National Crime Agency

Windows 10 Discovery & Requirements writing with ongoing support where requested by the NCA.

Incomplete applications

Incomplete applications
10 SME, 3 large

Completed applications

Completed applications
8 SME, 7 large
Important dates
Opportunity attribute name Opportunity attribute value
Published Thursday 10 January 2019
Deadline for asking questions Thursday 17 January 2019 at 11:59pm GMT
Closing date for applications Thursday 24 January 2019 at 11:59pm GMT


Opportunity attribute name Opportunity attribute value
Summary of the work Provide a clientside team to work with NCA and Suppliers' Windows 10/ O365 Project team to build the requirements for NCA to either conduct a procurement to appoint a Windows 10 Lead Provider or use for assuring project delivery success criteria. Also reviewing of EndUserDevices and Core tooling.
Latest start date Monday 4 March 2019
Expected contract length 3 months initial discovery with ongoing up to 12 month facility to support the project as requested.
Location London
Organisation the work is for National Crime Agency
Budget range

About the work

About the work
Opportunity attribute name Opportunity attribute value
Why the work is being done With End of mainstream support for the Windows 7 platform announced as Jan 2020, the Agency has a compelling reason to commence the upgrade of its End User Device estate and capabilities. The complexities around the configuration of this estate and the understanding of how devices operate in different security scenarios means a detailed and structured approach to requirements gathering and discovery is performed against a refreshed and comprehensive set of user Personas.
Problem to be solved A solid requirements, discovery and persona base on which to perform an effective and streamlined upgrade of EUD O/S against industry best practice in recognition of the complex security and technical environment in which the NCA operates. Combining this technical upgrade with user enhancements from O365 and a modern desktop experience will also require a strong end user training, support and communications focus.
The successful supplier may also be requested to support the agency after the initial discovery phase in order to transition knowledge gained during the Discovery phase and support the Agency during the execution of the requirements.
Who the users are and what they need to do This requirement covers the entire NCA estate and ranges in use case from those who only ever access OFFICIAL data and utilise consumer grade applications and tools to those working in highly restricted and sensitive environments with significant restrictions on their daily operations. At present the segregation of these use cases is minimal in terms of End User Compute with the Agency defaulting to a Secret Grade device across the estate.
Early market engagement
Any work that’s already been done As part of an earlier mobility programme a piece of work was established to build a set of Agency wide personas. This could form the basis of a revised and refreshed Persona exercise although it's envisaged this work will still need to be completed. The successful supplier will be required to review the tooling that discovers and monitors end users and core tooling on the estate and make assessments on the impact to delivery and possible alternatives. It is not within the scope of this project to replace this tooling.
Existing team The NCA has onboarded its own PM and a Business Analyst to support the project throughout. Architecture resource has already been aligned and is familiar with the requirements of NEP
Current phase Discovery

Work setup

Work setup
Opportunity attribute name Opportunity attribute value
Address where the work will take place The NCA, Spring Gardens, Tinworth Street, Vauxhall, London
Working arrangements The supplier is expected to supply individuals at different stages of the project based on different skills sets.

Work will be a mix of onsite and offsite working. Summary/ write up phases of work could be done remotely provided data relating to NCA is assessed before removal from site. No data specific to NCA systems or people to be removed from site or placed onto 3rd party machines (more detail to be provided on request). Should you choose to include travel expenses those should be included in the cost proposal making it clear which locations this would apply to
Security clearance The initial requirement will be for a minimum of SC however Supplier Personnel may be required to go through the SC Enhanced Clearance process.

Additional information

Additional information
Opportunity attribute name Opportunity attribute value
Additional terms and conditions Additional clauses relating to FOIA as the NCA is exempt.
The NCA has a multi-supplier environment and any successful supplier for this tender should not expect to have exclusivity for the types of services supplied as it is expected that there will be overlaps with other projects and programmes.
This package of work is also intended to inform the decision for any potential follow on procurement for a Windows 10 Lead provider. Where the NCA decides there is a requirement, it may decide that the additional work will not be placed with the client side supplier delivering this work package.

Skills and experience

Buyers will use the essential and nice-to-have skills and experience to help them evaluate suppliers’ technical competence.

