Website development and managed hosting partner

Tender description

Summary of the work The ICO needs a partner that has the skills and experience to rebuild/migrate its Umbraco website to the latest stable and supported version, help us maintain and develop new digital services and hosted infrastructure, to meet the changing needs of our users and in line with relevant standards. Expected Contract Length Two years Latest start date Friday 18 November 2022 Why the Work is Being Done The ICO needs a partner with the skills and experience to rebuild our website at ico.org.uk, help us develop new digital services, and manage our hosted environment, on expiry of our current contract. Key dates: Contract expiry - 28 January 2023 End of life of existing CMS software version - September 2023 Problem to Be Solved The ICO needs an experienced partner that has the skills and experience to rebuild/migrate an Umbraco website to the latest stable and supported version, in line with the Government Service Standard; help us develop new digital services, and; maintain and develop our hosted infrastructure (Azure), to meet the changing needs of our users. Who Are the Users As a data controller (organisation), I need to pay/renew my annual data protection fee, so that I meet my obligation to pay the data protection fee. As an information rights practitioner, I need to be able to access practical guidance about data protection, electronic marketing and freedom of information so that I can meet my obligations under information rights legislation. As an information rights practitioner (including small business owners), I need to be able to self-serve, and use easy tools and/or contact the ICO to get the information and support I need, so that I can meet my information rights obligations. As a citizen, I need to be able to complain/report a concern about an organisation’s information rights practices to the ICO, so that the ICO can take action to improve the practices of organisations. As a citizen, I need to be able to self-serve and/or contact the ICO to get the information and support I need, so that I can exercise my information rights. Existing Team You will be working most closely with an ICO Product Owner (Digital Architect), Product Engineer (Developer) and Tester, who are responsible for the development of the services; communications team members who are responsible for the content, and; from time to time, ICO managers responsible for specific products and services. Current Phase Live Skills & Experience • have experience of rebuilding a website in Umbraco where there is no direct upgrade path from a previous version, that involves redesigning some aspects, as well as some ‘migration’. • have experience of developing, supporting and maintaining Umbraco-based digital services, including the latest versions of Umbraco CMS, and Umbraco Forms. • have experience of maintaining, extending, and developing new integrations with Umbraco and Umbraco Forms as required, eg open source projects and other third party services. • have experience developing, supporting and maintaining pages, forms and databases in ASP.NET and SQL. • have experience of meeting best practice coding standards, including compliance with OWASP, and WCAG 2.1/2.2 accessibility standards to at least AA. • have experience of developing/maintaining digital services with good information rights practices, including compliance with GDPR, and the rules on cookies. • have experience of building digital services that are fully responsive so they work on different devices. • have experience of managing the application lifecycle and ability to maintain and develop automated deployment processes for virtual infrastructure, and code. • have experience of managing and maintaining public cloud hosted environment to maintain appropriate security of information at OFFICIAL and up to OFFICIAL-SENSITIVE, in accordance with recognised frameworks. • have proven experience of agile project delivery, eg Scrum or DSDM, including processes to support structured, frequent changes • have experience of supporting public sector organisations in meeting the Service Standard (https://www.gov.uk/service-manual/service-standard). • have experience of managing and maintaining DDoS mitigation tools and public cloud disaster recovery. • have experience of managing DNS. • experience of developing and integrating Umbraco with modern integration services, eg Logic Apps, Service Bus, API Management. • ability to provide a helpdesk for logging faults and requests available 24/7, with normal support from 8am-5pm weekdays, and ability to proactively resolve major incidents 24/7 to SLAs. Nice to Haves • provide evidence of adhering to good data protection, electronic communications and freedom of information practices. • show evidence of supporting customers to become more self-sufficient, including skills and knowledge transfer to an in-house development team. • show evidence of operating in a way to support customers to meet open standards and avoid vendor lock-in. • show evidence of integrating Azure technologies with back office systems, especially with Microsoft Dynamics CRM, in the cloud and/or on premise. • show evidence of providing automated testing tools and ability to run automated testing. Work Location The ICO's head office is in Wilmslow, Cheshire. However, it's expected that most of the work will be completed remotely. We would expect there may be benefit to occasional face-to-face collaboration sessions. Working Arrangments The supplier's team would work in a multi-disciplinary team, working closely with the ICO's staff to plan, refine, develop, test, and deploy. We run two-week agile sprints. The supplier team members would attend regular standups, refinement sessions, reviews and retrospectives, all remote via video/audio and screen sharing. All work would be completed in the ICO's Azure environment. Azure DevOps is used to manage our backlog, user stories and deployments. Security Clearance Baseline Personnel Security Standard (BPSS) No. of Suppliers