NLEDP 154 - Cyber Security Operations Team

Tender description

Why the Work is Being Done The Police and Public Protection Technology directorate contains a number of delivery programmes two of which are the National Law Enforcement Data Programme and Law Enforcement Cloud Platform which are hosted on public commodity cloud. In line with Industry Good Practice and HMG Policies there needs to be a Cyber Security wrap around applications and services hosted within our commodity cloud environments. Problem to Be Solved Provide a team to run the day to day BAU cyber security activities. Who Are the Users Police and Public Technology portfolio need a Operational Security team to react to security incidents and manage the day to day activity of security issues in a development programme and operational platforms. Early Market Engagement Work Already Done The Home Office provide the first line monitoring of the Cyber Security SIEM tooling. This procurement is to establish a Cyber Security Operations team that can undertake the following activities. Existing Team The team will be working in a multi supplier environment and interactions with other elements of the Home Office, including the Cyber Security Operations Centre, the Portfolio Platform & Service teams and broader Security Management. There is 1 existing resource that will be retained as per the requirements below. Current Phase Live Work Location The team is expected to be at the Home Office Bernard Weatherill House site in Croydon most days, but may be required to travel to other Croydon or London HO locations. Working Arrangments To run this service and support the delivery & support teams you will need to be on site. Also due to technical lock downs access to the environments remote working under exceptional circumstances will not be possible. Out of hours incident response will be required, access to the environments will be from agreed locations. The Initial request is for the following for daytime BAU activity: Role 1 x Operational Security Manager SFIA Level 5 1 x Deputy Operational Security Manager SFIA Level 4 / 5 1 x Operational Security Practitioner SFIA Level 4 Security Clearance Team members must have Security Clearance (SC) or be prepared to undergo Security Clearance. NPPV Level 3 is also required and new members will be put through this vetting. NPPV is non-police personal vetting, performed by the police. Additional T&Cs The Customer may, if it chooses, use its in-house resources, business units and other framework agreements to deliver specific services. The Customer will consult fully with the Supplier before exercising this right. o Volume and values Contract values are indicative only and are not a guaranteed level of expenditure. The Authority reserves the right not to spend the whole budget in each year of the contract. Programme budgets are subject to annual PIC approval. The Authority will advise on the outcome in March each year. Skills & Experience Experience in providing a Cyber Security Operations Service with a good understanding of investigating cyber security incidents and operating proactive security incident management The supplier must have knowledge of security managing AWS native Services Eg S3, EC2, DMS Databases, Cloudtrail, Cloudwatch etc. The supplier must have knowledge of security managing Windows, Red Hat and Centos operating Systems. The supplier must have knowledge of Splunk SAAS and Nessus Tenable cyber tooling including Use Case development, configuration, onboarding and operation Experience of identifying and implementing continuous improvements to the Cyber Security Operations service Experience of responding to, and managing to conclusion, Cyber Security incidents as per agreed service level targets and in line with approved procedures. Experience of defining, maintaining and updating any work instructions and operational processes relating to cyber security. Skills in threat vulnerability analysis, prioritisation and remediation/remediation planning and reporting on a regular basis Experience of establishing an Operational Security Working Group to discuss detailed cyber operational issues. Experience of providing assurance and managing the technical teams that remediating, patching and upgrading the infrastructure in line with agreed policies. Experience of implementing and managing the escalation of privilege when required. Experience of managing BAU Cyber Activity. Experience of management of a Privileged Access Management Service. Ability to flex in line with operational requirements. Experience of providing an on call out of business hours service should a Cyber Event occur. This is not expected to be more than 2 events a month. SC level of Security Clearance and Non-Police Personnel Vetting Level 3 or be able to obtain the required vetting. Ability to work from multiple locations, if required. Experience of managing contractor resource. (A contractor will be supplied to you and will be paid for by the authority directly, TUPE is not relevant in this case) Experience of leading onboarding of new services on to the cyber security capabilities. Experience of supporting ITHC or Penetration Testing activities within the estate. Nice to Haves Knowledge of Industry and Government Cyber Security practices & incident response. Experience in working in a Law Enforcement and Government working environment No. of Suppliers to Evaluate 3 Proposal Criteria Approach to the work, illustrating flexibility in team roles and multi-skilled personnel to meet NLEDP goals. How to be effective in a small focussed team Team structure Demonstrate Value for Money in your approach with transparent costs Ability to plan and anticipate for risks and provide potential mitigations Cultural Fit Criteria Have a no-blame culture and encourage people to learn from their mistakes Share knowledge and experience with other team members Be transparent and collaborative with colleagues and Product owners to make informed decisions Work as a team with our organisation and other suppliers Adaptable and flexible people able to deliver against changing security priorities as they evolve Proactive issue management, problem resolution and improving ways of working Payment Approach Time and materials Assessment Method Case study Presentation Evaluation Weighting Technical competence 50% Cultural fit 20% Price 30% Questions from Suppliers No questions have been answered yet Budget range £3m total contract. maximum blended day rate of £850 / day