Cyber Security

Tender description

Summary of the work This opportunity explores Cyber Security & Information Assurance for MAS as a service/output • Conduct regular external security tests ensuring our security measures are effective. • Providing expert advice to the organisation, ensuring compliance to ISO27001 • Co-ordinating information security activities (including training) • Investigating suspected and actual breaches Expected Contract Length 2 years Latest start date Sunday 1 October 2017 Budget Range This opportunity is being published to help us understand options and likely costs. To give an indication, we have employed a Cyber Security consultant as an interim in an expert management level role Why the Work is Being Done The key purpose of this role is to manage the security and compliance of all of the IT assets and data held within the Service, and hosted by 3rd party suppliers. Ensure that best practices for IT security and data management is documented, designed and implemented, and that the Services compliance is alignment with the ISO27001 framework. Should we proceed, we would look to start working with the supplier in September/October Problem to Be Solved A service is required to manage the ongoing cyber security concerns Who Are the Users As an Information Security service or consultant, you will ensure all IS investments deliver appropriate security solutions to protect the business now and in the future. You will act as a key player/partner to define IS strategy and lead the vision for the future of security. Providing regular reports on the performance of the IT infrastructure and report on exceptions or breaches of policies and procedures. This is a role, which include hands on activities to deliver and support the IT Strategy. The head of Information Security should hold the following qualifications; CISSP, CISM, CISO, Cyber Security. Early Market Engagement This opportunity is our market testing; currently the service is filled by an interim Work Already Done There is currently an interim filling this role. We are exploring to what extent a service could meet our needs Existing Team Currently an interim who is expected to leave in Autumn Current Phase Live Skills & Experience • Demonstrate previous competence in this field • Provide case studies of previous work • Be qualified in the field, holding the following qualifications; CISSP, CISM, CISO, Cyber Security. Work Location MAS is based in Holborn. The supplier can be based wherever is appropriate, with meetings at the client site to be expected Working Arrangments Flexible; the focus is on delivery of an output. There will be close contact with all business heads, IT and members of the Executive Leadership team As this is a service, based on outputs, we wouldn't expect to pay expenses Security Clearance Not required No. of Suppliers to Evaluate 6 Proposal Criteria • Technical Solution • Approach and methodology • Implementation and handover process Cultural Fit Criteria Demonstrate the approach to understanding the organisation and how they would build relationships Payment Approach Fixed price Evaluation Weighting Technical competence 60% Cultural fit 10% Price 30% Questions from Suppliers 1. Since it's a fixed price. How many consultants are required to fill the position. I suppose one? As we are requesting a fixed price you can construct your pricing/headcount however you feel appropriate. It is a service/outcome that we looking for 2. Can we schedule a conference call this week please? We will look to host a call this week and will update all bidders via the portal 3. How regularly would you expect external security tests to be run? How many days per month would you expect expert advice to be available? How regular would the co-ordination of information security activities be? How regularly would you expect external security tests to be run? I would expect there to be around 20 tests per year which will include application and network testing.How many days per month would you expect expert advice to be available? We would expect expert advice available very working day and support out of hours to cover incidents.How regular would the co-ordination of information security activities be? This is a daily activity. 4. You have asked for the following essential qualifications; CISSP, CISM, CISO, Cyber Security. Are you looking for an individual with both CISSP and CISM or one? CISO and Cyber Security are roles and generic titles not qualifications, please clarify what you require in terms or qualifications Thank you for raising. We are looking for an individual with both CISSP and CISM