2 Cyber Security Specialists for DfT Security Improvement Project

Tender description

Summary of the work Cyber security specialists (2) to work for 6 months or longer on a security improvement project aiming to improve standards, policies and awareness of cyber security in the Department for Transport. Specialist role Cyber security consultant Expected Contract Length Six months with possible extension for further three or six months. Latest start date Monday 8 February 2021 Maximum Day Rate £850 Early Market Engagement N/A Who Speclialist Work With DfT Digital Service staff working on • Information Management and Cyber Security Assurance • Live Services (IT Operations) • Digital Project Delivery and Software Development • Digital Adoption and Innovation Other DfT staff and suppliers What Specialists Work On Plan and manage technical and procedural changes to address gaps in how DfT meets the government Minimum Cyber Security Standard. Develop and deliver education and awareness sessions to improve cyber security knowledge amongst general DfT staff, in-house software development teams and in-house IT operations teams. Skills & Experience • knowledge and understanding of government Security Policy Framework, Minimum Cyber Security Standard and latest NCSC guidance • Recent experience of working with government departments on cyber security • knowledge and experience of cyber security risk assessments and risk-based approaches to managing cyber security • Familiarity with Microsoft products appropriate for medium and large enterprises and Google Cloud Platform Nice to Haves • CISSP, CISM, ISO27001 Qualifications • Experience of User Research or Business Analysis Work Location Digital Service (DS) team at Department for Transport. Due to the current COVID-19 situation it is likely the work will be based remotely/at their own premises with the use of video conferencing or applicable applications. If the COVID-19 situation changes the supplier could be partially based at DfT Great Minster House office (33 Horseferry Road, London, SW1P 4DR) for all important meetings. If any travel is required any proposed T & S will be at DfT Rates (Outside M25 only). Working Arrangments Normal/flexible office working hours. Objectives, outcomes and workplans will be agreed with the DfT project team. Progress, issues and adjustments will be discussed during short, regular (often daily) project team meetings. Regular communication with DfT is required via voice and video and in writing using Microsoft Teams and Office. DfT accounts and equipment will be provided for the duration of the engagement. Security Clearance Security Check (SC) required – to be active on the contract start date. Successful bidders will be required to provide evidence of clearance before starting work. Additional T&Cs N/A No. of Specialists to Evaluate 6 Cultural Fit Criteria Recent experience of working with government departments on cyber security Assessment Method Interview Evaluation Weighting Technical competence 65% Cultural fit 5% Price 30% Questions from Suppliers 1. Please confirm if you have an Incumbent? Off Payroll Working Rules IR35 Applies. 2. Please confirm if you have an Incumbent? No 3. What is the IR35 Status of this Requirement? Off Payroll Working Rules IR35 Applies. 4. Since you are looking for 2 Cyber Security Specialists why is there only one requirement? DfT Will accept applications for 1 Specialist if it is a 1 person application, however if there are suppliers who can provide 2 specialists as part of 1 bid then DfT will accept the application as well. 5. Since you are looking for 2 Cyber Security Specialists, how are both supposed to complete each section within 50 or even 100 words? The word count will apply to each role, so essentially you can double the word count. 6. Could you explain how we fit 2 responses in to one given the word count? The word count will apply to each role, so essentially you can double the word count. 7. Our specialists have the required skills, certification and experience for this role. However, they don’t have an active security clearance. Please suggest if there is a way out? We have no desire to exclude qualified candidates who do not hold SC but are willing to obtain it. However, practicalities of delivering the work mean we will, other things being equal, favour bids that can provide people who already have clearance. 8. Will the DfT transfer and hold SC clearance for successful candidates? No, we only require evidence of clearance. 9. This is a requirement for 2 specialists, we have 2 specialists who would be of interest but can only submit 1 via DOS. Is it possible to send cv’s by email for review? You can submit the required return for each Specialist as part of one requirement. The word count will apply to each role. Essentially you can double your entry. 10. Hello, can you please clarify if this ‘specialists’ notice is the same as the ‘outcomes’ notice 13808 or are they separate requirements for different elements of the project? They are separate requirements for different elements of the Project. 11. Are you asking the supplier to provide 2 specialists or will you accept one specialist as part of this bid? DfT Will accept applications for 1 Specialist if it is a 1 person application, however if there are suppliers who can provide 2 specialists as part of 1 bid then DfT will accept the application as well. 12. If you are requesting 2 x specialists as part of this opportunity is the max £850 per day per specialist or is it the total daily rate for both specialists? The Max is £850 per day per Specialist. 13. Please may you expand on ‘Experience of User Research or Business Analysis’. It would be useful to understand why this experience is required, and what the objectives are. Additionally, do you expect any tools or specific methodologies to be used here? DfT's Digital Service includes user researchers and business analysts. An understanding of their approach and terminology would be beneficial, especially in understanding the change management aspects of our cyber security improvements. 14. With regard to ‘Familiarity with Microsoft products appropriate for medium and large enterprises and Google Cloud Platform’, is experience with architectural design principles appropriate, as opposed to archiectural design directly? Experience of architectural design principles will be acceptable, practical experience would be better. 15. Does this role require a resource full time or can this be covered off on a call- off basis against a statement of works? We want dedicated, full time resource as deliverables are not yet clear. 16. The DOS portal only allows a supplier to put forward one specialist for an opportunity.Normally when a buyer has a requirement for two specialists, as in this case, there are two seperate DOS Lot 2 opportunities. This allows suppliers to put forward two different specialists, one for each opportunity. How should suppliers proceed if they have two specialists they would like to put forward? You can submit the required return for each Specialist as part of one requirement. The word count will apply to each role. Essentially you can double your entry. 17. • Who is the existing DfT IT service provider/integrator?• Are the DfT planning to move to a Zero Trust security model or adapt existing secure perimeter segmentation? • In house.• We have already moved to an untrusted network model. Other aspects of zero trust might be considered in future. 18. Could you advise at what stage is the project currently at? Discovery. 19. Are you aware it is not possible to double the word count? It would mean only 50 words per candidate if proposing 2 candidates. If a Supplier wishes to provide a bid for 2 Specialists they can submit their 100 word criteria per Specialist to carwyn.jenkis@dft.gov.uk by the set deadline to mitigate these circumstaces. Apologies. 20. Are you aware it is not possible to double the word count? It would mean only 50 words per candidate if proposing 2 candidates. If a Supplier wishes to provide a bid for 2 Specialists they can submit their 100 word criteria per Specialist to carwyn.jenkins@dft.gov.uk by the set deadline to mitigate these circumstaces. Apologies.