Public procurement notice: Contract Notice
Published: 2019-11-22
Buyer: Ministry of Defence, Information Systems and Services, ISS Commercial Sourcing Team
Country: UK
Contract type: Services
Procedure: Restricted procedure
CPV classification: 48100000
Estimated value:  GBP
Submission deadline: 2019-12-16
Award criteria: The most economic tender

Technical requirements: Industry specific software package. The United Kingdom Ministry of Defence will be placing a contract to replace the current supplier cyber protection tool, which enables the MOD’s Defence Cyber Protection Partnership (DCPP) cyber security model. The tool provides both risk assessment (RA) and supplier assurance questionnaire (SAQ) functionality, ensuring the process can be flowed down the supply chain. The tool is accessed via the www.gov.uk website and must adhere to UK Government Digital Service (GDS) requirements for design. It uses GDS’ Verify online authentication tool to authenticate some of the users.
Users log in using multi-factor authentication and are taken to a dashboard showing their existing submissions and can elect to complete an RA or an SAQ. On completion of an RA, the tool calculates the cyber risk profile (N/A, very low, low, moderate or high) and advises this, together with an RA reference, to the RA author. SAQ authors respond to a specific RA using the RA reference. When flowing down, a contractor’s RA (for a sub-contract) is linked back to their original SAQ response. The combination of linked RAs and SAQs provides visibility of the supply chain, for which subcontractor names will be hidden to all except their immediate customer, and to a small number of super-users within MOD.
RA and SAQ authors also have options to save, continue and re-use questionnaires and invite collaboration, and anyone may produce a trial RA or SAQ. Only MOD users may initiate a top-level RA.
The initial requirement is for a tool, to be delivered as a managed service, consisting of a workflow and back-end database, to replicate the functionality of the current tool, in terms of the process described above. The new tool will be hosted on the MOD Cloud (see supplementary information attached to the PQQ).
Further enhancements to extend the functionality to other areas (including secure by design in product/system design and development) will be sought through the ITT process including, but not limited to, those which might offer updates on the cyber security status of particular suppliers. This is intended to be managed through a staged approach, building on the proven effective and stable operation of the baseline functionality.
This requirement is specific to MOD needs, with wider Government having an interest in the output. A commercial exploitation licence will be sought as part of the ITT to reflect this.
This requirement is intended to be contracted as a 3-year initial commitment, with the potential for two 1-year extension options, which can be exercised individually or collectively by the authority.
This requirement will be based on a 3-year initial commitment with 2, one-year extension options for continued delivery of the core scope. The authority reserves its right to exercise each option individually (and prior to expiry of the initial 3-year term or the end of the first extension) or both options at the same time (prior to expiry of the initial 3-year term).
The authority reserves its right to request an indemnity, bank bond or guarantee if the supplier does not meet the required standard for economic and financial standing.
If a group of economic operators submits a bid, the group must nominate a lead organisation to deal with the authority. The authority shall require the group to form a legal entity before entering into the contract.
The authority reserves the right to amend any condition related to security of information to reflect any changes in national law or government policy. If any contract documents are accompanied by a security aspects letter, the authority reserves the right to amend the terms of the security aspects letter to reflect any changes in national law or government policy whether in respect of the applicable protective marking scheme, specific protective markings given, the aspects to which any protective marking applies or otherwise.
The authority will apply all the offences listed in Article 39(1) of Directive 2009/81/EC (implemented as Regulation 23(1) of the Defence and Security Public Contract Regulations (DSPCR) 2011 in the UK) and all of the professional misconducts listed at Article 39(2) of Directive 2009/81/EC (see also Regulation 23(2) in the DSPCR 2011) to the decision of whether a candidate is eligible to be invited to tender.
A full list of the Regulation 23(1) and 23(2) criteria are at http://www.contracts.mod.uk/delta/project/reasonsForExclusion.html#dspr
Candidates will be required to sign a declaration confirming whether they do or do not have any of the listed criteria as part of the pre-qualification process.
Candidates who have been convicted of any of the offences under Article 39(1) are ineligible and will not be selected to bid, unless there are overriding requirements in the general interest (including defence and security factors) for doing so.

Eligibility requirements: (b) the presentation of balance-sheets or extracts from the balance-sheets, where publication of the balance-sheet is required under the law of the country in which the economic operator is established; (c) where appropriate, a statement, covering the 3 previous financial years of the economic operator, of: (i) the overall turnover of the business of the economic operator; and (ii) where appropriate, the turnover in respect of the work, works, goods or services which are of a similar type to the subject matter of the contract. Provision of at least 2 years audited accounts (if available) or equivalent information will be required as part of the pre-qualification questionnaire (PQQ) response.
The estimated annual contract value is 500 000 GBP (five hundred thousand pounds sterling). If the estimated annual contract value is greater than 40 % of the supplier’s turnover, the Authority reserves the right to exclude the supplier from being selected to tender except where the supplier provides, to the satisfaction of the authority, evidence showing it has sufficient economic and financial capability, for example such evidence may include: 1) Any additional information proving it has sufficient economic and financial resources to deliver the requirement; and 2) Stating whether the supplier is willing to provide the Authority with an indemnity, guarantee or bank bond. A financial assessment will be undertaken on the supplier’s financial status. An overall pass/fail judgement will be made after considering areas such as turnover, profit, net assets, liquidity, gearing and capacity. This assessment will include the Parent company where applicable. An independent financial assessment obtained from a reputable credit rating organisation may be utilised as part of this process.
N/a
(a) in the case of a supply contract requiring the siting or installation of goods, a services contract or a works contract, the economic operator's technical ability, taking into account in particular that economic operator's skills, efficiency, experience and reliability (d) a statement of the technicians or technical services available to the economic operator to: (i) carry out the work under the contract; or (ii) be involved in the production of goods or the provision of services under the contract, particularly those responsible for quality control, whether or not they are independent of the economic operator. (e) a statement of the economic operator's: (i) technical facilities; (ii) measures for ensuring quality; (iii) study and research facilities; and (iv) internal rules regarding intellectual property. (i) a statement of the services provider's or contractor's average annual number of staff and managerial staff over the previous 3 years (j) a description of the tools, material, technical equipment, staff numbers, know-how and sources of supply (with an indication of their geographical location when it is outside the territory of the EU) available to the economic operator to perform the contract, cope with any additional needs required by the contracting authority as a result of a crisis or carry out the maintenance, modernisation or adaptation of the goods covered by the contract. Information will be required to evaluate technical capability in response to the pre-qualification questionnaire stage N/a
(a) in the case of a supply contract requiring the siting or installation of goods, a services contract or a works contract, the economic operator's technical ability, taking into account in particular that economic operator's skills, efficiency, experience and reliability (d) a statement of the technicians or technical services available to the economic operator to: (i) carry out the work under the contract; or (ii) be involved in the production of goods or the provision of services under the contract, particularly those responsible for quality control, whether or not they are independent of the economic operator. (e) a statement of the economic operator's: (i) technical facilities; (ii) measures for ensuring quality; (iii) study and research facilities; and (iv) internal rules regarding intellectual property. (i) a statement of the services provider's or contractor's average annual number of staff and managerial staff over the previous 3 years (j) a description of the tools, material, technical equipment, staff numbers, know-how and sources of supply (with an indication of their geographical location when it is outside the territory of the EU) available to the economic operator to perform the contract, cope with any additional needs required by the contracting authority as a result of a crisis or carry out the maintenance, modernisation or adaptation of the goods covered by the contract. Information will be required to evaluate technical capability in response to the pre-qualification questionnaire stage