WP2011.4: A fully documented baseline operating model for the .gov.uk domain and its subdomains

Tender description

Summary of the work Develop an existing draft into a fully documented operating model for how public sector organisations manage the .gov.uk apex domain and every domain beneath it. The completed model will support a multi-year transformation programme that will change the way that the public sector keeps its domain names secure. Expected Contract Length 5 months Latest start date Monday 1 November 2021 Budget Range £275k Why the Work is Being Done This work supports the Cabinet Office's priority to strengthen and secure the UK. Secure government services depend on secure domain names. CDDO helps public sector organisations keep their domain names secure through an initial set of guidance (https://www.gov.uk/guidance/keeping-your-domain-name-secure), and providing focused support where needed. This work is being done to accelerate a multi-year transformation programme that will change the way that the public sector keeps its domain names secure. The programme includes some self-contained workstreams that can commence early that will bring the overall programme schedule forward and thus reduce the overall cyber risk to the public sector. This work is one of these self contained workstreams, and it is to be completed by March 2022. A draft operating model already exists. The basic structure and key components are known. The draft model was created through user research, business analysis and interviews with specialists. More such work is required to flesh out and fully document the operating model. Problem to Be Solved The operating model is a set of ways of working and service levels for the .gov.uk apex domain and every domain beneath it. Local domain holders will be responsible for applying and flowing the model down. The model addresses: - Understanding who owns what - Legal, policy and brand protection, and how this is implemented - Standards, guidance and best practice that protect the domain space - Standards that protect services using the domain space - Registry and registrar service framework, including security, availability, performance, legal, service support, pricing. - Supplier management - Operational support - Monitoring, review and improvement. Work outline Milestone 1: (~10% budget) - Baseline existing model - Identify stakeholders - Agree engagement plan Milestone 2: (~30% budget) - Engage with representative central government .gov.uk domain holders across the public sector - Baseline existing draft reqirements and evaluation criteria for the procurement of potential future DNS services Milestone 3: (~20% budget) - Engage with representative wider public sector .gov.uk domain holders across the public sector Milestone 4: (~20% budget) - Deliver legal, policy, brand protection and supplier management aspects of the model Milestone 5: (~20% budget) - Deliver technical standards, guidance, and operations aspects of the model Who Are the Users UK Public Sector workers who are accountable and responsible for their organisation's domains As the person responsible for a public sector domain name, I need to: - take business responsibility for my domains - take technical and operational responsibility for my domains So that: - I can manage my domain properly - my organisation's digital presence remains available - my organisation's digital services runs effectively - my organisation is trusted online by other government organisations, commercial organisations and citizens Early Market Engagement n/a Work Already Done The team has established some draft material and resources that will support and define the work. This includes: - an outline stucture for the multi-year domains transformation programme - a draft operating model for how public sector domains could be managed - good relationships with certain key stakeholders across the public sector - a prototype toolset that identifies domain configuration issues in public sector domain - successful engagement campaigns across the public sector that addressed certain domain configuration issues Existing Team The supplier will be working with the CDDO Domains team. This team includes subject matter experts. The team can provide material produced over the past two years to help guide the work. Current Phase Not applicable Skills & Experience • Experience of: - setting or applying domain name and DNS standards (including business, operational, technical and security standards) across a complex organisational structure with federated or autonomous local teams • Experience of: - writing clear and accessible long form guidance, documentation or standards to the GOV.UK style, as per https://www.gov.uk/guidance/content-design/writing-for-gov-uk • Experience of: - working at enterprise-level with DNS Registries or Registrars Nice to Haves • Experience of: - working with ICANN, or applying ICANN standards • Experience of: - working with the global DNS marketplace • Experience of: - working with domain name corporate