Development of a secure data transfer mechanism for transfer of gambling operator data into MS Azure

Description

Summary of work You will work alongside our team to design, build and test a new secure interface to allow gambling operators to submit data directly into our existing Microsoft Azure cloud environment daily. The data structures for the data itself are already defined and analytical tools over the data will be provided/managed by the Commission, although you may be asked to provide advice and guidance. You will also be available to assist our internal teams with building the Azure storage capability to hold and transform data. Delivery of the interface and knowledge transfer must be completed within a two-month window. You will demonstrate your continuous progress to us throughout delivery. All components of the interface must sit within the Commissions digital estate. Where the supplied staff will work No specific location (for example they can work remotely) Who the organisation using the products or services is The Gambling Commission will be the recipients of the transferred data, 20 gambling operators will be the senders of the data Why the work is being done We are planning to gather data from around 20 of the largest UK remote gambling operators at a player/transaction level. The data will be submitted daily by each operator and must end up in our private Azure cloud infrastructure so that it can be analysed for data quality before transformation into an appropriate storage/reporting solution. The business problem The data must be transferred between the operator and the Commission using industry best practice security and verification and will need to handle circa 5m records to be uploaded per day . The storage solution will need to scale up to be able to hold and report across circa 11bn records. Whilst the Commission has considerable Azure experience we do not have experience in designing secure data transfer mechanisms and hence require a partner to work closely with us to deliver this component of the solution and advise on other areas. The people who will use the product or service User type: Gambling Operator Definition: The gambling operator will submit daily their transaction logs to data field specification already defined by the Commission. Any pre-market engagement done None Work done so far The Azure environment already exists. We have completed the data specification and agreed the frequency of transfer. Which phase the project is in Alpha Existing team Your team will join our team to deliver this component of the project and be overseen by the Commission’s Digital and Research and Statistics teams. Core points of contact during the project will include the Technical Delivery Manger, IT Infrastructure Manager and the Data Analytics manager. Address where the work will be done Victoria Square House, Victoria Square, Birmingham, B2 4BP Remotely Working arrangements We anticipate that almost all of this work can be done remotely. Any travel expenses that are incurred will have to be taken from the project cost advertised and are not additional. Security and vetting requirements Security Check (SC) More information about the Security requirements: As you will be designing the interface and mechanism of transfer of information of considerable commercial value it is important to us that all staff involved are SC cleared. Latest start date 14 September 2023 Expected contract length Contract length: 0 years 3 months 0 days Optional extension: 0 years 1 months 0 days Special terms and conditions special term or condition: Intellectual Property in relation to the development of the interface must sit with the Gambling Commission. Budget Indicative maximum: £100000 Indicative minimum: The contract value is not specified by the buyer Further information: Budget includes VAT and any expenses incurred. Contracted out service or supply of resource? Contracted out service: the off-payroll rules do not apply Questions and Clarifications 1. Good afternoon, please clarify: 1. Does the 750 chrs count include or exclude spaces? 2. Can we include diagrams/pictures. If so, how do these count towards the chr count? 3. Is the Gambling Commission prepared to sponsor SC clearance? Thanks Questions relating to the character count/diagrams will need to be sent to Crown Commercial as the operator of the site rather than to the purchaser. However I believe 750 characters will include spaces and it is not possible at this stage to include diagrams. Yes the Gambling Commission will consider sponsoring SC clearance and review where/who clearance is required for with suppliers at stage 2 of the procurement process. Last Updated : <strong>31/05/2023</strong> 2. Please clarify what you mean by Question 3 in the Nice-to-have skills and experience. "Has experience of delivery in a similar size and type of organisation." What size is the organisation? With regards to the type of organisation, do you mean the Gambling Commission or Gambling Operators? Thank you. We mean the Gambling Commission i.e. a public sector organisation of circa 340 employees but would also be useful to know if there is any experience of working in a regulatory environment (either for a regulated industry or a regulator) and/or any experience of working in the gambling sector. Last Updated : <strong>01/06/2023</strong> 3. Good morning, Please find below additional clarification questions: 1. Does the GC expect to set any specific NFR’s relating to this service i.e. response times for operator submissions. 2. Does the GC expect to store PII data within the solution. i.e. Operator customer details ect. 3. Does the GC have existing tooling which needs to integrate to the new solution (i.e existing analytics tools) and is this on prem or in the cloud? Kind regards 1. no, the interface is not overly time critical 2. no we have specifically designed the data structures to not include any PII data 3. no, this part of the solution is to load the data into Azure only. Last Updated : <strong>02/06/2023</strong> 4. Please can the Gambling Commission confirm what their encryption standards are for this project? As we are not experts in this area we will look to be guided by potential suppliers as to what they consider appropriate and industry standard, given the nature of the data and the type of transfer that we have outlined. Last Updated : <strong>06/06/2023</strong> 5. Can you please clarify if the following have already been decided or have a preferred option as part of the implementation: - Can the ingestion be API or file based? - Has the schema for the data already been defined and agreed and what format is this in? - Is there infrastructure for authentication and authorisation available, eg Azure Active Directory for OAuth 2 Client Credentials flow? - What reporting tools need access to the data? We are open minded as to whether the ingestion can be file or API based and are looking for the successful bidder to guide us on this, currently we have no preference. Yes the schema for the data is already defined. Currently it exists in CSV format. Yes there is already an Azure AD infrastructure in place. The reporting tools that will sit across the data have not yet been defined and are not part of this procurement. Last Updated : <strong>12/06/2023</strong> 6. In the bid pack, it mentions the delivery of work must be done in a two month window, but in the expected contract length, it details both a three and one month length. Can you please clarify the differences in these or the reasons for them We expect the work could take between one and three months to complete. Last Updated : <strong>12/06/2023</strong> 7. Are there assurance steps within the two month window which will be required, such as Architecture Control Boards, Change Control Boards or Penetration Tests and remediation time? Yes we expect all of these things to be completed within the time window, which could be extended up to 3 months (see answer to previous question) Last Updated : <strong>12/06/2023</strong> 8. In attachment 3 you only list the Essential Skills and Experience and Nice to Have skills, our assumption is that these are the only questions that you need answering at this stage? And the further questions will be answered following shortlisting? Is that correct? The technical experience questions are also contained within the first attachment of the bid pack and we are expecting answers to the technical questions listed in attachment 1 at this stage. We are unsure as to why the technical questions are missing from attachment 3, that question will have to be directed at CCS. Last Updated : <strong>15/06/2023</strong> 9. Hello Can you give any update on the likely completion of the evaluation of shortlisting responses please? Thanks in advance The shortlisting process has been delayed by around 2 weeks. Last Updated : <strong>30/06/2023</strong>