Digital Exposure Analysis — UK Public Procurement Procedure

The Analysis is intended to identify all accessible digital data that may pose a security risk to the Chair and Panel members. The supplier will be required to identify all available digital information that may lead to whole or partial identification of the subject’s personal address(es); their family members identities, likeness, personal or work address(es) or contact information; locations they frequent; personal or individual contact information; medical history; internet and social media history; financial or business information other than that declared publicly in the course of their duties; or any other data that may give rise to security risk. The supplier will be required to develop a mitigation plan, detailing steps to be taken to remove the data or otherwise digitally mitigate the risk it creates. This and the analysis will be contained together in a single report per subject to be produced by the supplier. The supplier may be required to complete some or all of the mitigating actions proposed in the report. The Inquiry timeline requires that public evidential hearings begin in December 2026. It is imperative that mitigating actions have been successfully concluded by the commencement of hearings to enable the Chair and Panel to proceed with their work confident in their personal security.