The Pensions Regulator

Microsoft Azure IAAS Data Centre Migration

Incomplete applications

17
Incomplete applications
13 SME, 4 large

Completed applications

35
Completed applications
22 SME, 13 large
Important dates
Opportunity attribute name Opportunity attribute value
Published Wednesday 12 June 2019
Deadline for asking questions Wednesday 19 June 2019 at 11:59pm GMT
Closing date for applications Wednesday 26 June 2019 at 11:59pm GMT

Overview

Overview
Opportunity attribute name Opportunity attribute value
Summary of the work Design and implementation of a Microsoft Azure tenant for approx 400 virtual servers, with subsequent migration of the current VMware based servers and associated network design and any configuration required.
Latest start date Monday 5 August 2019
Expected contract length 6 - 9 months
Location South East England
Organisation the work is for The Pensions Regulator
Budget range

About the work

About the work
Opportunity attribute name Opportunity attribute value
Why the work is being done Services are required to move the existing Infrastructure from an IBM based Data Centre to a Microsoft Azure Platform. This is required due to the end of an existing contract which cannot be extended.

This migration must be completed no later than April 2020.
Problem to be solved The existing IBM Platform our environment is hosted in is End of Life and cannot be extended.
Who the users are and what they need to do All The Pensions Regulator's (TPR) staff are reliant on the server infrastructure that is hosted within this data centre to carry out all aspects of work undertaken by TPR.
Early market engagement
Any work that’s already been done
Existing team A small team of internal technicians (TPR staff) who can provide a good level of in house Application Subject Matter Expertise, but who are lacking Microsoft Azure design and migration experience
Current phase Not applicable

Work setup

Work setup
Opportunity attribute name Opportunity attribute value
Address where the work will take place The Pensions Regulator's offices
Napier House, Trafalgar Place, Brighton, BN1 4DW
Working arrangements Initially on site (Brighton offices - BN1 4DW) for discovery, with a presence in Brighton as and when required.
Security clearance

Additional information

Additional information
Opportunity attribute name Opportunity attribute value
Additional terms and conditions Section 82 Pensions Act 'Restricted Information'

Expenses policy
All out of pocket expenses shall be charged in line with The Pensions Regulator's expenses policy (available on request).

Key Personnel Schedule to be appended to the contract.

Skills and experience

Buyers will use the essential and nice-to-have skills and experience to help them evaluate suppliers’ technical competence.

Skills and experience
Opportunity attribute name Opportunity attribute value
Essential skills and experience
  • Proven ability of set up/migrating IT estate of large/complex public-sector organisation to MS Azure cloud compute environment to agreed standards of compliance/performance/cost control/quality parameters – 3%
  • Proven ability to deliver solutions within NCSC/CESG constraints to ensure PSN & ISO compliance is maintained and alignment with new regulations such as GDPR. – 3%
  • Must have adequate capability and capacity to deliver project outputs on time and within agreed budget – 3%
  • Proven skills in critical assessment of cloud design and recommend improvements/alternatives – 3%
  • Proven expertise in cloud optimisation and improvement. – 1%
  • Demonstrable expertise at knowledge transfer such that TPR staff are able to fully manage and operate the solution as migration occurs within current staff utilisation levels. – 2%
  • Must be willing to operate beyond standard working hours to ensure migration activity is performed at non peak times where necessary – 1%
  • Show evidence of experience creating testing frameworks to support cloud migrations including all applicable testing standards – 1%
  • Provide demonstrable experience of leading and owning delivery, as opposed to assuring - 2%
  • Demonstrable experience of governance within projects delivered to the GDS service standards and production of appropriate artefacts as projects move through discovery and migration into live service - 1%
  • Partner must provide technical knowledge, commercial expertise, implementation planning, engagement and drive for delivery plus programme and stakeholder management. Provide evidence your organisation possesses these skills, capabilities, experience - 3%
  • Demonstrable experience of working within a multi-vendor environment – 1%
  • UK based only engineers with no outsourcing to countries outside of the EU are allowed, please provide details of where your workforce is based – 1%
Nice-to-have skills and experience
  • Willing to work on-site and off-site, to balance cost effectiveness - 1%
  • Demonstrable experience of running a comprehensive test plan and go live plan - 1%
  • Demonstrable experience of your approach to maintaining systems performance during migration - 1%
  • Demonstrable experience of robust quality assurance practice - 1%
  • Demonstrable experience of migrating or preparing legacy systems for migration within public sector - 1%

