CSA Designated Reporting Body - Front Door - Discovery Team

Description

Summary of the work This requires a team of people who will be dedicated to undertaking discovery work-packages. The boundaries of each work-package will be predefined. The output of discovery will be: User needs and requirements, HLD, EPICs or Features, and benefits. Each discovery work-package is likely to last ~8 weeks. Expected Contract Length 12 months - this is a low fidelity estimate. Latest start date Monday 6 February 2023 Budget Range ~£100,000 per month (low fidelity estimate) Why the Work is Being Done Legislation is being introduced in the Online Safety Bill in 2024 that will require an update to established workstreams at the NCA. Current systems for the ingestion and handling of CSA material are well established but will not be suitable once the changes in legislation are implemented. Objectives for the project are: • Conform to the legislation in the Online Safety Bill. • Increase efficiency of existing workstreams. • Allow secure upload and ingestion of CSA material. Critical Success Factors include, by the 31st December 2023: • Secure ingestion of uploads into NCA back-end systems. • Output of Management Information from systems to 3rd parties. • User management functions within the Front Door. Problem to Be Solved The NCA has requested the development and delivery of: • A public facing web application (the ‘DRB Front Door’) to ingest data supplied by a large body of specific and preapproved set of users. • An interface to interface with back-end systems that is expected to include the development of an API The Discovery Teams will work with the Product Owner and members of a Core Team, to build on high level work already completed by the NCA and each phase will result in the generation of a detailed Product Backlog. Requirements for the Discovery phases in this project will consist of a number of work packages, required features defined at a high level, for which the Discovery team will require the following skills (this list is not exhaustive): • Business Analysis • Gathering User needs and requirements • Generation of detailed Product Backlog • Investigation of interactions with multiple internal systems • Front end interface and interaction design for users • Data validation, retention and disposal policies • Skills in visualisation and presentation of Management Information • Environment and interconnection mapping Who Are the Users Electronic Service Providers (ESP’s) will be the primary users of the DRB Front door, they will upload data for analysis by NCA staff using existing back-end systems. There will be a large but unknown number of ESP users of the DRB Front Door system, they will be invited and pre-approved external members of the community. These ESPs are represented in the development and delivery of the service by OFCOM, and the recipients of the data will be an internal team. Both groups are being engaged throughout this process and no further action is required at this point. Early Market Engagement Not applicable Work Already Done There has been some work completed to define features for the project, this work is all at a very high level which can be used as the starting points for each of the Discovery work packages: • An outline set of functions has been defined for the Product Backlog and will continue to be refined internally until taken on by the team • Environment options have been internally assessed and AWS has been selected. The team will have the freedom to design and implement infrastructure and architecture as necessary within these bounds Existing Team The existing team undertaking the current phase is a cross consultancy partnership with the NCA. Current Phase Discovery Skills & Experience • Ability to deploy an Agile team able to provide all skillsets to successfully complete the project Discovery. • Development of detailed User requirements into system functional and non-functional requirements in a Project Backlog • Experience capturing and demonstrating benefits associated with the components identified within Discovery. • Experience with Drawing and prototyping front-end UIs/screens, demonstrating knowledge of government usability and accessibility guidelines. • Development of a Strawman solution with detailed features for work- packages (LLD) and assurance needs. • Ability to work in integrated teams with customers and other suppliers. Nice to Haves • Demonstrate experience of working with CDDO standards and assessments and data protection regulation requirements • Illustrate the ability to conduct training and ongoing knowledge transfer to Authority staff. Work Location Remote work with some prearranged travel to NCA offices. Working Arrangments A mechanism will be provided to work remotely from within the UK. There will be some necessity for travel to NCA offices. All NCA data/information/records including all backup assets: • Must be stored securely within the UK and not leave the United Kingdom • Must not be dependent on overseas facilities or accessed from outside the UK • Would reside Encrypted both when in transit and at rest Security Clearance SC clearance will be required for individuals engaged in the project. Enhanced SC clearance may be required for a number of roles. The Authority will support these Security Clearance (Enhanced) applications if necessary. Additional T&Cs Additional terms will be sent to shortlisted suppliers including Security and FOIA terms as NCA is not subject to FOI requests. Shortlisted suppliers will be required to utilise Bravo, or a similar system, after shortlisting. Evaluation will be on a scale of 0 to 5: with a minimum score of 3 to pass: Score Description 0 - Poor standard, no confidence 1 - Little confidence 2 - Clear strengths but giving some concern 3 - Degree of weakness, outweighed by strengths 