Sustained Support for Access Pass Holder Information Distribution System (APHIDS)

Description

Summary of the work The Requirements include: DevOps, Technical, Security Information and Security Event Management (SIEM), Recovery Time and Recovery Point Objectives, Service Volumes, Service Management. Expected Contract Length 12 months with the option to extend for further 12 months (12+12). Latest start date Friday 1 April 2022 Why the Work is Being Done The APHID Service is a key critical component of the overall Homeland Security portfolio. The solution assists in maintaining the security of the UK by delivering a step-change in the ability of the Security Service; the NCA and Police to have an accurate, up-to-date picture of who has access to security restricted areas at all major airports (approximately 50 nationwide). APHIDS enhancements are is looking to address two areas: • INSIDER THREAT: The lack of consolidated airside pass data and access presents a potential security vulnerability for exploitation by a constantly evolving insider threat. It means HMG and Law Enforcement agencies cannot uniquely identify all staff with airside access at UK airports and then identify potential threats. • LEGISLATION: According to proposed European legislation, all individuals with AIC’s or CIC’s will require a government enhanced background check & continuous vetting. There are a number of additional roles (i.e. instructors) that also require these checks. Yet, HO have no consolidated way of identifying who holds these passes and roles to enable this continuous vetting.   The anticipated commencement date for the contract is 1st April 2022 to be preceded by 8 weeks mobilisation period. Problem to Be Solved The supplier is required to provide on-going 2nd and 3rd line support for the APHIDS solution, in order to maintain a sustained service The supplier will need to interface with internal Home Office Enterprise Services team and Borders and Aviation Security Unit. Wider stakeholders; DfT, ACRO Criminal Records Office, PNC-Hendon, and CAA. Plus, data providers and LEA consuming organisations The APHIDS support service will need to be scalable and provide capacity for expansion, supporting up to 1000 unique users with the capacity to enable up to 58 concurrent data uploads from data providers with no noticeable performance degradation. The supplier is required to on-board to the authorities ITSM tooling and work within the defined ITIL processes to provide the required support service and manage incidents, have processes in place for secure development, continuous integration/deployment and DevSecOps, software maintenance, configuration and change management, incident and problem management, data sanitisation and continuous improvement. The supplier will be responsible for ensuring Business As Usual (BAU) is maintained for the APHIDS service. For example: • Defects • Uplift of third-party software versions • Essential uplifts required due to modernisations to dependencies. E.g. ACP service enhancement requiring tenants change Who Are the Users The Homeland Security function within the Customer are building, modernising and transforming how the Customer provide a number of capabilities at UK airports and port with one of those capabilities being the enhancement of background checks for staff provided within the existing Access Pass Holder Information Distribution System (APHIDS). Existing Team The supplier will need to interface with internal Home Office Enterprise Services team and Borders and Aviation Security Unit. Wider stakeholders; DfT, ACRO Criminal Records Office, PNC-Hendon, and CAA. Plus, data providers and LEA consuming organisations. APHIDS is hosted on the Home Office AWS Application Container Platform (ACP). The supplier will need to engage regularly, and work closely, with the Home Office ACP team, for all deployments and updates to both the non-production and production environments. Current Phase Not started Skills & Experience • SC security cleared staff • Have Agile-trained individuals, with certified Agile practitioners across Scrum Masters, SMEs and POs (SAFe, Scrum Alliance and PMI Certifications) • Have suitably qualified staff that hold formal delivery qualifications including ITIL3 and ITIL4, PRINCE2® and MSP® • Have highly skilled delivery teams, which includes Change Management and Engineering (DevOps) • Have relevant Relationship Management skillsets to enable collaborative working with Home Office SMEs in the Aviation arena • Have relevant Service Management skillsets to enable collaborative working with Home Office SMEs • Have access to the most appropriate and best qualified resources • Have appropriately qualified resources in the following areas: (i) AWS including S3, SQS and Kinesis (ii) Kubernetes & Docker (iii) Drone CI (iv) Apache NiFi & NiFi Registry • Have appropriately qualified resources in the following areas: (v) Apache Zookeeper (vi) Elasticsearch & Kibana (vii) Node.js, React.js & Express.js (viii) Java, Javascript & Python programming languages (ix) DevSecOps • Have appropriately qualified resources in the following areas: (x) RESTful APIs (xi) OAuth2, ODIC, SAML and PKI. KeyCloak Identity & Access management provider (xii) Security Architecture (xiii) Technical Authoring. • ISO/IEC 27000 compliant Nice to Haves • Technical consultancy skillsets to enable collaborative working • Service Architecture skillsets to enable collaborative working with Home Office • Service Technical Architecture skillsets to enable collaborative working with Home Office • Understanding of the Home Office APHIDS mission to enable technical conversations with industry • Capabilities and skillsets are current, relevant, and match pace with evolving technologies Work Location The Homeland Security Group teams operate from 2 main locations: Marsham