Defence Cyber Operations Close Support Partner

Description

Summary of the work The Ministry of Defence is looking for a Delivery Partner to provide suitably qualified and experienced personnel to support in a highly agile, multi-disciplinary Cyber environment (Digital, Data, Technology, Information management, architecture etc) with the flexibility and capacity to meet changing priorities. Expected Contract Length 24 months with an option to extend by a further 6 months Latest start date Monday 4 April 2022 Budget Range Over 24 months the contract value must not exceed £9.34M inclusive of VAT Why the Work is Being Done Support has been provided across the Cyber Programmes with Subject Matter Expertise (SME) from industry since 2018 to enhance MOD capabilities in predicting, detecting and defending against attack vectors across the Defence Digital enterprise. The Cyber Capability Lifecycle Management Function (CLMF) Board has considered the requirement through to 2024 and approved the option to maintain the Programme's ability to access and leverage Industry Knowledge Skills and Experience (KSE). The CLMF Board recognised the need to respond to changes for client-side support to complete mission-critical objectives for the Cyber Programmes. The Client-Side Support(CSS) project aims to achieve this through contracting for an industry CSP to be able source the Subject Matter Expertise (SME) to augment the Programmes/Projects to achieve stated and emerging objectives. Problem to Be Solved This Close Support Partner will align with Defence Cyber Organisation’s agile delivery approach to effectively respond to ongoing and emerging requirements through the provision of resource(s) on a Service Points based contract. The Close Support Partner will support the Defence Cyber Organisation across the Cyber Programmes for the provision of specialist skill sets not otherwise available to complete project activities. Who Are the Users The users will be front-line Defensive Cyber Operations. They need to to achieve the vision for Cyber Security Operations Capability. A critical success factor to delivery is recognised as being able to access the broad and diverse expertise needed as and when required to support the continued delivery of current projects as well as effectively responding to surge demand. Areas of expertise will include: specialist infrastructure engineers, expert and practitioner cyber security specialists, product managers, cyber operations, delivery managers, commercial and acquisition support, data analysts and common Programme and Project Management (P3M) Assurance (Controls, Governance, Communications, controls etc) Early Market Engagement N/A Work Already Done N/A Existing Team There are a number of teams across a range of projects. These teams are a mix of Civil Servants, military personnel and contractors working together to deliver outcomes. Current Phase Not applicable Skills & Experience • Be able to provide the following: specialist infrastructure engineers, expert and practitioner cyber security specialists, product managers, cyber operations, delivery managers, commercial and acquisition support, data analysts and common P3M • Have previous experience of working in an Agile environment responding to epics, scrums and sprints. • In response to changing requirements from the Authority, the supplier must have the ability to scale their resource pool up or down as required through out the contract period. • By contract start date and for the length of the contract period, the supplier must have the ability to provide resources that have security clearance up to and including DV. Nice to Haves • Experience of, qualification in, or working towards a qualification in ITIL4 • Experience of working in a cyber defence environment Work Location Most work will be conducted at MOD Corsham: Westwells Road, Corsham SN13 9RA Other locations may be required as advised by the Authority and in response to emergent requirements. Working Arrangments Working arrangements will be agreed on a task by task, role by role basis. SQEP provided by the successful bidder will need to be able to work flexibly and in an agile fashion depending upon the nature of the work to be completed at the time. It is anticipated that most work will be completed at MOD Corsham although working form home will also occur, as will occasional travel to other MOD sites. Expenses, travel and subsistence will not be paid through out the contract term, this includes travel to any sites including MOD Corsham. Security Clearance Security clearance requirements will vary from task to task. By the time of contract award and for the duration of the contract, the successful bidder will need to be able to provide SQEP with security clearances from SC to DV. The Authority WILL NOT sponsor SC or DV Clearance. Additional T&Cs The following DEFCONs will apply: DEFCON 531 [edn 09/21] Disclosure of Information DEFCON 632 [edn 11/21] Third Party Intellectual Property - Rights and Restrictions DEFCON 703 [edn 06/21] Intellectual Property Rights - Vesting in the Athority No. of Suppliers to Evaluate 5 Proposal Criteria • approach