4 - Strengths clearly outweigh any minor weaknesses 5 - Robust and fully comprehensive proposal No. of Suppliers to Evaluate 4 Proposal Criteria • Demonstrate your ability to deploy resources, that would be SC cleared, and capable of passing SC-Enhanced vetting checks. In your response, please outline the proposed team, including CV's, • Describe your mobilisation approach for your team, including your approach to on-boarding and retaining key resources. What available capacity do you have within your organisation? • Explain how you will meet NCA's need for skilled specialists, What internl assessments are undertaken to ensure these resources meet our requirements? • Provide examples where you have developed a detailed implementations backlog from multiple sources. • Demonstrate your ability to work in integrated teams with customers and other suppliers. • Demonstrate a clear understanding of working in an environment with tight security controls with appropriate governance and monitoring. • Note - the sub weightings for the Proposal and Cultural Fit criteria will be confirmed at Stage 2 of the tender. Cultural Fit Criteria • Ability to work with customers and other suppliers across multiple sites, sharing components, reviewing each other's work and promote a collaborative working environment. • Demonstrate how you would objectively base your advice and decisions on rigorous analysis of evidence and merits of the case • Be collaborative and apply these principles in delivery of work. given that the NCA has a diverse workforce, with different backgrounds. • There are organisational and governance challenges to be overcome that will require determination and resilience, please outline your experience of dealing with those. Payment Approach Capped time and materials Assessment Method • Case study • Work history • Presentation Evaluation Weighting Technical competence 65% Cultural fit 10% Price 25% Questions from Suppliers 1. Do you already have an incumbent providing these services required? If so, who are they please, and how long have they been providing the services to you? We have had a small project team, comprising some NCA FTE and some resource from our Strategic Partner, in place for approximately 6 months, undertaking some very early Discovery work. 2. Are you able to sponsor basic SC as well as enhanced? No. We require an immediate start; unfortunately we do not have time to wait for basic SC clearance. 3. it is stated that 'The Authority will support these Security Clearance (Enhanced) applications if necessary'. Will the Authority be able to support in acquiring Security Clearance for member of the project team? No. We require an immediate start; unfortunately we do not have time to wait for basic SC clearance. 4. Which CDDO standards would you like to demonstrate experience of working with? We would ideally like experience working with the whole standard but in particular:Standards 1, 2, 7, 9 and 11. 5. Where does the budget and delivery accountability (if different) for this system sit within the Home Office? Responsibility for the budget sits within the Home Office's Tackling Child Sexual Exploitation Abuse Unit (TCSEU). Delivery accountability for this technical build sits with the NCA. 6. Many of our relevant case studies are in related sectors to that of the Agency; by their nature, they require client confidentiality. Will it be acceptable to provide 100-word responses which anonymise the client organisation/programme? Yes, this will be acceptable. 7. At proposal stage, will it be possible to use case studies which do not identify the specific client/programme in order to protect client confidentiality? Yes, this will be acceptable. 8. Can the Authority please provide indicative dates for shortlist announcement, proposal clarification and submission deadlines, clarification/presentation session (if applicable) and successful supplier announcement? Indicative dates:Shortlist (Down Select ) - 19/12/22Stage 2 Submission - 13/01/23Clarification/Presentation session - 23/01/23Award - 13/02/23 9. Which Authority role will the Discovery team be reporting to? DRB Front Door Project Manager 10. Is the Product Owner identified and in post? Yes they are 11. Will the successful supplier be sole commercial provider of the Discovery teams for CSA DRB Front Door? Yes, for this outcome. 12. Will Discovery Team members be required to undergo Psychological Evaluation? Discovery team members are not expected to come into contact with operational material, so this is not anticipated. It will be kept under review, 13. Will Discovery Team members be required to undergo Psychological Evaluation? Discovery team members are not expected to come into contact with operational material, so this is not anticipated. It will be kept under review, 14. Will Discovery Team members be required to undergo Psychological Evaluation? Discovery team members are not expected to come into contact with operational material, so this is not anticipated. It will be kept under review, 15. What DDaT roles would you expect for a typical discovery? A Technical Project Manager alongside a core team, including security and architecture leads, which will oversee the project. 16. What DDaT roles would you expect for a typical discovery? A Technical Project Manager alongside a core team, including security and architecture leads, which will oversee the project. 17. Do you have an expectation of the number of Discoveries to be delivered during the course of the contract? The initial, high level scoping has been completed, and this has identified 7 Discovery work packages. Discovery is expected to cover these packages and anything raised during the phases should be explored by the team. 18. Do you expect discoveries to run in parallel? If yes, do you have an expectation of how many? The 7 discovery packages may be run in parallel or sequentially as required. This project requires interaction across a number of existing internal systems, and interaction with teams working on these systems will be expected to ensure fitness for purpose of the solution. 