Criminal Justice System Common Platform Programme (CJSCPP) - IdAM Product Enhancement Team

Tender description

Summary of the work IdAM (new development initially existing backlog) combined with 2nd and 3rd line production support. Current significant items include: • Implement public access solution for IdAM • Migrate existing product from SAML to OAuth • Add a second 2FA technology (if required) • Further on access for internal and external users Expected Contract Length Two years Latest start date 01/04/2017 Budget Range N/A Why the Work is Being Done CJSCPP is a business transformation to enable the CJS, and agencies be more efficient and deliver a better service. Criminal case information will be kept together in one place, and parties will be able to access and update the same data set based on their security profile and associated access rights. IdAM will complete primary development at the end of Q1 2017 and then transition into Product enhancement mode with continuing development at a slower pace combined with 2nd and 3rd line Production Support. Delivery will include both a known backlog and evolving requirements. Problem to Be Solved The CJSCP IdAM system acts as user authentication and service access control to the various CJSCP services and may be extended to support other MoJ services. It includes organisation and user management and supports various authentication levels (e.g. 1FA and 2FA) appropriate to the sensitivity of the systems it protects. It will be necessary to continue enhancements to support developments in the CJSCP, as well as the wider HMCTS Reform Programme, including for work in other jurisdictions and for citizen facing access. Who Are the Users Example needs are: As an HMCTS user administrator I need to manage the users in my organisation so that only the correct people can access the Platform and its services. As a CPS user I need to reset my password in order to keep working. As a CJSCP administrator I need to add a defence organisation to the system and assign an administrator in order that users in that organisation can access CJSCP. There may be future extensions of the service to other user groups, including citizens. Early Market Engagement N/A Work Already Done The primary development and deployment of IdAM is complete. IdAM currently supports user authentication (with and without 2FA). It supports self-service where possible and it supports organisations with a hierarchy allowing each organisation to manage and support its own users. Existing Team The supplier will be working with CJSCP Operational Services and with CJSCP Delivery teams. These are comprised of a mixture of civil servants and multiple suppliers. Current Phase Live Skills & Experience • Have experience of working in multi-discipline environments focused on meeting user needs using agile methodologies and delivering digital improvement outcomes=6% • Have experience of successfully delivering high transaction digital services to national organisations working in complex and highly regulated environments=6% • Experience of agile testing strategies and automation=3% • Experience of working in a security testing and delivery cycle=6% • Have experience of working with multiple cloud vendor technologies and tools (e.g Azure and UKCloud)=3% • Experience of deliverying usable IdAM solutions and integrating them in live services, by maximising use of the products and minimising custom developement=3% • ForgeRock partner with evidence of design and delivery of complex IDAM solutions based on OTS products such as Glue and Janrain=2% Nice to Haves • ForgeRock delivery experience=1% • Have experience of working on three or more digital by default government services with high transaction volumes (100k p/a) and meeting digital by default service standard criteria=1% • Be able to hit the ground running and deploy an effective multi-discipline team able to fulfil the required outcomes no later than 1st April 2017=2% • Development with – front-end coding (HTML5, CSS 3, Angular 2, Javascript) and back-end coding (SQL, Java 8, DropWizard, JMS) =2% • Have expertise operating DevOps and continuous delivery principles, in live national scale operations. Reference practices that enable safe, sustainable releases into live production, mitigating risk to existing operations=2% • Experience in delivering as part of a live operational service=1% • Experience of delivery using configuration management, orchestration and monitoring tooling (Ansible, Zabbix, ELK stack)=1% • Experience of adopting agile approaches in delivering a number of IdAM solutions in large complex environments – demonstrating best practices and approach=1% Work Location Central London location; initially Rose Court, 2 Southwark Bridge Road London SE1 9HS (the 'Base location', although some UK Travel may be expected) Working Arrangments The suppliers team will be required to work onsite at the base location working a five (5) day week. The Service is being delivered against the GDS Service Manual (e.g. agile delivery aligned to scrum methodology). For any work performed at a location different to that of the Base location and London (outside of the M25), all