Small Organisation Helper Service - to help Parish Councils adopt .gov.uk domains securely

Tender description

Summary of the work CDDO want a supplier to define and trial methods to improve the adoption and protection of .gov.uk domains by Parish Councils. The supplier must recruit PCs for user research; draft, deliver and review proposals for new ways of working; define KPIs and measure progress against these KPIs. Expected Contract Length 6 months for Discovery and Pilot phases. Latest start date Monday 16 January 2023 Budget Range Fixed price, excluding VAT not to exceed: £251,737 Why the Work is Being Done CDDO wishes to increase the adoption and secure use of ‘.gov.uk’ domains and modern cloud services linked to these domains across English Parish Councils, Parish Meetings, and small Town Councils. This would bring a step change in the country’s cyber resilience at the foundational tier of our democracy because ‘.gov.uk’ domains are continuously monitored, and if they get subverted for malicious purposes this will be quickly spotted. Of approximately 3,500 third-level “.gov.uk” domains, around 1800 have been registered with Parish Councils. There are over 10,000 PC's in total, so many have chosen either to use a non-government domain, or not to have a domain at all. This may be because: - It’s hard for someone unfamiliar with current best security practice to know where to start to guard against, or help others to guard against the most common cyber threats - there are obligations that come with having a .gov.uk domain and it’s difficult to discharge these obligations without knowledgeable IT support This procurement is just for the Discovery and Pilot phase of this project. Future phases (alpha, beta, and live) will be subject to approvals, funding, and the successful delivery of this Discovery and Pilot phase. Problem to Be Solved Work with NALC/SLCC to recruit 5 PCs who don’t have a .gov.uk domain plus 5 PCs who do have a .gov.uk domain but finding it difficult to adopt it. Conduct user research and business analysis with each PC to identify barriers that exist for them to adopt a .gov.uk domain and modern cloud services. Work through CDDO/above bodies to recruit 10 .gov.uk domain registrars that provide services to PCs at different scales. The PC's registrars must be included. Conduct user research and business analysis with these registrars to understand support models they currently offer, and how they can be adapted to deliver the outcome. Define and trial its proposed methods to improve adoption and its pilot support model, with all participants in this discovery and pilot phase. Deliver: User research and business analysis notes from all engagements. A draft proposal for new ways of working, including: scalable methods for improving .gov.uk adoption by PCs changes to the support model provided by domain registrars to PCs The new ways of working deployed across all the PCs/registrars involved in the Pilot phase. A detailed review of how successful these new ways of working are, and any recommendations. KPI definitions/data to baseline progress. Who Are the Users As a Clerk to a Parish Council, I need: - my Parish to have a .gov.uk domain so that we can get the benefits of having a .gov.uk domain. - my Parish to have its IT services set up with a .gov.uk domain so that we can get the benefits of having a .gov.uk domain. - access to training and support so that my Parish Councillors and I can use our .gov.uk domain on our personal IT. As a Parish Councillor, I need - to understand what the benefits of having a .gov.uk domain are and why I should use it. - to have my personal IT configured properly so that I can use my .gov.uk domain for my parish business. - to know how to use my .gov.uk domain on my personal IT so that I can use my .gov.uk domain for my parish email. - to use my .gov.uk domain on my personal IT so that my Parish and I can get the benefits of having a .gov.uk domain. See: https://www.gov.uk/guidance/benefits-of-getting-a-govuk-domain?step-by-step-nav=5a9309a3-9a80-4faa-b24f-1797023e897f Work Already Done CDDO has undertaken some substantive work in this area, and can provide the findings of relevant user research, stakeholder workshops and business analysis undertaken recently. Existing Team The supplier must work with the National Association of Local Councils, County Associations, and the Society of Local Council Clerks to recruit Parish Councils who don’t have a .gov.uk domain. Plus Parish Councils who do have a .gov.uk domain but are finding it difficult to adopt. Current Phase Discovery Skills & Experience • Experience of: obtaining users for this requirement, who are not technically proficient to adopt modern IT • Experience of: delivering business and technical changes that improve how small organisations address their operational cyber security risks • Working knowledge of: how English parish councils operate, how they work together, the IT services that they consume and the ‘.gov.uk’ registrars that support them • Experience of: translating complex technical issues and security vulnerabilities into actions that can be understood and implemented by non-technical people • Experience of: delivering projects using principles described in the service manual, conducting comprehensive user research, designing/delivering services to meet KPIs, working with users to iterate and improve designs Nice to Haves • Working knowledge of: Public Sector IT and security standards • Working knowledge of: The Domain Name System (DNS) Work Location No specific region, they can work remotely. The domains team is normally based at The White Chapel Building 10 Whitechapel High Street, 7th Floor, London, E1 8QS Working Arrangments The supplier can rely on CDDO to provide specialist domain knowledge. We expect the supplier to meet with us virtually, using Google Meet or similar platforms. There will be no reimbursement for travel costs to meet stakeholders. Security Clearance SC clearance is helpful but not mandatory. Additional T&Cs "All vendors are obliged to provide sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets the requirements of GDPR and ensures the protection of the rights of data subjects. For further information please see the Information Commissioner's Office website:https://ico.org.uk/for-organisations/data-protection-reform/overview-of-the-gdpr/" No. of Suppliers to Evaluate 3 Proposal Criteria • The proposed approach and methodology - 30 points • How the approach identifies risks and dependencies and offers ways to manage them - 20 points • Please provide details of your overall team structure, including relevant roles, expertise and skills. Please also detail how this structure will deliver the requirements of this contract. - 10 points • How the approach will ensure the programme can be continued by another supplier - 10 points • Please provide work histories of all proposed team members - these will be scored as a set. - 15 points • How proposed approach meets our timeframe - 5 points • Value for money of the proposed solution - 10 points Cultural Fit Criteria Please provide evidence of a team which reflects the diversity of the nation. Payment Approach Fixed price Assessment Method Work history Evaluation Weighting Technical competence 75% Cultural fit 5% Price 20% Questions from Suppliers 1. The brief indicates substantive research has already taken place, with this in mind, is the focus of this project to use the existing research to prepare for and run the pilot, rather than start a new discovery? Broadly, yes. Some substantive user research has taken place, and we can share the findings of this with the supplier. However, we need the supplier to verify these findings through a small amount of further user research. 2. 2 of the skills-based questions for this discovery and pilot request evidence of experience related to business change for cyber security and security vulnerabilities. How important is having a cyber security expert within the bidding team. It is essential that the team that delivers this project has operational cyber security experience. 3. Is there any expectation that parish councils would need to achieve cyber essentials certification? No. Cyber Essential is not a precondition for participating in the pilot. However, the proposed new ways of working may call for it as part of an overall solution.