WP2011.3: Survey and audit the usage of the .gov.uk domain name

Tender description

Summary of the work Undertake a comprehensive survey and audit of .gov.uk domain name usage and responsibilities. The audit focuses on business, not technical responsibilities. Expected Contract Length 5 months Latest start date Monday 1 November 2021 Budget Range £290k Why the Work is Being Done This work supports the Cabinet Office's priority to strengthen and secure the UK. Secure government services depend on secure domain names. CDDO helps public sector organisations keep their domain names secure through an initial set of guidance (https://www.gov.uk/guidance/keeping-your-domain-name-secure), and providing focused support where needed. This work will accelerate a multi-year transformation programme that will change the way that the public sector keeps its domain names secure. The programme includes some self-contained workstreams that can commence early that will bring the overall programme schedule forward and thus reduce the overall cyber risk to the public sector. This work is one of these self contained workstreams, and it is to be completed by March 2022. Public sector organisations must recognise that domain management is a business problem, not simply a technical problem. This workstream is to raise awareness with business stakeholders across the public sector, and take a comprehensive survey and audit of their understanding of their domain namespaces. The audit will attempt to reach as many .gov.uk domain holders as possible. There are around 3500 .gov.uk domains and each engagement will require a level of effort to find the right person, get them to engage and answer the questions. Problem to Be Solved The purpose of the audit is to: - remind .gov.uk domain holders that they have a business responsibility to the whole of the public sector to keep track of their domains and subdomains, so they can be properly managed - understand the level of basic care that is given to .gov.uk domains and subdomains - understand from domain holders how they keep track of their .gov.uk domains and subdomains - identify any .gov.uk domains that domain holders don't know about, or don't know what they're used for, or no longer need, and address this. Wave 0: (~20% budget) - Create collateral - Agree plan, including target communities and numbers for each wave - Train team - Pilot audit (wave 0) with friendly stakeholders Wave 1. (~20% budget) - Audit wave 1 community - Analysis and report - Review plan for next wave Wave 2. (~20% budget) - Audit wave 2 community - Analysis and report - Review plan for next wave Wave 3. (~20% budget) - Audit wave 3 community - Analysis and report - Review plan for next wave Wave 4. (~20% budget) - Audit wave 4 community - Final analysis and report Who Are the Users UK Public Sector workers who are accountable and responsible for their organisation's domains As the person responsible for a public sector domain name, I need to: - take business responsibility for my domains - take technical and operational responsibility for my domains So that: - I can manage my domain properly - my organisation's digital presence remains available - my organisation's digital services runs effectively - my organisation is trusted online by other government organisations, commercial organisations and citizens Early Market Engagement n/a Work Already Done The team has established some draft material and resources that will support and define the work. This includes: - an outline stucture for the multi-year domains transformation programme - a draft operating model for how public sector domains could be managed - good relationships with certain key stakeholders across the public sector - a prototype toolset that identifies domain configuration issues in public sector domain - successful engagement campaigns across the public sector that addressed certain domain configuration issues Existing Team The supplier will be working with the CDDO Domains team. This team includes subject matter experts. The team can provide material produced over the past two years to help guide the work. Current Phase Not applicable Skills & Experience • In depth experience of: - conducting large scale and intensive UK public sector stakeholder engagement activities over a short period of time • In depth experience of: - conducting stakeholder engagement activities where technical issues need to be explained to business stakeholders • In depth experience of: - finding the right stakeholder, and getting them to engage, during a stakeholder engagement activity • In depth experience of: - conducting stakeholder engagement activities that involve meeting UK government cloud security standards Nice to Haves • Working knowledge of: - Public Sector IT and security standards • Working knowledge of: - how UK central government departments and bodies are structued • Working knowledge of: - how UK Local Authorities are structured • Working knowledge of: - how Parish, District and County Councils are structured Work Location No specific region, they can work remotely. The domains team is normally based at The White Chapel Building 10 Whitechapel High Street, 7th Floor, London, E1 8QS Working Arrangments We will provide - useful points of contacts within organisations who can help find the right people - specialist guidance to support the supplier in the development of their engagment plans and scripts. The supplier will be able to use this information to find exactly the right people and conduct the audit autonomously Security Clearance BPSS clearance required Additional T&Cs "All expenses must be pre-agreed with between the parties and must comply with the Cabinet Office (CO) Travel and Subsistence (T&S) Policy." "All vendors are obliged to provide sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets the requirements of GDPR and ensures the protection of the rights of data subjects. For further information please see the Information Commissioner's Office website:https://ico.org.uk/for-organisations/data-protection-reform/overview-of-the-gdpr/" No. of Suppliers to Evaluate 3 Proposal Criteria • The proposed approach and methodology - 40 points • How the approach identifies risks and dependencies and offers ways to manage them - 20 points • Team structure and organisational makeup - 20 points • How proposed approach meets our timeframe - 10 points • Value for money of the proposed solution - 10 points Cultural Fit Criteria • Work as a team with our organisation and other suppliers • Transparent and collaborative when making decisions Payment Approach Fixed price Assessment Method • Case study • Work history • Presentation Evaluation Weighting Technical competence 75% Cultural fit 5% Price 20% Questions from Suppliers 1. When will suppliers receive an invite to the buyer presentation? The buyer presentation/ supplier Q&A meeting details are: WP 2011 DOS 3 Supplier Q&AThursday, 9 September · 13:00 – 13:45Google Meet joining infoVideo call link: https://meet.google.com/yft-inij-nrgOr dial: ‪(GB) +44 20 3937 0230‬ PIN: ‪620 939 602‬# 2. Are you looking for suppliers with experience of working with central government departments (i.e. CDDO / GDS) or are you open to suppliers who have worked with specific government departments but still have understanding of gov.uk? The supplier does not have to have experience of working with Cabinet Office, CDDO or GDS. We are open to suppliers who have worked with other government departments but still have understanding of gov.uk. 3. Please can the buyer confirm whether suppliers are to use the Buyer’s survey/contact management tooling or if suppliers should use their own? Suppliers should use the Buyer's survey/contact management tooling 4. You mention both a one-to-one contact approach (i.e. "lots of people on the phone") or "survey and audit" one-to-many.... are CDDO specifically seeking/requiring one approach over the other or looking for the bidder to lead and define the approach? We're looking for a 1 to 1 approach, perhaps with an initial email, but probably lots of parallel one to one calls. 5. Are there any other campaigns currently running? None in CDDO but there could be things in other organisations (NCSC, GSG, etc) so we'll check this and coordinate before we do anything 6. Can you clarify what is meant by the Wave 0 "train the team" activity. Is this supplier's prepping their own teams or does it involve a wider community? It's the supplier prepping their own teamWe'll test the approach with a 'friendly' domain and organisation 7. If those entities do have other campaigns, will there be a need to deliver "shared campaigns" with them ? Our time is limited, so we won't get involved in shared campaigns. What we will be doing is keeping these entities informed as we proceed. 8. Do you have a thought on priorities for the groups for the audit? We'd like a consistent level of effort on all domains, irrespective of where they sit in the public sector.Stakeholders in central government/ministerial departments are probably easier to reach than those in the wider public sector. It'll be harder to find the people responsible in smaller orgs. We don't want to speak to outsourced suppliers, we want to speak to the business owner of the domain, and they may not have a technical background. 9. What is your view on success criteria in terms of %age completion? We want to be fair to the supplier and take an agile approach to the delivery.