and utilising public or private cloud infrastructure to host a complex digital platform with multiple end points • Experience of developing for and deploying a microservice-based or cloud native digital platform and of managing large scale use • Experience in using SAFe or similar accelerated delivery methodologies • Demonstrate evidence of delivery of continuous innovation and growth in a cost effective environment using latest and upcoming technologies • Extensive experience of developing and building security by design into complex digital platforms hosted on cloud services • Demonstrate experience in rapid application delivery with minimal hand coding using web and mobile low code visual drag-and-drop development toolsets • POL will be assessing suppliers on demonstrable experience in other organisations of transitioning comparable complex digital platforms in short timescales including a defined methodology to knowledge transfer and uninterrupted transition • Extensive experience in DevSecOps development, release and operations • Experienced in providing a service management framework in accordance with ITILv3 or equivalent; Evidence that the services being offered are covered by ISO27001 or have the equivalent controls in place • The supplier is GDPR compliant or has credible plans in place to be compliant by 25 May 2018 or earlier • Experience of evolving a service to reduce run costs and make use of services provided by others (e.g. managed services provided by hosting providers) • Experience of designing, provisioning and managing utility cloud infrastructures to enable always-on never-down platforms • Demonstrable knowledge and experience of managing technologies indicated in the linked document - https://docs.google.com/document/d/1dMw8MnhIHwU-o4zEBcUC6x1abhHrJe7KG8eod2GDrOU/edit?usp=sharing • Experienced in working with 3rd party multi-supplier teams and support structures in support of a wider enterprise system or system of systems to enable product delivery and services to customers • Demonstrate experience of running similar complex digital platforms for other organisations, including Big Data and Predictive Analytics capabilities through machine learning and other techniques Work Location Principal POL locations including Finsbury Dials London, Future Walk Chesterfield, the incumbent supplier’s UK premises and partner’s premises. Working Arrangments A flexible on-site presence in London is essential to enable close working and co-creation. Some travel will be necessary to other POL locations. Project methodologies such as Agile will require close client proximity working. Security Clearance All resources must be Baseline Personnel Security Standard compliant or equivalent, some of which should be prepared to undergo the clearance process to at least Security Check level. Additional T&Cs Shortlisted bidders may be provided with additional terms and conditions. Any expenses shall be submitted in line with POL’s travel and subsistence policies. Suppliers shall provide transparency to POL on the rates paid to resources and any third parties in the supply chain. POL reserves the right to review and change the payment criteria. No. of Suppliers to Evaluate 6 Proposal Criteria • Response to Functional and Technical, Application Development, and Application Management and Support requirements (40%) • Response to approach to Service Transition and Project Management, and Service Management and fit to the required service model (35%) • Response to Continual Service Improvement requirements (10%) • Response to Information Security, Compliance and Data Protection requirements (10%) • Response to Administration and Financial Management requirements (5%) Cultural Fit Criteria • Evidence of working in a complex IT ecosystem and matching values and behaviours to those of the client. • Transparent and well-established decision making processes. • Evidence of principal relevant contracts in the last three years having been satisfactorily performed in accordance with their terms. Payment Approach Fixed price Evaluation Weighting Technical competence 50% Cultural fit 15% Price 35% Questions from Suppliers 1. How is CDP currently being hosted and with what provider? UK Cloud is the hosting provider under subcontract to the incumbent supplier, Accenture. 2. Will the current supplier definitely be exiting (as indicated under 'Existing team') and not be renewed? CDP Procurement is a competitive selection process. The contract will be awarded to the supplier who demonstrates the best overall match to the contract evaluation criteria. 3. Are you able to provide any guidance on your budget range for the services? Indication of a budget range is not considered desirable as it is felt that this would unduly constrain supplier’s eventual responses. 4. Some of the questions - such as "The supplier is GDPR compliant or has credible plans in place to be compliant by 25 May 2018 or earlier" do not lend themselves to the recommended response structure: - What the situation was - The work the team did - What the results were. Is it acceptable to deviate from this structure for such questions? Yes, provided the response is comprehensive. 