Research into UK Data Storage and Processing Infrastructure Critical Systems

Tender description

Summary of the work DCMS require a team with good understanding of digital infrastructure to research critical systems and dependencies of the UK data processing and storage infrastructure sector; and to inform estimates of the financial and commercial impact of outages. Expected Contract Length Up to 4 months. Latest start date Thursday 24 November 2022 Budget Range The amount of work that can ultimately be completed is uncertain, due to significant external dependencies. To remove the risk of significant underspend, we commit to a minimum spend of 25 working days subject to supplier performance being deemed satisfactory. We have a maximum budget of £120k (excl VAT). This will include any and all expenses, which we do not expect to be significant. Why the Work is Being Done DCMS is seeking to better understand the data infrastructure sector in terms of key vulnerabilities, and the impact of risks materialising. "Data infrastructure" is the physical and virtual infrastructure privately owned and operated by colocation data centre operators (colo DC/DCOs), cloud service providers (CSPs), or those managed service providers (MSPs) which provide large-scale data storage and processing services. It does not include "enterprise" data centres that serve a single organisation or sector, such as government or financial data centres. We must understand dependencies between the interconnected systems that comprise the sector, any direct dependencies on other sectors, and the features on paper and in practice of dependency chains. “System” is a family of interrelated physical or virtual parts that together perform one or more functions. This will be used to map critical national infrastructure, and develop a Systems Dynamics Model (SDM). This in turn will enable us to more accurately and clearly determine what should be critical national infrastructure, effectively plan how impacts and scenarios can be managed, and evidence whether interventions would be value for money (by comparing the potential cost of a risk materialising against the cost of a proposed mitigation). Problem to Be Solved We seek the following data and insight across the UK data infrastructure sector: 1) Identify critical systems in terms of significant impact on the UK economy, way of life, essential services, public safety and/or national security. Collect details on them, or present reasonable assumptions in place of missing data where reasonable 2) Dependencies or other relationships between systems (and associated organisations and locations), including those one step removed in other sectors. 3) The mechanism(s) through which redundancy is achieved in the network, and how provision can be rerouted between systems. 4) Where appropriate, a methodology for estimating high-level monetary values (financial and commercial combined) for outage costs, by converting from capacities (e.g. m2, MW, Tbps, running instances). 5) Across all the above, we would also seek to understand where data or insight: -would be retrievable with more time; -is likely to exist but is not forthcoming from potential sources, and why; -is likely not to exist, but could potentially exist (e.g. if requirements were set for industry to collect certain data); -is unfeasible to exist. The above is in priority order, with 1 the highest priority. Work will have to be scoped to fit the budget. Who Are the Users This desk and interview-based research will produce data and insight to inform national policy. The users will be: - Internal DCMS, NCSC and CPNI teams mapping and managing in real-time UK critical systems - Internal DCMS team developing a Systems Dynamics Model to simulate cascade impacts through a system of nodes and dependencies in various scenarios (and estimating the sum cost of impacts) - Internal DCMS team developing long-term policy for UK critical systems (e.g. understanding risks, estimating the return-on-investment of mitigating risks) - Internal teams across UK government working on national critical infrastructure, that can learn from our insight and modelling in this area, and plan in relation to their own data infrastructure dependencies. Early Market Engagement A request for information was published to the Research and Insights framework. However after no response, the budget was changed and the selected framework changed to Digital Outcomes and Specialists. Work Already Done - Previous research gathered data on critical UK data infrastructure systems. We are not certain all have been captured, and understanding of dependencies remains limited. - Been notified of a separate piece of research being undertaken on behalf of the Telecommunications Infrastructure team (also DCMS), looking at business-to-business links and dependencies. We will coordinate closely with this project to reduce the risk of duplication. - Planned the development of an SDM, with which we intend to simulate the impacts of outage scenarios. This will initially use data we already have, and take account of new data produced by this project. Existing Team - Data Policy Analytical Team, Data Infrastructure Lead Analyst and Data Scientist - Data Infrastructure Security & Resilience Team, Policy Advisors The supplier will be supported to coordinate their work with a similar project being carried out by Advanced Capability Environment (ACE) on behalf of the Telecoms Resilience team. Current Phase Discovery Skills & Experience • Understanding of the infrastructure and services for storing and processing data provided by data centre operators, cloud platforms, and managed service providers with large-scale data storage and processing capabilities (10%) • Research skills relevant to collecting data and insight on the operations of technical organisations (8%) • Information management and security capability appropriate for managing information with significant commercial and security sensitivities (4%) Nice to Haves • Pre-existing data or insight on relevant systems (3%) • Pre-existing relationships or experience with relevant organisations that are likely to provide data or insight (2%) • Awareness of relevant