and methodology • how the approach or solution meets user needs ensuring quality outcomes • team structure • value for money • how they’ve identified risks and dependencies and offered approaches to manage them • technical solution • All of the above will be evaluated through written responses to example scenarios given in the second stage of evaluation Cultural Fit Criteria • Have excellent interpersonal and influencing skills and a positive approach • Values and behaviours in line with MOD core values Payment Approach Fixed price Assessment Method Case study Evaluation Weighting Technical competence 60% Cultural fit 10% Price 30% Questions from Suppliers 1. Given this is the MoD, is the status of the roles deemed to be inside/outside IR35, please can this be clarified given the end Client in question? Off-payroll working rules (IR35) apply. 2. Is there an incumbent supplier and will they be invited to tender? This is a new requirement and there is no incumbent. However, the Authority recognises that there are suppliers providing similar work to similar teams as described in this advert. There have been no additional invitations sent to any suppliers, the only form of advertising is through the Digital Marketplace. 3. How much time would the winning supplier have to supply/free up suitable SQEP for the customer? The Authority would require some resource to be available in April 2022. We recognise that due to the agile nature of this requirement there will be some lead time in recruiting the required SQEP as Epics are developed and the Authority will support the successful bidder by giving as much notice as possible. In the second round of evaluation suppliers which have been down selected will be able to explain how they will respond to changing staffing requirements and the lead time that they would require. 4. In the guidance for responses it states: You should only provide one example for each essential or nice-to-have requirement (unless the buyer specifies otherwise).Please can you advise if you want us to base our answers on one example per requirement or if we can use multiple examples per requirement? Please base your answers on one example per requirement. You can use different examples for different requirements if that provides better evidence for example: requirement 1 = example A used; requirement 2 = example B used. 5. Please can you provide more detailed specification of the levels of experience required, and how many people you need at each level? The Authority has not defined or requested different levels of required experience for the roles which have been identified. For example the Authority is not looking for a junior and a senior for the same role, rather the Authority is expecting the supplier to identify an appropriate individual for the task as required. As the tasks will be ever changing there is no set number of people required for each role. Any suppliers invited to the second stage of evaluation will be able to demonstrate how they will identify and/or recruit SQEP depending upon the nature of the task. 6. With regard to the criteria on working in a cyber defence environment, does this criteria apply to working in a cyber defence team (such as a SOC) or role in any sector, working in a cyber team within the defence sector, or working specifically in a cyber defence team within the defence sector. The Authority cannot demand experience with in a specific Government body or Government team. As such the example concerning working in a cyber defence environment is open to any sector. 7. You have confirmed that IR35 will apply, yet you have also stated that the work will be delivered on a fixed-price basis. In our experience, where a supplier accepts a level of delivery risk, the working practices required to achieve this usually result in an outside IR35 determination. Are you expecting suppliers to simply deliver SQEP that will work to the direction of DD? If so, would Time and Materials be a more appropriate payment method? The Authority is expecting suppliers to deliver SQEP that will then work to the direction of Defence Digital, hence the IR35 determination. Fixed price has been settled upon as the Authority is looking to agree a fixed price for a service point where a service point is one day of work. As such all resources would have the same price regardless of role. The Authority can then use this price to calculate the possible number of service points to determine an over all contract value. Monthly invoices may be different but the over all contract value will be fixed. 8. The requirements state that delivery will be on a Service Points based contract. Can you describe how this model works? The Authority anticipates that one service point will equal one work day for one individual. A ‘Service Points’ contract that allows the Authority to be more flexible and agile in project delivery and the ability to resource emerging priorities. The ‘Service Points’ elements represent fixed levels of input for variable output that are managed using an agile approach to enable flexibility in how the Authority draws on the services from the Supplier.