Developing Hackney’s Cyber and Technology Resilience

Description

Work done so far To date the Council has: Migrated from a traditional ‘on-premise’ platform to a hybrid cloud model. Restructured its ICT service to align with agile ways of working. Extended our cyber security capabilities, including collaborative work with partners in London’s local government to explore opportunities to develop pan-London cyber capabilities. Established governance arrangements, including technical design and cybersecurity governance. Invested in in-house skills and capacity, including a cybersecurity apprentice. Became a pilot member of the NCSC Compliance Assurance Framework. Worked with a leading consultancy to improve our overall technology risk position. Which phase the project is in Not applicable Existing team Hackney would expect to provide: Assistant Director, ICT & Workplace Services Head of Cybersecurity Head of Engineering Head of Product & Delivery Analysts of mixed levels Additional support from other Heads of Service, as necessary Address where the work will be done We primarily work remotely, however occasional (twice per month) visits will be required to our primary business address of: 1 Hillman Street, Hackney, London, E8 1DY Working arrangements We would expect our supplier to be based remotely, with very occasional travel to our primary work address within Hackney. Expenses will be capped at £5,000 for the duration of the contract. Provide more information about your security requirements: Baseline Personnel Security Standard (BPSS) Latest start date 2025-05-05 Enter the expected contract length: 2 years Extension period: 1 year Are you prepared to show your budget details?: Yes Indicative maximum: £480,000 Confirm if you require a contracted out service or supply of resource Contracted out service: the off-payroll rules do not apply Summary of work The London Borough of Hackney is looking for a team to lead the continued development of Hackney’s cybersecurity function, engineering and product functions, and drive change in how technology is procured and implemented. We seek support in building effective change management processes, and implementing best-practice architecture and technology standards. At a high level, we anticipate over the course of the contract: Cybersecurity: Development of a cybersecurity strategy and associated roadmap, prioritising high risk remedial work. Engineering Principles and strategy: ensuring that the products we build and procure are effective and meet best practice industry standards. Our objective is to reach a position where our technology is interoperable, scalable, reliable and cost effective. Technology Architecture: taking an enterprise approach to maximise interoperability of our technology stack and meeting the organisation’s objectives. Change Management: Continuing the work to ensure we manage technology change effectively including embedding best practice around code reviews, update and major upgrades, improving the performance, quality and reliability of our technology. Continuing work to rationalise our architecture estate to reduce maintenance and support burden and tech debt. Training and development: A Training and Development strategy that ensures the right skills and capabilities are built within the teams that align with the strategic objectives of the department. Recruitment: Contributing to identifying gaps in our needed skills and recruiting the right capabilities to meet our organisational needs. Where the supplied staff will work London Where the supplied staff will work No specific location (for example they can work remotely) Why the work is being done In October 2020 Hackney suffered a serious, criminal cyberattack which meant that several of the Council’s legacy systems were unavailable. The cloud based services we had already implemented continued to operate without interruption and provided the most rapid path for recovery. We have since continued to develop a small number of systems in-house, but increasingly buy off-the-shelf solutions. We therefore require the support of a firm with deep technical experience, who can take ownership of items of work, whilst supporting the Head of Cybersecurity to deliver cyber initiatives across the Council, and especially within the Product and Engineering functions, to increase our overall cyber resilience. The business problem you need to solve Hackney wishes to continue the work that has been done to improve the resilience of our infrastructure. At a high level, we anticipate over the course of the contract: Cybersecurity: Development of a cybersecurity strategy and associated roadmap, prioritising high risk remedial work. Engineering Principles and strategy: ensuring that the products we build and procure are effective and meet best practice industry standards. Our objective is to reach a position where our technology is interoperable, scalable, reliable and cost effective. Technology Architecture: taking an enterprise approach to maximise interoperability of our technology stack and meeting the organisation’s objectives. Change Management: Continuing the work to ensure we manage technology change effectively including embedding best practice around code reviews, update and major upgrades, improving the performance, quality and reliability of our technology. Continuing work to rationalise our architecture estate to reduce maintenance and support burden and tech debt. Training and development: A Training and Development strategy that ensures the right skills and capabilities are built within the teams that align with the strategic objectives of the department. Recruitment: Contributing to identifying gaps in our needed skills and recruiting the right capabilities to meet our organisational needs. Additionally: Skills & Capabilities: leading skills development across the team, continuing development of our technical practices, and embedding a high performing service model. Culture, Mindset and Knowledge Transfer: continuing the development of modern skills & practices across the Cyber, Engineering and Product services. Products & Services: contributing to the secure and effective procurement of technology, including development of our cloud platform (currently based on AWS), and API platform. Systems & Processes: continuing to develop robust, well documented, and standards based working pract First user type: A resident. First user type: A member of Council staff First user type: A senior Hackney leader First user type: An engineer First user type: A member of the security team