Prototype for Advanced / Automated Network Defence Actions (PANDA)

Tender description

Why the Work is Being Done The UK Ministry of Defence along with the commercial sector is now heavily reliant on strategic and enterprise systems both in fixed and deployable contexts. Such systems can contain hundreds or thousands of endpoints across multiple locations, potentially in different countries and with varying levels of communication bandwidth and stability. These systems are becoming increasingly highly dynamic and complex with every new technological innovation, and require highly skilled operators to DETECT and PROTECT from an ever increasing variety (in terms of sophistication and methods of operation) of threats. Problem to Be Solved Currently this DETECT and PROTECT posture is reliant on processes that are predominately mandraulic. Increasing complexity is placing a larger cognitive burden on a limited resource. Moreover in increasingly federated/ coalition mission environments, boundaries of system ownership and management authority are more porous and DETECT and PROTECT activities must be coordinated across operating authorities. Who Are the Users The desired outcome is to raise the technological level of both software and knowledge of stakeholders in the area of automated network defence. This automation will not seek to remove the human decision making process, but to reduce the burden on the operator by assimilating all the information the network is presenting and providing the operator or his commander the relevant information to allow a coherent and timely response based on policy, doctrine or operational need. Early Market Engagement Work Already Done In 2014/15, Dstl funded a series of projects on Automating Cyber Defence Responses, which delivered proof of concept research proposals for tools and techniques that supported the planning and carrying out of automated responses in the protections of networks in the face of complex multi vector attacks. Follow-on work in 2015/16 specifically examined automated Course of Action (CoA) analysis. Existing Team The supplier will be working with a dedicated technical partner from Dstl for day to day interaction. Alongside this will be a small team from the project, who will act as hosts, when or should the need to work on the software on our Porton site arises. This team operates out of their own laboratory space which is equipped to support software integration and development. Current Phase Discovery Work Location We would expect the majority of the work to be conducted at the suppliers own address, but there maybe times when both formal meetings and development work will take place at Dstl Porton Down, Salisbury, SP4 0JQ. Working Arrangments The supplier shall utilise an Agile development approach (e.g. Scrum). This will allow development to closely align with requirements and assist evaluation throughout the project. The supplier shall host an initial start up meeting. The supplier will need to spend time at Dstl's site and project team during the initial phase of the project (identifying and prioritising user stories). It is expected that the majority of development work will take place at the supplier’s site, but occasional visits to Porton will be necessary. Any expenses such as Travel and Subsistence must be detailed in the suppliers breakdown of price Security Clearance Must be able to handle OFFICIAL material only. Additional T&Cs DEFCON 76 (EDN 12/06); DEFCON 501 (EDN 05/17) – (NOTE ONLY TO BE USED WHEN INTERPRETING THE DEFCONS); DEFCON 531 (EDN 11/14); DEFCON 608 (EDN 10/14) ; DEFCON 611 (EDN 02/16); DEFCON 649 (EDN 12/16); DEFCON 659A (EDN 02/17); DEFCON 703 (EDN 08/13).FULL TEXT VERSIONS OF THE DEFCONS CAN BE FOUND ON THE ACQUISITION SYSTEM GUIDANCE (ASG): HTTPS://WWW.GOV.UK/ACQUISITION-OPERATING-FRAMEWORK. Skills & Experience Demonstrate with evidence, the ability to deliver without authority funded capability enhancements, for example procurement of additional ICT to support development activities Demonstrate with evidence, the ability to write software in Python and Java Create software to run on supported versions of Microsoft Windows (>= Windows 7) and Debian-based Linux operating systems (>= Ubuntu 16.04 LTS) without reliance on any closed-source, proprietary, software dependencies Demonstrate with evidence, experience of third party technology integration Must be able to produce appropriate levels of Validation and Verification documentation during the development (show supporting evidence) Must be able to provide weekly unstable and monthly stable builds via a public facing (preferably Git-based) repository (show supporting evidence) Demonstrate with evidence the ability to conduct software development in-house and not use a subcontractor for this task Nice to Haves No. of Suppliers to Evaluate 6 Proposal Criteria Demonstrate experience of developing robust, high quality software solutions in demanding timeframes, within the quoted budget Demonstrate expertise and experience of developing software to implement machine learning algorithms Demonstrate experience of developing software in the cyber security domain / cyber defence operations in support of high threat and government organisations Provide a breakdown of the team structure (please include CVs of the team members doing the work) Provide estimated timeframes for the work (include Gannt chart with approximate sprint timeframes) Detail and explain identified risks and dependencies. Provide details of offered approaches to manage these risk (include a Risk Register) Provide a detailed breakdown of costs and include information against the following: Hours and rates. Cost of materials. Travel and Subsistence Provide a breakdown of the roles within the team and the manpower hours allocated to these Describe how your proposal will optimise costs and generate savings Cultural Fit Criteria Demonstrate with evidence ability to follow industry best practice when conducting Verification and Validation for example TickITplus Demonstrate with evidence that they are able to respond to an evolving customer requirement Demonstrate consistent cultural commitment to agile software development practices Provide a summary of the suppliers work ethos and working environment Demonstrate ability to work compatibly with Dstl Share knowledge and experience with other team members Be transparent and collaborative when making decisions, show evidence Payment Approach Fixed price Assessment Method Written proposal Evaluation Weighting Technical competence 60% Cultural fit 20% Price 20% Questions from Suppliers Budget range £250k discovery phase should be fixed price (i.e. user story & backlog generation). alpha + should be capped time & materials.