The NCA's SARs IT Transformation Project

Tender description

Why the Work is Being Done The current service is approaching end-of-life. Architectural constraints inhibit functional and technical improvement. Investment Objectives for the project are: ● more efficient and functional processing of SARs; ● meet additional security requirements; ● reduce Technical Debt. Critical Success Factors include: ● Agile-based approach to application development; ● continuous engagement with key stakeholders. The NCA has bundled its Requirements into indicative releases. Bidders may propose limited amendments to Requirements and/or Releases provided that these can be delivered by 30 November 2021 (with a subsequent 30 day Early Life Support/assurance period). Problem to Be Solved The Supplier will design, build, test and hand over a replacement IT SARs system. They will be capable of: ● Agile delivery of complex native Azure cloud applications (including security, API, UI/UX, Analytics, Workflow); ● Service Design; ● Functional, Technical, Operational and Performance Testing; ● Migration of legacy SAR data including transformation of in-flight DAML cases; ● Support of NCA-led testing (e.g. ITHC, Accessilbility) and lead on remediation of issues; ● Cut-over from legacy services to the new Releases; ● Service Introduction, including operational readiness reviews, knowledge transfer and Early Life Support following each release to Production. Who Are the Users Approximately 250 user stories have been generated through user engagement over the proceeding project period. At a high level, there are three key personas: ● Reporters (members of the public and regulated sector); ● UK Financial Intelligence Unit (part of the NCA); and ● End Users (a collection of all UK law enforcement agencies and a number of other government departments). [Example] As a reporter I need to report suspicious [financial] activity and keep track of my submissions so that I comply with the law and can effectively manage my obligations. A full list of known user needs will be provided at Stage 2 to short-listed bidders. Early Market Engagement None. Work Already Done The NCA has completed detailed user research and a proof-of-concept in Azure which has informed significant changes in the technology approach used in Alpha. The NCA has developed a high level cloud architecture approach for the application, including security and technical risk mitigations. The NCA has also developed a draft SAR submission schema and technical approach for a set of APIs which will allow regulated sector SAR reporters to submit reports automatically to the new service. Existing Team The NCA has a small number of project delivery resources working full time on the project which includes a Project Manager, Solution, Service, DevSecOps and Data Architects, a UX Designer and a number of business analysts. Service handover will be to the incumbent hosting and application support partners. The project reports into an NCA Programme of work. Current Phase Beta Work Location NCA's London premises except as otherwise agreed. Working Arrangments Strong experience working as part of an agile team participating in daily stand up, sprint reviews and planning and retrospectives. A "matrix" team stand-up on a daily basis is the preferred approach with supplier representation at monthly Project and Programme Boards. The Supplier is expected to use NCA provided tracking and development tooling such as Azure Boards or Jira to report progress via burn down or similar against the user needs and features with complete transparency. Suppliers must have enterprise IdP SAML integration capability in order to access development lifecycle services in the NCA's cloud tenancy. Security Clearance All staff must be at least SC cleared or capable of being cleared to SC (noting, however, the challenging milestones for this work and clearance lead-times). Bidders must confirm clearance of the resources comprising their Key Staff. Additional T&Cs Standard DOS 4 Terms & Conditions - including an amendment to Clause 6.3 which extends the warranty relating to Acceptance Criteria to the design being fit for the purpose(s) described in the Statement of Requirements (and subject to any qualification or exclusions proposed by the Bidder in their tender response). Skills & Experience Strong and proven high performance, user-centric agile delivery demonstrated with methods, assets and credentials. Strong experience of complex business application delivery at scale, using cloud PaaS. Strong test management capabilities including test automation (incl. functional, technical and operational). Strong and demonstrable credentials working collaboratively in a multi-supplier environment. Strong service introduction capabilities including demonstrable documentation and knowledge transfer methods. Cloud security design and delivery (incl. logical network segregation, NSG, Azure firewall, anti-malware, DDoS). Cloud operations architecture (incl. backup, monitoring and alerting). RESTful API development with schema validation and OAuth using Azure AD. Design thinking, UX and accessibility design (WCAG 2.1 AA) for custom web applications. Design and delivery of highly available, resilient, auto-scaling cloud native services. Custom web application development with Angular. Azure PaaS services (incl. APIM, ASE, .NET/C# Functions, SQL, CosmosDB). Relational and graph data architecture (entity relationship modelling) and advanced database administration (SQLServer, CosmosDB or equivalent). Legacy Systems Integration including batch processing and VB6 scripting. Bespoke business workflow application delivery using LogicApps or equivalent cloud-native service. Low-code application delivery using Microsoft Power Platform (incl. PowerBI, PowerApps). Custom PowerBI report development. Evidence of Service Delivery Reporting and Accountability including Status Reporting, Deliverable Tracking and Project Planning. Demonstrable evidence of innovation, value-add and continuous improvement, in-project and in-environment. Evidence of adherence to Service Level Agreements, response time targets and engagement in project feedback. Nice to Haves Anti-Money Laundering functional expertise. Delivery of solutions using the GDS Design System. OpenBanking & FAPI standards for secure transmission of financial data. POLE data architecture. KeyLines JavaScript ERD library. No. of Suppliers to Evaluate 4 Proposal Criteria Implementation Plan (30%) - comprising: (i) Delivery Narrative describing approach/methodology; (ii) Statement of Compliance, advising omissions/changes; (iii) WBS and Gantt chart; (iv) RACI and RAID. Sample of HLD (5%) - to evidence the methodology in (1). Core Team (25%) - the qualifications and experience evidenced by CVs. Cultural Fit Criteria Payment Approach Fixed price Assessment Method Presentation Evaluation Weighting Technical competence 60% Cultural fit 10% Price 30% Questions from Suppliers No questions have been answered yet Budget range the nca has a maximum budget of £4m for this work. note - proposals must be affordable.