Cabinet Office Personal Data Protection Delivery Enhancement

Description

Why the Work is Being Done Delivering the Cabinet Office business strategy places a critical reliance on enhancing the capture, storage, management and use of personal and non-personal data. Recent events, however, have identified weaknesses in the Cabinet Office capabilities for managing personal data privacy. The Data Protection Act 2018 demands stringent obligations on the management of privacy risk and exposes the department to material penalties and regulatory censure in the event that risks are insufficiently managed or mitigated. An independent review https://www.gov.uk/government/publications/building-trust-in-digital-government was commissioned following a high profile data breach in December 2019. The review identified systemic inconsistencies in data processes, controls and culture across Cabinet Office and that there is a significant risk that further and more impactful breaches will occur as the amount of personal data being handled by the Department increases. The independent review of the Cabinet Office’s personal data handling practices proposed recommendations to enhance the overall risk management of data privacy across the department. The Cabinet Office needs to implement this work prior to end December 2020 Problem to Be Solved The independent review https://www.gov.uk/government/publications/building-trust-in-digital-government of the Cabinet Office’s personal data handling practices proposed recommendations to enhance the overall risk management of data privacy across the department. Recommendation 1: Enhance accountability and governance Aim: Establish unified leadership for personal data handling supported by extension of existing best practice delivery in Cabinet Office to increase consistency of delivery. Recommendation 2: Reward the right behaviours and recognise skills Aim: Strengthen existing business unit responsibilities through active identification and promotion of personal data handling experts. Recommendation 3: Confirm a new Data Strategy Aim: Define a new Data Strategy aligned to Cabinet Office values and Digital Government ambitions which will inspire current and future Cabinet Office resource. Recommendation 4: Be transparent on progress Aim: Develop the execution oversight and data analysis required to demonstrate progress on maturing data delivery capabilities to all stakeholders. Recommendation 5: Refresh Training and Guidance Aim: Rebuild Training and Guidance to become accessible on a sustained basis by all Cabinet Office resource. Recommendation 6: Establish consistent standards and technology controls Aim: Achieve consistent leading standards and controls across personal data handling processes. Who Are the Users Cabinet Office staff, stakeholders and the wider external community Early Market Engagement Work Already Done A review has been conducted https://www.gov.uk/government/publications/building-trust-in-digital-government Subsequently there have been 3rd party contracted individuals within the BAU teams working on our approach. As a consequence of this work we have decided to consider a co-ordinated and consolidated solution and hence this request for support for a team from one provider from the external market Existing Team Existing Cabinet Office Data Protection Office; Digital Knowledge Information Management teams; Security; Information Assurance; 3rd Party Contracts team and the Chief Data Office Current Phase Beta Work Location Ordinarily in various locations across London However during lockdown it is anticipated the majority of the work will be conducted remotely Working Arrangments The newly appointed Cabinet Office Chief Data Officer (CDO) is commissioning this work. During the early phases of the programme we would expect a comprehensive work schedule to be agreed The vast majority of our staff are currently working from home, due to Covid-19. Remote working is expected during Covid-19 lockdown which would revert to a mixed on-site and remote delivery model once lockdown restrictions are eased/removed. Security Clearance Personnel from the Service provider need to have both BPSS/CTC and an enhanced DBS check For clarity, we do not need SC clearance Additional T&Cs Skills & Experience Have demonstrable evidence of cultural and transformational programme management at CXO level within a FTSE 100 or Central Government function Identify evidence of delivering Outcomes at pace in line with Data Governance Be able to demonstrate your approach and experience of delivery across Discovery, Alpha, Beta and Live Demonstrate how you would successfully deliver Beta, including identifying and managing any risks. Demonstrate your approach and methodology Demonstrate your ability to scale resources to the demands of this programme, giving an example of where this has been done successfully Demonstrate experience of how, when delivering outcome based programmes, you have supported the development of internal capability (leaving a positive legacy) All individuals deployed as part of the delivery team must have demonstrable experience in data practice or on a data change project To be able to evidence experience of data practice and protection enhancements The delivery team must have demonstrable experience of developing data policies, data security concepts and issues The delivery team must have demonstrable experience in PMO, and operating as part of a change programme, to include implementing Risk and Data frameworks The delivery team must have demonstrable experience of developing communication plans and reporting activities Nice to Haves Evidence of how you look to transfer knowledge and up-skill teams to ensure continuity of delivery Describe how you have adapted your delivery model to account for new remote working practices with an emphasis on pastoral care for your team. Should have demonstrable influencing skills Evidence of proven stakeholder management experience No. of Suppliers to Evaluate 3 Proposal Criteria Evaluation of technical solution delivery and its meeting of the Requirements Evaluation of the delivery approach and methodology, (Transformation methods, processes, control and compliance) Evaluation of how the approach or solution meets the Adrian Joseph review response policy and goal Assessment of the team and individual's relevant Data Handling Experience/Track Record Assessment of the individuals skills, knowledge, experience, capability and management. Assessment of process to manage the delivery and the team, who may be remote working, to include project and quality assurance, delivery and currency Risk and Critical Success Factors (and how will these be successfully managed) Implementation Plan and estimated timeframes for the work Assessment on value for money Your approach to building multi-disciplinary teams Your approach to managing conflict resolution (resources, stakeholders) and managing expectations Cultural Fit Criteria How the vendor will work with the Cabinet office BAU workstream owners Demonstrate an empowered ‘can do’ team culture, encouraging constructive feedback and learning Demonstrate how you work as a team, manage collaboration, share know-how and best practice, motivate & maintain high levels of engagement and how this links to our values Actively promote diversity and inclusion as per the public sector equality duty Your approach to embedding a team quickly within organisations with differing cultures Your approach to pastoral care of core or subcontractor resource Payment Approach Fixed price Assessment Method Presentation Evaluation Weighting Technical competence 65% Cultural fit 10% Price 25% Questions from Suppliers No questions have been answered yet Budget range the maximum spend under the contract will be £2.25million