Cloud Centre of Excellence - CloudOps Service

Tender description

Summary of the work Partner with NDA and Magnox to help drive adoption of Azure cloud and hybrid computing environments and close gaps in organizational cloud operations capability where they exist. Expected Contract Length 24 months Latest start date Monday 9 January 2023 Why the Work is Being Done NDA and Magnox have embarked on a journey to leverage the flexibility and speed of execution of cloud-based solutions. Although the initiatives at each organisation have differed in goal, the shared experience has been that several gaps exist in the ability of the organisations in their current state to effectively adopt cloud services. Cloud adoption requires a wholesale overhaul of organisational alignment of skills, process and policy to cope with the design, development and operation of cloud services. The successful supplier will partner NDA and Magnox by delivering a world class CloudOps capability. Problem to Be Solved NDA and Magnox are in the process of delivering our first cloud services and require a partner to support our cloud adoption journey, specifically covering the CloudOps function as the internal teams do not have the cloud capabilities required to deliver a world class CloudOps function. The core demand is for a supplier to provide 9x5 BAU/ticket support with 24x7 call out for incidents. Approximately 200 services will be required to be supported initially, covering NDA, SENDE, RWM and security. Throughout the engagement, it is expected that the supplier will focus on Observability, Security and Automation, alongside BAU requirements. Who Are the Users There are two user groups within the NDA and Magnox. Application development teams wanting to consume cloud based services. The second group is focused on the the integration points between cloud and existing on-premise services, such as the Security Operations Centre (GSOC). The organisations requires the cloud services to meet cloud best practices (CAF and CIS as a minimum) around observability, security and automation, covering service introduction, service operations, integrated identity management, alongside best of breed governance and resource management. Work Already Done An initial discovery phase has been completed, looking at two specific elements. Firstly for Magnox a cloud platform design has been defined and the environment built in readiness for a lift and shift migration from on-premise data centres. For NDA a separate environment has been built to house a reporting application, although further application on-boarding is expected. Alongside the environment build, a CloudOps strategy has been defined and agreed with senior stakeholders, as part of a wider cloud strategy exercise, covering DevOps, FinOps and the Operating model. Existing Team The successful partner will be working in a complex multi-organisation environment comprising Magnox and NDA architects, project staff, security, GSOC and managed service providers. Alongside the internal teams it is expected that the supplier will work with multiple other consulting and engineering firms that will be engaged to deliver specific point solutions (e.g. in the application development space). Current Phase Live Skills & Experience • Provide evidence of delivering CloudOps to organisations spanning IaaS through PaaS/Functions on Azure, managing services through ITIL or CAF related policies and procedures. • Provide evidence of delivering CloudOps support in the management of large, complex and highly secure cloud environments - spanning incident management, alerting, ticket management, platform management, capacity and configuration management. • Provide evidence of operating and reliably managing cloud services in a high paced IT transformation environment involving a significant number of services moving through the SDLC. • Provide evidence of managing hybrid cloud-based solutions. • Provide evidence of managing cloud-based solutions across complex tenancy models and multiple business units. • Demonstrate inter-operability management spanning server and M365 services (such as AAD and InTune) integrating across multiple support teams. • Provide evidence of driving CloudOps innovation and continuous improvement, demonstrating improved operational effectiveness throughout the contract engagement. • Provide evidence of how use of agile methods (backlogs management, orchestration and automation, IaC/SDN) have been used to drive transformation. • Provide evidence of managing and supporting cost optimisation and cost management (through tagging, service utilisation and reporting) to ensure efficient use of resource. • Provide evidence of implementing and managing Observability and Security through associated tooling and methods, for example the Cloud Control Framework. • Provide evidence of managing and integrating with internal Identity Management spanning personas and roles, user management (JML) and PIM. • Provide evidence of governance around quality-of-service reporting based on agreed SLOs/SLIs for RPOs/RTOs, supplier management and escalation, and how they have been used