Investment Security Unit - Discovery and Alpha

Description

Summary of the work An outsourced team is required to deliver Discovery and Alpha (subject Discovery approval) for digital project. Requires end-to-end Service Design covering both the citizen facing and back-end services. Latest start date Monday 22 March 2021 Budget Range Max budget will be £500,000. Contract will be call-off with statements of work (SoW) issued against phases. Discovery is SOW 1 and Alpha SOW 2, progression to alpha contingent on discovery outcome. The discovery is expected to last 4 weeks with an additional 2 weeks for preparation for alpha planning and spend approval (22/03-30/04/21). The alpha is expected to last 10 weeks with an additional 2 weeks for the supplier to support the team through alpha service assessment and beta spend approval (10/05/21-30/07/21). Note dates are provisional, alpha could start earlier subject to approvals. Why the Work is Being Done The National Security and Investment Bill (NS&I), one of Secretary of State’s top priorities, will establish a new regime for reviewing and intervening in business transactions, including takeovers, which may raise national security concerns. The Investment Security Unit (ISU) will be a new operational unit in BEIS, responsible for managing the new regime created by the NSI Bill. We are looking to develop and build a notification and case management system to enable the ISU to identify, assess, mitigate and assure legitimate economic activity where there may be national security risks to the UK. Problem to Be Solved ISU unit will need a digital service to conduct their day-to-day operations. They are expecting hundreds of notifications per year from businesses. Each of these notifications needs to be processed with data enriched from different sources including other government departments. Decisions are taken at different steps in the process by the ISU team. The data captured is sensitive from both commercial and national security perspective. Discovery needs to confirm the classification of different data elements and Alpha should confirm a solution that will protect the data adequately. Alpha should also produce a working prototype to confirm the feasibility of the Service in terms user acceptance, deliverability and technical viability. Who Are the Users ISU Case Work Team need to access Notifications, so that they can review the Notifications and make Decisions. Businesses (Acquirers) need to submit Notifications, so that they are compliant with the legislative requirements. NSI Market Research Team need to initiate news cases based on their findings, so that these are progressed to protect UK Security interests. Some Other Government Departments have (OGDs) users who need to review cases and provide information, so that all relevant information is captured, and correct decisions are taken. Work Already Done Some work has taken place to understand problem domain and high-level requirements. No user research activity has taken place. Currently early engagement is taking place with key government departments with respect to SECRET Case Management systems and will be shared with Discovery/Alpha team. Existing Team The ISU Service Owner will attend sprint planning meetings and show and tells and Product Owner will oversee day to day activity. Both of these post-holders have not previously worked on a Digital project. BEIS Digital will provide assistance: • Lead Technical/Security Architect for Technical Governance and Oversight. Help liaise with Technical Resources in other departments. Supplier should include a Solution/Technical architect who will propose the solution for the service. • Delivery Manager to act as conduit to BEIS Digital and Assurance but will not be performing a Delivery Manager role in the Discovery and Alpha team Current Phase Not started Skills & Experience • Demonstrate your experience of designing services compliant with the Service Standard, including Service Design Manual, Technology Code of Practice, GOV.UK standards (3%) • Demonstrate your experience of successfully passing alpha assessments and deliver a successful alpha phase, describing the approach you took. (3%) • Demonstrate your experience of designing and delivering a digital service processing SECRET information in alignment with NCSC Security Principles, or equivalent security standards, and taking it through Security Accreditation. (3%) • Demonstrate your experience of designing a digital service for automating a business process covering different government departments or teams. (3%) • Demonstrate experience of capturing user needs in developing citizen faces services, ideally for businesses, and detail your approach. (3%) • Demonstrate your experience of recruiting users for user research, considering this is a new service with a new user base of businesses and their representatives (lawyers etc.) (3%) Nice to Haves Demonstrate your experience of ability to draw together a sustainable multidisciplinary team to deliver project requirements and flex resources to meet project needs (2%) Work Location Due to COVID-19 restrictions, we expect the supplier will conduct a majority of their work remotely, however, there will be a requirement for entry to London Office sites to access sensitive material available on site. Working Arrangments The customer team and other internal key stakeholders will be working with supplier’s team remotely in an agile mindset, particularly using SCRUM methodology. This would include daily stand-ups, sprint planning and retro events. There will be no provision for travel expenses within London. Security Clearance Due to the nature of the project all personnel are required to hold valid Security check (SC) Clearance by project start date. No. of Suppliers to Evaluate 5 Proposal Criteria • Demonstrate your approach and methodology (15%) • Describe your Team structure, including estimated number of days per resource dedicated to project, and team members’ capability to successfully deliver this project (15%) • Provide a project plan with a detailed timeline including milestones for key deliverables and resource allocated for each sprint (10%) • Demonstrate how you will identify risk, assumptions, and dependencies, and how you will manage these (5%) Cultural Fit Criteria • Demonstrate a user-driven approach, using research and evidence to challenge underlying assumptions (5%) • Demonstrate your ability to be transparent and work in collaboration with BEIS’s technical and non-technical teams, and other government stakeholders (5%) • Demonstrate your approach to knowledge transfer, upskilling and sharing best practices with BEIS’s internal team members (3%) • Demonstrate how you will refer to BEIS at key decision points, facilitating quality control of work and escalating risks (2%) Payment Approach Capped time and materials Evaluation Weighting Technical competence 65% Cultural fit 15% Price 20% Questions from Suppliers 1. Can you please advise the timelines of this procurement (e.g. shortlisted companies notified, anticipated contract award)? Also, can you confirm if shortlisted suppliers will have the opportunity to present? Provisional TimetableShortlisted suppliers for evaluation notified - 24/02/2021Shortlisted suppliers to provide written proposal - 03/03/2021Shorlisted supplier presentations - 05/03/2021Shortlisted suppliers notified of outcome 08/03/2021.The supplier presentations will take place on MS Teams 2. Could you please advise who conducted the initial work? Technical Archtiect from the BEIS Digital team 3. The notice mentions early engagement taking place with departments with respect to SECRET Case Management systems. Do you envisage developing a bespoke application or using a case management system product as a basis? We would expect the supplier to compare COTS vs Bespoke options and recommend the best way forward. 