SME Data Essentials LMS

Tender description

Pre-market engagement We invited all suppliers on DOS6 and RM6219 to review our provisional requirements and indicate their capability and interest to provide the requirements. We received strong interest via DOS6 and decided to run the procurement via this route. Work done so far We have already completed a Discovery and Alpha (pilot) phase. Discovery was used to research and understand user needs, and explore the technologies that might be suitable for delivering the solution. This was followed by a pilot where we built a prototype and gathered feedback from users. The evaluation report from the pilot / Alpha phase is available here: https://ico.org.uk/media2/migrated/4024375/sme-data-essentials-final-evaluation-report.pdf Which phase the project is in Beta Existing team The ICO has a team set up that includes the following job titles and roles: Project manager to ensure the project happens and is properly managed; Website product owner to ensure the solution meets user needs and meets ICO standards; User centred design manager to set the standards of usability and accessibility; Business representatives: This team will provide the raw content via scripts in word or excel documents to be transformed into engaging, easy to use and understand, interactive learning materials. We need a supplier to supply and build the solution, including the population of content to take us through the public Beta stage, and provide training to ICO staff to support, maintain, manage and continuously improve the service ready for the Live phase. By go-live, in addition to being able to administer the system themselves, they must also be able to confidently create, upload and amend learning content independently. Address where the work will be done N/A Working arrangements Remote delivery. Key supplier staff should be contactable during standard UK working week. Expenses not applicable. Provide more information about your security requirements: Baseline Personnel Security Standard (BPSS) Latest start date 2025-09-11 Enter the expected contract length: 2 years Extension period: 1 year Write the term or acronym: ICO Write the term or acronym: LMS Write the term or acronym: SLA Write the term or acronym: SME Write the term or acronym: WCAG Write the term or acronym: DP Are you prepared to show your budget details?: No Confirm if you require a contracted out service or supply of resource Contracted out service: the off-payroll rules do not apply Summary of work The objective is to implement an e-learning solution which provides Small and Medium Sized Enterprises (SMEs) with a learning and self-assessment tool and enables them to demonstrate their commitment to data protection. It is anticipated that this requirement can be met with an off-the-shelf solution, with configuration and perhaps some customisation. Where the supplied staff will work No specific location (for example they can work remotely) Why the work is being done All businesses have a legal obligation to comply with data protection laws. We know that unlike their larger counterparts, Small and Medium Sized Enterprises (SMEs) do not typically have in-house expertise to help them maximise their use of personal data in a responsible way. The ICO is committed to supporting UK SMEs and making data protection as easy as possible. We have already produced and published a host of online resources aimed specifically at SMEs; but we need a stronger offering. The Information Commissioner has made a public commitment to Government to launch the SME Data Essentials scheme during 2025/26. This commitment can be viewed here: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/01/ico-response-to-government-on-economic-growth/ The Data Essentials scheme will help SMEs to: understand, meet, and keep up to date with the rules; self-assess their compliance with DP law;   publicly demonstrate a commitment to protecting personal information;    provide reassurance that minimum requirements are in place;  support them to build beyond the basic requirements and; bring down the cost of compliance. The business problem you need to solve We require a solution to deliver data protection training and compliance self-assessment to SMEs, that allows business to easily keep up to date with the rules, self-assess their compliance, publicly demonstrate a commitment to protecting personal information and their completion of the training, that is engaging and accessible, and reduces the cost of compliance for those businesses. We require support to deploy, host, and maintain the solution. We require support to produce engaging learning materials from the raw content already produced internally. We require knowledge transfer to enable our staff to administer the system and become self-sufficient in future creation/amendment of learning materials. We consider the key challenges to be: Provision of a solution that is aimed at users that are EXTERNAL to the ICO, ie customers, not staff. The ability for customers to complete training as an individual, then complete a self assessment and gain a certificate for their business. Achieving compliance with WCAG 2.2 to AA level, so that the service is accessible to all who might use it, and so that the ICO complies with its obligations to accessibility. Making the training materials simple