The NCA's SARs IT Transformation Project

Tender description

Summary of the work The NCA' s SARs IT Transformation Project comprises the design, build, test and handover of a Suspicious Activity Reports (SARs) cloud native (Azure) application for UK law enforcement and members of the regulated reporting sector. Expected Contract Length 12-14 months, ending following end of Early Life Support/assurance period. Latest start date Tuesday 1 December 2020 Budget Range The NCA has a maximum budget of £4m for this work. Note - proposals must be affordable. Why the Work is Being Done The current service is approaching end-of-life. Architectural constraints inhibit functional and technical improvement. Investment Objectives for the project are: ● more efficient and functional processing of SARs; ● meet additional security requirements; ● reduce Technical Debt. Critical Success Factors include: ● Agile-based approach to application development; ● continuous engagement with key stakeholders. The NCA has bundled its Requirements into indicative releases. Bidders may propose limited amendments to Requirements and/or Releases provided that these can be delivered by 30 November 2021 (with a subsequent 30 day Early Life Support/assurance period). Problem to Be Solved The Supplier will design, build, test and hand over a replacement IT SARs system. They will be capable of: ● Agile delivery of complex native Azure cloud applications (including security, API, UI/UX, Analytics, Workflow); ● Service Design; ● Functional, Technical, Operational and Performance Testing; ● Migration of legacy SAR data including transformation of in-flight DAML cases; ● Support of NCA-led testing (e.g. ITHC, Accessilbility) and lead on remediation of issues; ● Cut-over from legacy services to the new Releases; ● Service Introduction, including operational readiness reviews, knowledge transfer and Early Life Support following each release to Production. Who Are the Users Approximately 250 user stories have been generated through user engagement over the proceeding project period. At a high level, there are three key personas: ● Reporters (members of the public and regulated sector); ● UK Financial Intelligence Unit (part of the NCA); and ● End Users (a collection of all UK law enforcement agencies and a number of other government departments). [Example] As a reporter I need to report suspicious [financial] activity and keep track of my submissions so that I comply with the law and can effectively manage my obligations. A full list of known user needs will be provided at Stage 2 to short-listed bidders. Early Market Engagement None. Work Already Done The NCA has completed detailed user research and a proof-of-concept in Azure which has informed significant changes in the technology approach used in Alpha. The NCA has developed a high level cloud architecture approach for the application, including security and technical risk mitigations. The NCA has also developed a draft SAR submission schema and technical approach for a set of APIs which will allow regulated sector SAR reporters to submit reports automatically to the new service. Existing Team The NCA has a small number of project delivery resources working full time on the project which includes a Project Manager, Solution, Service, DevSecOps and Data Architects, a UX Designer and a number of business analysts. Service handover will be to the incumbent hosting and application support partners. The project reports into an NCA Programme of work. Current Phase Beta Skills & Experience • Strong and proven high performance, user-centric agile delivery demonstrated with methods, assets and credentials. • Strong experience of complex business application delivery at scale, using cloud PaaS. • Strong test management capabilities including test automation (incl. functional, technical and operational). • Strong and demonstrable credentials working collaboratively in a multi-supplier environment. • Strong service introduction capabilities including demonstrable documentation and knowledge transfer methods. • Cloud security design and delivery (incl. logical network segregation, NSG, Azure firewall, anti-malware, DDoS). • Cloud operations architecture (incl. backup, monitoring and alerting). • RESTful API development with schema validation and OAuth using Azure AD. • Design thinking, UX and accessibility design (WCAG 2.1 AA) for custom web applications. • Design and delivery of highly available, resilient, auto-scaling cloud native services. • Custom web application development with Angular. • Azure PaaS services (incl. APIM, ASE, .NET/C# Functions, SQL, CosmosDB). • Relational and graph data architecture (entity relationship modelling) and advanced database administration (SQLServer, CosmosDB or equivalent). • Legacy Systems Integration including batch processing and VB6 scripting. • Bespoke business workflow application delivery using LogicApps or equivalent cloud-native service. • Low-code application delivery using Microsoft Power Platform (incl. PowerBI, PowerApps). • Custom PowerBI report development. • Evidence of Service Delivery Reporting and Accountability including Status Reporting, Deliverable Tracking and Project Planning. • Demonstrable evidence of innovation, value-add and continuous improvement, in-project and in-environment. • Evidence of adherence to Service Level Agreements, response time targets and engagement in project feedback. Nice to Haves • Anti-Money Laundering functional expertise. • Delivery of solutions using the GDS Design System. • OpenBanking & FAPI standards for secure transmission of financial data. • POLE data architecture. • KeyLines JavaScript ERD library. Work Location NCA's London premises except as otherwise agreed. Working Arrangments Strong experience working as part of an agile team participating in daily stand up, sprint reviews and planning and retrospectives. A "matrix" team stand-up on a daily basis is the preferred approach with supplier representation at monthly Project and Programme