CPD4122015 - Cyber and Technical Support for Councils

Tender description

Summary of the work Support local authorities to improve their cyber health by providing IT teams with remediation plans, advice, guidance and tools to make improvements to the security of their IT estate. Expected Contract Length Up to 1 year Latest start date Monday 25 October 2021 Budget Range Up to £1.3m (excluding VAT) Why the Work is Being Done As part of the Local Digital Declaration - https://localdigital.gov.uk/declaration - the MHCLG Local Digital team is looking to support councils in England to improve their cyber health and reduce their risk from malware and ransomware. Problem to Be Solved As part of the Discovery work into cyber security in local government, a survey of councils based on NCSC's tips for mitigating malware and ransomware - https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks - was completed. Based on the results, we are looking for a team to continue our work with councils, supporting them to make changes based on the survey findings through a process of engagement and creation of common guidance, advice, tools (e.g. scripts) and technical documentation to be made available more broadly to the sector. Focus areas identified include central logging, use of NCSC's Active Cyber Defence tools, use of 2-factor authentication and security of backups. Who Are the Users The team will be expected to work with IT staff at local authorities and also engage with senior and strategic leaders on occasion. As a cyber responsible person in a local authority I need to understand my organisation's cyber risks and the actions required to remediate them. So that I can carry out prioritised remediation work to reduce the risk from malware and ransomware. As a senior or strategic leader within a local authority I need to understand the cyber posture of my organisation and the priority of remediation work so that I can set strategic objectives, allocate resource effectively, and hold delivery teams accountable. Early Market Engagement n/a Work Already Done We completed a Discovery phase which included a survey of councils based on NCSC's tips for mitigating malware and ransomware - https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks During Alpha we engaged with an initial cohort of 34 councils through a series of briefings and workshops to validate their survey responses and agree a personalised Cyber Treatment Plan. Councils were provided with funding and technical support to address the remediation actions identified in their plan. Advice and guidance for common issues has been made available through regular cyber clinics and associated artefacts. An update on the recent phase of work can be found at - https://mhclgdigital.blog.gov.uk/2021/03/18/the-cyber-support-teams-technical-remediation-and-support-activities/ Existing Team This work is focused on supporting technical remediation at councils. We have commenced work on the other recommendations from our Discovery phase and there is an expectation that this team will work in partnership with other workstreams including sharing learning and any other artefacts. Current Phase Beta Skills & Experience • Demonstrate meeting skill requirements based on the anticipated composition of the team • Proven and demonstrable knowledge of IT security standards and assessments such as Cyber Essentials, PSN, NCSC's 10 steps and Government Minimum Cyber Security Standard • Recent experience of working with NCSC's Active Cyber Defence tools • Recent experience of coaching and supporting existing teams and individuals on technical topics • Recent experience of working with local authorities to provide similar support • Recent experience of creating technical assets (e.g. guidance and tools such as scripts) for reuse by others • Recent experience of running interactive sessions to upskill a wide audience inside or outside the organisation with differing levels of skill on technical topics Nice to Haves • Experience of presenting and explaining cyber and IT matters to non-technical senior leaders • Experience of 'working in the open' and regularly sharing findings with a wide audience inside or outside of the organisation Work Location The primary site is the MHCLG office located at 2 Marsham Street, London, SW1P 4DF. However current circumstances mean remote working is the default. Given the nature of the work is working with councils in England, travel may be neccessary. Travel/expenses to sites should be included in your costs and will not be reimbursed separately. Working Arrangments The supplier is expected to work alongside existing teams for face-to-face meetings. The supplier should demonstrate effective use of Agile principles and established project management approaches to enable progress to be monitored and issues resolved. The supplier will be expected to work openly and allow anyone in the sector to have visibility of progress including blogging and show and tells. Currently much of this work will need to be completed via video calling so the supplier should be comfortable using products such as Microsoft Teams and Google Meet with cameras on. Security Clearance CTC or above is desirable as staff will otherwise need escorting on site. If the successful supplier does not have CTC cleared staff, MHCLG will sponsor clearance. The supplier team will be expected to start this immediately after appointment. Please make it clear whether staff have clearance when submitting responses. Additional T&Cs 1. All outputs will be owned by MHCLG and published openly where appropriate using a suitable open license that supports reuse. 2. All materials/outputs derived from the contract shall be the property of MHCLG. 