OT and IT Cybersecurity Services framework

{
    "tag": [
        "compiled"
    ],
    "id": "ocds-h6vhtk-047bc5-2024-07-08T20:20:51+01:00",
    "date": "2024-07-08T20:20:51+01:00",
    "ocid": "ocds-h6vhtk-047bc5",
    "initiationType": "tender",
    "tender": {
        "id": "7648",
        "legalBasis": {
            "id": "32014L0025",
            "scheme": "CELEX"
        },
        "title": "OT and IT Cybersecurity Services framework",
        "status": "planned",
        "classification": {
            "scheme": "CPV",
            "id": "72600000",
            "description": "Computer support and consultancy services"
        },
        "mainProcurementCategory": "services",
        "description": "Scottish Hydro Electric Transmission Plc. (SHET) seeks a skilled provider of Operational Technology (OT) cybersecurity assurance services and IT cybersecurity services. The supplier will act as an independent assurance authority, ensuring that OT systems are designed, delivered and managed in a secure manner and in line with SHET and national standards. Among key responsibilities the prospective supplier would provide design assurance, assurance of onsite installation, security testing, threat-intelligence, and operational assurance. Additionally they may be required to provide ad-hoc projects and support with incident management and response, digital forensics, security, network and infrastructure consulting. The supplier should be able to provide CREST certified penetration testing services There may be a future requirement for IT managed services, IT cybersecurity services and project delivery services to be provided by the supplier, so it is desirable that the supplier have the capability to provide IT managed services (for example but not limited to networking, infrastructure, cybersecurity specialisms), cybersecurity services and professional services. This may include implementing new security tools or architectures. The PIN estimate reflects a combination of day to day capacity, flex contingency, potential ad-hoc projects and support services, and is not a promise or guarantee that the estimate will be reached during the initial or renewal terms.",
        "value": {
            "amount": 150000000,
            "currency": "GBP"
        },
        "lots": [
            {
                "id": "1",
                "description": "Detailed description Among key responsibilities the prospective supplier would provide design assurance, assurance of onsite installation, security testing, threat-intelligence, and operational assurance. Additionally they may be required to provide ad-hoc projects and support with incident management and response, digital forensics, security, network and infrastructure consulting. SHET seeks suppliers with experience in all of the following; Audit Review & Compliance Cyber Security Training & Awareness Design and Build of Turnkey Cyber Security Services Digital Forensics Incident Management & Response Risk Assessment and Management Services Security Architecture Services Security Consultancy Security Testing Technical Cyber Assurance Vulnerability Management Desirable; o Infrastructure Managed Service Support o Network Service Managed Service Support o IT managed services delivery (including but not limited to networking, infrastructure, cybersecurity) o Vendor Cyber Assurance Managed Services. There may be a future requirement for IT managed services, IT cybersecurity services and project delivery services to be provided by the supplier, so it is desirable that the supplier have the capability to provide IT managed services (for example but not limited to networking, infrastructure, cybersecurity specialisms) and professional services. This may include implementing new security tools or architectures. The PIN estimate reflects a combination of day to day capacity, flex contingency, potential ad-hoc projects and support services, and is not a promise or guarantee that the estimate will be reached during the initial or renewal terms.",
                "value": {
                    "amount": 150000000,
                    "currency": "GBP"
                },
                "contractPeriod": {
                    "durationInDays": 3600
                },
                "hasRenewal": true,
                "renewal": {
                    "description": "Duration estimate reflects initial term with extension options up to a maximum term of 10 years"
                },
                "status": "planned"
            }
        ],
        "items": [
            {
                "id": "1",
                "deliveryAddresses": [
                    {
                        "region": "UK"
                    }
                ],
                "deliveryLocation": {
                    "description": "Onsite delivery services to take place in the UK"
                },
                "relatedLot": "1"
            }
        ],
        "communication": {
            "futureNoticeDate": "2024-08-19T00:00:00+01:00"
        },
        "submissionMethod": [
            "electronicSubmission"
        ],
        "submissionMethodDetails": "https://sse.app.jaggaer.com/esop/guest/go/opportunity/detail?opportunityId=387",
        "selectionCriteria": {
            "criteria": [
                {