Boards. The Supplier is expected to use NCA provided tracking and development tooling such as Azure Boards or Jira to report progress via burn down or similar against the user needs and features with complete transparency. Suppliers must have enterprise IdP SAML integration capability in order to access development lifecycle services in the NCA's cloud tenancy. Security Clearance All staff must be at least SC cleared or capable of being cleared to SC (noting, however, the challenging milestones for this work and clearance lead-times). Bidders must confirm clearance of the resources comprising their Key Staff. Additional T&Cs Standard DOS 4 Terms & Conditions - including an amendment to Clause 6.3 which extends the warranty relating to Acceptance Criteria to the design being fit for the purpose(s) described in the Statement of Requirements (and subject to any qualification or exclusions proposed by the Bidder in their tender response). No. of Suppliers to Evaluate 4 Proposal Criteria • Implementation Plan (30%) - comprising: (i) Delivery Narrative describing approach/methodology; (ii) Statement of Compliance, advising omissions/changes; (iii) WBS and Gantt chart; (iv) RACI and RAID. • Sample of HLD (5%) - to evidence the methodology in (1). • Core Team (25%) - the qualifications and experience evidenced by CVs. Cultural Fit Criteria Carry forward of Key Skills evaluation from Stage 1 (shortlisting) - pro rated based on 10% max score. Payment Approach Fixed price Assessment Method Presentation Evaluation Weighting Technical competence 60% Cultural fit 10% Price 30% Questions from Suppliers 1. Is there a current incumbent? There is no incumbent supplier for the scope of works which is open to all framework suppliers. There are incumbent suppliers at the NCA in regards to architecture, strategy & advisory, technology delivery & service management and cloud delivery & support roles. The successful bidder will be required to work collaboratively with them in order to deliver the requirements. 2. You state that the location of work is London. Is this flexible or is London the sole site? Precise arrangements regarding locations will be agreed with the Supplier, noting that:- the supplier's Key Staff need to collaborate closely with NCA personnel based at the NCA offices in London - for example, on site activities such as additional user research (noting user base is nationally dispersed), user validation and face to face governance meetings;- however, significant development work, testing and some daily coordination/communication can be delivered remotely.Shortlisted bidders should include their recommendations at the proposal stage. 3. Is there a company associated with the current service and if so are they excluded from bidding? See answer #1. No framework supplier is excluded from bidding and responses will be scored on merit. Incumbent suppliers at the NCA include provision of service management for the existing legacy service. 4. Is there a company associated with the proof of concept and if so are they excluded from bidding? See answer #1. No framework supplier is excluded from bidding and responses will be scored on merit. Incumbent suppliers at the NCA include provision of services related to the proof of concept which has now concluded. 5. Please can you clarify what you mean by:‘The NCA has a small number of project delivery resources working full time on the project which includes a Project Manager, Solution, Service, DevSecOps and Data Architects, a UX Designer and a number of business analysts. Service handover will be to the incumbent hosting and application support partners.’Is it the Authority’s intent to have the current delivery resource team and their work/service absorbed into the successful bidders team, or their work/service, or something different? The Authority’s intent is for the resources comprising the current delivery team resources to work alongside, assist and assure the work of the Supplier in delivery of the project.Regarding service handover, this ITT is for delivery of the IT project only and not support of the product in live service, nor service management. The scope will, however, include Early Life Support and knowledge transfer/handover to existing application and infrastructure management teams. 6. For those selected, what is the timeframe expected between the evidence submission, notification of down selection and proposal submission? Responses to the Key Skills criteria will be received by close on Tuesday 6 October. We anticipate generating our shortlist the following week.Subject to internal governance approvals, we anticipate issuing the ITT to the shortlisted bidders on/around Thursday 16 October – with Tenders due to be submitted by cob Thursday 12 November. The successful supplier will be required to start work by the end of November.These dates may change. Further information will be provided to shortlisted bidders at the next stage in the ITT. 7. Could you please set out what information you expect to provide to down selected bidders to enable us to provide a fixed price for delivery? The NCA will share an ITT and a comprehensive a Statement of Requirements (SoR) with the shortlisted bidders at the next stage. The SoR will comprise a comprehensive list of the functional and non-functional requirements, including identifying which comprise the MVP and preferred milestone dates.Please also see further explanation of the Fixed Price and Risk/Reward mechanism in the answers below. 8. Please can you share the name of the agency who developed the Alpha. NCA will not be sharing this information with the Bidders at this stage; we do not feel that this information would materially help Bidders in formulating their estimates and responses. 9. Who is your hosting and applications support partner? NCA will not be sharing this information with the Bidders at this stage. However, additional information which will enable bidders to produce their proposals will be provided to short-listed bidders. 