Skills and experience
Opportunity attribute name Opportunity attribute value
Essential skills and experience
  • 2 or more projects working with clients on Windows 10 and O365 rollouts (specifically requirements and discovery phases)
  • Ability to work with client teams and in a multi supplier environment following agile practices and principles
  • Demonstrable understanding of Modern Deployment Techniques including: Windows AutoPilot, SCCM, Zero Touch Deployment
  • Demonstrable experience of assessing ‘Enterprise Readiness’ including: Technology Readiness & Maturity, Integration to associated toolsets and recommendations on deltas, Appropriateness for Different use cases e.g. mobile vs. fixed
  • Demonstrate process for establishing correct split of in-place versus device refresh upgrades
  • Demonstrable experience of working hand in hand with application rationalisation processes as part of the requirements gathering and discovery process
  • Demonstrable experience of performing Workstyle Analysis and the production of testable Personas for deployment
  • Demonstrable experience of assessing environment readiness and providing requirements including determining operating environment compatibility, infrastructure capacity and cloud/non-cloud mix for core services, existing application readiness work.
  • Demonstrable experience of building requirements for end user deployment including understanding user volumes / demographics / locations, alignment of application portfolios to user groups and determining the optimal deployment.
  • Demonstrable experience of user engagement to build requirements for successful user adoption ensuring users understand how to maximise/ exploit functionality, their training needs and approaches to continual engagement.
  • Demonstrable experience of writing secure environment customer requirements for Windows as a Service (“Evergreen”) including approaches to feature adoption, mapping and understanding of application portfolios, deployment of updates processes.
Nice-to-have skills and experience
  • Ability to facilitate brand agnostic device procurement requirements workshops on behalf of the NCA (Device procurement etc is however out of scope)
  • Understanding of Device as a Service versus Capital Purchase

How suppliers will be evaluated

How suppliers will be evaluated
Opportunity attribute name Opportunity attribute value
How many suppliers to evaluate 4
Proposal criteria
  • Methodology or approach to delivery and support
  • Technical capability /Competance
  • Subject matter expertise
  • Timeframe proposal
  • Risks, assumptions and challenges identified
  • Added value experience in Enterprise rollout solutions
  • Knowledge of secure environments and security considerations
  • Estimated timeframes for the work
  • Knowledge transfer
  • Team structure
  • Solution
  • Value for money
  • Requirements scope proposed
Cultural fit criteria
  • Share knowledge and skills
  • Be transparent and collaborative when making decisions
  • Take responsibility for their work
  • Subject matter expertise
  • Work in partnership with flexibility
Payment approach Capped time and materials
Assessment methods Written proposal
Evaluation weighting

Technical competence


Cultural fit




Questions asked by suppliers

Questions asked by suppliers
Supplier question Buyer answer
1. Please can you provide a secure email address and/or a point of contact; as we are currently engaged in this space at a classified level. Further contact details will be provided at the next stage of the procurement
2. The opportunity states that as part of an earlier programme "a piece of work was established to build a set of Agency wide personas." Please clarify:
Between which dates was the earlier persona piece of work conducted?
Was the earlier persona piece of work completed and delivered?
The personas are held within our present IT strategy. This work was conducted in 2015 and published in August of that year.

Due to the date of this work and the subsequent changes to the organisation it should be expected that this material is for reference only and new persona profiling should be conducted.
3. Please can you expand on the requirement to supply individuals with different skill sets during the project. what sort of skills will you require? Expectation is that the supplier will onboard the resources they require, when they require to achieve the overall outcomes. The NCA will look to the suppliers to advise on resource profiling as part of their response.

