SME Data Essentials LMS

Description

Pre-market engagement We invited all suppliers on DOS6 and RM6219 to review our provisional requirements and indicate their capability and interest to provide the requirements. We received strong interest via DOS6 and decided to run the procurement via this route. Work done so far We have already completed a Discovery and Alpha (pilot) phase. Discovery was used to research and understand user needs, and explore the technologies that might be suitable for delivering the solution. This was followed by a pilot where we built a prototype and gathered feedback from users. The evaluation report from the pilot / Alpha phase is available here: https://ico.org.uk/media2/migrated/4024375/sme-data-essentials-final-evaluation-report.pdf Which phase the project is in Beta Existing team The ICO has a team set up that includes the following job titles and roles: Project manager to ensure the project happens and is properly managed; Website product owner to ensure the solution meets user needs and meets ICO standards; User centred design manager to set the standards of usability and accessibility; Business representatives: This team will provide the raw content via scripts in word or excel documents to be transformed into engaging, easy to use and understand, interactive learning materials. We need a supplier to supply and build the solution, including the population of content to take us through the public Beta stage, and provide training to ICO staff to support, maintain, manage and continuously improve the service ready for the Live phase. By go-live, in addition to being able to administer the system themselves, they must also be able to confidently create, upload and amend learning content independently. Address where the work will be done N/A Working arrangements Remote delivery. Key supplier staff should be contactable during standard UK working week. Expenses not applicable. Provide more information about your security requirements: Baseline Personnel Security Standard (BPSS) Latest start date 2025-09-11 Enter the expected contract length: 2 years Extension period: 1 year Write the term or acronym: ICO Write the term or acronym: LMS Write the term or acronym: SLA Write the term or acronym: SME Write the term or acronym: WCAG Write the term or acronym: DP Are you prepared to show your budget details?: No Confirm if you require a contracted out service or supply of resource Contracted out service: the off-payroll rules do not apply Summary of work The objective is to implement an e-learning solution which provides Small and Medium Sized Enterprises (SMEs) with a learning and self-assessment tool and enables them to demonstrate their commitment to data protection. It is anticipated that this requirement can be met with an off-the-shelf solution, with configuration and perhaps some customisation. Where the supplied staff will work No specific location (for example they can work remotely) Why the work is being done All businesses have a legal obligation to comply with data protection laws. We know that unlike their larger counterparts, Small and Medium Sized Enterprises (SMEs) do not typically have in-house expertise to help them maximise their use of personal data in a responsible way. The ICO is committed to supporting UK SMEs and making data protection as easy as possible. We have already produced and published a host of online resources aimed specifically at SMEs; but we need a stronger offering. The Information Commissioner has made a public commitment to Government to launch the SME Data Essentials scheme during 2025/26. This commitment can be viewed here: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/01/ico-response-to-government-on-economic-growth/ The Data Essentials scheme will help SMEs to: understand, meet, and keep up to date with the rules; self-assess their compliance with DP law;   publicly demonstrate a commitment to protecting personal information;    provide reassurance that minimum requirements are in place;  support them to build beyond the basic requirements and; bring down the cost of compliance. The business problem you need to solve We require a solution to deliver data protection training and compliance self-assessment to SMEs, that allows business to easily keep up to date with the rules, self-assess their compliance, publicly demonstrate a commitment to protecting personal information and their completion of the training, that is engaging and accessible, and reduces the cost of compliance for those businesses. We require support to deploy, host, and maintain the solution. We require support to produce engaging learning materials from the raw content already produced internally. We require knowledge transfer to enable our staff to administer the system and become self-sufficient in future creation/amendment of learning materials. We consider the key challenges to be: Provision of a solution that is aimed at users that are EXTERNAL to the ICO, ie customers, not staff. The ability for customers to complete training as an individual, then complete a self assessment and gain a certificate for their business. Achieving compliance with WCAG 2.2 to AA level, so that the service is accessible to all who might use it, and so that the ICO complies with its obligations to accessibility. Making the training materials simple and engaging, so that customers want to complete the training to the end and refresh it each year, so that they understand it, and so that they put their learning in to practice, improving their data protection practices and achieving our goal of reducing the cost of compliance. Making the logged-in account area re-usable, so that customers logging in for SME Data Essentials will be able to use the same login to access services that we plan to add in the future. First user type: As a small to medium-sized business First user type: As a small to medium-sized business First user type: As a small to medium-sized business First user type: As a small to medium-sized business First user type: As an ICO administrator Questions and Clarifications 0. In the pre-market engagement, there was a reference to a preference for data processing and storage within a UK-based data centre. However, the current call-off documentation does not explicitly state a requirement for UK data residency and instead requests for GDPR compliance. Could you please confirm whether it is acceptable for data to be processed and stored in an EU-based data centre, provided full GDPR compliance is ensured? Yes, it would be acceptable for data to be processed and stored in an EU-based data centre, provided full GDPR compliance is ensured. Last Updated: <strong>28 April 2025, 10:28</strong> 1. In the pre-market engagement, there was a reference to have up-to-date Cyber Essentials certificate. Will ISO 27001 acceptable instead of Cyber Essentials as it is a more comprehensive standard and demonstrates a higher level of commitment to information security? While we do have a preference for Cyber Essentials due to its focus on technical controls and alignment with UK government requirements, we do accept ISO27001 instead. Last Updated: <strong>28 April 2025, 10:29</strong> 2. In the pre-market engagement, there was a reference to 20,000 users active on the platform for first year, increasing by 20,000 a year for for years 2,3,4 and 5. Is this a minimum commitment of user volumes across the contract? The user numbers in the published spec were amended due to updates to the business case. Whilst we are confident in the level of demand for the service, the advised numbers are estimates and should not be seen as guaranteed. Bidders should ensure any minimum cost base is covered by their proposed pricing model (in the stage 2 submission). Last Updated: <strong>28 April 2025, 10:32</strong> 3. We would request more details around the raw content available with you – type of content (SCORM, videos, xAPI etc) along with the volumes. Also, the level of interactivity expected for the content? We will provide scripts for each module in Microsoft Word and some additional content in Excel. We will be led by the successful bidder on the most effective and accessible ways to engage the learner. Last Updated: <strong>28 April 2025, 10:33</strong> 4. In the pre-market engagement, there was a reference to WCAG 2.1 AA while the call-off mentions WCAG 2.2 AA. Can you clarify the exact compliance required on the contract start and if it is ok for the supplier to present a roadmap to achieve the required WCAG compliance post the contract start date? The required standard is compliance with WCAG 2.2 to AA standard. We recognise that accessibility compliance can be difficult and requires a level of effort over time. We would consider bids where the standard may not yet be met. These factors would be considered in our evaluation. We'd expect to see evidence in all bids that the supplier has the resources to ensure compliance is properly assesssed and can be met, and to provide assurance as to the standard met. Last Updated: <strong>2025-04-28T10:35:10.94287Z</strong> 5. Could you please confirm if there is an indicative budget range or maximum budget allocated for this call-off? Understanding the financial parameters will help us assess feasibility and ensure our proposal is appropriately scoped and aligned with your expectations. The maximum budget for 2025/26 is £500,000, to cover all set up and fixed costs for this financial year as well as costs relating to taking our first groups of users (numbers to be determined) through the programme both to test and then to launch it. This figure represents an upper limit, not anticipated expenditure. As a public body funded largely by statutory fees, we must, of course, ensure the programme provides value for money. We encourage bidders to propose cost-effective solutions that achieve our objectives. Last Updated: <strong>28 April 2025, 10:49</strong>