10. Split onshore / offshore delivery models are very cost effective. In this model security cleared, onshore resources are responsible for all customer interaction, and development is performed by uncleared resources offshore who have no access to real data. Does the Authority have an appetite to explore such delivery models? The question refers to development potentially being performed by “uncleared resources”. The NCA has a minimum requirement that all personnel working on this project (including development) must possess SC Clearance as a minimum. Consequently, we anticipate a model entailing off-shoring will not be feasible. 11. In relation to the work being carried out at” NCA's London premises except as otherwise agreed”, can you provide clarification as to whether the work can be carried out off-site during the current COVID restrictions, and any constraints to delivery we would need to be aware of” Please refer to the answer to Question 2 above.We acknowledge that the COVID restrictions add further constraints. We will take a pragmatic approach regarding location, including leveraging available technology (Teams, etc) to reduce the need for the successful bidder to be present at the NCA’s London premises.In principle:• we anticipate much of the work will be performed remotely at the successful bidder’s premises, particularly during the Dev phase; and• attendance at site can therefore be limited to exceptions which cannot be performed remotely using available technology (eg. face to face workshops or demos; end-of-Release Testing/formal acceptance) 12. Please can you explain how the Fixed Price model will work in more detail. We propose a Fixed Price model supplemented with risk/reward sharing: i.e. 1. Each Bidder will quote a total price for delivery of their solution to the Requirements. 2. Bidders may qualify this with Assumptions and Dependencies. 3. If the NCA subsequently fails to comply with agreed Assumptions or Dependencies then it may entitle the Supplier to claim relief (additional time and/or cost). 4. If work goes to plan, the Supplier will complete the work at the Fixed Price.5. Alternatively, if delivering under/over budget, additional measures will apply. See answers below. 13. How will Risk/Reward be shared in your Fixed Price model? Under Budget: if the Bidder delivers the Requirements under budget, they may charge a percentage of the unbilled portion of the Fixed Price (‘Incentive Fee Percentage’). Over Budget: if the Bidder’s costs exceed the Fixed Price, they may charge the NCA for the overspend at cost (excluding profit) up to a maximum limit (‘Maximum Ceiling’). Short-listed Bidder’s will propose: - Incentive Fee Percentage: the percentage share of the underspend of the Fixed Price they will receive; and - Maximum Ceiling Amount: the amount additional to the Fixed Price they can bill (at cost) if their costs exceed the Fixed Price. 14. How will you evaluate Price as a component of your MEAT evaluation? Each Bidder’s total price for evaluation will be calculated: a) by aggregating three scenarios: - Under-budget (i.e. (Fixed Price minus an assumed 15% underspend) + (Underspend x Bidder’s Incentive Fee Percentage); +- Fixed Price (i.e. on budget); - Over-budget (i.e. Fixed Price + Bidder’s Maximum Ceiling Amount); and b) dividing this figure by three to generate an average Notional Total Price. This will then be converted to a percentage evaluation score with:- the lowest Notional Total Price receiving 30%; and- the other proposals scored pro rata. 15. When will the Charges be payable? We anticipate that Charges will be billed retrospectively at the end of each month for the work actually performed – subject to a 20% retention.The retention will be released (in two tranches) after 30 days of successful, continuous running following go live of each of:- The MVP;- The subsequent, remaining backlog.The definition of “successful” means no occurrence of a major incident during this continuous assurance period following go live. 16. For the requirements for “Legacy Systems Integration including batch processing”, is this expected to be in support of:- a one-off migration of legacy data to a new system, or - on-going integration with legacy system(s) which will continue to exist? Data from the legacy SARs system will need to be migrated to the new system, there will be no two-way integration with the legacy system at any point, and no data migration post go-live. Data will be exported regularly from the system to downstream consumers. This must be done in the same format as the existing exports in order to ensure continuity. 17. Where you ask for “Custom PowerBI report development”, is this:- the development of PowerBI reports using standard PowerBI features and functionality; or- is this development of Custom Visuals that extend out-of-the-box functionality (bespoke to NCA)? Custom report development in PowerBI refers to the creation of required reports by the business using out-of-the-box functionality. If a need for bespoke extension of out-of-the-box-functionality is identified this will be dealt with via the contract's Chane Control process. 18. You ask for “Evidence of adherence to Service Level Agreements, response time targets” but suggest that the Supplier will not be responsible for Live service operation or support. Are you interested in SLAs in relation to service development or service management/support? Your point is noted.All Bidders are advised that they should disregard Essential Skill #20 (“Evidence of adherence to Service Level Agreements, response time targets and engagement in project feedback”). A response is NOT required to Essential Skill #20 and will not be evaluated.Our intention was to focus on the experience of bidders regarding the handover of the developed service to the service maintainer. We will evaluate this on the basis of your response to Essential Skills #5 (“Strong service introduction capabilities including demonstrable documentation and knowledge transfer methods”).