ISO 27001 surveillance audit and gap analysis for the VMD

Tender description

Summary of the work Qualified and certified ISO 27001 Lead auditor to review and measure the VMD IT activity in line with the ISO 27001 standard. Identify gaps and highlight specific actions to assist in transition from 2013 version to the 2022 version of the standard. Expected Contract Length 2 - 3 weeks Latest start date Monday 19 June 2023 Budget Range under £5,000 Why the Work is Being Done To improve IT security systems and meet ISO compliance within the Weybridge office. Gap analysis in transition from 2013 to 2022 version of ISO 27001. Problem to Be Solved Identification of IT security non-compliance within the VMD which could result in a data breach risk on site. Who Are the Users All VMD employees using the IT infrastructure need assurance that the systems and processes set in place are compliant to ISO 27001. Work Already Done ISO 27001 certification re-awarded October 2022 and repeated every 3 years. Existing Team VMD Information Technology Team Current Phase Live Skills & Experience ISO 27001 Auditing qualification (in date) Nice to Haves Government CTC security clearance Work Location The Veterinary Medicines Directorate, Woodham Lane, Addlestone, Surrey KT15 3LS Working Arrangments On site surveillance audit for 3 days. Further week to prepare and review findings and report. Security Clearance CTC counter terrorism clearance for unescorted access. Minimum of company credentials with a dedicated VMD employee to escort on site and in the office. No. of Suppliers to Evaluate 5 Proposal Criteria • approach and methodology • how they’ve identified risks and dependencies and offered approaches to manage them Cultural Fit Criteria • work as a team with our organisation and other suppliers • share knowledge and experience with other team members Payment Approach Fixed price Assessment Method • Work history • Reference Evaluation Weighting Technical competence 30% Cultural fit 5% Price 65% Questions from Suppliers 1. Do you need audit and gap analysis report as the deliverables? or you need the proposal for certification renewal as well? No need for certification renewal. This would be an audit with gap analysis between certification renewals. The VMD was certified in 27001 last year so certified until 2025. 2. Could you please confirm the number of employees in each location? The audit is only needed at 1 location, VMD office in Addlestone. There are approximately 130 employees currently working in VMD with hybrid working (3 days in the office / 2 days working from home on VPN).There are approximately 25 inspection officers who work remotely through the UK. 3. Could you please confirm how many locations will be part of the audit and gap analysis? Just 1 location, VMD office: Woodham La, Addlestone Surrey, KT15 3LS