WP2011.2: Establish a Programme to Accelerate Domains Transformation

Tender description

Summary of the work Establish a programme to accelerate a multi-year transformation that will change the way that the public sector keeps its domain names secure. Expected Contract Length 5 months Latest start date Monday 1 November 2021 Budget Range £200k Why the Work is Being Done This work supports the Cabinet Office's priority to strengthen and secure the UK. Secure government services depend on secure domain names. CDDO helps public sector organisations keep their domain names secure through an initial set of guidance (https://www.gov.uk/guidance/keeping-your-domain-name-secure), and providing focused support where needed. This work is being done to accelerate a multi-year transformation programme that will change the way that the public sector keeps its domain names secure. The programme includes some self-contained workstreams that can commence early that will bring the overall programme schedule forward and thus reduce the overall cyber risk to the public sector. This work is one of these self contained workstreams, and it is to be completed by March 2022. Problem to Be Solved 1.Establish programme governance (~25% budget) - Set up the Programme Management Office - Confirm the SRO - Establish programme governance mechanisms with suitable cross-public-sector representation - Establish the programme in the context of delivering the Government Cyber Security Strategy - Establish a community of stakeholders and sponsors across the Public Sector. 2.Agree the programme outcomes and principal ways of working (~25% budget) - Confirm the Vision, prepare the Programme Definition Document and Blueprint - Confirm how we measure and demonstrate value - Confirm key success criteria - Show how we make the programme a success - Present options on what incentives can we apply - Show how will we overcome resistance - Define how benefits are to be measured and tracked - Define how risks are to be managed - Define a draft communications strategy. 3. Define the next phase of the programme (~50% budget) - Detailed programme of work - Detailed resource requirements for the programme - Detailed costings, and where they fall - Reconfirm the business case. Who Are the Users UK Public Sector workers who are accountable and responsible for their organisation's domains As the person responsible for a public sector domain name, I need to: - take business responsibility for my domains - take technical and operational responsibility for my domains So that: - I can manage my domain properly - my organisation's digital presence remains available - my organisation's digital services runs effectively - my organisation is trusted online by other government organisations, commercial organisations and citizens Early Market Engagement n/a Work Already Done The team has established some draft material and resources that will support and define the work. This includes: - an outline stucture for the multi-year domains transformation programme - a draft operating model for how public sector domains could be managed - good relationships with certain key stakeholders across the public sector - a prototype toolset that identifies domain configuration issues in public sector domain - successful engagement campaigns across the public sector that addressed certain domain configuration issues Existing Team The supplier will be working with the CDDO Domains team. This team includes subject matter experts. The team can provide material produced over the past two years to help guide the work. Current Phase Not applicable Skills & Experience • In depth experience of: - establishing cross-public-sector transformation programmes • In depth experience of: - delivering cross-public-sector transformation programmes • Experience of: - handing responsibility for delivering a transformation programme over to a third party • In depth experience of: - delivering a programme that involves meeting UK government cloud security standards • Experience of: - operating in a hybrid of Agile, waterfall and other project delivery methodologies. Nice to Haves • Working knowledge of: - Public Sector IT and security standards • Experience of: - delivering change programmes to central government departments and bodies • Experience of: - delivering change programmes to Local Authorities • Experience of: - delivering change programmes to Parish, District and County Councils • Experience of: - the DNS marketplace and global structure Work Location No specific region, they can work remotely. The domains team is normally based at The White Chapel Building 10 Whitechapel High Street, 7th Floor, London, E1 8QS Working Arrangments The supplier should be familiar with establishing successful UK cross-public sector programmes, and should be able to engage with key stakeholders autonomously to prepare and deliver the necessary work products. The supplier must be able to evidence key stakeholder support for its work products. The supplier can rely on CDDO to provide specialist domain knowledge. Security Clearance BPSS clearance required Additional T&Cs "All expenses must be pre-agreed with between the parties and must comply with the Cabinet Office (CO) Travel and Subsistence (T&S) Policy." "All vendors are obliged to provide sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets the requirements of GDPR and ensures the protection of the rights of data subjects. For further information please see the Information Commissioner's Office website:https://ico.org.uk/for-organisations/data-protection-reform/overview-of-the-gdpr/" No. of Suppliers to Evaluate 3 Proposal Criteria • The proposed approach and methodology - 20 points • How the approach identifies risks and dependencies and offers ways to manage them - 20 points • How the approach will make the programme a success - 20 points • How the approach will ensure the programme can be continued by another supplier - 10 points • Team structure and organisational makeup - 10 points • How proposed approach meets our timeframe - 10 points • Value for money of the proposed solution - 10 points Cultural Fit Criteria • Work as a team with our organisation and other suppliers • Transparent and collaborative when making decisions Payment Approach Fixed price Assessment Method • Case study • Work history • Presentation Evaluation Weighting Technical competence 75% Cultural fit 5% Price 20% Questions from Suppliers 1. When will suppliers receive an invite to the buyer presentation? The buyer presentation/ supplier Q&A meeting details are: WP2011 DOS 2 Supplier Q&AThursday, 9 September · 12:00 – 12:45Google Meet joining infoVideo call link: https://meet.google.com/dgf-wcuf-rhrOr dial: ‪(GB) +44 20 3956 6965‬ PIN: ‪486 999 045‬# 2. Please can the buyer confirm the status of the business case for this programme. Including whether it is outline/full, the level of approval and whether significant changes have occurred within your programme since it was written? Whilst this piece of work is approved and funded, the business case and approval for the multi-year programme is subject to Spending Review process 3. Have any 3rd parties already advised CDDO on what good looks like from a technical solution perspective? We're aware of what's happening internationally (eg the USA's .GOV Act), and we have our own in-house expertise, so we've developed an outline. There is another DOS opportunity (WP2011.4) that will develop this. 4. How closely is, or will, this programme and governance link to other orgs and their governance? (CDIO, GDS, Cabinet Office, NCSC etc.) Very closely. They will be key stakeholders. .gov.uk risk is distributed across the public sector, so there will be key elements of those organisations in the stakeholder group for this programme. 5. Besides operation of DNS Services (Technology), do CDDO have a view on whether they expect the Multi-Year programme to be run internally in CDDO or by/with Suppliers(s)? We won't know the answer to this until funding is settled. There will be a transformation programme phase and an operational phase. Some or all of that may be done in house or outsourced. 6. What scale of multi-year programme are you envisaging? We anticipate the transformation phase to be around three years, not including the current financial year, but we can't give any more detail right now. 7. Are there candidate SROs already shortlisted? No, there are some potential candidates but nothing is agreed yet. 8. You mentioned some issues that you especially cared about. Can you give some detail on those? An important issue is to help stakeholders keep in control of the their domains. We have rolled out a Registry Lock service to many domain holders that help with this. Many of the issues are described here: https://www.gov.uk/guidance/keeping-your-domain-name-secure 9. Is there a tension between your security advice & the approaches outlined in that page, and the desires/goals of other public sector bodies - I’m thinking of cultural or commercial resistance to getting onboard with your approach? Domain management is not just a technical or security issue, it's a business, cultural, commercial and legal issue. There is another DOS opportunity (WP2011.3) that is specifically intended to audit the business owners of .gov.uk domain names and their understanding of their domains. The purpose of this is to see how we can have the greatest influence. Our overall programme need to balance the technical side with the other aspects.There isn't commercial resistence but there is always a balance for where organisations apply their resources.