103113 - Operationalising a government data checking gateway (process & technical design)

Tender description

Summary of the work DCMS requires a technical digital identity expertise to advise on operationalising the government checking gateway. Expected Contract Length 24 weeks with a possible two week extension in exceptional circumstances. Latest start date Monday 26 September 2022 Budget Range The maximum budget for the full scope of services is in the range of £110,000 to £120,000 (Excl VAT). Once shortlisted the bidders shall provide a Fixed Price for delivering the full scope of work including all fees, costs and expenses. This shall include incorporating comments and feedback from DCMS and our stakeholders, amending/refining deliverables where appropriate; creation, refinement and delivery of workshops and presentations. All pricing shall be exclusive of VAT. Why the Work is Being Done As part of the digital identity consultation response, DCMS announced plans to create a legal gateway to allow private sector organisations to make checks against government-held attributes from data sets held by departments. In order to operationalise this there are two areas we have identified as needing consultancy support: -Developing a centralised technical solution that checks that firms are trust marked before allowing access. -Defining a shared set of standards that underpin a single approach to making departmental data available, both within government and with the private sector. Problem to Be Solved We want to enable trust marked digital identity and attribute providers to check against government-held data for verification purposes. DCMS requires support in defining process maps to support potential paths to adopt a trusted list and means for allowing access to government-held attributes. Potential paths include: - a 'directory' to store and manage trust mark details, - a set of standards in order to simplify any integration and minimise proliferation of bespoke and custom interfaces, - a set of technical patterns and examples so that services and providers can see practical implementations to make it easier to understand how to use it, - a test harness and sandbox so that departments and providers can easily test their systems against standards to prove they have implemented them correctly before allowing live data and users into their services. An indicative timeline for deliverables would be: Week 1 - Kick off Week 14 - Presentation-1: Process maps for key processes, including resolved policy decisions to support development Week 20 - Presentation-2: Technical specifications and potential solutions Week 20 - Presentation-3: Requirements for governance and operations to support the infrastructure Week 23 - Menu of integration support materials Week 24 - Finalise and sign-off Who Are the Users The users will be identity providers, demonstrating that they hold the relevant trust marks to access government-held data. Similarly, public authorities will use the system to confirm that providers hold the trust marks. Relying parties will want to check the system to confirm that IDSPs are trust marked before accepting identities through them. Finally, users may check the directory to confirm that their IDSP is operating under the trust framework. Work Already Done DCMS has already undertaken initial thinking and a feasibility study to consider how to make it as easy as possible for departments to share their data with trusted organisations. We have explored the idea of using PKI infrastructure and standard API protocols for data checking. Existing Team The existing team consists of a market development expert, technical expert, and 2-3 policy development officials. Current Phase Discovery Skills & Experience • Demonstrated expertise in working with data security and verification. The supplier must have comparable experience and should list any relevant projects or contracts previously worked on (7.5%). • Demonstrated expertise in working with personal data, including personal attribute standards, on both a policy and technical level (5%). • Understanding of and prior experience in working with secure data infrastructure (5%). • Understanding of the digital identity market including personal attributes, relevant legislation, regulation and technical approaches (7.5%). Nice to Haves • Demonstrated experience in working on large digital identity programmes in either the public or private sector (2.5%). • Demonstrated success working in a complex environment with shifting priorities and competing stakeholder needs (2.5%). Work Location The appointed supplier's team can work remotely however the team must be available to travel to London in order to deliver interactive workshops/presentations to DCMS staff. DCMS, 4th floor, 100 Parliament Street, Westminster. SW1A 2BQ. Working Arrangments The supplier (team) can work remotely in normal office hours to deliver their proposed methodology but will be required to travel to London for in person meetings, presentations and anchor point workshops. Security Clearance All must have BPSS as a minimum. Additional T&Cs For the avoidance of doubt, a call off contract will be on the basis of a fixed price for the required services and no other charges of any kind are paid over and above the fixed price. No. of Suppliers to Evaluate 4 Proposal Criteria • A methodology to deliver the required services including key tasks and activities; a rationale for your proposed approach, engagement with the DCMS and key government stakeholders. (12.5%) • Plan for translating policy objectives into technical solutions into implementation plans (including commercial considerations). This should account for being in a large, complex environment with competing stakeholder needs. (7.5%) • Identification of risks, issues and dependencies, with considerations for how to mitigate them (10%). • Project Management proving that the methodology is achievable specifying project management techniques. Provide confidence that measures are in place to manage information and data appropriately (5%). • Demonstration that the supplier will allocate staff with appropriate level of seniority throughout the discovery phase (5%). Cultural Fit Criteria Describe effective measures and commitment your organisation will make to support health and wellbeing, including physical and mental health of staff, suppliers, customers and communities through delivery of the contract(10%) Payment Approach Fixed price Evaluation Weighting Technical competence 70% Cultural fit 10% Price 20% Questions from Suppliers 1. Will DCMS be providing additional ITT documentation after shortlisting? The shortlisted bidders will be provided with a document inviting their detailed proposal. 2. This advertisement states it’s for a discovery but is 24 weeks in duration. Has a discovery already taken place? If so, can you share how you undertook this discovery? This tender is required for the first phase of the project. Since announcing our plans to create a legal gateway to allow private sector organisations to make checks against government-held data, we undertook some initial analysis and identified a need for a centralised technical solutions that ensures organisations are trust marked before enabling data-checking, and a defined set of standards to underpin the data-checking process and make things easier for government departments and the private sector. 3. Is there an incumbent? No. 4. What is the make up of the team? As published on the opportunity - the existing DCMS team consists of a market development expert, technical expert, and 2-3 policy development officials.