Alpha and Beta Cyber Health Framework for Local Government in England

Tender description

Why the Work is Being Done MHCLG is looking to support councils in England to improve their cyber health and reduce their cyber risk. There is no shared baseline against which councils can measure their cyber health. This absence makes it difficult to secure buy-in from senior leadership. Current standards and principles are not applicable or appropriate to every council and no single standard covers all the requirements. We have identified tools (see below) that have been developed for other sectors and would like to use these as a basis for identifying what MHCLG should provide through a process of design, prototyping and testing with users. Problem to Be Solved Discovery work into cyber security in local government found that councils need a framework to apply a minimum level of cyber health and ensure the continued delivery of services. The framework should reflect the wider view of cyber security addressing non-technical and technical practices, such as: - People - knowledge and behaviours - Processes - procurement, executive governance - Technology - standards, architecture, management Local authorities should be able to: - know that there is a minimum level of cyber security to reach - determine their own organisation’s level of cyber security - devise a path to build greater resilience Who Are the Users Council person responsible for cyber security: - understand what an acceptable level of security is so I can plan and prioritise our efforts. - need advice and support on how to reach the acceptable level so we have the skills and knowledge to be secure. - want a trusted and recognised level so I can evaluate and measure the level of cyber health. Council CEO: - to be confident that my organisation is secure so able to assure the continued delivery of services to citizens. Person at MHCLG: - want to understand where local authorities are not secure so can provide support where appropriate. Early Market Engagement n/a Work Already Done We have completed a Discovery phase. Our end of Discovery blog post can be found at: https://mhclgdigital.blog.gov.uk/2020/08/25/key-findings-and-recommendations-from-the-cyber-security-discovery During Discovery we identified work that the Scottish Cyber Resilience Unit and NHS have undertaken to develop tools/frameworks for their respective sectors: - Scottish Cyber Resilience Framework and Self-Assessment Tool https://www.gov.scot/publications/cyber-resilience-framework - NHS Digital's Data Security and Protection Toolkit https://www.dsptoolkit.nhs.uk We expect reuse of existing work from other sectors to develop candidate toolkit, relevant to English councils through analysis of existing standards and tools, producing prototypes for validation in Alpha, with continuation into Private and Public beta, subject to GDS assessment. Existing Team The service designer from the Discovery will be part of the team. A user researcher from MHCLG is potentially available who is new to the workstream. We have / will be commencing work on the other recommendations from our Discovery phase and there is an expectation that this team will work in partnership with other workstreams including sharing learning and any other artefacts. A delivery manager is helping to manage across the workstreams. We expect flexibility in any proposed service and financial model to replace supplier team members with internal team members during the lifetime of the project. Current Phase Alpha Work Location The primary site is the MHCLG office located at 2 Marsham Street, London, SW1P 4DF. However current circumstances mean remote working is the default. Given the nature of the work is working with councils in England, travel may be necessary. **Travel/expenses to sites must be included in your costs and WILL NOT be reimbursed separately** Working Arrangments The supplier is expected to work alongside existing teams for face-to-face meetings and work in the open with the sector through open show-and-tells and blogging. The supplier should demonstrate effective use of Agile principles and established project management approaches enabling progress to be shared, continually visible, monitored and issues resolved. Current working means much of this work will need to be completed via video calling so the supplier should be comfortable using products e.g. Microsoft Teams and Google Meet with cameras on. The supplier will work with MHCLG to identify the appropriate architecture and technologies for a beta phase. Security Clearance CTC or above is desirable as staff will otherwise need escorting on site. If the successful supplier does not have CTC cleared staff, MHCLG will sponsor clearance. The supplier team will be expected to start this immediately after appointment. Please make it clear whether staff have clearance when submitting responses. Additional T&Cs 1. All outputs will be owned by MHCLG and published openly where appropriate using a suitable open license that supports reuse. 2. All materials/outputs derived from the contract shall be the property of MHCLG. 3. GDPR requirements will be discussed and agreed once the successful supplier has been notified (as part of discussions to agree the wording of the call-off contract). 4. Continuation to beta is subject to the outcome of the alpha phase and positive alpha service assessment. Skills & Experience Demonstrate meeting skill requirements based on the anticipated composition of the team and as outlined in the Government Service Standard Proven and demonstrable knowledge of IT security standards and asssesments not limited to Cyber Essentials, PSN, PCIDSS, NCSC's 10 steps and Government Minimum Cyber Security Standard Demonstrate having experience of undertaking user research, design and prototyping of public services Demonstrate having experience of designing a service that everyone can use as outlined in the Government Service Standard (point 5) Demonstrate having recent experience of working with local authorities Nice to Haves Demonstrate experience of presenting and explaining technical content (such as IT or cyber) to non-technical senior leaders Demonstrate experience of 'working in the open' (blogging, show and tells, project backlog) and regularly sharing project findings and progress with a wide audience inside or outside of the organisation Demonstrate experience of using open standard, common components and patterns from inside and outside government as outlined in Government Service Standard (point 13) No. of Suppliers to Evaluate 3 Proposal Criteria Approach and methodology to the work - including technical proposal Demonstrating an understanding of our requirements Identified risks and dependencies and potential approaches to manage them Team structure, including skill, experience and accreditation of individuals and their relevance Estimated and credible time-frames for the work How the approach or solution meets user needs How you will ensure smooth transition and knowledge transfer to the live service team Value for money of the proposed approach Cultural Fit Criteria Experience of successful collaborative working as part of a mixed supplier-client delivery team sharing knowledge within the team and with other suppliers Be transparent and collaborative when making decisions Demonstrate supporting a no-blame culture and encouraging people to learn from their mistakes Demonstrate establishing rapport with stakeholders, keeping them informed and managing their expectations Demonstrate understanding of the local government landscape and the spirit of the Local Digital Declaration https://localdigital.gov.uk/declaration/ Payment Approach Capped time and materials Assessment Method Work history Presentation Evaluation Weighting Technical competence 50% Cultural fit 15% Price 35% Questions from Suppliers No questions have been answered yet Budget range overall budget: up to £1,000,000 (excluding vat) continuation into beta will be contingent on alpha findings and subject to a service assessment / spend control. suppliers are requested to provide a budget split for the 2 phases of work. suppliers are also requested to provide a timeline for the 2 phases of work. a short break should be allowed for between alpha and beta to allow for a review of the alpha phase, including a service assessment and review of findings to confirm the work should proceed to beta.