Data Centre Infrastructure Service

1. Technology Risks

• Data Centre Infrastructure: Risks of physical security breaches, unauthorised access, inadequate audit controls, and failure in onsite sparing or equipment management.
• Mainframe & Platforms: Risks of service outages, backup failures, data loss, or insufficient monitoring and alerting.
• Patch Management: Risks of delayed or failed patch deployment, vulnerabilities due to unpatched systems, and errors in automated/manual patching.
• Technical Services: Risks of insufficiently certified technical resources, tooling failures, and lack of scalability or automation.

2. Network and Security Infrastructure Risks

• DC Networks: Risks of network outages, poor interconnectivity, third-party coordination failures, and WAN/LAN service disruptions.
• Perimeter Security: Risks of firewall misconfiguration, security breaches, and lack of certified network resources.

3. Application Support Risks

• Enterprise Job Scheduler: Risks of workflow automation failures, impacting business process continuity.
• Operational Support Systems: Risks of inadequate Tier 3 support, misconfiguration, or delayed updates.
• Siebel Support: Risks of application downtime, data integrity issues, and multi-server coordination failures.

4. Service Management Risks

• Availability & Capacity Management: Risks of poor performance, capacity shortfalls, and unidentified risks.
• Compliance & Information Security: Risks of non-compliance with standards, security incidents, inadequate staff vetting, and failure in digital access control.
• IT Service Continuity: Risks of ineffective disaster recovery/business continuity planning and testing.
• Service Level Management: Risks of unmet service expectations and lack of service improvement.

5. Service Transition Risks

• E-bonding & Change Management: Risks of failed data transfer, unauthorised changes, inadequate change management, and insufficiently skilled change teams.
• Knowledge & Release Management: Risks of incomplete or inaccurate knowledge transfer, poor release planning, and failed service take-on.

6. Service Operation Risks

• Event & Incident Management: Risks of poor event logging, delayed incident resolution, inadequate communication, and lack of accountability.
• Problem & Request Fulfilment: Risks of unresolved problems, poor collaboration, and delayed service requests.
• Third Party Management: Risks of SLA breaches, poor supplier coordination, and service continuity failures.

7. Continual Service Improvement Risks

• Risks of ineffective CSI initiatives, lack of monitoring, and failure to implement recommendations.

8. Governance and Reporting Risks

• Risks of inadequate governance frameworks, poor service reporting, and non-compliance in reporting.

9. Social Value Risks

• Risks of failing to meet social value targets (jobs, skills, education), EDI requirements, SME engagement, ESG compliance, and sustainability obligations.

10. Delivery Risks

• Project Services: Risks of project delays, poor quality assurance, non-compliance with processes, and inadequate risk/issue management.
• Skilled Resources: Risks of insufficient architectural or enhancement resources, poor onboarding/offboarding, and lack of testing support.
• Third Party Management: Risks of poor operational management and reporting.

11. Transition Risks

• Risks of poor programme management, service readiness failures, inadequate knowledge transfer, asset/configuration management issues, and reduction in service performance during transition.

12. Transformation Risks

• Risks of failing to identify or deliver efficiency improvements, poor collaboration, and strategy misalignment.

13. Exit Risks

• Risks of inadequate exit planning, poor knowledge transfer, and disruption at contract end.

14. Optional Scope Risks

• Risks of poor flexibility in service take-on, inability to scale for industry transformation, and failure to support public cloud or future integration needs.

15. Legal & Compliance Risks

• Risks of non-compliance with contract management guidelines, failure to meet SLA/accountability requirements, lack of transparency in pricing, and inability to rapidly deploy certified security services.

These are risks which the Authority considers could jeopardise the satisfactory performance of the contract, but because of their nature, may not be capable of being addressed in the contract as awarded (noting that this is a competitive flexible procedure and technical dialogue and commercial negotiation are anticipated). Accordingly, these are risks that may require a subsequent modification of the contract under paragraph 5 of Schedule 8 of PA23.