PS141 - Security Assurance Spt to NSOIT, FS, MNO, ROSA, IUS, Evolve, and GC in DD

Tender description

Summary of the work Provide Security Assurance guidance and support to NSOIT, Future Secret, MNO, ROSA, Integrated User Services (IUS), Evolve (EUS, MPS & ERM, EMS, EMS Legacy), and Global Connectivity (GC) Projects and the Services they deliver. Expected Contract Length 9 months plus 4.5-month option to extend Latest start date Tuesday 3 January 2023 Budget Range The maximum budget is: £3,253,750.00 ex VAT Why the Work is Being Done Specialist Security advice to meet assurance and/or accreditation activities is required in order to ensure NSOIT, Future Secret, MNO, ROSA, Integrated User Services (IUS), Evolve (EUS, MPS & ERM, EMS, EMS Legacy), and Global Connectivity (GC) projects deliver key capabilities on time and fit for purpose. Problem to Be Solved Requirement to provide Security Assurance knowledge and expertise for all MODNET NSOIT, Future Secret, MNO, ROSA, Integrated User Services (IUS), Evolve (EUS, MPS & ERM, EMS, EMS Legacy), and Global Connectivity (GC) services. Who Are the Users For the tasks required, the 'users' are the Project Teams and our stakeholders. Work Already Done Many items (Projects) have already been started or are in the delivery phase and as such, the tasks are about refinement, further development and operation. Existing Team Supplier will be working with MoD military, Civil Servants, Contractors, Suppliers and Industry Current Phase Live Skills & Experience • Provide evidence of ability to conduct Technical security reviews/approvals of Supplier & MoD Design & Test documentation to ensure that it’s compliant with Defence Security standards & policy. 20% • Confirm experience of current JSP440 and JSP604 Accreditation, a mandatory requirement under Rule 10 of JSP604 (Network Joining Rules) to enable the NOA to issue the Authority to Operate. 15% • Detailed evidence must be shown of recent working experience supporting delivery in a large scale IT Environment (200k+ Users) using M365 and cloud technology. 10% • Recent working experience and clear evidenced understanding of the MOD estate (UK and Overseas), in particular Defence Digital and wider business practices in both the Official and Secret environments 10% • Evidence of making recommendations to project teams on the direction of key deliverables, where security risks/issues were identified, including raising/managing of security/risk-balance cases and any other security related documentation/artefacts. 10% • Evidence of when you have co-ordinated technical security documentation (e.g. Risk Statements, RBCs, AES etc) in support of CySAAS to support achievement of assurance and/or accreditation. 10% • As a minimum, confirm one of the following valid qualifications such as CISM, CISSP, ISO27001 Lead Auditor or ISO27001 Lead Implementor is held. 5% Nice to Haves • Illustrate expereince of Identification and management of security related risks to project delivery and Live Service. 5% • An example of management of security actions that arise out of Project Meetings and/or Security Working Groups. 5% • Provide evidence of adhering to Security Policy Framework (Oct 13)MR8 (ICT sys that handle protectively marked critical data, or interconnected to cross-gov networks/services undergo accreditation process ensuring risks managed). 5% • Demonstrate experience of mandatory risk management/info security outcomes detailed within SPF April 2014.(Requires MoD to deliver overarching responsibilities in areas of info security &risk man &supports application of protective security).5% Work Location Defence Digital, Ministry of Defence Corsham, Wiltshire Working Arrangments Base location will be Corsham, however individuals can work remotely but must attend Corsham when required. There is no T&S budget. Security Clearance Minimum Valid SC – with at least 1 DV cleared member of the Team (predominantly for GC) valid for Contract duration. Additional T&Cs Suppliers must use the Authority’s Purchase to Payment Tool called CP&F or be prepared to sign up to the tool. IR35: The MOD off-payroll rules do apply. Mod laptops will be provided No. of Suppliers to Evaluate 3 Proposal Criteria • Provide a technical solution and approach to the requirement. 25% • A Plan of action/milestones for delivery 20% • Illustrate value added activities which further improve delivery confidence 15% • Include the risks identified with approach and the solution to manage those risks 10% • Explain your approach in flexibility to potential changing Project requirements 10% • Provide team roles and structure 5% • Value for money/maximising investment 5% • Describe your approach to engaging with multiple suppliers 5% • Describe your ability to quickly draw upon/source other skills sets as and when required by the Authority 5% Cultural Fit Criteria • Illustrate your ability to work in a complex defence IT environment, whilst adapting to change and/or any potential new approaches to successful delivery 25% • Demonstrate your ability to work collaboratively and pragmatically within a team of Civil Servants and other Suppliers 25% • Give an example when you have been transparent and collaborative when making decisions ensuring a clear audit trail is available 25% • Provide an example of working at pace when managing / supporting multiple workstreams 15% • Provide an example that demonstrates your ability to work with and/or brief Senior Management, when having to deliver negative news. 10% Payment Approach Fixed price Evaluation Weighting Technical competence 60% Cultural fit 5% Price 35% Questions from Suppliers 1. Could the Authority please confirm whether the stated budget includes funding for the optional extension period, or just the core contract period? Budget is for initial 9 month period (core contract period). 2. The stated approved budget is £3,253,750.00. Is this for the initial 9-months only or does this include the 4.5 month option? Initial 9 months. 3. As the ‘projects have already been started or are in the delivery phase’ it has to be assumed an incumbent team is in existence & delivering this capability today, is this correct? And if it is, what is the current team size & skill set per individual team member? The incumbent is People Source Consulting Limited. The Authority cannot comment on current team size/skillsets. 4. Can you indicate/confirm how the budget sums referred to align with the initial contract period of 9 months.. or are intended to cover any of the extension option referred to as well? Initial 9 months. 5. Can the Authority please confirm the size of the current team (if applicable), and the size of the team required under this scope of work? The Authority cannot comment on existing supplier arrangements. Bidders are to propose the size of team to meet the requirement. 6. Is there a current incumbent or preferred supplier for this programme of work? The incumbent is People Source Consulting Limited.