Proc 688 - Biometric Cards Processing

Tender description

Summary of the work Immigration Technology Portfolio (ITP) is undertaking a technology refresh programme to re-develop a number of the technical services to orchestrate and manage the production of Biometric Identity Cards. As part of the technology refresh programme, a new microservice (Biometric Cards Processing) is needed to replace an existing legacy service. Expected Contract Length 2 years, with an option to extend. Latest start date Saturday 31 July 2021 Why the Work is Being Done Biometric Residence Permits (BRPs) are produced using the existing PKI Shared Signing Service (PKISS) to sign the card data and a bulk production service from DVLA to produce the cards. It is currently thought that BRPs will be required until at least 2024, or even beyond, until being replaced by Digital Status. In current As-Is architecture, the originating system Biometric Residence Permit Fulfilment (BRPF) sends card data to PKISS. The PKISS interface is used both to sign the card data but also to send the data to DVLA to control card production. This work is being done to; • Use HMPO Shared Signing Service: PKISS functionality is very similar to HMPO’s new Shared Signing Service (SSS) and a decision has been made to move the signing services from the existing PKISS Signing Service to the new Shared Signing Service provided by HMPO. • Provide Flexibility & Supportability: new system will be developed on a more flexible architecture, by separating the card production from the signing service, thus removing responsibility for card production from the signing service. Problem to Be Solved ITP is undertaking the technology refreshment programme to eliminate the pain points of the existing legacy system, by replacing it with a better, easily supportable system developed on flexible architecture. The new system eliminates below listed problems of current legacy service: • Support issues: The current legacy application has limitations given that it was designed for greater volumes, is a legacy system that is expensive to support. • Maintenance Problems: It represents a high risk given that many of its components are no longer supported and is being maintained by a dwindling supply of spare parts. • Replacement requirements: The current system needs to be replaced by June 2022. Who Are the Users The Biometric Card Production (BCP) system is the orchestrator the cards production process, initiated by Biometric Residence Permit Fulfilment (BRPF) system. BCP has no direct end-users hence BRPF system is the direct user and civil servants initiating the card production process in BRPF system are the indirect users. BRPF system (direct user) requires: • Ability to send card production requests as and when a new request it triggered by the case working fulfilment process • Ability to get real time updates on card signing, card production and failure statuses • Authentication (ex: oAuth client authentication flow) and secure data transfer • Reliability and performance of card production process • Capability to scale the process during peak usage months of the year, during which card production requests load is expected to rise significantly. • Data preservation as per high-level design architecture in order to support investigations on card production statuses and/or failures. Fuller details of the scope of requirements and Maximum/Target rates are available on application to IPTCommercial@homeoffice.gov.uk. Please cite 'Proc 688 - Further details' in the message title. Work Already Done The project team have completed Discovery phase for the new microservice with a clear understanding of existing As-Is Architecture, current process and services, high-level architecture of the new BCP service including integration with other systems, component diagrams, integration diagrams, high-level APIs and data exchange contracts sufficient enough for taking the system to Alpha stage. Existing Team The team consists of civil servants and specialist contractors. The project is being managed by the Immigration Technology Portfolio (ITP), working alongside multiple (internal and external) delivery partners. The successful bidder will be required to engage and collaborate across all groups delivering and maintaining services for the Home Office. Current Phase Alpha Skills & Experience • Demonstrate experience in with Event Driven Service Architecture, AWS cloud technologies, serverless architecture, microservices, containerization, open-source technologies and languages. • Demonstrate experience in building real-time event driven applications, API-based and file-based integrations with internal and external systems. • Demonstrate experience in designing and implementing robust, scalable security solutions. Being able to adopt HO DDaT security architecture guidelines and principles. • Demonstrate experience in DevOps, Jenkins CI/CD pipelines, cloud native application and dockerization platforms. • Be able to provide specific and relevant examples of previous work. • Demonstrate experience working collaboratively in a multi-vendor environment. • Have experience delivering