SOC Cyber Security Improvement Plan

Tender description

Why the Work is Being Done Key drivers for this work include the National Cyber Security Strategy and the FCO's Diplomacy 20:20 programme. No successful organisation remains static - in a fast-changing world, it needs to adapt quickly and respond to new challenges and opportunities. To support this the FCO’s change programme, Diplomacy 20:20, is designed to deliver a more expert and agile organisation, supported by a world-class platform. The National Cyber Security Strategy details the UK government’s investment in cyber security, with the vision for 2021 that the UK will be secure and resilient to cyber threats while prosperous and confident in the digital world. Problem to Be Solved The improvement plan and accompanying outline business case will cover people, process, information / data, technology and governance. The supplier will also provide programme management and organisational development resources. These will support the improvement plan elements responsible for embedding cyber security across the organisation, including transforming organisational culture, procurement, programme delivery and governance processes. Deliverables include an outline business case (using the HMG 5 case model) that is supported by (but not limited to): • Cyber security improvement plan / road map; • Defined cyber security target state; • Prioritised areas for further work. Who Are the Users As an Audit and Risk committee member, I want to understand how well we are managing our strategic risks, have clear metrics for judging progress and be confident we are doing our best to keep up with good practice. As CIO, I want to ensure that technology programmes improve our management of risk, not expose us to new vulnerabilities. As the CISO, I want our approach to cyber security to be one that supports organisational objectives, delivers an effective end-to-end cyber culture throughout the organisation, and prevents us from unknowingly being exposed to unmanaged risk. Early Market Engagement N/A Work Already Done There are number of ongoing projects, details of which will be available to winning supplier. Existing Team The internal FCO team consists of an array of personnel from across its Knowledge and Technology Directorate (KTD). Current Phase Not applicable Work Location The team will work within the FCO's main offices in King Charles St, Whitehall, Westminster, London SW1A 2AH. Close collaboration with teams in Milton Keynes will be required, including some travel to the area. Working Arrangments There may be some scope for remote working, our focus is to build a close and effective relationship between the supplier and KTD teams. The FCO will not be liable for any travel and subsistence expenses within M25/Greater London. Any travel and subsistence expense reimbursements outside M25/Greater London will be in accordance with FCO’s Travel & Expenses Policy. The supplier must follow the FCO's IT and security procedures and policies in relation to access, data and equipment use. Security Clearance Minimum SC vetting for all core staff involved. It would be desirable if at least one team member was DV cleared. Non-core staff (e.g. additional SMEs) may be BPSS/CTC cleared where there is prior agreement and an appropriate security management plan. Additional T&Cs Skills & Experience Experience in successful delivery of cyber strategy and target operating models [20%] Proven track record of working with stakeholders to generate programme implementation plans / road maps for large-scale complex projects [17%] Examples of working with customers to design and deliver cyber improvement business cases [17%] Previous experience of supporting organisational change (including culture and skills) within large organisations support board-level decisions [15%] Experience in supporting organisations in the assessment and management of risk across a broad spectrum of technologies [15%] Nice to Haves Proven track record of assessing governance procedures for large projects and recommending / implementing improvements [4%] Previous experience of working with a large central UK government department on complex cyber projects in accordance with HM Treasury’s Green Book [4%] Ability to think creatively and articulate innovative ideas to solving complex business, technology and risk management problemss [4%] Experience of designing management information and performance metrics for audit and risk assurance committees [4%] No. of Suppliers to Evaluate 5 Proposal Criteria Documented proposed solution. Documented proposed approach, methodology. Estimated timeframes for the work. Detailed resources plan, including team structure Confirmation of ability to supply a team with the required clearances. Identify risks, assumptions, issues and dependencies and how they’ve been approached to manage them. Plan for service quality management. Cultural Fit Criteria Able to understand role in the wider context of diplomacy and national security. Have excellent interpersonal and influencing skills and a positive approach. Ability to transfer knowledge. Establish good working relationships and generate team spirit. Work collaboratively with permanent staff and other suppliers. Approach to issue management, problem resolution and improving ways of working. Approach to commercial and contract management. Ability to use the existing knowledge, experience and lessons learnt from previous similar engagements. Payment Approach Capped time and materials Assessment Method Written proposal Case study Work history Presentation Evaluation Weighting Technical competence 60% Cultural fit 20% Price 20% Questions from Suppliers Budget range £300,000