Cyber Deployment Partner Cyber Design Authority - as a Service

Tender description

Why the Work is Being Done In February 2018, NHS Digital and NHS England were asked to provide improved and enhanced cyber security services to health and care. To ensure funding is utilised in the most effective way to address security threats, vulnerabilities and risks most prevalent across the sector, a systemic risk analysis has been undertaken to inform the strategy and approach. The outcome of the risk analysis reconfirmed the working assumption within NHS Digital, NHS England and other Arm’s Length Bodies that cyber risks are systemic across the sector- systemic vulnerabilities exist across a range of security domains and consistently across different organisation types Problem to Be Solved The Data Security Centre needs to build a Cyber Design Authority (CDA): this element of the CDP will provide enterprise security architectural patterns, design reviews, and guidance to ensure consistency of quality, architectural robustness, and alignment to overarching architectural, platform, and technology strategies Who Are the Users The team will deliver support to the NHS D Data Security Centre which in turn supports the wider NHS with the Cyber & Data Security Requirements. The team will ultimately report into the Data Security Centre Director. Early Market Engagement Work Already Done Development of an initial CDP Operating Model and Options Existing Team You will be working with a full team made up of a Programme director, Programme manager, various work stream leads and commercial leads - additionally you will be working with our Strategic Partner - IBM Current Phase Alpha Work Location Leeds - Vantage House & London - Skipton House Working Arrangments The supplier is expected supply a resource working within team made of up of the specialist skills. We expect the supplier to be flexible to our needs and can make working with a mixed team across multiple sites. Off site and remote working can be accommodated by exception, however due to security considerations this would need to be discussed. Day rates to be inclusive of travel and subsistence Security Clearance Individuals in the supplier’s team will require SC clearance, or be willing to undergo SC clearance checks. Additional T&Cs The will be the requirement to add a formal condition in relation to the ability of the supplier to transition to services into BAU and the commercial agreement regarding this milestone. Invoicing against deliverables / billing will be subject to a 20% retention linked to the BAU transition timelines Skills & Experience Designing and delivering Cyber Design Authority within cyber security programmes in the last 3 years Implementing Cyber Design Authority function methodologies, tools and resources Implementing a suite of Cyber Design Authority policies and standards within cyber security programmes in the last 3 years Setting up a BAU team including supporting recruitment, training newly appointed staff and knowledge transfer to the enduring team Mobilising an experienced Operating model implementation and transformation team within the timescales and to managing its performance over the entire contract duration Collaborating and working alongside external delivery partners to enable the delivery of the wider Cyber Security Programme Nice to Haves Outline experience of collaboration and functioning within complex ecosystems of suppliers and internal stakeholders, and ensuring that the end customer needs are represented and met Proven thought leadership in implementing Cyber Design Authority methodologies in complex governmental organisations. Relevant professional qualifications, memberships and contributions to cyber security knowledge, corporately or by proposed team members No. of Suppliers to Evaluate 3 Proposal Criteria Approach and methodology in planning and managing the delivery of the various work packages. Solution design methodology and governance Proposed team structure including CVs and relevant experience of named team members Mobilisation plan, including capacity to be flexible with requirements and ability to quickly draw on/source other skills sets as required. Supplier Exit Strategy, including knowledge transfer to DSC BAU teams. Risks identified with approach suggested and the solution to manage those risks. Ensuring consistency of staff within the implementation team Value added activities which further improve delivery confidence Cultural Fit Criteria Approach to functioning effectively and collaboratively in a complex multi-supplier environment. Approach to proactive issue management, problem resolution and improving ways of working Approach to leading by example to keep data secure. Approach to leveraging existing supplier knowledge and experience to the benefit of the wider programme Strategy for leaving a sustainable legacy by providing learning opportunities / knowledge transfer events for the wider DSC team. Payment Approach Capped time and materials Assessment Method Written proposal Case study Work history Reference Presentation Evaluation Weighting Technical competence 70% Cultural fit 10% Price 20% Questions from Suppliers Budget range the budget for this work is the region of £700,000 to £850,000