Developing Hackney’s Cyber and Technology Resilience

Description

Work done so far To date the Council has: Migrated from a traditional ‘on-premise’ platform to a hybrid cloud model. Restructured its ICT service to align with agile ways of working. Extended our cyber security capabilities, including collaborative work with partners in London’s local government to explore opportunities to develop pan-London cyber capabilities. Established governance arrangements, including technical design and cybersecurity governance. Invested in in-house skills and capacity, including a cybersecurity apprentice. Became a pilot member of the NCSC Compliance Assurance Framework. Worked with a leading consultancy to improve our overall technology risk position. Which phase the project is in Not applicable Existing team Hackney would expect to provide: Assistant Director, ICT & Workplace Services Head of Cybersecurity Head of Engineering Head of Product & Delivery Analysts of mixed levels Additional support from other Heads of Service, as necessary Address where the work will be done We primarily work remotely, however occasional (twice per month) visits will be required to our primary business address of: 1 Hillman Street, Hackney, London, E8 1DY Working arrangements We would expect our supplier to be based remotely, with very occasional travel to our primary work address within Hackney. Expenses will be capped at £5,000 for the duration of the contract. Provide more information about your security requirements: Baseline Personnel Security Standard (BPSS) Latest start date 2025-05-05 Enter the expected contract length: 2 years Extension period: 1 year Are you prepared to show your budget details?: Yes Indicative maximum: £480,000 Confirm if you require a contracted out service or supply of resource Contracted out service: the off-payroll rules do not apply Summary of work The London Borough of Hackney is looking for a team to lead the continued development of Hackney’s cybersecurity function, engineering and product functions, and drive change in how technology is procured and implemented. We seek support in building effective change management processes, and implementing best-practice architecture and technology standards. At a high level, we anticipate over the course of the contract: Cybersecurity: Development of a cybersecurity strategy and associated roadmap, prioritising high risk remedial work. Engineering Principles and strategy: ensuring that the products we build and procure are effective and meet best practice industry standards. Our objective is to reach a position where our technology is interoperable, scalable, reliable and cost effective. Technology Architecture: taking an enterprise approach to maximise interoperability of our technology stack and meeting the organisation’s objectives. Change Management: Continuing the work to ensure we manage technology change effectively including embedding best practice around code reviews, update and major upgrades, improving the performance, quality and reliability of our technology. Continuing work to rationalise our architecture estate to reduce maintenance and support burden and tech debt. Training and development: A Training and Development strategy that ensures the right skills and capabilities are built within the teams that align with the strategic objectives of the department. Recruitment: Contributing to identifying gaps in our needed skills and recruiting the right capabilities to meet our organisational needs. Where the supplied staff will work London Where the supplied staff will work No specific location (for example they can work remotely) Why the work is being done In October 2020 Hackney suffered a serious, criminal cyberattack which meant that several of the Council’s legacy systems were unavailable. The cloud based services we had already implemented continued to operate without interruption and provided the most rapid path for recovery. We have since continued to develop a small number of systems in-house, but increasingly buy off-the-shelf solutions. We therefore require the support of a firm with deep technical experience, who can take ownership of items of work, whilst supporting the Head of Cybersecurity to deliver cyber initiatives across the Council, and especially within the Product and Engineering functions, to increase our overall cyber resilience. The business problem you need to solve Hackney wishes to continue the work that has been done to improve the resilience of our infrastructure. At a high level, we anticipate over the course of the contract: Cybersecurity: Development of a cybersecurity strategy and associated roadmap, prioritising high risk remedial work. Engineering Principles and strategy: ensuring that the products we build and procure are effective and meet best practice industry standards. Our objective is to reach a position where our technology is interoperable, scalable, reliable and cost effective. Technology Architecture: taking an enterprise approach to maximise interoperability of our technology stack and meeting the organisation’s objectives. Change Management: Continuing the work to ensure we manage technology change effectively including embedding best practice around code reviews, update and major upgrades, improving the performance, quality and reliability of our technology. Continuing work to rationalise our architecture estate to reduce maintenance and support burden and tech debt. Training and development: A Training and Development strategy that ensures the right skills and capabilities are built within the teams that align with the strategic objectives of the department. Recruitment: Contributing to identifying gaps in our needed skills and recruiting the right capabilities to meet our organisational needs. Additionally: Skills & Capabilities: leading skills development across the team, continuing development of our technical practices, and embedding a high performing service model. Culture, Mindset and Knowledge Transfer: continuing the development of modern skills & practices across the Cyber, Engineering and Product services. Products & Services: contributing to the secure and effective procurement of technology, including development of our cloud platform (currently based on AWS), and API platform. Systems & Processes: continuing to develop robust, well documented, and standards based working pract First user type: A resident. First user type: A member of Council staff First user type: A senior Hackney leader First user type: An engineer First user type: A member of the security team Questions and Clarifications 0. Suppliers have asked the Council to confirm the expected start date. 5th May 2025 Last Updated: <strong>03 March 2025, 13:53</strong> 1. Suppliers have informed the Council that they can see conflicting information with regards key dates. We apologise that an issue with the system means that the information on buyer side is accurate and up to date, but this is not feeding through to suppliers. The closing date for Stage 1 submissions (answers to essential skills and experience) is 10th March. Suppliers have until 4th March to ask the Council any questions that may support responding to the opportunity. This leaves suppliers a few days to consider the Council's response to their questions and factor them into any response. The Council will evaluate Stage 1 responses on 12th March. Suppliers who are taken forward to Stage 2 (technical skill and cultural fit questions) will be notified on 13th March and have until 20th March to submit their Stage 2 responses. Last Updated: <strong>28 February 2025, 18:58</strong> 2. Suppliers have asked whether the Council will respond to any clarification questions in relation to the Stage 2 questions. Yes, the Council is committed to supporting all potential suppliers to make strong submissions. It is not inbuilt to the Commercial Service system to detail the timeline for Stage 2 clarification and responses (it is for Stage 1), which is why it is not appearing in key dates. Last Updated: <strong>28 February 2025, 19:01</strong> 3. Suppliers have asked if there is an existing supplier. Yes, there is an existing supplier who is eligible to bid for this opportunity. Last Updated: <strong>28 February 2025, 19:26</strong> 4. Suppliers have asked whether there is a word count limit, and whether there are any nice-to-have criteria. There are no nice-to-have criteria. The Council are only assessing the essential skills and experience detailed. For Stage 1 questions, there is a 250 WORD count limit for each question. For Stage 2 questions there is a 350 WORD count limit for each question. Last Updated: <strong>28 February 2025, 19:38</strong> 5. Suppliers have asked for details of the Council's technology. Coding C# (.NET) - Microservices and backend processes Javascript (React/Next) - Frontend Python - Scripting for data and infrastructure Infrastructure/Automation Terraform for Infrastructure Code Github Actions - CI/CD Database Technologies RDS (Postgres) DynamoDB Cloud Platform Amazon Web Services (AWS) Last Updated: <strong>06 March 2025, 19:05</strong>