to drive operational and commercial excellence. • Provide evidence of your ability to provide resource that has appropriate security clearances (SC required). • Evidence how you will be able to rapidly ramp up resource to provide support at the point of contract signature, moving from resource based to outcome-based services. • Demonstrate how you would use pairing to upskill client staff. Work Location The work can take place remotely (within the UK) but it is expected that the team will also spend time on-site as needed Working Arrangments We expect the supplier to partner with NDA and Magnox to drive maturity of service throughout the organisations. To that end, we expect the successful supplier to pro-actively engage with our stakeholders, to encourage and support transformation activities, and to assist in the delivery of a world class solution. Therefore, we expect the supplier to drive ways of working, to work alongside internal service suppliers and integrate and change as needed - encouraging observability, security and automation. Security Clearance The team must meet SC vetting levels. No. of Suppliers to Evaluate 6 Proposal Criteria As above for this stage, a request for a written proposal will follow in the second stage Cultural Fit Criteria • Demonstrate experience consulting for a multi-business unit organisation with over 25,000 users • Demonstrate experience of working within a remote first working environment • Demonstrate multi-site consulting experience • Demonstrate experience working with modernising client technology processes • Demonstrate experience of working with organisations with varying paces of delivery and decision making • Demonstrate experience of consulting approach, and in running workshops both remotely and physically Payment Approach Capped time and materials Assessment Method Presentation Evaluation Weighting Technical competence 60% Cultural fit 20% Price 20% Questions from Suppliers 1. Are you able to sponsor SC clearance? Staff must be SC cleared in alignment with NDA policy and on boarding. 2. In respect to CIS acronym, are we referring to cloud security controls presumably and not cloud integrated storage CIS is Center for Internet Security (https://www.cisecurity.org) 3. In respect to the support requirement, does that pertain just to the two cloud platforms NDA and Magnox have stood up or is support to span the full model including on prem/hybridisation. If so, is there any high-level detail or architecture diagram that can be provided that details the on prem/hybridisation touch points The requirement is to manage and support the cloud tenancies for both NDA and Magnox. The on premises environment will continue to be managed by the current managed service providers although these may be added to the service at a future date. 4. In terms of providing the cloud platform support, what will be the access mechanism (guest access, azure lighthouse or cross tenant AD) The expectation is to act as the global administrators and help NDA and Magnox defining the best solution going forward working with Service Management and group IT security. 5. Please can you clarify the acronyms agreed SLOs/SLIs for RPOs/RTO Service Level ObjectivesService Level IndicatorsRecovery Point ObjectiveRecovery Time Objective 6. Please can you clarify what you mean by SDN? Software Defined Networking 7. Please can you clarify what you mean by server services Please advised where this is referenced. 8. Of the user base that requires BAU/ticket support – what is the percentage mix of technical to non-technical resources Technical resources amount to approximately 3% of the total user base, made up from NDA, Magnox and current vendor support. 9. And taking to one side what data there would be proprietary access (visibly), how sensitive is the nature of the actual data that resides within the platform (from a network travel/transit perspective There is a combination of official, official sensitive and sensitive nuclear information, special category personal data. 10. Clarification of Scope – does this include the transition or transformation of the current on-prem infrastructure in to Azure? The requirement is to manage and support the cloud tenancies for both NDA and Magnox within the current Azure environments. The transition and transformation of the current on premises infrastructure will be part of future scope of works. 11. Does this service require its own service desk function or will the team integrate into NDA’s? It is envisaged that as part of the management of the environments any service desk function would be managed by the vendor and also integrated with NDA and Magnox’s existing service desks. 12. What level of support is required? 1st/2nd/3rd? The support requirement will be for 1st, 2nd and 3rd level support. 13. What is the budget for this programme of works please? It is for the bidders to submit their proposals at this stage. 14. Are you able to sponsor SC clearance? Or you are expecting SC clearance to already be in place? Staff must be SC cleared. 