How suppliers will be evaluated

How suppliers will be evaluated
Opportunity attribute name Opportunity attribute value
How many suppliers to evaluate 3
Proposal criteria
  • Technical solution
  • Approach and methodology
  • How the approach or solution meets TPR's user needs
  • How the approach or solution meets TPR's goal
  • Estimated timeframes for the work
  • How you've identified risks and dependencies and offered approaches to manage them
  • Team who will be assigned to the project for the duration of the integration
  • How you will ensure continuity of staff throughout the duration of the migration and integration and your contingency plans in the event of unexpected absence due to illness or holiday
  • Value for money
Cultural fit criteria
  • Please define how as our primary supplier you work with others, both internal staff and 'other' external suppliers - 1%
  • Please describe how in previous engagements you have gone about solving problems as they arrive - 1%
  • Please explain how as a supplier you approach decision making - 1%
  • Please detail how as a supplier you share knowledge and experience - 1%
  • Please explain what your attitude is to making mistakes and how you communicate this to the customer - 1%
Payment approach Capped time and materials
Assessment methods
  • Written proposal
  • Case study
  • Reference
  • Presentation
Evaluation weighting

Technical competence

75%

Cultural fit

5%

Price

20%

Questions asked by suppliers

Questions asked by suppliers
Supplier question Buyer answer
1. Does this opportunity replace the one previously published on Friday 7th June 2019? Yes, The Pensions Regulator took the decision to withdraw its requirement published on Friday 7th June 2019 so that we could add a further evaluation method 'presentation' to the process.
We have also made some minor changes to the essential skills and experience criteria and the proposal criteria.
The latest start date required is now Monday 5th August 2019.
Can we please request that all suppliers who had applied to the previous opportunity who wish to still be considered then please 're-apply' and re-submit your questions.
2. Could you please advise on how you will score a bidder where they have demonstrable experience of large scale migration to MS Azure but not in the public sector. Will the bidder just be marked down on that one question or is the public sector experience a pre-requisite resulting in the bidder being eliminated from the competition? Public sector was stipulated due to both the technical differences that exists within the public sector (adherance to NCSC guidelines, experience with PSN based infrastrcuture) and due to the complex nature of the administration required when working with a public sector body. If a bidder has demonstrable experience of large scale migration to MS Azure in the public sector then this will attract a higher score for that question, than if just private sector examples are provided. For clarity, private sector examples will not result in a bidder being eliminated, just marked down in comparison to public sector examples.
3. Can you please confirm your reasons for using Azure, rather than considering a discovery into all viable IAAS providers? TPR has a very rich suite of technology and data and we want to be able to ensure that the costs of integration are managed and the skillsets that we have can be leveraged. TPR is predominantly a SQL server, Microsoft house. So, it was trying to use that combination of what can we leverage in terms of existing skills and what our functional fit is in terms of existing technology. After looking at other Cloud Vendors, we found that the best fit and the best opportunity would be that from Microsoft.
4. Could you please confirm if the software running is all part of IBM software stack, Oracle Databases, WebSphere application server. Are the operating systems Linux or Windows and what versions of operating systems are being run: Windows Server 2003, Windows Server 2008 etc, Linux Redhat version 7,8 etc? Primarily, TPR uses MS Windows 2012R2, but we have a selection of 2003, 2008 & 2016 servers. The majority of applications are already MS based, SQL etc. We have a small Linux footprint (approx. 5-10) with some F5 LB's present. We currently do not use any of the IBM Software Stack with the exception of SPSS.
5. Can I confirm if this role is inside or outside IR35? As detailed in the DOS suppliers' guide, this is not an employment framework. Organisations providing specialists through DOS framework must be employed or contracted by the organisation. Organisations have responsibility and liability for the work the specialists do.
6. Can I confirm your maximum budget for the role and expectation of rate? TPR has an approved budget of £400k excluding vat; this figure was TPR's best estimate of cost based on initial analysis prior to obtaining supplier proposals. TPR has no expectation of rate.
7. When are you looking to review candidates and set up interviews for (after the deadline of the, just so we can manage each candidates expectation)? TPR is aiming to complete its initial evaluation and agree the shortlisted suppliers by 03/07/19. The shortlisted suppliers will be asked to register in our esourcing portal in order to access the written proposal requirement; anticipating to publish this on 08/07/19. Deadline for proposals is scheduled for 15/07/19 and presentations will be held w/c 22/07/19.
8. When you say 'multi-vendor', do you mean a team with members from multiple suppliers, or multiple cloud providers (e.g. Azure, AWS, GCP)? 'Multi-vendor' refers to our use of our Data Centre supplier, our Network and Telephony supplier, our Software partner and other support organisations we have working relationships with.