reasonable travel and expenses costs shall be met in accordance with the rates set out in the MoJ travel and subsistence policy. All expenses will require prior approval before being reimbursed. Security Clearance Disclosure Scotland. See www.disclosurescotland.co.uk/basicdisclosureonline/index.htm Additional T&Cs Any expenses shall be submitted in line with the Ministry of Justice standard Travel and Subsistence policy and agreed in advance of expenditure. No. of Suppliers to Evaluate 5 Proposal Criteria • Overall Technical Solution and Approach - High Level Delivery Plan, Approach and Method, Timescales, Risks and Dependencies and Quality=6% • Proposed team structure (including CVs of key members) - Reference contract/ case studies examples including linked CV’s=8% • Value for Money - how the proposal will optimise costs and generate savings=6% Cultural Fit Criteria • Proposed approach for working with co-located, multi-vendor HMCTS/CPS team - demonstration of transparency and collaboration, inclding ability to engage and work with users at all levels=5% • Have a no-blame culture and encourage people to learn from their mistakes=5% Payment Approach Time and materials Evaluation Weighting Technical competence 60% Cultural fit 10% Price 30% Questions from Suppliers 1. Bidder Q&A Session Please note a teleconference will take place on Monday 06/02/2017 at 14:00 - 15:00. Dial in details to follow. It will be helpful if bidders can ask the questions they've already submitted. 2. Q&A Session Teleconference Dial in details Dial in details as follows: 0800 917 1956 (mobile 0208 839 3652) participant PIN 58214721# 3. Q&A Session Follow Up Answers to all questions to be published asap. Please Email me (david.baxter@justice.gsi.gov.uk) if you want a copy of the information pack. 4. What is the sizing of this opportunity and what is the likely volume of calls on 2nd and third line support? We’re expecting very few calls to 3rd line support. 1st and 2nd line support are already in place and the PET team is primarily 3rd line support. 5. Do the 2nd and 3rd line support teams run 24/7? No, they run office hours (08:00 – 18:00), however, as more users come on board, there’s possibly scope to grow to 24hrs. 6. Is there a form of Ticket management in place, or does it need to be provided by supplier? A ticket management system is in place, we run ServiceNow and that will be used. Team also use Jira for backlog planning for on-going development. ServiceNow tickets can be transferred to Jira, if they’re a lengthy piece of work. 7. Is there any chance further details could be provided around IdAM integration? For the foreseeable future, only services within the Common Platform and Reform programmes will need to integrate with IdAM. There is a documented integration pattern that can be used when engaging with these services. 8. Is change management in scope? The PET team will be expected to deliver enhancements as well as new functionality. 9. What are the backlogs, will further information be released? The majority of the immediate backlog that will be left at the end of March will include some functional changes, e.g., the mechanism to change e-mail address/username (which can’t be done at the moment) so there will be some small changes in the backlog. But primarily the immediate backlog is made up of technical debt and minor known issues. There is a set of identified longer term enhancements of various sizes; covering functionality, user experience, technical integration, and security workflows. 10. What is the expected user base, internally and externally? The user base is any organisation involved in the Criminal Justice System, though at the moment there are only internal users within HMCTS and CPS. This will increase overtime and may include any organisations and users involved in the Criminal Justice process, as well as any citizen using the Courts and Tribunals Service. 11. Have ForgeRock done a suitability review ahead of handing over to PET? ForgeRock are currently conducting a review, a response is expected soon. 12. Will the risk appetite be known before the bidding exercise? Yes 13. Could you elaborate on the technical criteria? It is as per the criteria already released, which includes the technical criteria. 14. On what basis of subject matter experts (SME) - has budget been planned? How many SMEs will this require? We do have a budget, though we’re not going to reveal the budget, we will give an indication of the type of roles we will anticipate within the team, and rate ranges of each respective role. The team size could vary over time. 15. How long will the PET team be in place? Two years as per the maximum period available under the DOS framework. It’s an on-going need. 16. If one hasn’t done a DOS tender before, but is able to demonstrate meeting the criteria, will we still be considered for this competition? Suppliers are initially required to provide Yes/No responses to criteria published in requirement and responses that meet the most ‘Nice to Have’ Criteria will be shortlisted. If more suppliers shortlisted than the published number of 5 then the shortlisted suppliers will be required to provided supporting evidence which will be evaluated to arrive at final shortlist of not more than the published number. 