security and resilience risks facing data infrastructure organisations (3%) • Understanding of the challenges that may be faced extracting data and insight on the data infrastructure sector (2%) Work Location The work can be completed from any location in the UK, although travel may be required to the DCMS team and/or offices of relevant companies. The DCMS team are based at 5th Floor, 100 Parliament Street, Whitehall, London, SW1A 2NH Working Arrangments The supplier is welcome to work in any arrangements that best suits them while delivering the project efficiently and effectively within its constraints. The supplier will be paid a day rate per staff member, enabling part-time working and changing of team size during the project. The supplier will need to staff the project sufficiently to have made significant progress by a review point in w/c 9th January. The supplier will need to be available for regular touch-points with DCMS (e.g. twice weekly), and to be able to contact and communicate with industry representatives when required. Security Clearance All must have BPSS as a minimum. Preference for contractors to hold SC clearance, as this will enable us to share greater detail on the Systems Dynamics Model being built, but not necessary. Additional T&Cs To ensure comparable bids, tenderers are asked to propose a team of 3 staff members. Successful supplier shall sign a non-disclosure agreement at contract award. Contract shall expire if DCMS determines: 1) no further research fits with its wider dependencies and timelines 2) all appropriate and proportionate avenues for research are exhausted 3) termination in accordance with terms and conditions (e.g. poor performance) 4) the £120k budget is exhausted 5) at 31st March 2022 In an event, an appropriate close-out period will be planned in. Expenses should comply with the DCMS Travel and Subsistence policy. No. of Suppliers to Evaluate 5 Proposal Criteria • Demonstrate a clear and appropriate methodology for delivering the requirements, including rationale; and providing confidence in your ability to deliver, with the most efficient and effective use of resources (8%) • Provide an initial high-level project plan, for this discovery project with a number of unknowns and external dependencies, that is realistic and achievable with a clear set of assumptions (3%) • Identify key risks and propose appropriate mitigation strategies. (4%) • Provide confidence the project will be managed effectively and with flexibility; including planned and adjusted to fit within time and budget constraints (6%) • Provide confidence that processes, systems and management proposed for use are robust, effective and efficient; and any key roles/responsibilities have been identified and appropriate individuals are assigned. (3%) Cultural Fit Criteria • Work as a team with our organisation and other suppliers (2%) • Be transparent and collaborative when making decisions (2%) • Demonstrate action to support health and wellbeing, including physical and mental health, in the contract workforce (10%) Payment Approach Capped time and materials Assessment Method Work history Evaluation Weighting Technical competence 56% Cultural fit 14% Price 30% Questions from Suppliers 1. What are the Data Infrastructure Security & Resilience team’s objectives? The team is responsible for ensuring the security and resilience of the infrastructure on which data relies. This includes understanding and mitigating threats and hazards posed to the UK’s data storage and processing infrastructure, corresponding to “Mission Four” of the National Data Strategy, found here: https://www.gov.uk/guidance/national-data-strategy 2. How will this research be used? The research will be used to:- more accurately and clearly map critical national infrastructure.- deepen our team’s understanding of the data infrastructure sector and its operations.- populate a systems dynamics model, which in turn will help us to a) more effectively plan how scenarios and impacts could be managed and b) compare mitigation cost against the current risk-adjusted cost to determine whether interventions would be value for money. 3. Is the data collected not just a snapshot in time? Given ongoing development in this area (e.g site expansion) data collected will necessarily reflect the infrastructure landscape as it currently is, and not how it will be in the future. 4. What are the limitations on data collection? To avoid scope creep, evidence gathering will focus on information closely linked to data infrastructure operators (inc. colo, cloud, relevant managed service providers). Relevant data is likely to relate to infrastructure operated by these organisations or one step removed in the dependency/customer chain. We will avoid expanding too far into (e.g) power, telecommunications networks. Our priorities for data gathering in the allocated time will be agreed at project initiation, building on the work completed last financial year. 5. What outputs should include as a minimum? As a minimum outputs should include:- Project initiation- Review of existing data and research- Datasets- A report or multiple reports summarising the data and/or providing insights - - Including details of methodologies and sources used- - If data should be refreshed regularly and if so, how and how frequently- - Also should evaluate existence, availability and means to access any relevant information not collected during the project.Close-out report- Explaining the work completed- Any instances in which our requests could not be fulfilled- Lessons learned for both buyer and supplier. 6. Can work be completed by foreign nationals or staff based abroad? Anyone working on the project requires baseline personnel security standard (BPSS) or equivalent security clearance. Moreover the supplier must demonstrate that they will put in place appropriate cyber and information security measures. Provided these conditions are met, foreign nationals and those based abroad should be able to work on the project. There is further information we can show any staff member that has SC clearance and is a British National, which may assist in the research but is not necessary to complete it.