103147 - Operationalising fraud information sharing and threat analysis

Tender description

Summary of the work DCMS requires support to develop policy on fraud information sharing and threat analysis for the Office for Digital Identities and Attributes. Expected Contract Length 3 months, with an optional extension of up to 1 month (if required). Latest start date Monday 17 October 2022 Budget Range It is estimated that the work can be delivered within the budget range of £20,000 to £22,000, excluding VAT. Why the Work is Being Done As part of the digital identity consultation response, DCMS announced it was exploring potential formats to establish an information sharing function within the Office for Digital Identities and Attributes (OfDIA). Such a function would facilitate the sharing of information to help the detection and prevention of fraud and security incidents. DCMS has also commissioned expert advice that stated it would be beneficial to create an active threat analysis function as part of the OfDIA. DCMS needs to decide if and how it will achieve its policy objectives on fraud threat information sharing and analysis. Initial research highlighted two key areas that DCMS needs expert advice on: - Defining what kinds of information sharing the OfDIA should facilitate, and what operational design would best enable the kinds of information sharing recommended. - Deciding if the OfDIA should facilitate active analysis of threats to its operations and the digital identity market, and what operational design would best achieve this. Problem to Be Solved The project should ensure that fraud threats to the digital identity market are robustly analysed and market actors can effectively share information related to threats. To do this, the supplier will deliver outputs based on analysis using criteria set by the DCMS project owner (including but not limited to funding viability and effectiveness). All outputs should include a rationale based on the criteria set by DCMS. Implementing the recommendations is outside of the scope of this project. The supplier must deliver: 1. Papers with options and recommendations for: What kinds of information sharing the OfDIA should facilitate Whether DCMS should facilitate active analysis of threats to its operations and the digital identity market 2. A report recommending an approach to operationalise the design of: An operational function to share threat information in real time, such as a ‘shared signals’ structure A threat analysis function, outlining where the function should be housed, the scope of threats that should be analysed, and a high level description of what would be the next steps in its design. If the papers(1) recommend that one or both structures not be created, the report should outline the reasons for this in detail, including risks and implications. Who Are the Users The DCMS Digital Identity Team will use the outputs of this project to inform policy development related to the Office for Digital Identities and Attributes. If implemented, the structure that will have been informed by recommendations in this project would be used by the OfDIA, digital identity, attribute and orchestrations providers, relying parties and scheme-owners (including public sector organisations). Work Already Done DCMS has consulted on a fraud information sharing structure in its Digital Identity and Attributes Consultation (https://www.gov.uk/government/consultations/digital-identity-and-attributes-consultation) and commissioned expert advice on fraud threat analysis and information sharing. Both pieces of work recommended that a fraud information sharing and threat analysis function should be created. Existing Team The existing team consists of a policy adviser who manages the project, a senior technical adviser and the digital identity programme's Head of Certification and Assurance, who is a fraud expert. Current Phase Discovery Skills & Experience • Demonstrated expertise in working with fraud-management, analysis, information sharing and the role of digital identity. Must have comparable experience and should list any relevant projects/ contracts previously worked on (5%). • Understanding of the fraud information sharing and threat analysis landscape and the role of digital identity (2.5%). • Understanding of and prior experience in working with 'shared signals' infrastructures and the role of digital identity (2.5%). • Understanding of the digital identity market including personal attributes, relevant legislation, regulation and technical approaches (5%). Nice to Haves • Demonstrated experience in working on digital identity fraud mitigation programmes in either the public or private sector (2.5%). • Demonstrated success working in a complex environment with shifting priorities and competing stakeholder needs (2.5%). Work Location Remote working. If the appointed supplier would prefer to deliver workshops and/or meetings in person, then DCMS would be open to this suggestion. In person activities would take place at 100 Parliament St, London, SW1A 2NH. Working Arrangments The appointed supplier can work remotely in normal office hours to deliver their methodology. This can be a mixture of in person and remote working depending on best suitability. If the appointed supplier would prefer to deliver workshops and/or meetings in person, then DCMS would be open to this suggestion. In person activities would take place at 100 Parliament St, London, SW1A 2NH. Security Clearance All must have BPSS as a minimum. Additional T&Cs For the avoidance of doubt, a call off contract will be on the basis of a fixed price for the required services and no other charges of any kind are paid over and above the fixed price. No. of Suppliers to Evaluate 4 Proposal Criteria • Methodology including key tasks and activities: a rationale for your proposed approach, engagement with the DCMS team and key government stakeholders (17.5%). • Plan for how to translate policy objectives into operational structures (including commercial considerations). This should account for being in a large, complex environment with competing stakeholder needs. (7.5%) • Identification of risks, issues and dependencies, with considerations for how to mitigate them (12.5%). • Demonstration that the supplier has considered how to ensure that the work is consistent with other policy development projects being developed by the Digital Identity Team (5%). • Demonstration that the supplier will allocate staff with appropriate level of seniority throughout the discovery phase (2.5%). Cultural Fit Criteria Have a collaborative approach and take an interest in different projects happening across the programme that might have dependencies for the project in question. (5%) Payment Approach Fixed price Evaluation Weighting Technical competence 65% Cultural fit 5% Price 30% Questions from Suppliers No questions have been answered yet.