                    "type": "suitability",
                    "description": "Prospective suppliers should be able to commit that they have reasonable procedures in place for the prevention of modern slavery, human trafficking, financial crime and bribery Prospective suppliers should be able to commit to revealing the identity of any third party subcontractors or solutions upon which their delivery of services would be dependent. SHET may require the right to undertake business probity, financial, cybersecurity and other compliance reviews of subcontractors. Prospective suppliers may be required to sign a Non-Disclosure-Agreement before security sensitive content is shared with them Other or additional conditions of participation may be set out in the final tender documents.",
                    "appliesTo": [
                        "supplier"
                    ]
                },
                {
                    "type": "economic",
                    "description": "Prospective suppliers should have a minimum annual turnover of PS50m p.a. The financial standing of a prospective supplier must give SHET reasonable confidence that they can successfully fund the services for the duration and accept reasonable liability in line with the level of risk their project presents to SHET. Other/additional requirements may be set out in the final tender documents.",
                    "appliesTo": [
                        "supplier"
                    ]
                },
                {
                    "type": "technical",
                    "description": "Prospective suppliers should be able to evidence strong knowledge and experience in the delivery of similar services, at scale; ideally in a critical national infrastructure context. Prospective suppliers should be familiar with major brands of OT and IT equipment Additional requirements may be set out in the final tender documents.",
                    "minimum": "Prospective suppliers will be required to be accredited to SOC2 or ISO27001 level (or recognized equivalent) Prospective suppliers should be able to provide personnel based in the UK (during delivery) who have been through enhanced background vetting or carry current security clearance (SC or above). The same vetting expectation may be required for subcontractors of the supplier who work on the delivery Prospective suppliers should be knowledgeable in NIST standard SP800-53 Penetration test personnel provided should be CREST accredited. Additional requirements may be set out in the final tender documents",
                    "appliesTo": [
                        "supplier"
                    ]
                }
            ]
        },
        "otherRequirements": {
            "requiresStaffNamesAndQualifications": true
        },
        "techniques": {
            "hasFrameworkAgreement": true,
            "frameworkAgreement": {
                "maximumParticipants": 1,
                "periodRationale": "The cost, resource effort, complexity and business disruption to change a major support partner is substantial; 10 years reflects and reasonable period through which it is desirable to retain the services of a single supplier. It is desirable to retain a cybersecurity providers services for an extended time so they are deeply familiar with the recent history and practices of the organisation"
            }
        },
        "submissionTerms": {
            "languages": [
                "en"
            ]
        },
        "contractTerms": {
            "hasElectronicOrdering": true,
            "electronicInvoicingPolicy": "allowed",
            "hasElectronicPayment": true
        }
    },
    "parties": [
        {
            "id": "GB-COH-SC213461",
            "name": "SCOTTISH HYDRO ELECTRIC TRANSMISSION PLC",
            "identifier": {
                "legalName": "SCOTTISH HYDRO ELECTRIC TRANSMISSION PLC",
                "id": "SC213461",
                "scheme": "GB-COH"
            },
            "address": {
                "streetAddress": "Inveralmond House,200 Dunkeld Road",
                "locality": "PERTH",
                "region": "UKM77",
                "postalCode": "PH13AQ",
                "countryName": "United Kingdom"
            },
            "contactPoint": {
                "name": "James Pike",
                "email": "james.pike@sse.com"
            },
            "roles": [
                "buyer"
            ],
            "details": {
                "url": "https://www.ssen-transmission.co.uk/",
                "classifications": [
                    {
                        "scheme": "TED_CE_ACTIVITY",
                        "description": "IT Services"
                    }
                ]
            }
        },
        {
            "id": "GB-FTS-117914",
            "name": "SSE Plc.",
            "identifier": {
                "legalName": "SSE Plc."
            },
            "address": {
                "locality": "Perth, Scotland",
                "countryName": "United Kingdom"
            },
            "roles": [
                "reviewBody"
            ]
        }
    ],
    "buyer": {
        "id": "GB-COH-SC213461",
        "name": "SCOTTISH HYDRO ELECTRIC TRANSMISSION PLC"
    },
    "language": "en"
}