Street in Central London and the Croydon Estate. Travel, where necessary shall be to other service user agencies' locations in the UK. Working Arrangments Details of working arrangements including location can be finalised on appointment, however typically a 5 day a week is expected. Security Clearance All supplier 2nd/3rd line support staff must be SC-UK Security Vetted, as minimum or must be willing to meet the requirements to obtain the relevant Home Office SC status. Additional T&Cs Standard DOS5 terms and conditions however any IP generated as a result of projects commissioned by the authority, shall vest with the authority. The work may be undertaken on a fixed price basis No. of Suppliers to Evaluate 4 Proposal Criteria • Technical solution • How the approach or solution meets user needs • Value for money • How they’ve identified risks and dependencies and offered approaches to manage them • How the approach or solution meets the organisation’s policy or goal Cultural Fit Criteria • Approach to knowledge transfer, upskilling and sharing of best practice with the client • Flexibility in approach in order to meet changing priorities and business requirements • Ability to work collaboratively with permanent staff and suppliers Payment Approach Fixed price Assessment Method Presentation Evaluation Weighting Technical competence 45% Cultural fit 10% Price 45% Questions from Suppliers 1. Regarding prior HomeOffice experience in both skills, can you please explain with respect to DOS 5 discriminatory guidelines ? https://assets.crowncommercial.gov.uk/wp-content/uploads/RM1043.7-DOS-5-Buyer-webinar-how-to-create-an-opportunity-with-notes.docxExtracts (page -8)“It is discriminatory to suppliers to state that they must have previous experience working in the public sector or within your specific industry.What is it about the public sector that requires specific skills or experience? Suppliers may have worked for complex commercial organisations which are highly regulated (eg financial or pharmaceutical) and could therefore demonstrate the required skills and experience within a different environment.” Please sign post specifically where in the published requirement the question pertains to in order to provide a response. 2. On SC clearance and ISO certification, are you fine with these being produced on supplier selection? Evidence of SC clearance and ISO certification will be required prior to start of contract so the answer is yes. 3. Can this work be carried out using a remote working UK based team with occasional travel to HO offices for meetings? Suppliers can use a remote UK based team with occasional travel to HO office. 4. How many suppliers do you intend to down-select for the next phase? Four (4) as stated in the publication. 5. Can you elaborate HomeOffice support on SME for this project as some of requirements may be difficult for small business during Stage 1 submissions (SC certification and ISO)? The ISO certification is the standard created by the International Organisation for Standardization (ISO) which deals with Information Security Management. It is a way of making sure organisations are managing information security risks and data effectively, establishing and maintaining an effective Information Security Management System (ISMS). Suppliers will need to show that they have attained this level of certification. HO is not expected to assist suppliers in gaining this certification.SC clearance will need to be gained via due process. HO uses Cluster2 Security to run this process and it is up to suppliers to arrange their own SC clearance. 6. The timing of the launch of this procurement, means that there are only 4 working days before the deadline for questions which itself is on a public holiday and the submission deadline is only 7 working days from the date of the launch, and also on a public holiday. To ensure that all bidders have an equal chance to submit a response, would the Authority consider amending the submission deadline by a week? With DOS opportunities the timescales from the publishing date to the deadline for suppliers to apply is fixed. As these timescales are automated by the digital marketplace there is no way for a buyer to make these shorter or longer. Also, the timing for the procurement is crucial. The Authority is looking to move from contract award to mobilisation & implementation early 2022. 7. 7. Can the timeframes be revisited for this opportunity?The Question deadline is a Bank Holiday (27th Dec) as is Tues 28th Dec.The Closing Date is also a Bank Holiday (Mon 3rd Jan).Can the closing date for responses be extended to Mon 17th January based on the above and most members of staff taking leave between Christmas and New Year? See answer at 6 please. 8. The dates for Clarification Questions and Submission are set for public holidays, is this correct? See answer to Q6 please. 9. 9. Regarding reponse for Q1 on signpost please find the below :Essential Skills:-Have relevant Relationship Management skillsets to enable collaborative working with Home Office SMEs in the Aviation arenaHave relevant Service Management skillsets to enable collaborative working with Home Office SMEsNice to have skills :-Prioir experience of working with Home office SME The Authority is looking for the ability of the supplier in Relationship Management and Service Management disciplines. The essential skills of Relationship and Service management will enable effective working with HO partners and the aviation sector. These essential skills need not have been learned specifically in the HO environment. 10. The tender assessment weighting is 45% on Price. Can you explain what level of detail is required for the pricing element of our response? Bidders that have made the shortlist shall be required to provide pricing against a full set of requirements.