3. GDPR requirements will be discussed and agreed once the successful supplier has been notified (as part of discussions to agree the wording of the call-off contract). No. of Suppliers to Evaluate 4 Proposal Criteria • Approach and methodology to the work including how you will identify and implement iterative improvements to the existing process • Identified risks and dependencies and potential approaches to manage them • Team structure, including skill, experience and accreditation of individuals and their relevance • Added value of the proposed approach • Social value criteria: Theme 2 - Tackling economic inequality (10% of proposal criteria weighting) Cultural Fit Criteria • Work as a team with our organisation and other suppliers • Share knowledge and experience with others • Build trust quickly with users • Have a no-blame culture and encourage people to learn from their mistakes • Demonstrate understanding of the local government landscape and the spirit of the Local Digital Declaration • Demonstrate capacity for sensitive stakeholder management through effective communication and escalating issues to the right level in order to guide progress Payment Approach Capped time and materials Assessment Method • Case study • Presentation Evaluation Weighting Technical competence 35% Cultural fit 15% Price 50% Questions from Suppliers 1. Please can you clarify how the 10% of the evaluation for social value maps into your 35/15/50 split on Technical/Cultural/Price? The 10% weighting for Social Value is incorporated as a sub-weighting within the proposal criteria. So the full breakdown of the weightings is Technical 25%, Social Value 10%, Cultural Fit 15%, Price 50% 2. Is it permissible for a member(s) of the team to be based outside of the UK? Unfortunately not. We will require team members to be based in the UK. 3. Is there an incumbent organisation already in place to deliver this work? No. A previous phase of this work ended earlier this year and the supplier has been off-boarded. 4. We note the number of councils involved during the early discovery phase, but how many will need to be consulted during this phase of the task? Our estimate is c.110 councils, including continued engagement and quarterly check-ins of those supported in earlier cohorts as they progress their treatment plans.Where there is a common need we would encourage briefings, guidance and other artefacts etc. to be made available more broadly to the sector so that those that aren’t directly engaged in this phase of work can also benefit. 5. We understand that 34 council’s were included in the initial cohort, could you please confirm the number of council’s this contract seeks to support? Please see response to question no. 4. 6. Could you please confirm the anticipated timescale required to successfully deal with remediations at each council in terms of whether a funding quota is to be used? Based on the previous cohort, the time spent and the type of support for each council will vary. The aim is to always work with, and build capability within, the council team to deliver sustainable change. We expect the supplier to provide a range of options to provide the best value for money and appropriate to the issue, such as (but not limited to) 1:1 support, group workshops, design reviews, written guidance or other artefacts such as configuration scripts.We would welcome views on how you would prioritise requests and time to ensure a single issue/organisation doesn’t monopolise time. 7. We understand that this work is focused on supporting technical remediation at councils, could you please clarify the scope of the technical remediation e.g. Is this covered within your referenced blog post detailing the 7 key highest impact areas? Yes, but as we work with more councils and learn more, we are open to reprioritising the areas we focus on. 8. Please can the buyer confirm whether there is an existing incumbent supplier in place that has been working on this opportunity to date? Please see response to question no. 3. 9. Can the authority clarify what is meant by ‘scripts’ in the context of creating technical assets. Should this be taken to mean the creation of custom coding or the creation of process playbooks and instructional documentation? It will be very much subject to the need found.Where appropriate we would expect the team to possess or be able to draw on a capability to create reusable artefacts that meet common needs and help accelerate work. A potential example may be a PowerShell scripts that could help make it easier for teams to deploy a configuration change, discover some information or scan for a vulnerability etc.These technical assets may complement any instructional documentation etc. 10. Within section Essential Skills and Experience, recent experience of working with local authorities to provide similar support, is asked for.We have experience providing similar support and services to other public and private sector clients – however these are not local authorities. Will this experience be considered relevant against this requirement? On this occasion, given where we are, we feel it important to ask for a supplier that has experience of working with local government and understands the relationship between central and local government. 11. What does the Authority anticipate the ideal team size to be to meet this need? That is for the supplier to recommend, dependent on the skill set of the individuals in the team and approach proposed. 12. Out of the anticipated 110 Local Governments, how many have completed the Mitigating Malware and Ransomware in Councils Survey? circa.70% currently - with further activity planned over the next few weeks to increase completion rates. 13. For the Digital Marketplace application, please confirm the written proposal is required at a later stage and only for the four (4) suppliers shortlisted to the next stage of the procurement? Yes, only the shortlisted suppliers will be required to provide a full proposal. At this stage, suppliers are required to provide evidence to demonstrate how they meet the shortlisting criteria. 14. Please can you confirm when you are looking to announce the shortlisted suppliers, and what timescales will be provided to complete the written proposal? We anticipate that we’ll be issuing the outcome of the shortlisting exercise by Wednesday 29 September. The shortlisted suppliers will then have two weeks to provide a written proposal. Please note that this is only an indicative timescale at this stage. 15. Please can you confirm the names of the 34x LA’s? We are able to confirm that they are located across England. 16. Will the buyer provide some assumptions on which to base T&S costs to ensure these are consistent across the potential suppliers? Whilst the majority of Covid restrictions have now been lifted, many teams are currently continuing to work remotely. Suppliers should therefore expect to spend much of their time providing support remotely and where appropriate, and agreed with the council, deploy to site.Suppliers will be expected to identify a maximum budget for T&S costs in the event that they are shortlisted to provide a full proposal.