15. Can you provide the secured budget for this procurement? If you do not have an exact budget can you please provide a budgetary range for this procurement? It is for the bidders to submit their proposals at this stage. 16. In one of the evidence questions you mention “moving from resource based to outcome-based services”. Can you provide more detail on what you expect from the supplier? Is the engagement going to start with specific resources and then move to an outcome-based service? There is a desire to move toward outcome based as the cloud operations model is developed alongside the implementation of Service Integration and Management (SIAM).As we move to the outcome-based service, we are looking to improve the current service in multiple areas including end to end support of the cloud service including day to day operations, analytics and reporting, patching and compliance, security, networking, performance, automation, integration with on premise. These align to the five pillars of the well architected framework. 17. If you are seeking an outcome based service will this change the pricing structure from capped T&M (which it typically used when providing resources by the day)? There is a desire to move toward outcome based as the cloud operations model is developed alongside the implementation of Service Integration and Management (SIAM). 18. You mention that approx 200 services will be required to be supported initially. Do you have a roadmap that you can share highlighting the scale (servers and services) that are to be migrated to the cloud and over what timeline? What is the final number of servers that you are moving to the cloud? The roadmap for services is being developed. At present the scope is 200 services however this will increase over time as the group evaluates existing services and new solutions for cloud adoption. 19. Is there an expectation that the successful supplier will assist with migrating workloads to the cloud as well as performing the cloud operations services? The requirement is to manage and support the cloud tenancies for both NDA and Magnox within the current Azure environments. The migration of additional infrastructure and services will be part of future scope of works aligned to the group roadmap. 20. You have defined one of the user groups as Application Development teams. Can you provide more details on the types of application developments that are currently ongoing? Are these agile bespoke developments. Are these being delivered by NDA/Magnox staff, or by a 3rd party supplier? The primary development activity is in business intelligence and reporting using Microsoft Power Platforms (Power, BI, Power Apps, Data Lakes). This is being developed in partnership with Microsoft and Microsoft Gold Partners. 21. How much time on site will be expected and what types of roles will be expected on site? The requirement is to manage and support the cloud tenancies for both NDA and Magnox. There will be initial requirements for workshops as the service models are developed and implemented. There will also be a requirement for workshops on networks and integration. 22. You have stated, “The core demand is for a supplier to provide 9x5 BAU/ticket support with 24x7 call out for incidents”. Can you confirm that this is a 3 line support service with tickets being passed through a level 1 service desk and level 2 triage service? Also Do you have any estimate on anticipated ticket volumes, both in hours and our of hours? It is envisaged that as part of the management of the environments any service desk function would be managed by the vendor and integrated with NDA and Magnox’s existing service desks. The service requirement is as described as mentioned in the question and will also need to integrate with NDA and Magnox’s existing service desks for ticketing.There is limited information on the volume of tickets as the services have only been stood up. Please base your response on an average ticket volume across any estates you currently manage. 23. With regards to clarification question number 7, this relates to the following question: • Demonstrate inter-operability management spanning server and M365 services (such as AAD and InTune) integrating across multiple support teams. This is about managing and supporting multiple tenancies and demonstrating how the vendor would implement this. 24. Do you have a CASB (Cloud Access Security Broker) sat between the azure tenancies and on prem resources? We currently have Cloud App Security and Microsoft Defender for Cloud. 25. what is the nature of the connection between azure tenancies and on prem resources (VWAN, ExpressRoute, IPSec) At present the connections are site to site VPN although we are looking at strategic solutions. 26. Monitoring & Alerting – the requirement for 24x7 incident support is P1 only? What service monitoring tools are being used e.g. Azure Monitor, CloudWatch? Is there any integration with the ITSM tool of choice? The vendor should advise on their chosen monitoring and alerting solution as part of their tender submission. At present we are implementing Microsoft Defender, Microsoft Sentinel, and Microsoft Monitoring Agent/Azure Monitor. There is also a monitoring toolset for on premise servers provided by a third party Managed Service provider. There will be a future requirement for ITSM integration. 