5. What capability has Post Office in place today that provides a Common Digital Platform Service? Your attention is drawn to our published notice and evaluation criteria as that provides useful information about the platform elements and capabilities that Post Office has deployed. 6. 6. Is it Post Office’s intent for the selected supplier to assume responsibility for the existing Common Digital Platform capability, retain it and develop it as the basis for the future Post Office CDP capability, or has the selected supplier, after taking on the existing service and in collaboration with Post Office, the opportunity to transition to a new CDP service ? As stated in the posting, POL is looking for a supplier partner to firstly transition the existing CDP and to also drive innovation. 7. Is the technology requirement based on 100% functionality to support their e and m commerce platform and Dev Ops scope of work? As stated in the posting, the CDP currently provides POL’s digital platform, but enhancement and innovation is expected, and some functionality may be developed by 3rd parties. 8. Are we able to see sight of any high level reference architecture at this stage (CMO) aligned to their target operating model (TOM) requirements? The high level architecture will be provided to shortlisted bidders. 9. Do Post Office foresee a move to 100% digital platform (cloud based) for all their apps development and hosting? We are aware of technology trends and are looking for suppliers to offer solutions that optimally balance change with risk, efficiency and cost. 10. Is the required technology architecture already in place as the CMO or do they what this building out as extension to or through developing a new platform (recognizing exiting e and m commerce and move to a cloud platform environment)? The architecture is already in place, but POL is looking for a partner that can drive innovation and enhance the platform. 11. Are they including all elements of security into their scope of work? All elements relating to hosting, supporting, operational security and development of a digital platform is in scope, The vendor must also be mindful of wider enterprise systems, taking into considering methods of secure communication between services. 12. What budget has Post Office set aside for this opportunity ? Indication of a budget range is not considered desirable as it is felt that this would unduly constrain supplier’s eventual responses. 13. With respect to data security and baseline personnel security clearance and reference to 'working arrangement' section, is it right to assume that the entire scope of application management and application development of CDP would need to be delivered from UK or an offshore delivery centre will be an option? ODC delivery will be an option provided appropriate controls are demonstrable. 14. With respect to hosting the digital platform what are the data centre requirements e.g. security, openness to Cloud (private or public) and location? We are prepared to consider a full range of solution proposals involving public and private cloud solution propositions provided these meet the security criteria that we will supply to shortlisted bidders in the detailed specification. 15. Do post office own any technology licenses that would need ownership transfer as part of this programme? Post Office preference is to own our own technology licences, however, there may be some licence ownership transfers required. 16. Is the content management in scope? The content management system (Magnolia) is in scope - Post Office resources are responsible for content origination and updating. 17. Could you please share any upper maximum spend budget defined for annual management of CDP and in scope services? Indication of a budget range is not considered desirable as it is felt that this would unduly constrain supplier’s eventual responses. 18. What data protection guidelines and levels are followed for services in scope? POL is subject to UK data protection legislation; our expectation is that the successful supplier partner will be compliant with all data protection directives and guidelines 19. Is the current hosting of CDP an on premise or cloud hosting? If current hosting is on premise, could you please share any ownership on facility and hardware? CDP is cloud hosted at UK Cloud. 20. Is the security management currently with POL or any third party vendor? CDP DDOS is a managed service and full details will be provided to qualified shortlisted bidders. Responsibility for security of the core CDP will be a core competence of the successful supplier partner and will require alignment with Post Office security policies and standards. 21. Is there any command centre set up that is currently in place to monitor infrastructure and CDP? If so, who owns it and where is the location? Yes. It is based at current supplier premises. 22. What data protection guidelines and levels are followed for services in scope? POL is subject to UK data protection legislation; our expectation is that the successful supplier partner will be compliant with all data protection directives and guidelines 23. Is there any people transfer requirement as part of service transition? All legal obligations relating to service transition will need to be fulfilled and completed in conjunction with the incumbent supplier.