Public procurement notice: Prior Information Notice Without Call For Competition
Published: 2019-09-06
Buyer: Ministry of Defence, DE&S Mat Strat, DE&S Mat Strat
Country: UK
Contract type: Services
CPV classification: 48000000

Technical requirements: Defence Equipment & Support is key in delivering a vast range of equipment to support the UK’s armed forces. We manage a portfolio of complex projects to buy, support and supply vital equipment and services that the Royal Navy, British Army and Royal Air Force need to operate effectively. The programme of work ranges from jets and warships through to armoured vehicles and field kitchens. This means that DE&S manages a complex supply chain which underpins the UK’s Armed Forces ability to maintain Assured Capability, Operational Advantage and Freedom of Action. To enable this, we need to ensure we deliver uncompromised equipment throughout the capability lifecycle.
It is clear that even if an organisation has excellent cyber security, there can be no guarantee that the same standards are applied by contractors and third-party suppliers in the supply chain. Attackers will target the most vulnerable part of a supply chain to reach their intended victim. A series of high profile, very damaging attacks on companies has demonstrated that attackers have both the intent and ability to exploit vulnerabilities in supply chain security. This trend is real and growing. So, the need to act is clear. In DE&S, this is made challenging by the complexity of our extensive supply chains who are globally distributed over multiple tiers. To more effectively overcome these challenges and mitigate security risks within our supply chains, we need to build a greater understanding of the key components, suppliers and relationships within the Defence industrial base.
The UK Ministry of Defence (UK MOD) is issuing this Pre-Procurement Notice to invite companies to participate in a Request for Information (RFI) for the Supply Chain Assurance Project Cyber Security Ratings Phase. As part of wider Supply Chain Assurance work, the Chief Information Office (CIO), a department of DE&S, wish to engage with industry in order to refine and inform the Statement of Requirement and business case for a programme of work to deliver cyber security ratings of Suppliers, as and when identified following mapping exercises, of our multi-tiered supply chain for given systems and sub-systems. Responses to the questions below are being requested from industry partners to add to DE&S’ supply chain security knowledge base.
4) Do you discuss the cyber security rating with the Supplier being rated during or after the process?
5) If you were to conduct a cyber security rating for the Authority, what information would be included in the rating provided? (e.g. Ratings score, reports, risk matrices, areas for improvement)
6) Is the data held purely on a cloud-based system and dashboard/User Interface (UI) or can it be exported to an external hosting environment?
7) Please advise how data is exported to both Official and SECRET environments - e.g. file formats, media type and relevant security handling procedures.
Please note that any potential supplier who do not response to the RFI questions above will not be disadvantaged at any later PQQ and ITT stage. The purposes of this RFI is to inform the internal Business Case and Statement of Requirement for future procurement activity.
The Authority reserves the right to amend any condition related to security of information to reflect any changes in national law or government policy. If any contract documents are accompanied by instructions on safeguarding classified information (e.g. a Security Aspects Letter), the Authority reserves the right to amend the terms of these instructions to reflect any changes in national law or government policy, whether in respect of the applicable protective marking scheme, specific protective markings given, the aspects to which any protective marking applies, or otherwise. The link below to the Gov.uk website provides information on the Government Security Classification.
Advertising Regime OJEU:- This contract opportunity is published in the Official Journal of the European Union (OJEU),the MoD Defence Contracts Bulletin and www.contracts.mod.uk GO Reference: GO-201992-DCB-15319290