CEFAS24-107 RFQ for exercises to test Business Continuity & Disaster Recovery

Tender description

CEFAS24-107 Request for Quotation for Provision of scenario-based exercises to test Cefas Business Continuity and Disaster Recovery Plans As part of business planning Cefas has the requirement to validate our business continuity, incident management, and recovery plans across our business. To ensure that these are current, accurate, effective, and complete, Cefas require the supplier to provide in the first year 3 quarterly virtual or on-site desktop exercises and an annual on-site live exercise. At the end of the first year the requirements will be evaluated for consideration of continuing with 3 quarterly exercises and an annual live or changing to 2 annual exercises, it is envisioned that the time and resources for 3 quarterly exercises will be equal to an annual exercise, however the bidder will need to confirm this in the pricing schedule. Requirement: 1. For year 1 to arrange, facilitate and manage quarterly desktop exercises and follow-up meetings/actions: 1.1. The quarterly desktop exercises will require the creation of a realistic scenario to be exercised in time jumps e.g. 1st hour real time, then 30 minute steps; 1st 30 min step jumps to 12hrs and 24hrs, 2nd 30 min step jumps to 24hrs. This will include the main Incident Management Team (IMT) or Disaster Recovery teams (DRT) (Gold, Silver and Bronze) or be focused on a single team (Gold, Silver or Bronze). The gold–silver–bronze command structure is a command hierarchy used for major operations by the emergency services of the United Kingdom. Some practitioners use the term strategic–tactical–operational command structure instead, but the different categories are equivalent. 1.2. The quarterly exercise must: 1.2.1. Include pre-exercise briefing 1.2.2. Validate the Incident Management structure in a response to an emergency 1.2.3. Enable the IMT or DRT, to practice their emergency response roles 1.2.4. Practice the functionality of the IMT or DRT in the event of a disaster 1.2.5. Provide an opportunity for the IMT or DRT to learn from the exercise and consider critical activities 1.2.6. Include feedback survey of those involved 1.3. At the end of year 1 for years 2 and 3 the exercise structure will be reviewed to determine if an extra annual exercise as per the requirements in section 2 below will be beneficial over 3 quarterly desktop exercises. 2. To arrange, facilitate and manage an annual exercise and follow-up meetings/actions: 2.1. The annual exercise will require the creation of a realistic scenario or scenario’s to be exercised in time jumps e.g. 1st hour real time, 2nd hour steps to 12hrs and 24hrs, 3rd hour 24hrs on. Depending on the scenario the exercise may include an evacuation test in liaison with Cefas Health Safety and Environmental Quality team (HSEQ), or liaison with Cefas suppliers either for input to the scenario, involvement in the exercise or both. Time jumps must contain injects to test the level of knowledge of the Disaster Recovery Team and create pressure for observation. 2.2. The annual exercise must: 2.2.1. Include pre-exercise briefing 2.2.2. Validate the Incident Management structure in a response to an emergency 2.2.3. Enable the IMT or DRT and other managers, to practice their emergency response roles, communications, and joint working across the organisation and with external parties, e.g. media, suppliers 2.2.4. Practice the set up and functionality of the IMT or DRT in the event of a disaster 2.2.5. Raise awareness of the importance of communications and social media in an Emergency Response 2.2.6. Provide an opportunity for the IMT or DRT to learn from the exercise and consider critical activities across the organisation 2.2.7. Include feedback survey of those involved 3. Provide an overview plan showing the proposed exercises for the first year at the start of the contract and a new yearly plan issued on an annual basis 4. A detailed plan of each exercise will be arranged in advance to plan dates and availability of staff, to be completed and agreed no later than 1 month before the agreed date of each exercise. The planning phase of each exercise will include: 4.1.1. Setting and agreeing the objectives to be achieved 4.1.2. Setting and agreeing the scenario 4.1.3. The methods used to achieve the objectives 4.1.4. Proposed dates, timing and training methods 4.1.5. An exercise plan that outlines the steps and injects 5. The output from each exercise (annual and quarterly) will include: 5.1. A hot debriefing directly following the end of the exercise 5.2. A formal debriefing within 2 weeks of the exercise 5.3. A comprehensive report including but not restricted to: 5.3.1. An executive summary 5.3.2. A timeline and narrative of activities 5.3.3. Recommendations for corrective actions 5.4. Quarterly follow-up meetings to check progress against the corrective actions (this can be combined with the quarterly desktop exercise) 5.5. The output from the annual exercise should feed the following quarterly desktop exercises with an aim to improve team performance 6. The effectiveness of each exercise will be assessed following the completion and issue of the final exercise report 7. It is expected that the initial annual exercise will take place during November 2024 with the quarterly desktop exercises to follow in February 2025, May 2025 and August 2025, and continue in these months on the following years or change to 2 annual exercises in November and May for years 2 and 3. The Authority may require Suppliers personnel appointed to work on the contract to comply with HMG Baseline Personnel Security Standard. Suppliers should note that they will be required to supply all necessary information and documentation needed by the Authority to enable such checks to be made before the commencement of any contract and the Supplier must meet the costs associated with carrying out such checks. Deliverables: 1. Provide an overview plan showing the proposed exercises for the first year a. To be delivered by October 25th 2024 2. First year initial annual exercise as per above requirements a. To be delivered by November 2024 3. Quarterly exercises as per above requirements a. To be delivered by February 2025, May 2025 and August 2025 4. Provide an overview plan showing the proposed exercises on an annual basis a. To be delivered by October 24th 2025 and October 23rd 2026 b. Deliver exercises to the agreed plan(s) in 4.a.