projects using an Agile approach. • Demonstrate experience of working collaboratively with an in-house team, building skills and capabilities to support a smooth handover. • Demonstrate understanding of service-led/microservice architecture. • Have experience in developing, delivering and supporting code coverage, security and test automation. • Have experience in supporting and maintaining the applications, being able to provide knowledge transfer to Home Office civil servant staff. Nice to Haves • Evidence having successfully delivering Minimum Viable Product solutions within compressed timelines. • Demonstrate an understanding of Home office approach to technology, data and platforms. • Evidence experience in building services in alignment with HO DDaT architecture principles, Immigration Technology Platform (ITP). • Demonstrate experience of developing methodology, standards and strategies. Work Location Croydon or London. During the Covid period, remote working will be the norm. Working Arrangments The Immigration Technology Portfolio (ITP) is based in Croydon. Delivery Partner resources working at this location will need to ensure they comply with guidance provided by the Portfolio Security Team. Work from home or supplier’s office may also be required. Security Clearance Delivery Partner personnel need to be compliant with BPSS as a minimum, with people securing SC prior to working with live data. If working in a Home Office building, CTC clearance will be required. Due to the nature of the development, SC clearance is preferred. No. of Suppliers to Evaluate 3 Proposal Criteria • Evidence of experience defining and implementing new services in a cloud environment. (10%) • Approach and methodology with particular attention to agile and collaborative delivery. (5%) • Technical competence in the identified technologies/processes and delivery practices. (17%) • Demonstrable experience of working alongside clients and other delivery partners in co-located and integrated teams. (8%) • Demonstrate understanding of the challenges and critical success factors of implementing in a government agile / hybrid environment. (7%) • Risk: demonstrate experience in the identification of key assumptions, dependencies, risks and issues, with robust mitigation plans. (8%) Cultural Fit Criteria • Show ability to collaborate and communicate with personnel at all levels of the organisation in a diverse environment, including with other suppliers. • Show ability to be innovative and achieve value for money in all activities. • Show experience of successful collaborative working as part of a blended team sharing knowledge within the team. • Evidence how you actively promote diversity, inclusion and remote working. Payment Approach Capped time and materials Evaluation Weighting Technical competence 55% Cultural fit 15% Price 30% Questions from Suppliers 1. What is the budget for this opportunity? The procurement includes a price competition element. As such, it is for bidders to decide an appropriately-competitive price they wish to charge for their offering. 2. Can you please share the Budget for services in scope for 24 months Please see the response to Q1. 3. As the current stage is Alpha, does the scope for new vendor include transitioning from current team during Alpha and deliver Alpha? We have completed Discovery stage, but NOT entered into Alpha (this was an error in the advertisement). We want the delivery partner to take system to Alpha and all the way to Live and L3 support. 4. Is new Vendor expected to start work after Alpha is finished and deliver private beta and public beta? Yes, the delivery partner needs to take the system to Alpha, Beta and then all the way to Live. 5. Is new vendor also expected to move service to live and provide support? Yes. 6. If support is required, is new vendor expected to provide L3 with on-call support or does scope also includes L1 and L2? Yes, early life support and L3 with on-call support is required, but the scope does NOT include L1 and L2 support. 7. What is current Alpha team size and roles? Alpha has not been completed. 8. In Essential Skills to Have, can you please clarify what do mean by ‘Be able to provide specific and relevant examples of previous work.’Is Home Office asking to provide affirmation or provide case examples? Please provide case examples. 9. What specific capabilities or knowledge does the customer see as critical to partner selection? The essential and 'nice to have' attributes are set out in the published requirements. 10. Will the existing project team (civil servants and specialist contractors) continue to be part of the project, working in partnership with the chosen delivery partner? Existing team is the Customer-side team, it always remains and supports the engagement with successful bidder (delivery partner). 11. What are the roles and capabilities of the current project team that will continue to provide resource to the project? Please see the answer to the previous question. 