Security Assurance Support to Base Services in Defence Digital

Tender description

Why the Work is Being Done Specialist Security advice to meet assurance activities is required in order to ensure Base services projects deliver key capabilities on time and fit for purpose. Problem to Be Solved Requirement to provide Security Assurance knowledge and expertise for all MODNET services. NSoIT – 12 month contract from 30/03/2020 to 31/03/2021 IUS - Initial Period of 6 Months 30/03/2020 – 29/09/2020 (Option to extend the IUS element for a further 6 Months 30/09/2020 – 31/03/2021 subject to Financial approval) Who Are the Users For the tasks required, the 'users' are the project team and our stakeholders. Early Market Engagement Work Already Done Many items (Projects) have already been started or are in the delivery phase and as such, the task are about refinement, further development and operation. Existing Team Base Services – New Style of IT and Integrated User Services Current Phase Live Work Location Defence Digital, Ministry of Defence Corsham Working Arrangments Work onsite 4/5 days a week in Corsham as agreed with the Project Manager in order to support Project Teams in all of their Security Assurance activities. NSoIT T&S Limit of Liability - £8,000 for 12 month period IUS T&S Limit of Liability - £2,000 for 6 month period Security Clearance Minimum SC – with access to DV personnel as and when required Additional T&Cs Key Personnel will be required to hold/working towards CISM, CISSP, ISO27001 Lead Auditor or ISO27001 Lead Implementor. T&S will be paid based on receipted actuals and in compliance with MoD Policy, no other expenses are permitted. Suppliers must use the Authority’s Purchase to Payment Tool called CP&F or be prepared to sign up to the tool. The Cyber Risk Profile has been identified as Moderate. More detail will be provided at the tender stage, for suppliers that pass the shortlisting stage. Further contractual conditions may apply, these will be comfirmed later in the tendering process. IR35 does not apply. Skills & Experience Demonstrate with evidence recent working experience(s) of supporting delivery in a large scale IT Environment / Project (150k+ users) (5%) Demonstrate experience of working in MOD or other large government organisation, with a good understanding of Defence Digital Services or equivalent and wider business practices (5%) Demonstrate with evidence a clear understanding of the MOD estate or similar government organisation and the difference between Official and Secret environments (5%) Demonstrate with evidence a firm understanding of Microsoft O365 environment in a large corporate deployment (10%) Demonstrate a clear understanding of / recent working experience of JSP 604 Accreditation (10%) Provide evidence of analysis and evidence gathering experience; ability to understand where potential Security gaps lie based on evidence and producing written analysis (15%) Demonstrate recent experience in producing Security Cases that work in a pragmatic way for both Delivery and Security Teams, including providing evidence (15%) Nice to Haves Demonstrate experience of conducting Technical security reviews / approvals of Supplier and MoD Design and Test documentation to ensure that it is compliant with Defence Security policy (15%) Demonstrate experience of Defence Digital and/or MOD Security Accreditation and MOD Security Assurance process (10%) Demonstrate previous working experience of Coordinating technical security documentation in support of CyDR to support achievement of accreditation (10%) No. of Suppliers to Evaluate 3 Proposal Criteria Evidence/explain how you will introduce Security policies and templates with a pragmatic approach that allows flexibility for projects; ‘one size fits all approach’ will not satisfy our requirement (20%) Provide a high level plan to your approach for identifying and managing Security Risks, Issues and Dependencies in mature business/project area (15%) Evidence/explain how you have provided Security Assurance documentation to enable an organisation to continue the route to full rollout and adoption of policies and templates within delivery areas (20%) Evidence your ability to mobilise your team quickly and to flex up and down resources to meet the demand of the project, whilst ensuring quality and consistency (5%) Evidence Communications and Stakeholder Management operating at all levels collaboratively (10%) Supporting CV’s – These should not be included in the main proposal word count but should be a maximum of 500 words and no longer than 1 page. (10%) Evidence and explain how you have communicated new policies and change across multi-discipline teams (10%) Evidence and explain how you have understood and incorporated project requirements whilst ensuring the results remain generic for the business (10%) Cultural Fit Criteria Ability to work in a complex defence IT environment, understanding the challenges and approaches to delivery (25%) Work as a team with our organisation and other suppliers (25%) Remain transparent and collaborative when making decisions (25%) Excellent communication, presentation, collaboration and client/stakeholder engagement skills with a wide variety of grades/positions. (25%) Payment Approach Capped time and materials Assessment Method Evaluation Weighting Technical competence 60% Cultural fit 5% Price 35% Questions from Suppliers No questions have been answered yet Budget range the maximum amount of approved funds is £740,000 (ex vat) nsoit t&s limit of liability - £8,000 for 12 month period ius t&s limit of liability - £2,000 for 6 month period ius t&s limit of liability – 6 month option period - £2,000 for 6 month period (subject to financial approval)