WP1490a(re-issued): Threat Intelligence for GOV.UK

Tender description

Summary of the work GOV.UK will be undergoing a penetration test. GDS are seeking a CBEST approved supplier to provide Threat Intelligence information under the GBEST security assessment framework. Latest start date Monday 4 December 2017 Budget Range £40k - £60k Why the Work is Being Done GOV.UK is the website for the UK government. It’s the best place to find government services and information. The site is maintained by the Government Digital Service (GDS). GOV.UK will be undergoing a penetration test. GDS are seeking a CBEST approved supplier to provide Threat Intelligence information under the GBEST security assessment framework. The GBEST framework aligns itself to that of CBEST and is split into 4 phases. This tender concerns itself with Phase 2, for the provision of Threat Intelligence, ahead of Penetration Testing in Phase 3 (procured separately). Problem to Be Solved The provider is expected to supply a summary of key threats to the functioning of GOV.UK, detailing the highest scoring threats to be prioritised by the Penetration Testers. Reports are expected to be the standard of CBEST, prioritising risks to address in Phase 3 Penetration Test. Expected outputs: Threat Modelling Threat Intelligence Plan Targeting/TI Reports (Draft), Test Plan (Draft) Targeting/TI Reports Intelligence Assessment The work should be completed by mid-February, but the TI provider is expected to remain available to answer questions from the Penetration Testers (Phase 3). We expect the Penetration Test will be complete by latest end April. Who Are the Users As a member of the public I need to be confident in GOV.UK So that I can rely on the information provided As a Government Publisher I need to trust GOV.UK So that I can be confident that our content is secure and accurate Early Market Engagement Crown Commercial Services informed the marketplace of the launch of the GBEST pilot scheme in September and October. Whereby 2 departments intend to go out to tender for the provision of CBEST approved Threat Intelligence via the Digital Outcomes and Specialist framework 2 Work Already Done n/a Existing Team Technical Architect and Delivery Manager Current Phase Live Skills & Experience • CBEST approved, CREST certified Threat Intelligence Manager, successfully assessed against CBEST criteria to supply CBEST Threat Intelligence services. • Experience with performing Threat Intelligence work for modern, web- and service-based architectures and cloud technologies • Experience of agile delivery processes • Experience of assisting customers with Threat Modelling Work Location GDS, Whitechapel Building, Whitechapel High Street, E1 and also supplier premises Working Arrangments Remote working required, travel potentially required to other gov't departments. The TI provider should check-in once a week with updates on how it is going. Security Clearance Baseline Personnel Security Standard (BPSS) Additional T&Cs The provider must share information as laid out in the GBEST Implementation Guide and abide by the GBEST Principles. Any non-disclosure agreements must not hinder the delivery of the scheme, specifically, relevant information should be readily shared between the Threat Intelligence provider, the Penetration Tester and GDS. All expenses must be pre-agreed between the parties and must comply with the Cabinet Office Travel and Subsistence Policy. All vendors are obliged to provide sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets the requirements of GDPR and ensures the protection of the rights of data subjects. No. of Suppliers to Evaluate 3 Proposal Criteria • How will you will deliver the TI within the GBEST framework? • What TI processes/framework will you utilise? • What TI tooling/resources will you utilise? • How will you deliver the output from the TI process? • Team structure and skill-sets. • Value for money Cultural Fit Criteria • Work as a team with our organisation and other suppliers • Excellent communication skills • Take responsibility for their work Payment Approach Fixed price Evaluation Weighting Technical competence 70% Cultural fit 10% Price 20% Questions from Suppliers No questions have been answered yet.