17. One of the questions, “have you worked with three high profile government”…Can we still progress without this? This is a 'Nice to Have' criteria so as stated in previous answer it could be a material factor. 18. Is the current team supporting the platform in house or made up of suppliers? Supplier provided staff. 19. Are you planning for a transition between suppliers? Yes, we’re hoping to have a transitional period. 20. Who is the current supplier? The current suppliers are Kainos and Verizon. 21. What are your thoughts on the number of SMEs needed? We’d rather have an expert view, i.e. from suppliers, on how many SMEs are needed. We will indicate the pivotal roles, but not indicate actual numbers. We will provide the range of day rates for each of these roles. 22. Do you think roles will be in place for a minimum of 2 years? IdAM will be around for more than 2 years, so yes. 23. With regards to pricing? The initial assessment is the non-pricing. Final shortlisted suppliers will be required to provide pricing which is 30% of the evaluation criteria. 24. Can you comment on how the two IdAM opportunities are linked? The IdAM Citizen Discovery will generate work to enter the backlog, which will be carried out by the PET team. 25. What architectural governance processes exist, and how will these be applied to this team? Architectural technology governance within the Common Platform Programme and processes within Digital Change Directorate/CFT. Any architectural changes to IdAM will be expected to go through existing governance processes/layers. 26. Will the team be required to support security and risk reviews, and what risk management processes are already in place that needs to be followed? The team will be involved with security and risk reviews. Current risk management is a standard project oriented process. 27. What risk management processes are in place that needs to be followed? There is a Programme Risk register, Jira/Confluence is used to manage risks, and these are pre-populated within Jira/Confluence. 28. Can resources be split between on-site/off-shore? The preference is to have an on-site team; this is due to complexities with security/access/controls. 29. Can you provide further details of the technical roadmap and backlog, articulating which additional IdAM features will need to be provided during the contract period? The backlog contains a mix of minor and major enhancements covering user experience, technical integration and security workflows. 30. Are HMCTS using licensed commercial open source ForgeRock software, against which we can call upon ForgeRock for L4 support as appropriate? Yes, a contract currently exists with ForgeRock, of which support is part of this. 31. How will work packages be identified and costed, and what flexibility in terms of resource numbers is required e.g. time considered acceptable for new resources to be brought into the team to meet any growing demand? There will be an ongoing process of backlog prioritisation managed by the IdAM Service Manager who is the primary stakeholder interface for the team. 32. What reporting requirements exist for the service? Is IdAM benefits measurement and realisation considered part of the service? There is no benefits realisation on IdAM currently, however, this may be a future requirement based on the work in the backlog. However, it is not envisaged that this will be the suppliers responsibility to do, but they may assist with. 33. Are there specific compliance requirements that need to be considered (both internal and external standards and policy and compliance)? No legal framework, though compliance with programme security requirements. 34. Are there any custom applications that need to be integrated? Who will do the application changes required? The policy around the IdAM service is that new apps must fit its approach; IdAM will not be customised to meet external software/services. 35. Is it possible that evidence will not be required during the DOS process? Evidence will be required if more suppliers are shortlisted than the published figure of 5. 36. If evidence is sought, what format do I need to submit it in, what’s the word count, etc.? An Experience Evidence template will be issued. Maximum 150 words per criteria. 37. What about the proposal criteria, how will technical proposal be evaluated? The DOS process will be followed. Written proposals will be required from shortlisted suppliers which will be evaluated against the published criteria. 38. What will be the involvement/roles of the relevant HMCTS & CPS staff? Can you describe the team and stakeholders aligned to this service? The BPO/Service manager will be from the business, they will be responsible for prioritising the backlog. 39. Could the current IdAM toolset and architecture used to support the CJS be provided? Available on request. 40. Are you planning any upgrades of the technology within the contract term (e.g. new version of ForgeRock), and would a specific number? Technical dependencies (e.g. versions of ForgeRock products) will need to be updated as required.