and engaging, so that customers want to complete the training to the end and refresh it each year, so that they understand it, and so that they put their learning in to practice, improving their data protection practices and achieving our goal of reducing the cost of compliance. Making the logged-in account area re-usable, so that customers logging in for SME Data Essentials will be able to use the same login to access services that we plan to add in the future. First user type: As a small to medium-sized business First user type: As a small to medium-sized business First user type: As a small to medium-sized business First user type: As a small to medium-sized business First user type: As an ICO administrator Questions and Clarifications 1. If we fully support xAPI/cmi5/ACCI for tracking learning experiences, is SCORM compliance still a mandatory requirement, or would coverage of xAPI alone be sufficient for the purposes of the SME Data Essentials LMS? The requirement is that the solution must comply with relevant standards so that learning modules could be migrated to other platforms in future, to reduce the likelihood of vendor lock-in, and meet the diverse needs of users. The standards were given as examples. We would accept that meeting xAPI would meet the requirement, yes. Last Updated: 6 May 2025, 14:48 2. If suppliers propose a Platform-as-a-Service (PaaS) deployment, is there a preferred cloud platform for hosting (e.g., Microsoft Azure, AWS, Google Cloud) or will suppliers have discretion provided data processing requirements are met? Please propose whichever hosting solution would best meet the data processing and other requirements. One PaaS option you may consider would be hosting the solution in the ICO's Azure tenant. Note that if you are proposing this, you must still include what the hosting costs would be in your pricing. Last Updated: 6 May 2025, 14:45 3. We note the preference to avoid per-user licensing models. Could the Buyer clarify acceptable licensing models for the LMS and platform (e.g., open-source, perpetual licence, site-wide enterprise licence, or source code escrow arrangements)? The ICO does not have a preference for a particular pricing model - we are looking for a cost-effective solution (which provides the best value for money). There may be challenges associated with per-user licensing models, due to the variation in estimated user numbers over the contract term; however, bidders may be able to propose pricing structures that accommodate this effectively. We do have a preference for solutions that reduce the likelihood of vendor lock-in and/or address any risks/impacts at the end of the contract term. We would expect that as part of detailing your exit plan, and explaining how the service could be transitioned to a new supplier, you would cover how you will facilitate the exit and transition in light of any applicable licence terms. Last Updated: 6 May 2025, 14:41 4. Is there an incumbent supplier? No. Last Updated: 6 May 2025, 14:38 5. We bid for a similar scope of work with ICO in 2023. Can you please confirm if this scope of work is to run concurrently alongside this or is this a replacement? The earlier procurement was cancelled prior to contract award due to external factors which caused SME Data Essentials to be postponed. Last Updated: 6 May 2025, 14:26 6. Under technical specifications, there is requests to show how we will fulfil the specifications. Will you accept a secure video or, alternatively, embedded screenshots within the submission to support this? Further detail on stage 2 will be provided to bidders who progress to that stage. The "show us" criteria are intended to be covered during the presentation. Last Updated: 6 May 2025, 14:24 7. For this proposal, is there an approved format for bids to be submitted in, such as Word, PDF etc? For stage 1 responses against the Essential and Nice-to-have Skills and Experience criteria, there is no specific format requirement. However, a system-generated template response document is available via the CCS eSourcing solution. Bidders should note that the 750 character limit specified by the template is per criterion. Further information about the stage 2 response, including the written proposal, will be provided to bidders who progress to that stage. Last Updated: 6 May 2025, 14:23 8. Could you please confirm if there is an indicative budget range or maximum budget allocated for this call-off? Understanding the financial parameters will help us assess feasibility and ensure our proposal is appropriately scoped and aligned with your expectations. The maximum budget for 2025/26 is £500,000, to cover all set up and fixed costs for this financial year as well as costs relating to taking our first groups of users (numbers to be determined) through the programme both to test and then to launch it. This figure represents an upper limit, not anticipated expenditure. As a public body funded largely by statutory fees, we must, of course, ensure the programme provides value for money. We encourage bidders to propose cost-effective solutions that achieve our objectives. Last Updated: 28 April 2025, 10:49 9. In the pre-market engagement, there was a reference to WCAG 2.1 AA while the call-off mentions WCAG 2.2 AA. Can you clarify the exact compliance required on the contract start and if it