to Evaluate 4 Proposal Criteria • Relevance and depth of examples to meet all must-have technical requirements. • Evidence, examples of relevant approach and methodology. • Evidence, examples of providing solutions that meet user needs. • Evidence, description of ability to provide support in line with requirements, and appropriateness of SLAs (please state what your support SLAs are). • Relevance of team skills that would work on our services • Value for money Cultural Fit Criteria • work collaboratively, as a seamless, multi-disciplinary team with our collective skills complementing each other • work together in ways which enable us to prioritise, support our agility, and our collective and individual high performance • experiment together, learn and continuously improve, quickly learning and making changes if something doesn't work • thrive on delivering at pace and with impact • set clear objectives, make timely, informed decisions using evidence and insight, and measure and evaluate our work • take personal ownership and accountability for our work, learning from mistakes, continuously develop and celebrate our successes • embrace inclusive ways of working, and respect each other • actively encourage equality, diversity and inclusion in our working and thinking Payment Approach Time and materials Assessment Method • Case study • Work history • Reference • Presentation Evaluation Weighting Technical competence 55% Cultural fit 15% Price 30% Questions from Suppliers 1. Can you confirm you are using Umbraco 7 and which version of Umbraco 7 you are currently on? We are using Umbraco 7.15.7, and Umbraco Forms 7.5.4. 2. Do you use a specific payment solution? We use Global Payments HPP as our payment solution. 3. Where are the current assets hosted? Is this also within Azure? Yes, the site and services are hosted in the ICO's Azure tenant, within a subscription. All the site assets are hosted there. 4. Do you have a separate DMS? Please clarify if you mean Document Management System? If so, it's a no -- all the assets, including any documents, pdfs, and images, are all hosted within Azure Storage in the same Azure subscription as the rest of the site. 5. Can you provide any more information on the infrastructure? Size? Failovers? Pipelines? Release Management? Is this an area where you are looking for us to add value to as well? Suggesting improvements etc. The resources supporting the main Umbraco site (ico.org.uk) are mostly PaaS, with one virtual machine (IaaS) supporting the CMS. Other PaaS resources support the Register of fee payers (ico.org.uk/ESDWebPages/Search).The Welsh mirror site (cy.ico.org.uk) is hosted on a web app within the subscription. The Chatbot, available at ico.org.uk/for-organisations/data-protection-fee/, is also hosted within the subscription.The infrastructure is deployed across two Azure regions. During normal operation, the live services are served from the primary region. The secondary region hosts a DR service, a mirror of the Production environment resources.We use Azure DevOps to hold our pipelines and do deployments. 6. Does the current platform integrate with anything other than Dynamics? The back office integrates with two databases: the Public register database enables checks to stop organisations registering that are already registered, and; a database that holds ID numbers of those who've paid by card, to allow logging of card payments and to prevent organisations paying twice for the same registration.APIs are used for integrations with Global Payments (card payment service), Data8 (predictive address, Companies House lookup, and bank validation), Live chat, and Azure Queues, used for capturing data from our transactional services.We use Azure Integration Services to push data to the ICO; it is then ingested into Dynamics. 7. Can you please confirm which CMS version you are currently using (Umbraco 7.xx.x)? We are using Umbraco 7.15.7, and Umbraco Forms 7.5.4. 8. Will the “rebuild/migrate” be a lift and shift of existing content in the same look and feel with the same taxonomy, etc? Based on recent research, we anticipate that by and large, the overall site visual design and the components that make up the design will carry forward to the rebuilt site front end. We also expect that the site functionality from the user’s point of view will also carry forward. We expect that nearly all of the content will continue to exist on the rebuilt site. Some content may be migrated to the same place in the site structure, while other content will need to be rehomed. 9. Do you have a product roadmap that you can share that covers the new digital services? The ICO has recently completed a consultation on ICO25 (https://ico.org.uk/media/about-the-ico/documents/4020926/ico25-plan-for-consultation-20221407-v1_0.pdf), our strategic plan to 2025, which will inform our work and priorities in the coming years. There’s some detail about priorities for the coming year set out in the annex (pages 35-57). We expect that a number of the digital services outlined will require greater integration between our back office systems and website, and new designs that allow users to quickly find and determine if a piece of advice answers their question. For example to allow us to publish ‘one off’ pieces of advice to organisations and the public. 10. How many support tickets on average are raised a month? The average number of cases raised is between 4 and 5 per month, based on the first 10 months of this year. 11. Please could you advisea) whether the as-is service needs supportb) the proposed start date and length of any support contract that will be required? Yes, the as-is service would need support from the start of the contract. We would expect that some of the services would be retired as the rebuilt site is made live and then the new service would need supporting.We expect that the start date will be around the start of December 2022, depending on the completion of the procurement and allowing time to agree the contract. The expected contract length is two years. 