CyberArk Implementation Partner

Tender description

Why the Work is Being Done A recent risk assessment of the Home Office’s top systems highlighted the need to implement a privileged access management solution, in order to: • Strengthen the security posture of the Home Office by protecting from cyber attacks relating to privileged accounts. • Establish an effective privileged account management capability. • Implement the principle of least privilege by ensuring that privileged access is only used when required and is revoked when not required. • Limit and control the access of privileged accounts or administrative credentials. • Implement a full audit trail for all privileged account activities. Problem to Be Solved The Home Office has previously completed a proof of concept, product selection and procurement of CyberArk’s Privileged Account Security Solution. An implementation partner is now required to complete a full implementation of a defined set of modules of the CyberArk product-suite in the Home Office data centre and public cloud environments using the existing licence base. This work will be delivered under multiple stages. The implementation partner will then be required to work with relevant Home Office stakeholders to transition the new capability into live service and fully on-board the first team designated to receive the new capability (~10 users). Who Are the Users As Cyber Risk Owner, I want to ensure that effective controls are in place over the access and usage of privileged accounts and credentials so that I can reduce the level of cyber risk to the organisation As a Network Infrastructure engineer, I want to elevate my privileges on the network devices that I manage remotely from my endpoint so that I can access the administrative functionality to configure them As System Administrator, I want to limit restrict privileged users to perform only specific commands or functions so that users can only perform actions that they are authorised to do Early Market Engagement Work Already Done • Initial proof of concept on CyberArk product in January 2017 • Project mobilisation and stakeholder discovery • Purchase of CyberArk licences • Discovery phase • Hardware installation at Home Office Data Centre 1 & 2 Existing Team The CyberArk Implementation Partner will be working as part of an ongoing programme of works, working in partnership with the programme team to deliver the work package. The existing team is composed of a Home Office programme team and additional technical resources provided by an existing delivery partner, working as part of a larger programme of works. The supplier will also be required to work with multiple Home Office stakeholders to implement the capability and transition it to live service Current Phase Discovery Work Location The team will be delivering output and digital outcomes primarily with a team located in Croydon and central London. Travel to other Departmental locations in the UK may be required. Working Arrangments The supplier’s team will be required to be located on site for five days (40 hours) per week, whether alongside the programme team in Croydon, or at a Departmental location around the UK. Occasional travel to regional sites may be required. Day rates will be inclusive of travel and subsistence expenses within M25/Greater London. Travel and subsistence expenses incurred from travel outside of the M25/Greater London will be subject to Home Office Travel and Subsistence Policy. Security Clearance Individuals in the supplier’s team will require SC clearance, or be willing to undergo SC clearance checks. SC clearance needs to have been achieved before work can commence. Additional T&Cs Standard DOS framework and call-off terms and conditions will apply. This contract will consist of multiple phases and a statement of work will be created for each phase. Further details to be provided in the RFP. Bidders who have succeeded in reaching the shortlist will be required to sign a Non-disclosure agreement in order to receive the full RFP documentation. Skills & Experience Experience of successful implementations (including testing and deployment) of CyberArk-based solutions in the last three years Experience of successfully delivering complex end-to-end software solutions in large public sector organisations Demonstrable knowledge of Privileged Access Management best practice methodologies and tools Demonstrate ability to mobilise an experienced CyberArk implementation team with relevant certifications within the timescales and to manage their performance over the entire contract duration Have demonstrable knowledge of networking technologies (including but not limited to HTTPS, RDP, SSH) Have demonstrable experience of collaborative working with a client's ‘in-house’ teams and external delivery partners, including coaching and mentoring, delivery of training, and knowledge sharing Have demonstrable experience of transitioning systems to live service, implementing new working processes for impacted teams, and providing a full knowledge transfer to the end customer Nice to Haves Evidence of CyberArk Partner Status (Platinum or Gold) Experience of successful implementation of CyberArk in both an on-premises data centre and in AWS. Demonstrable experience of sever build and configuration in on premises data centres No. of Suppliers to Evaluate 4 Proposal Criteria Provision of an implementation plan for estimated timeframes for the work, with approach to managing risks and dependencies Proposed implementation team structure, with CVs outlining relevant experience of each member of the proposed team Proposed approach to mobilisation of implementation team The proposed approach and methodology, and how these meet the requirements Provision of a case study where your company have implemented some or all of the CyberArk product suite Provision of case study where your company have transitioned a system into live service.Approach to ensuring value for money Cultural Fit Criteria Ability to function effectively and collaborate in a multi-supplier environment Working successfully in complex public sector organisations Approach to proactive issue management, problem resolution and improving ways of working Ensure consistency of staff and skills for the expected duration of the contract Payment Approach Fixed price Assessment Method Written proposal Case study Reference Presentation Evaluation Weighting Technical competence 60% Cultural fit 10% Price 30% Questions from Suppliers Budget range upto £1m for the contract and £200k-£350k for the initial sow