is ok for the supplier to present a roadmap to achieve the required WCAG compliance post the contract start date? The required standard is compliance with WCAG 2.2 to AA standard. We recognise that accessibility compliance can be difficult and requires a level of effort over time. We would consider bids where the standard may not yet be met. These factors would be considered in our evaluation. We'd expect to see evidence in all bids that the supplier has the resources to ensure compliance is properly assesssed and can be met, and to provide assurance as to the standard met. Last Updated: 28 April 2025, 10:35 10. We would request more details around the raw content available with you – type of content (SCORM, videos, xAPI etc) along with the volumes. Also, the level of interactivity expected for the content? We will provide scripts for each module in Microsoft Word and some additional content in Excel. We will be led by the successful bidder on the most effective and accessible ways to engage the learner. Last Updated: 28 April 2025, 10:33 11. In the pre-market engagement, there was a reference to 20,000 users active on the platform for first year, increasing by 20,000 a year for for years 2,3,4 and 5. Is this a minimum commitment of user volumes across the contract? The user numbers in the published spec were amended due to updates to the business case. Whilst we are confident in the level of demand for the service, the advised numbers are estimates and should not be seen as guaranteed. Bidders should ensure any minimum cost base is covered by their proposed pricing model (in the stage 2 submission). Last Updated: 28 April 2025, 10:32 12. In the pre-market engagement, there was a reference to have up-to-date Cyber Essentials certificate. Will ISO 27001 acceptable instead of Cyber Essentials as it is a more comprehensive standard and demonstrates a higher level of commitment to information security? While we do have a preference for Cyber Essentials due to its focus on technical controls and alignment with UK government requirements, we do accept ISO27001 instead. Last Updated: 28 April 2025, 10:29 13. In the pre-market engagement, there was a reference to a preference for data processing and storage within a UK-based data centre. However, the current call-off documentation does not explicitly state a requirement for UK data residency and instead requests for GDPR compliance. Could you please confirm whether it is acceptable for data to be processed and stored in an EU-based data centre, provided full GDPR compliance is ensured? Yes, it would be acceptable for data to be processed and stored in an EU-based data centre, provided full GDPR compliance is ensured. Last Updated: 28 April 2025, 10:28 14. We understand the course will be used to train the UK based SMEs only. Please confirm if the understanding is correct. If not, please share the list of other countries who will be taking this course. That is correct. Last Updated: 1 May 2025, 11:26 15. Could you please share details of the total user count annually and concurrent user count who will be registering and taking the course? It's difficult to estimate expected numbers. The training will be available to SMEs. We want it to be seen as attractive and hope that customers will sign up and complete it, but there's no obligation for them to take part. Please refer to the estimated numbers in the specification (non-functional requirements section). To attempt to work out concurrent users: We'd estimate that most users would complete the material at perhaps 15-60 minutes at a time, returning a number of times during a period of perhaps 1-4 weeks. We tend to see most traffic on our website on weekdays between 7am and 10pm, with peaks around 11am and 3pm, and might expect users of SME Data Essentials to follow a similar pattern. Once a user had completed the e-learning and self-assessment and received a certificate, we'd expect that most users would not return to the service until the following year. To clarify, each individual that has registered for SME Data Essentials will be asked to complete the e-learning, which we have estimated at four hours of learning. One user on behalf of each organisation would then complete the self assessment. For estimating purposes, assume that users only complete the self assessment each year thereafter. Please also assume that users will be evenly spaced throughout the year, and throughout the day. Last Updated: 1 May 2025, 11:25 16. We have a slight doubt around the requirement – “Evidence of providing automated testing tools and ability to run automated testing”. Does it refer to the self-assessment tool required after course completion and whether it should support automated testing, or, is it a process oriented question asking how the QA/ testing of the overall LMS will be managed? It's the latter. We want to see evidence of your experience of being able to quality assure the solution, and we're specifically asking for evidence of using automated testing tools. Last Updated: 1 May 2025, 11:23 17. We understand that the learning management solution will be used to train the external users. Could you please share details around how the external customers are taking the data essential course and the self-assessment currently? We don't currently offer this service. Last Updated: 1 May 2025, 11:22