12. How well is the current site documented, please? The ICO holds documentation that covers all the functionality that has been built over the past 4-5 years, which includes user stories, acceptance criteria and details of corresponding code commits. The ICO also holds the website code and configuration in our DevOps subscription. The existing supplier has provided an exit plan that includes providing further documentation about the infrastructure and functionality, as well as holding knowledge transfer sessions. 13. Which payment provider do you currently/do you plan to use, please? We use Global Payments currently. We have a contract with Global Payments to October 2023, at which time we will run a procurement process to select a new supplier. 14. Could you please share any existing infrastructure diagrams? We’d be happy to share infrastructure diagrams for shortlisted suppliers at the proposal stage. Broadly, the infrastructure consists of resources deployed into a single Azure subscription, with a Testing, Staging and Production environment existing in a primary region, and a disaster recovery (replica of Production) in a secondary region. The resources are mainly PaaS, so include Azure App Services, Azure SQL, Redis Cache, App Insights, Azure Storage, plus Azure Logic Apps for transactional services. The Umbraco CMS is deployed onto an Azure VM. 15. How do you currently manage your DNS, who is your DNS provider/management portal? The ICO uses Cloudflare for DNS management. We tend to manage our own DNS records day to day, with the supplier providing support as and when needed, and management oversight. 16. What DDOS mitigation services do you currently use, if any? We use Cloudflare for DDoS migitation and WAF. 17. Can you please confirm which security authentication is used for the CMS and for the website? CMS editors use the standard Umbraco and .NET membership provider for logging in. There are no login areas on the website. We use Azure Active Directory to manage access to the website infrastructure.In addition for the CMS, the CMS server is hosted on an Azure Virtual Machine and does not have publicly accessible domain. The CMS is within a virtual network requiring editors to install a VPN client to gain access. 18. Are you able to provide an update on why this opportunity has been re-issued? Are there any material changes? A procedural issue during the second stage resulted in our decision to re-start the procurement. No material changes have been made to this opportunity listing or the requirements. We’ve updated the procedure for how shortlisted suppliers will send their proposals, but the information we will be asking for will remain much the same; full details will be provided to shortlisted bidders. 19. Is this separate to the recent listing: https://www.digitalmarketplace.service.gov.uk/digital-outcomes-and-specialists/opportunities/18057? The previous listing has been withdrawn. This opportunity is a direct replacement. 20. Can you confirm if it is possible to provide more than one example reference against the specific listed criteria – especially the requirements around GDPR, good information rights practices, supporting customers to meet open standards and automated testing? You are welcome to supply multiple examples against a criterion, if you believe this best demonstrates your relevant skills and experience. Noting the word limit, please ensure you can provide an appropriate level of detail to demonstrate how you meet the requirement. 21. Hello, do you have a budget in mind, or at least a range of what budget is available? We also see that the chosen payment approach is Time and Materials based. Does that mean you will assign certain features/functionality a set budget, or do you have a set budget in mind, and you want to see how far that goes and how much work is possible. Thanks. We have not defined a set budget for this opportunity. We will be providing more information at the proposal stage about the breakdowns of costs that we are looking for. This will include some work that would be chargeable as time and materials, and other work that would be fixed price. We will be assessing value for money as part of the scoring at the proposal stage. 22. Hello, you state BPSS is needed for security. If your chosen partner does not have BPSS clearance, will you sponsor them as the project starts? Thanks. BPSS is the Government baseline personnel security standard. It ensures that basic pre-employment checks have been completed for people who, in the course of their work, have access to government assets. BPSS is not a security clearance and the ICO would not be looking to sponsor partners to complete these checks. More information is available at https://www.gov.uk/government/publications/government-baseline-personnel-security-standard 23. Could you confirm any indicative budget please? We have not defined a set budget for this opportunity. We are looking for suppliers to propose costs to complete the work and will be assessing value for money as part of the scoring. 24. What is the allocated budget for the migration and longer term service delivery? We have not defined a set budget for this opportunity. We are looking for suppliers to propose costs to complete the work and will be assessing value for money as part of the scoring. 25. What’s the budget for the project? We have not defined a set budget for this opportunity. We are looking for suppliers to propose costs to complete the work and will be assessing value for money as part of the scoring. 26. Is a generic response acceptable in response to the requirement for ability to provide helpdesk services? This requirement leans towards what support services are available rather than providing a single, specific contract example? Please advise. We do not anticipate that specific examples will be useful in demonstrating your BAU support services and you can discuss these in generic terms. It may, however, be beneficial to provide an example of support you have provided to effectively respond to a major incident.