12. Post COVID working, is the customer open to the delivery partner continuing to work remotely, coming to site for meetings as appropriate. "As the Immigration Technology Portfolio (ITP) is based in Croydon, Delivery Partner should be prepared to send resources to work at this location and willing to go through the appropriate security checks required.Work from home or Delivery Partners’ office will also be required and supported.However, exact details will be agreed from time to time." 13. "In Essential Skills to Have, can you please clarify what do mean by ‘Be able to provide specific and relevant examples of previous work.’When you say previous work, what is the service areas/capability for which you are looking for case examples?" "Relevant & specific experience on• Methodologies (agile, TDD, BDD etc)• Architectural Patterns : micro-services, event-driven architecture, serverless architecture, APIs etc• Technologies (AWS cloud, J2EE etc)• Security of systems (with APIs & file data transfers across organizations)• Home Office architecture familiarity (if any)• Biometric Cards Production domain (if any)• Any/all mentioned in the essential and desirable sections of the document" 14. What test automation and code quality tools does BCP program intend to uses? "• Test development / automation using junit, mockito, wiremock, tomcat embedded, Selelium, Cucumber, OpenPOJO, xmlunit.• Code coverage / security using BurpeSuite, Clare, Sonarqube" 15. "Be able to provide specific and relevant examples of previous work.” Can you provide guidance on which areas you are interested in case studies? Is this on the delivery of Biometrics, use of technologies within Home Office ITP, use of agile delivery or something else? "Relevant & specific experience on• Methodologies (agile, TDD, BDD etc)• Architectural Patterns : micro-services, event-driven architecture, serverless architecture, APIs etc• Technologies (AWS cloud, J2EE etc)• Security of systems (with APIs & file data transfers across organizations)• Home Office architecture familiarity (if any)• Biometric Cards Production domain (if any)• Any/all mentioned in the essential and desirable sections of the document" 16. Can you provide a link or further information about HO DDaT architecture principles and anything specific for Immigration Technology Platform (ITP)? "Home Office Digital Strategy:https://www.gov.uk/government/publications/home-office-digital-strategy/home-office-digital-strategy Home Office Technology Strategy:https://www.gov.uk/government/publications/home-office-technology-strategy/home-office-technology-strategy Government Service Design Manual:https://www.gov.uk/service-manual/browse HMG Security Policy Framework:https://www.gov.uk/government/publications/security-policy-framework NCSC Guidance: https://www.ncsc.gov.uk/section/advice-guidance/all-topicsGovernment Security Classification Policy:https://www.gov.uk/government/publications/government-security-classifications " 17. For the question “Demonstrate experience of developing methodology, standards and strategies.” can you provide some context? Is this to do with helping set-up internal methodologies, standards and strategies or industry wide? Any examples of helping organizations to develop strategies & standards so we can know that you are familiar with strategies & standards’ compliance as well as contribution. 18. Who from your team will be scoring applications for this opportunity and what positions do they hold? We don't propose identifying the evaluators: suffice it to say that they will be appropriately qualified and experienced for the role. 19. Can you please advise the timelines of this procurement (e.g. shortlisted companies notified, anticipated contract award)? Also, can you confirm if shortlisted suppliers will have the opportunity to present? We would expect the shortlisted suppliers to be notified towards the end of May, and the Stage 2 process being completed during June, with a contract commencement date in late July. No presentations are being used in this procurement. 20. Can we see the discovery outputs? This is available on request, as described in the published requirements, in the section 'Who the users are and what they need to do'. 21. Is there an incumbent supplier? There is no incumbent - work has been undertaken by contractors and civil servants, but changes have been made since then. 22. Can you please share links for ‘HO DDaT security architecture guidelines and principles’ Please see response to Q16. 23. "Have experience in developing, delivering and supporting code coverage, security and test automation. Can you please clarify what security aspects are you looking for?" "• Code coverage / security using tools such as BurpeSuite, Clare, Sonarqube• Test development / automation using junit, mockito, wiremock, tomcat embedded, Selelium, Cucumber, OpenPOJO, xmlunit." 24. "For ‘Demonstrate an understanding of Home office approach to technology, data and platforms. ‘Are you looking for a supplier to provide affirmation on understand of HO approach or you are looking for supplier to also provide experience?" The point mentioned is a desirable skill / experience, to see if the bidder has any familiarity / previous experience with HO technology, data and platforms. It may be useful to see if they have any.