Law Enforcement Cloud Platform (LECP) Cyber Security Operations Service

Tender description

Summary of the work LECP needs a Security Operations team to monitor and maintain the security posture of live operational services. This includes providing protective monitoring, threat and vulnerability management, and incident management, along with other operational day-to-day activities. The team will need to operate 24x7x365 on-call in response to security incidents. Expected Contract Length Up to 2 years with an early termination provision Latest start date Monday 12 December 2022 Budget Range TBD Why the Work is Being Done LECP is a secure, multi-tenanted cloud hosting platform that is law enforcement and policing assured. LECP is hosted on public commodity cloud and provides shared services to a number of national law enforcement applications. In line with industry Good Practice and HMG Policies, there needs to be a security operations wrap around the platform and the applications. Problem to Be Solved Provide a team to run the day-to-day security operations activities. This includes protective monitoring and threat and vulnerability management of the LECP platform and all of its hosted applications. Who Are the Users LECP needs a Security Operations (SecOps) team to monitor and maintain the security posture of live operational services. This includes providing protective monitoring, threat and vulnerability management, and incident management, along with other operational day-to-day activities. The team will need to operate 24x7x365 on-call in response to security incidents. Early Market Engagement None Work Already Done Security Operations is a mature and well-established service with a number of tools implemented and processed defined. This includes a set of protective monitoring use cases and playbooks. The supplier will be required to work with these. Existing Team The team will be working in a multi-supplier delivery environment, and will interact with other elements of the Home Office, including the Cyber Security Operations Centre (CSOC) and Enterprise Services, and Police Digital Services (PDS), including the National Management Centre (NMC). Current Phase Live Skills & Experience • 2 recent years in providing a Cyber Security Operations Service with a good understanding of investigating cyber security incidents and operating proactive security incident management • 2 recent years of security management of AWS native services e.g. S3, EC2, CloudTrail, CloudWatch, etc. • 2 recent years of security management of Windows and Linux operating Systems. • 2 recent years of Splunk Cloud (including Enterprise Security premium app), Nessus Manager, and Tenable.sc cyber tooling including use case development, configuration, onboarding and operation • 2 recent years of identifying and implementing continuous improvements to the Cyber Security Operations service • 2 recent years of responding to, and managing to conclusion, Cyber Security incidents as per agreed service level targets and in line with approved procedures. • 2 recent years of defining, maintaining and updating any work instructions and operational processes relating to cyber security. • Skills in threat and vulnerability analysis, prioritisation and remediation, including planning and reporting on a regular basis. • 2 recent years of providing assurance and managing the technical teams responsible for remediating, patching and upgrading the infrastructure in line with agreed policies. • 2 recent years of auditing the escalation of privilege when required. • 2 recent years of managing BAU Cyber Activity from multiple locations, if required. • 2 recent years of management of a Privileged Access Management Service. • 2 recent years of providing an on-call out-of-hours service should a Cyber Event occur. • Vetting to Security Check and Non-Police Personnel Vetting Level 3 or be able to obtain the required vetting. • 2 recent ears of leading onboarding of new services on to the cyber security capabilities. • 2 recent years of supporting IT Health Check or other Penetration Testing activities within the estate. • 2 recent years of securing a multi-tenanted public commodity cloud • 2 recent years of managing import and export requests from secure environments. • 2 recent years of producing and presenting clear and timely management and executive reports. • 2 recent years of supporting the transition from one security operation centre to another security operation centre. Work Location Croydon, London and remotely Working Arrangments Hybrid working, with the majority of time spent remote. Security Clearance SC and NPPV3. The Home Office will sponsor the clearances where required Additional T&Cs The Customer may, if it chooses, use its in-house resources, business units and other framework agreements to deliver specific services. The Customer will consult fully with the Supplier before exercising this right. Expenses will conform to Home Office internal travel and subsistence policies and will not be payable within the M25. Occasional travel to other Home Office locations may be required. The Supplier is expected to be available during these times. Home Office DDAT maximum rates for managed services will be applicable. No. of Suppliers to Evaluate 3 Proposal Criteria • Approach to the work, illustrating flexibility in team roles and multi-skilled personnel to meet LECP goals • How to be effective in a small, focused team • Team structure • Demonstrate Value for Money in your approach with transparent cost • Ability to plan and anticipate for risks and provide potential mitigations Cultural Fit Criteria • Demonstrable experience of working as a joint team with commissioning organisation and operating within its governance • Work in the open: be transparent and collaborative when making decisions. • Have a no-blame culture and encourage people to experiment, iterate and learn from their mistakes. • Take responsibility for their work. • Share knowledge and experience with other team members. • Challenge the status quo and be comfortable standing up for their discipline. • Approach to Social Value • Diversity and inclusion Payment Approach Time and materials Assessment Method • Case study • Work history • Reference • Presentation Evaluation Weighting Technical competence 65% Cultural fit 15% Price 20% Questions from Suppliers 1. Is there an incumbent Yes and we expect them to bid 2. What services are required specifically at initial stage The initial requirement is for the following resources: • 1x Security Operations Manager - SFIA Level 6• 1x Lead Security Operations Engineer - SFIA Level 5• 1x Lead Security Operations Analyst - SFIA Level 4• 2x Security Operations Analyst - SFIA Level 3/4This may be subject to change during the course of the contract 3. Do you expect the supply base to have resources in place for 12th December (start Date) Although start date is 12th December for agreement the existing contract does not end until 3rd Feb 23. The period between 12th December 22 and 3rd Feb 23 will be for handover. 4. Do you expect the supplier to be issued with Home Office resources (POISE Laptops etc) to access the security components and undertake the operational part of service delivery? Yes. 5. Please can you clarify “2 recent years”. Is it sufficient for evidence to be either within the last 2 years or 2 years in duration? The evidence must be within the last two years; it does not need to be two years in duration.