Cyber security strategy and testing partner

Tender description

Why the Work is Being Done We are delivering substantial change across our technology estate. We need assurance, through testing, that our current controls are fit for purpose. Further support to ensure that technology changes are underpinned by robust security controls and tools during transition and implementation. This should cover infrastructure and network controls, access management (including privileged account management), audit and reporting, application controls and device management. Problem to Be Solved We have a small in house IT/IM team and limited resources and capacity to undertake this work. We need assurance that we have adequate security controls (device, network and application) and that these controls will be fit for purpose as we roll out planned changes. Who Are the Users As a member of the technical team I need independent verification of our security controls and future requirements to deliver business needs As the Head of DDaT I need assurance that our cyber security is fit for purpose and offers value for money so that assurance can be given Early Market Engagement Work Already Done Some preliminary work undertaken in house. Current cyber essentials accreditation in place Existing Team We are a small in house team including Senior Leads for Desktop & Comms and Infrastructure & Network. We also have an Information Systems team who support SharePoint, Dynamics CRM and a bespoke web based platform. Current Phase Discovery Work Location Our London office, 3 Bunhill Row Working Arrangments We would expect in person engagement at our London office with technical team Security Clearance Base line checks Additional T&Cs Skills & Experience Technical capability to design and plan implementation for new security infrastructures. Proven ability to assist in setting the strategic direction for Cyber Security projects. Capability to support and assist the internal team in the assessment and risk identifying, against new services. Knowledge of a range of security standards including but not limited to ISO27000, SOC 2, CIS & NIST. Knowledge and Experience of widely used IaaS/PaaS/SaaS environments. Knowledge and experience of best practice regarding implementing least privilege security models and approaches within cloud and on-premise environments Ability to provide guidance on appropriate separation of roles across the various operation planes (management, control & data), within cloud and on-premise environments. Knowledge and experience of best practices to implement scalable and secure methods of storing sensitive data within cloud and on-premise environments. Experience of implementing Service based authentication within service and on-premise environments. Experience of designing and implementing the use of modern device-based authentication methods Nice to Haves No. of Suppliers to Evaluate 5 Proposal Criteria Approach and methodology How the approach or solution meets your organisation’s policy or goal Examples (more than one) of similar, successful projects they have delivered How they’ve identified risks and dependencies and offered approaches to manage them Value for money Cultural Fit Criteria Be transparent and collaborative when making decisions Share knowledge and experience with other team members Work as a team with our organisation and other suppliers Payment Approach Capped time and materials Assessment Method Written proposal Case study Work history Reference Evaluation Weighting Technical competence 60% Cultural fit 10% Price 30% Questions from Suppliers Budget range