Official UK procurement notice
OT and IT Cybersecurity Services framework
Authority: SCOTTISH HYDRO ELECTRIC TRANSMISSION PLC (Public body)
What is being bought
Published requirement descriptionScottish Hydro Electric Transmission Plc. (SHET) seeks a skilled provider of Operational Technology (OT) cybersecurity assurance services and IT cybersecurity services. The supplier will act as an independent assurance authority, ensuring that OT systems are designed, delivered and managed in a secure manner and in line with SHET and national standards.
Among key responsibilities the prospective supplier would provide design assurance, assurance of onsite installation, security testing, threat-intelligence, and operational assurance. Additionally they may be required to provide ad-hoc projects and support with incident management and response, digital forensics, security, network and infrastructure consulting.
The supplier should be able to provide CREST certified penetration testing services
There may be a future requirement for IT managed services, IT cybersecurity services and project delivery services to be provided by the supplier, so it is desirable that the supplier have the capability to provide IT managed services (for example but not limited to networking, infrastructure, cybersecurity specialisms), cybersecurity services and professional services. This may include implementing new security tools or architectures.
The PIN estimate reflects a combination of day to day capacity, flex contingency, potential ad-hoc projects and support services, and is not a promise or guarantee that the estimate will be reached during the initial or renewal terms.
CPV: Computer support and consultancy services
How this framework works
From the published notice- Places
- up to 1 suppliers
The lotProcurement structure
single lot · value publishedLot #1Detailed descriptionPlannedRenewalPublished value£150,000,000
Detailed description
Among key responsibilities the prospective supplier would provide design assurance, assurance of onsite installation, security testing, threat-intelligence, and operational assurance. Additionally they may be required to provide ad-hoc projects and support with incident management and response, digital forensics, security, network and infrastructure consulting.
SHET seeks suppliers with experience in all of the following;
Audit Review & Compliance
Cyber Security Training & Awareness
Design and Build of Turnkey Cyber Security Services
Digital Forensics
Incident Management & Response
Risk Assessment and Management Services
Security Architecture Services
Security Consultancy
Security Testing
Technical Cyber Assurance
Vulnerability Management
Desirable;
o Infrastructure Managed Service Support
o Network Service Managed Service Support
o IT managed services delivery (including but not limited to networking, infrastructure, cybersecurity)
o Vendor Cyber Assurance Managed Services.
There may be a future requirement for IT managed services, IT cybersecurity services and project delivery services to be provided by the supplier, so it is desirable that the supplier have the capability to provide IT managed services (for example but not limited to networking, infrastructure, cybersecurity specialisms) and professional services. This may include implementing new security tools or architectures.
The PIN estimate reflects a combination of day to day capacity, flex contingency, potential ad-hoc projects and support services, and is not a promise or guarantee that the estimate will be reached during the initial or renewal terms.
What it takes to wini
How this buyer will score bids.
The evaluation criteria and weights exactly as published on the notice, grouped by family (price, quality, social value and so on).
Evaluation split and conditions of participation as published; the tender pack may add morei
How this buyer will score bids.
The evaluation criteria and weights exactly as published on the notice, grouped by family (price, quality, social value and so on).
- Suitability
Prospective suppliers should be able to commit that they have reasonable procedures in place for the prevention of modern slavery, human trafficking, financial crime and bribery
Prospective suppliers should be able to commit to revealing the identity of any third party subcontractors or solutions upon which their delivery of services would be dependent. SHET may require the right to undertake business probity, financial, cybersecurity and other compliance reviews of subcontractors.
Prospective suppliers may be required to sign a Non-Disclosure-Agreement before security sensitive content is shared with them
Other or additional conditions of participation may be set out in the final tender documents.
- Economic & financial standing
Prospective suppliers should have a minimum annual turnover of £50m p.a.
The financial standing of a prospective supplier must give SHET reasonable confidence that they can successfully fund the services for the duration and accept reasonable liability in line with the level of risk their project presents to SHET.
Other/additional requirements may be set out in the final tender documents.
- Technical & professional ability
Prospective suppliers should be able to evidence strong knowledge and experience in the delivery of similar services, at scale; ideally in a critical national infrastructure context.
Prospective suppliers should be familiar with major brands of OT and IT equipment
Additional requirements may be set out in the final tender documents.
Minimum: Prospective suppliers will be required to be accredited to SOC2 or ISO27001 level (or recognized equivalent) Prospective suppliers should be able to provide personnel based in the UK (during delivery) who have been through enhanced background vetting or carry current security cle…
- Staff
- Names and qualifications of delivery staff must be submitted
- “OT and IT Cybersecurity Services framework” is a framework: the contest is a place on its panel, up to 1 suppliers, not a single contract.
Procedure terms & legal framework
From the official record- Legal basis
- CELEX · 32014L0025 Utilities Contracts Regulations 2016 (Directive 2014/25/EU)
- Procurement category
- Services
- Notice status
- Past planning notice
- Procurement threshold
- Unspecified in notice
- Regulatory regime
- Standard
- Commercial structure
- Framework agreement
- Who may use this agreement
- Not stated in the notice; call-off rights may be limited to the establishing authority
- Competition type
- Competitive procedure
- GPA / WTO covered
- Unspecified in notice
- Recurring procurement
- Unspecified in notice
- First published
- 8 Jul 2024, 20:20 BST
- Last source update
- 8 Jul 2024, 20:20 BST
- Authority reference
7648- FTS notice number
2024/S 000-020845- Classification (CPV)
- Delivery area
- Official registry OCID
ocds-h6vhtk-047bc5Find a Tender
- Electronic trading
- e-invoicing allowed · electronic ordering · electronic payment
How it was run
Official notice- Appointment period ends
- —
- Submission channel
- {"electronicSubmission"}
- Accepted languages
- en
Timeline
8 Jul 2024 → 19 Aug 2024 · 2 dates- Notice published8 Jul 2024, 20:20 BST
- Tender notice expected19 Aug 2024, 00:00 BST
Commercial outcome & contract awards
Pipeline notice- Awards (0)
- No award published
- Contracts (0)
- No contract published
- Bid statistics
- No aggregate bid statistics published
Contracting authority & participating public bodies
Dispute resolution & review bodies
- SSE Plc.Review body
Official documents & specifications
Official links; attachments are not copiedNo document links were published on the notice.