Expanding on this there is also an expectation that the supplier will advise as to which Agency side resources they will need access to achieve their outcomes.
4. We have significant experience working within secure government and have resources that hold or have held SC and DV security clearance.
Further staff who are already BPSS cleared, would also be willing to go through SC or enhanced SC security clearance as required. Should this be necessary, would the NCA be willing to sponsor these individuals in achieving the required security clearance?
It is unlikely that within the tight initial timescales that anyone who didn’t already hold SC clearance would complete security in sufficient time for the successful provider to be able to achieve their deadlines. The NCA would be willing to act as a sponsor for further staff where required and for the enhanced clearance but it is anticipated that this would be for after the initial discovery period.
5. Could you please provide details of the current tooling utilised for discovery and monitoring of end users/devices and core tooling on the estate? It is the Agency's expectation that the successful bidder will perform an assessment of the estate, alongside incumbents, to build up this view and make a gap analysis recommendation.
6. Could you please outline whether the likely 'O365 user enhancements' also require assessment and subsequent delivery as part of this engagement, or whether they are being handled within another workstream across NCA? Based on the personas developed and the understanding of the NCA environment through this work, the agency expects a holistic set of requirements and recoomendations to be produced, based on the suppliers expertise and experience, to provide the most appropriate environment for our user base.
7. What is the current size of the NCA EUD estate? Around 7000 devices which is a mixture of Laptops and Desktops
8. What data gathering tool sets for user software usage and hardware data are being used currently? Is this comprehensive? It is the Agency's expectation that the successful bidder will perform an assessment of the estate, alongside incumbents, to build up this view and make a gap analysis recommendation.
9. Are there any existing user migration readiness assessment tool sets or application rationalisation tool sets being used, other than data analysis via excel spreadsheet? The NCA has an in-flight project looking at application rationalisation. There is no user migration readiness tooling currently in play.
10. Will success in this opportunity preclude the supplier from subsequent related opportunities, e.g. any potential Windows 10 Lead supplier procurement? If the team is involved in the generation of requirements on the client side then the supplier may be excluded from bidding for the subsequent requirements that are generated. However, any follow on pieces of work are not guaranteed.
11. Is the planned refresh also looking at mobile devices and associated security? Due to the nature of mobilising the officers and the alignment of Office 365, if that can be deployed to mobile securely and efficiently, then it potentially includes a view of the mobile device estate.
12. In the ‘Summary of work’ it states the work is to provide support “to build the requirements for NCA to either conduct a procurement to appoint a Windows 10 Lead Provider or use for assuring project delivery success criteria”. This feels like two sets of requirements and associated acceptance criteria. Can you please confirm that this is correct? This is one set of requirements
13. Is the successful supplier expected to provide design services in the 12 month period or will this be to act as a ‘client side advisor’ to support the NCA in assuring design and supporting the delivery into live and the establishment of appropriate support structures? This is expected to be a client side advisor
14. Do you currently have an up-to-date view on EUC applications to job role mapping, or will this be part of the discovery phase? This would form part of the discovery phase
15. Did the earlier work to define the agency wide personas undertake direct user interviews / workshops and cover all operational branches? The earlier work was agency wide and used to identify personas that would take advantage of a corporate smartphone. This may not be an extensive list and as such there should be a review / gap analysis undertaken.
16. Which tool(s) does the NCA use to manage the traceability of requirements through to benefits realisation (e.g. iRise, Rational DOORS, JIRA, etc.), or are suppliers permitted to use industry standard tool sets. The NCA have a new implementation of JIRA/Confluence. This may or may not form part of the benefit realisation if the supplier has an alternative method. This would need to be reviewed as part of the tender process
17. Is there an existing up-to-date EUC application catalogue and a list of in-scope applications for windows 10? If not will creating this be part of the discover phase? There is an up-to-date EUC application catalogue. The list of in-scope applications for Windows 10 is being captured separately.
18. Can you please expand on the reference made in the tender to ‘NEP requirements’. There is a National Enabling Programme that is being lead by the Home Office. This forms part of those requirements.
19. Will the successful supplier be expected to also capture NCA security requirements for Windows 10 during the discovery phase? This would be expected to be captured during the discovery phase
20. In the ‘Problem to be solved’ section it mentions “Combining this technical upgrade with user enhancements from O365” Can you please confirm if any technologies outside of Windows 10 such as O365, Identity and Access Management are also in scope for discovery and requirements gathering? Office 365 deign configuration, identity / access management are not in scope of this bid as they will be performed by another strategic project. This bid will need to be able to integrate with this work to provide a Win10 build for desktop, laptop users across the estate.
21. What desktop management tools are in place today to collect PC inventory (e.g. SCCM)? This would form part of the discovery phase.
22. What is the current PC count? This would form part of the discovery phase.
23. Where is the information stored on PC warranty or lease dates? This would form part of the discovery phase.
24. Are we able to bring in a tool (complimentary to existing technology, no agent) to help with the assessment of devices? It would be beneficial to understand what the tool does and ensure there are no performance or security related impacts from the usage of the tool