branding services • Working knowledge of: - Public Sector IT and security standards • Experience of: - operating in a hybrid of Agile, waterfall and other project delivery methodologies. Work Location No specific region, they can work remotely. The domains team is normally based at The White Chapel Building 10 Whitechapel High Street, 7th Floor, London, E1 8QS Working Arrangments The supplier should be able to apply business analysis and user research tools to engage with key stakeholders autonomously and so prepare and deliver the necessary work products. The supplier must be able to evidence key stakeholder support for its work products. CDDO will provide specialist domain knowledge and guidance, but for the supplier to be able to work autonomously it must have a stong understanding of internet domains, the DNS marketplace, relevant international authorities, relevant best practice and how other ccTLDs and gTLDs manage their domain namespaces. Security Clearance BPSS clearance required Additional T&Cs "All expenses must be pre-agreed with between the parties and must comply with the Cabinet Office (CO) Travel and Subsistence (T&S) Policy." "All vendors are obliged to provide sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets the requirements of GDPR and ensures the protection of the rights of data subjects. For further information please see the Information Commissioner's Office website:https://ico.org.uk/for-organisations/data-protection-reform/overview-of-the-gdpr/" No. of Suppliers to Evaluate 3 Proposal Criteria • The proposed approach and methodology - 20 points • How the approach identifies risks and dependencies and offers ways to manage them - 20 points • - How the approach ensures broad stakeholder support - 20 points • - How the approach facilitates broad adoption of the operating model - 10 points • Team structure and organisational makeup - 10 points • How proposed approach meets our timeframe - 10 points • Value for money of the proposed solution - 10 points Cultural Fit Criteria • Work as a team with our organisation and other suppliers • Transparent and collaborative when making decisions Payment Approach Fixed price Assessment Method • Case study • Work history • Presentation Evaluation Weighting Technical competence 75% Cultural fit 5% Price 20% Questions from Suppliers 1. When will suppliers receive an invite to the buyer presentation? The buyer presentation/ supplier Q&A meeting details are: WP 2011 DOS 4 Supplier Q&AThursday, 9 September · 14:00 – 14:45Google Meet joining infoVideo call link: https://meet.google.com/cuc-rzhf-vdyOr dial: ‪(GB) +44 20 3956 5883‬ PIN: ‪629 603 597‬# 2. This is out of scope for project.Hi, have looked at the requirements here, and while we have considerable operating model experience, we have nothing specific along these subject matter lines. However, we work with a operating model/ governance management platform, BusinessOptix, which is available on G-Cloud. This platform would assist greatly if the project is complex and then relevant to consider here.https://www.businessoptix.com/If we can help in any other respect, please ask. Many thanks for the information. 3. Do you have a working assumption regarding the registry/registrar supply chain for the gov.uk operating model? There is no working assumption about this 4. What does the CDDO team composition look like, and how much of that team's time is dedicated to this activity The supplier will have to work reasonably autonomously without us. The team is doing several other things in parallel 5. Are you looking for the supplier to deliver an outcome with the buyer reviewing deliverables, or will you be involved in the preparation of the deliverables? We're looking for the outcome to be delivered. We'll give the supplier raw material, review your draft outcomes, and give you feedback, but we won't be working with you on the outcomes. 6. Milestone 4 - what do you see as the success outcome for that? Is it built into the operating model, are you looking for the supplier to have a legally waterproof document produce as to how the domains are managed. Also is that Government Legal or 3rd party expertise required? 1. We need to help public sector organiations understand the legal implications of choosing a domain, and what the .gov.uk domain gives them. 2. We need to consider what legal and other support mechanisms we can use to help domain holders work within the operating model.We will be able to provide some access to Government legal advisers, but the supplier should have their own legal support too. 7. You have a baseline operating model. Do you know the extent to which that is valid, or does it need any significant level of change? It's in different places in different formats, some internally, some in ministerial submissions, and some in published guidance. So that needs assembling. In the last two years it's profile has increased in the higher levels of government, so there might be some levels of support that are available now that weren't available a couple of years ago.