Business Continuity Testing Exercise - RFI

The NHSBSA is a Special Health Authority and an Arm's Length Body of the Department of Health and Social Care. We provide a range of critical central services to NHS organisations (our 'clients'), NHS contractors, health bodies, patients and the public (our 'customers').

The NHSBSA requires a service to design, deliver, and facilitate an independent business continuity exercise to test incident response in a realistic, catastrophic scenario.

The incident scenario should reflect the complexity and diversity of the NHS sector and be relevant to the threat landscape across the NHS i.e. a ransomware attack or a data integrity breach. It should ideally have a business wide impact, covering a range of the NHSBSA’s services and directorates.

Prior to the design of the business continuity exercise, the Supplier will engage with the NHSBSA and be provided with information and/or documents as required to design an appropriate exercise. Delivery of the exercise should take place over half a day and be followed by a debrief session on the same day. Following this, two reports should be submitted by the Supplier; one high level and the other more detailed. Both reports should include, but not be limited to, key observations, analysis of strengths and weaknesses, and prioritised recommendations.

Further details of the NHSBSA's requirements can be found within the Request for Information (RFI) documents within the supplier documents section of the individual opportunity.

At this stage we are seeking high-level input to enable us to assess the market and to inform any future procurement strategy to ensure compliance with The Procurement Act 2023 and/or the Public Contracts Regulations 2015 as the case maybe.

Interested parties must register an interest in this RFI via health-family.force.com/s/Welcome ↗ (search opportunities using system reference C483294). Suppliers can register from Wednesday 21st October 2026 and the RFI documents will be made available on Wednesday 21st October 2026.

The window for clarification questions will close on Wednesday 28th October 2026 at 12:00 noon BST and written RFI responses are requested by no later than Tuesday 3rd November 2025 at 12:00 noon BST.

The NHS Business Services Authority (NHSBSA) invites all interested economic operators to participate in an RFI. Your organisation’s involvement with our RFI is an invaluable way of us ensuring that, with your input, we have the best support and guidance to inform any subsequent procurement.

Please note that at this stage a route to market has not yet been determined. However, should the outcome of this RFI determine that the best value route to market is via a framework then any subsequent invitation to tender and notices will be restricted to those appointed to the applicable framework and will be governed by the Procurement Regulations 2015 or the Procurement Act 2023 as stipulated by the framework in question.

Additional Information:

Suppliers should note that this RFI is a market research exercise only and it is not an invitation to tender, an invitation to offer an agreement or a guarantee there will be a future procurement exercise.

If you do not wish to take part in this RFI exercise, it will not affect any current or future business with the NHSBSA.

Participation in this RFI is limited to suppliers that meet the definition of "economic operator" under the Public Contracts Regulations 2015. "Economic operator" means any person, or public entity, or group of such persons and entities, including any temporary association of undertakings, that offers the execution of works or a work, the supply of products or the provision of services on the market. Where a participant does not meet this criteria they may be removed from the RFI process.

Disclaimers:

(1) No competitive advantage will be gained by the suppliers engaging with the NHSBSA at this early stage and NHSBSA will ensure equal treatment of all interested parties at all times. We will make the outputs of the day available to those Suppliers who are unable to attend.

(2) NHSBSA does not bind itself, by conducting this RFI exercise, to commence any procurement procedure or award any contract, and will not in any event be responsible for any costs incurred by invitees in attending and/or preparing for the presentation and individual supplier meeting referred to above.

(3) Confidentiality of information which is clearly marked or identified as being confidential and which is reasonably viewed by NHSBSA as confidential will be observed, but NHSBSA does not accept any blanket claims of confidentiality.