Data services

Tender description

Lot 1: Data Protection This lot is for the provision of a suitably qualified and experienced organisation to provide advice based on the latest GB and EU data protection legislation. NIE Networks has an established data protection forum to focus on exchange, analysis and communication of information on matters relating to the protection of personal information and compliance with data protection. Lot 2: Cyber Security Advisors NIE Networks outsources the delivery of IT, telephony and other telecommunication services. These are provided through managed service contracts with third parties. This includes the operational aspects of Cyber Security. Lot 2 is for the provision of expert advice and support services to the NIE Networks IT Security Manager. This service will operate independently of the managed service contract to provide impartial advice. NIE Networks has an established data protection forum to focus on the exchange, analysis and communication of information on all matters relating to the protection of personal information and compliance with data protection. The following are the key data protection services required by NIE Networks to be carried out by the successful tenderer: — define and promote data protection policy, standards and procedures throughout NIE Networks, — assist with maintenance of data ownership for records systems identified on the personal information register, and provide support and assessment for data owners, — assist with maintenance for a risk analysis process for DPA/GDPR compliance, and liaise with management, data owners, IT and other relevant groups or departments, — assist in the support of ensuring privacy by design for NIE Networks, — assist in the development and delivery of annual data protection privacy Programme, — assist in preparation, and execution of data protection audit plan as agreed with NIE Networks contract manager, — liaise with the NIE Networks IT security forum and data protection forum on technical issues, including the reporting and investigation of incidents and/or breaches, — assist with maintenance of the NIE Networks Data Protection Act (DPA/GDPR) risk register, — facilitate communication between the audit and risk committee, executive directors, the risk management committee, the company secretary, internal IT Management Group, internal auditors and other areas of the business engaged in risk management activities. Participate in bi-monthly NIE Networks data protection forum, either in person or via telephone conference as agreed with the NIE Networks contract manager, —advice and guidance for technical proposals and projects, — hold monthly meetings with NIE Networks to review progress and tasking including previous monthly spend and agree work program for month ahead, — ad-hoc advice and guidance. NIE Networks outsources the delivery of IT, telephony and other telecommunication services. These are provided through managed service contracts with third parties. This includes the operational aspects of cyber security. NIE Networks seeks to appoint a suitably qualified and experienced organisation on framework for the provision of cyber security advisors to provide expert advice and support services to the NIE Networks IT security officer. This service is to operate independently of the managed service contracts and provide impartial advice and guidance to NIE Networks. The successful tenderer shall work collaboratively with the IT managed service provider throughout the course of the contract. NIE Networks wishes to establish a Framework Agreement for the services of suitably qualified and experienced supplier to provide these services in NIE Networks sites and also the IT managed service providers’ data centre (mainly in the Belfast area). The successful service provider will provide an estimated 44 days of cyber security support per annum. These days will be based on a call-off arrangement by NIE Networks as and when required. The majority of call-off days shall be planned in advance with the successful service provider; typically within 2 weeks notice. The Framework Agreement will comprise the following service areas: — general cyber security advice and guidance for services within the existing NIE Networks managed service contract, — general cyber security advice and guidance external to the existing managed service contract, — support for cyber security governance and compliance (such as the NIS Directive), — cyber security strategic and policy development and review, — cyber security and technical advice for NIE Networks SCADA and operational telecommunications networks and systems, — cyber security advice and support for existing SIEM, SOC services (e.g. emerging technologies and threats such as Cloud Security and mobile solutions), — ad-hoc guidance and advice on cyber security issues that arise, — advice and guidance for technical proposals and projects, — participate in bi-monthly NIE Networks’ IT Security forums either in person or via telephone conferencing as agreed with the NIE networks contract manager, — provide access to cyber security and computer forensics services, — application security testing/penetration testing, — infrastructure health checks, — advice and guidance for user awareness training and e-training, — advice and guidance for vulnerability scanning and penetration testing, — provide vulnerability and penetration testing services, — hold monthly meetings with NIE Networks to review progress and tasking including previous monthly spend and agree work program for month ahead. In some circumstances specific work packages may be required; this would typically include a piece of work lasting greater than 5 days. Examples of work packages include, but are not limited to: — security advice, specification and testing as part of a major NIE Networks project, — assess and provide advice on security infrastructure, — data management strategy.