19. Please can you confirm whether Stage 1 scores will be carried over and used as part of the evaluation at Stage 2? No, the Stage 1 scoring will not be carried over to Stage 2. 20. Please can you provider a timeline indicating the dates on which you intend to notify suppliers they have been shortlisted, the submission deadline for Stage 2, and the date of award etc.? Indicative dates:Shortlist (Down Select ) - 19/12/22Stage 2 Submission - 13/01/23Clarification/Presentation session - 23/01/23Award - 13/02/23 21. Regarding the response criteria at Stage 2, please can you confirm that the Case Study, Work History, Presentation and each of the 7 points listed in the Proposal Criteria section will be equally weighted within the 65% allocated to the Technical Competence within the evaluation? The sub weighting criteria for the Technical section questions will be advised at Stage 2. 22. Please could you confirm what scoring methodologies will be applied at Stage 1 and Stage 2? The scoring methodology is set out under the Additional information section, with each individual question scoring on a scale 0 to 5 - with a minimum individual question score required of 3 to move onto Stage 2 (subject to 4 suppliers being taken forward to the next stage as stated in How suppliers will be evaluated section) :0 - Poor standard, no confidence1 - Little confidence2 - Clear strengths but giving some concern3 - Degree of weakness, outweighed by strengths4 - Strengths clearly outweigh any minor weaknesses5 - Robust and fully comprehensive proposal 23. Please could you confirm how many work packages are in scope for the discovery? The initial, high level scoping has been completed, and this has identified 7 Discovery work packages. Discovery is expected to cover these packages and anything raised during the phases should be explored by the team. 24. Please could you confirm how many work packages are in scope for each of the discoveries? The initial, high level scoping has been completed, and this has identified 7 Discovery work packages. Discovery is expected to cover these packages and anything raised during the phases should be explored by the team. 25. Please could you confirm what the work packages are for discovery? Can more details be provided regarding the requirements for each package? The work outline in the initial scoping phase has been split into 7 packages, details of which will be provided to successful bidder. In broad terms these are:- A process and mechanism for on-boarding users and providing a front end interface - Allowing the upload, assessment, verification and transmission (to internal systems) of uploads - Monitoring, availability and reporting of the systems - Requirements gathering and presentation of the MI data from the Front door and internal systems 26. Please could you confirm if there will be development/Sandpit environment for early proofing? There is no intention to make the development area available to the discovery team. 27. Please could you confirm if the discovery of each work package is expected to be performed in sequence or whether they can be in parallel? The 7 discovery packages may be run in parallel or sequentially as required. This project requires interaction across a number of existing internal systems, and interaction with teams working on these systems will be expected to ensure fitness for purpose of the solution. 28. Please could you confirm if there are existing development and implementation governance/quality gate processes which need to be followed? The discovery supplier will be expected to work with the Authority governance processes, which will be based on CDDO Agile principles. 29. Please could you confirm how the discovery will lead to delivery in relation to the work packages? (E.g. will each work package be delivered by a separate delivery team?) The core team overseeing the project will provide guidance to the Discovery and the Delivery teams at all phases.The Discovery team will address all the defined questions and those that arise during the phase and will work with a primary delivery team. 30. Please could you confirm which roles would need Enhanced-SC? It can be assumed that all roles may require Enhanced-SC, but this is not a pre-requisite for the initial phases of work. 31. Please could you confirm who the expected users are of the DRB Front Door application? The DRB Front Door users will be the Trust and Safety/ Content Moderation teams of Online Safety Bill in-scope Electronic Service Providers (ESPs) who will be invited to use the system. This will not be open access for public users. 32. Please could you clarify what data the discovery team will be exposed to? (E.g. Will there be any sensitive data and if so, can you provide further detail regarding the type of data?) The discovery teams will not be exposed to sensitive CSA data/imagery, but will potentially be exposed to dummy reports that contain details of CSEA. 33. Please could you clarify the level of access the supplier's team will have to the overall scope of data which is ingested? Should the supplier expect to encounter/be exposed to any particularly sensitive data and if so, can you provide further detail regarding the type of data and whether this will be the whole team or only a number of specific roles? The supplier teams will not be exposed to sensitive CSA data/imagery, but will potentially be exposed to dummy reports that contain details of CSEA. 34. Who is the Strategic Partner that you have been working with on early Discovery work for this opportunity? It is a supplier that provides Client side support.