4. Are there any technical constraints to be aware of, e.g. strategic tech stacks or hosting preferences? No constraints but the proposed solution must take into account the wider landscape of Secure Systems in UK Government and how users will access the solution 5. Can you explain what you mean by “working prototype” A prototype that de-risks delivery by showing thin slice of the end-to-end process, covering not just the technology but also the hops across data classification layers as required 6. Is part of the Alpha work to recommend a technical strategy? We would expect Discovery to recommend an overall Technical Approach and Alpha to create and test Prototypes based on that approach 7. Could you kindly specify the bugdet allocated to each phase? We have digital spend approval for up to £133,200 on the discovery. We will not know the digital spend approval value for alpha until we conclude discovery and seek alpha spend approval. 8. Who from your team will be scoring applications for this opportunity and what positions do they hold? We will have representatives from BEIS Digital and the ISU team. 9. Please can you confirm that by “citizens” in the essentials you are referring to businesses (and their representatives) that will be submitting notifications and not to individual members of the public? By "citizens" we mean a public facing service. The external users of this service will be business and their representatives not general memebrs of the public in a private capacity 10. Will BEIS sponsor SC security clearance for suppliers as and when needed? The Deparment does sponser SC, however, we would usually expect it to take 30 working days of the person completing their online vetting application, though it can vary depending on that person’s circumstances or the level of clearances going through UKSV at that time, some clearances can take longer. The successful supplier will be notified w/c 08/03 and the latest start date is 22/03 with personell needing to be SC cleared by the time they start work on the project. 11. Is SC clearance of the full discovery and alpha team by the start date a pass/fail criteria? The successful supplier will be notified w/c 08/03 and the latest start date for the discovery is 22/03, with team members needing to be SC cleared by the time they start work on the project. 12. As the team is likely to contain multiple specialists, can we start the project with SC cleared resource and will you be able to sponsor the remaining members? The Deparment does sponser SC, however, we would usually expect it to take 30 working days of the person completing their online vetting application, though it can vary depending on that person’s circumstances or the level of clearances going through UKSV at that time, some clearances can take longer. The successful supplier will be notified w/c 08/03 and the latest discovery start date is 22/03 with team members needing to be SC cleared by the time they start work on the project. 13. “Demonstrate your experience of designing a digital service for automating a business process covering different government departments or teams.” Please advise if it would be acceptable to use an arms-length body as an example to this question? Yes it is acceptable to use an arms-lenghth bodies. What this question is looking to asses is your ability to automate a business process covering more than one organisation or team. 14. Could you please advise how we can respond to the essential criteria asking for demonstration of processing SECRET information on an unclassified platform without breaching client security and confidentiality? Supplier does not need to name the org and platform, a high level description of digital requirement of the service will suffice and type of org (eg central gov dep, ALB, prviate sector). We are looking for the response to describe the experience of dealing with this type of information and the process that was followed 15. Will the ISU also cover Wales and, therefore by default, have a Welsh language requirement in the design of the system? Yes, the NSI Bill covers all of UK not just England 16. Could you expand a little on sustainability in the context of N1.....” sustainable multidisciplinary team” This is about putting together a right sized team and having the ability to bring on board more resources that meet the SC requirement as the project progresses if required- for example during the discovery the supplier may identify the team profile for the alpha team they envisaged may benefit from some changes 17. In E3 you ask for details of “experience of designing and delivering a digital service processing SECRET information”. Given the sensitivity of these types of services how much information do you think is appropriate to answer the question given that Digital Marketplace is only OFFICIAL. Supplier does not need to name the org and platform, a high level description of digital requirement of the service will suffice and type of org (eg central gov dep, ALB, private sector). We are looking for the response to describe the experience of dealing with this type of information and the process that was followed 18. Can you describe/publish any pre-market engagement please? We have not conducted pre-market engagement. 19. Who will be on the evaluation panel? We have representatives from BEIS Digital and the ISU team. 20. In some questions you refer to digital services (plural) and others digital service (singular). Are you looking multiple examples to the plural questions? We would advise suppliers to take the approach that best demonstrates their abilities whilst noting their is a word limit on responses. The use of a plural in the first question was not intended to be leading. 21. SC clearance: If some of the team hold valid SC but some of the team are capable of being cleared (e.g. pre-vetted or previously held SC clearance), would BEIS be willing to sponsor a fast-track clearance? Last year there was a priority triage system used during the capacity issues that came about due to COVID-19 but now the providers are back to operating on business as usual there is not a fast-track option that the department can sponsor. 22. Have you determined any UK Sovereignty requirements for the service and its supply chain? Given the sensitivities, all resources and data must remain in the UK 23. Are there any specific security accreditations that are must haves? At this stage there are no specific security accreditations that are must haves. We are looking for suppliers to demonstrate experience of taking a solution through an accreditation process related to security and/or management of information 24. Our capability provides an automated solution for the commercial and supplier due diligence for a variety of clients including sensitive government departments, as well as Innovate UK (part of BEIS); we are operating up to Official Sensitive with a road map solution to high side operations. Is this sufficient to pass your enabling questions based on SECRET classification? A supplier will not be scored as a not met for "Demonstrate your experience of designing and delivering a digital service processing SECRET information..." if their example is relevent but without active secret classification experience, however, they will not be eligible to achieve a 3 score.