27. You have stated that you expect the supplier to provide 1st, 2nd and 3rd line support. Given the that the scope of the service is only for the Azure cloud platform, can you then provide more detail on how you expect the supplier’s 1st line support function to handle non-Azure cloud related incidents and requests? It is envisaged that as part of the management of the environments any service desk function would be managed by the vendor and integrated with NDA and Magnox’s existing service desks. 28. Can you please clarify if application managed service (AMS) is in scope? Application Management will continue to be managed by the current managed service providers although these may be added to the service at a future date. 29. Can you please share your expectations regarding SLOs/SLAs from the managed service provider? Currently we work to 4 hour resolution for major incidents and 5 day for service request fulfilment. 30. Can you please share the nature of services (approximately 200 services) required to be supported initially? The services mainly consist of Microsoft Windows servers with a few Linux servers. 31. Can you confirm that your expectation is that the supplier will act as a resolver group for Cloud Ops and that the supplier will integrate with an existing NDA/Magnox service desk? It is envisaged that as part of the management of the environments any service desk function would be managed by the vendor and integrated with NDA and Magnox’s existing service desks. 32. Please clarify what the ‘200 services’ are, including what components they run on. Please give examples. The services mainly consist of Microsoft Windows servers with a few Linux servers. 33. Please provide an estimate of VMs needing support / any physical servers requiring migration support. Currently there are approximately 200 servers. The roadmap for services is being developed and will define the requirement for servers and cloud managed services. There are approximately 400 servers that would be subject to initial review. 34. Please clarify how the services are currently managed. For example, infrastructure as code. The vendor is expected to provide guidance on implementation of best practises including infrastructure as code. 35. Does the Authority require additional support for key applications within the estate? Application Management will continue to be managed by the current managed service providers although these may be added to the service at a future date. 36. Does the Authority require a first line service desk, or would incidents be triaged from an existing one? It is envisaged that as part of the management of the environments any service desk function would be managed by the vendor and integrated with NDA and Magnox’s existing service desks. 37. What capacity is there for the Authority to participate in developing in-house cloud skills? This is currently under review. 38. How does the Authority see this service integrating with existing suppliers? It is envisaged that as part of the management of the environments any service desk function would be managed by the vendor and integrated with NDA and Magnox’s existing service desks.There is a desire to move toward outcome based service as the cloud operations model is developed alongside the implementation of Service Integration and Management (SIAM). 39. Please can you confirm who conducted the Discovery? This has been conducted by service / project teams and architects including using the Azure migration tools. 40. Please can you provide a procurement timetable indicating the dates you intend to shortlist suppliers, the submission deadline for Stage 2, and the date you intend to award the contract to the winning supplier etc.? There is a desire to commence the service as soon as possible. The dates below are indicative and subject to change. Where possible these dates will be brought forward. Key approximate dates are:20th Sep – 1st stage shortlist11th Oct – 2nd stage bidder responses25th Oct – 2nd stage shortlist31st Oct - 4th Nov – bidder presentationsw/c 11th Nov – Contract awardw/c 2nd Dec – Contract commencement 41. Re. your previous responses to CQ#1 and #14, we understand that you will need SC-cleared staff but normally public sector clients sponsor this once an engagement begins. Do your responses imply that this opportunity is only open to List-X suppliers (i.e. who can self-clear staff and provide SC-cleared resources from day 1) or are you simply asking for staff who have previously been SC-cleared and can relatively quickly be re-cleared to work for yourselves? Staff working on this contract must be SC cleared. However, suppliers without suitably cleared staff are not precluded from bidding for this work, and NDA will sponsor SC clearances for staff who don't currently hold a suitable clearance. 42. Please can you confirm if Stage 1 scores will form part of the overall evaluation for Stage 2? The evaluation and scoring will be in line with guidance provided on the DOS portal