9. Could you please publish the procurement calendar up to the call-off contract award? The anticipated procurement timetable is as follows:
Evaluation of supplier responses: 27/06/19 - 03/07/19
Contact shortlisted suppliers and get them registered in TPR's esourcing portal in order to access the written proposal requirement: 04/07/19 - 05/07/19
Publish proposal requirements: 08/07/19
Deadline for supplier proposals: 15/07/19
Stage 2 evaluation deadline: 18/07/19
Supplier presentations: w/c 22/07/19
Contract award decision / finalise contract 29/07/19 - 02/08/19
Procurement reserve the right to amend the timetable as required.
10. Could you publish the list of suppliers that have expressed interest in this opportunity? TPR will not know which suppliers have expressed interest in this opportunity until after the closing date for applications.
11. What are TPR's (The Pensions Regulator) existing DC and DR locations? Primary DC is located in London (Kings Cross) with the DR failover located in central Amsterdam - Holland.
12. Does TPR have any footprint on Azure? If yes, does TPR have the subscription or any kind of agreement with the public cloud provider (Azure). If yes, what kind of agreement is in place? Does TPR own the subscription on cloud in that case? Does TPR plan to extend their current subscription in that case or would they want the supplier to bring in a new subscription and own it? Yes, there is an existing footprint, albeit very minimal, but we are currently based out of UK South with our geo-redundant location being UK West.
We do already have an existing Microsoft Server Cloud and Enrollment agreement we would want to extend, whereby we pay for Azure overage quarterly in arrears. We would not require the supplier to create a new subscription.
13. What is the Azure region in which TPR has a foundation zone, in case there is any existing footprint on Cloud? Yes, there is an existing footprint, albeit very minimal, but we are currently based out of UK South with our geo-redundant location being UK West.
14. In case TPR has a footprint on Azure, could you please share the details on connectivity that currently exists between on-premise (TPR's DC) and Azure – is it through Express Route, VPN, etc? We currently do not have any direct connections into MS Azure either from our existing DC or our site location in Brighton. This would be something we are looking to achieve either prior to the engagement or during the initial phase of discovery. We currently use a 100mb line from our Brighton location to manage our MS Azure estate.
15. We understand that there are approx. 400 servers in TPR's landscape which are in scope for migration to Azure. We would like to know the count of applications, hosted on the servers, which will be migrated to Azure. This would include our Document Management solutions, CRM platform, SQL estate etc. A full list detailing all of our applications will be made available to shortlisted suppliers, but in number, there are approx. 50 applications (including some inhouse built).
16. Are there any High Availability (HA) requirements and expectations in terms of service availability (SLA, etc.)? Yes, our SQL estate currently resides on HA servers, along with both of our document management solutions. We would also require other more minor applications to have HA. In terms of SLA, we are content with MS's 99.9% availability for the infrastructure layer and would look to this level for our more important applications, but this can be discussed and amended once the partner is on board.
17. Does TPR have any specific DR, backup, security and compliance related requirements that can be shared at this stage? We do, nothing out of the ordinary, but we will share these at the next stage.
18. Has TPR carried out any application or infra-level Assessment of the existing environment for migration to public cloud or Azure? If yes, could you please share the high-level results of the assessment? No; we would be looking for the partner to undertake a full 'Current State Analysis' as the first step of the engagement.
19. We would like to understand the overall cloud operations requirement and the service SLA TPR is looking at. We're sorry, we are unclear what is meant by 'Cloud Operations Requirement'; can you please clarify further?
20. We would like to know if there is an existing ITSM solution in place which needs to be integrated with the suppliers' ITSM. If Yes, kindly specify the processes that needs to be integrated? TPR currently uses ServiceNow as an ITSM toolset, but we would not look to integrate this with a partner.
21. We need to understand that it is open to bring in a supplier's own best of breed cloud operation tools to cater to TPR as a part of scope of this engagement. TPR are open to this as an option, but reserve the right to suggest and supply its own toolsets if we have comparable ones already in use.
22. Please can you confirm the approved budget for the contract? As per question 6, TPR has an approved budget of £400k excluding vat; this figure was TPR's best estimate of cost based on initial analysis prior to obtaining supplier proposals.
23. Are you happy for us to quote more than one customer example per bid question? Yes.
24. 'Show evidence of experience creating testing frameworks to support cloud migrations including all applicable testing standards – 1%’
Are there any specific tools you’d like to hear from us on? Which ones are currently in use at TPR?
Selenium & MS Azure DevOps are the 2 primary testing toolsets in employment at TPR.
25. What are the key challenges you are facing currently with respect to this migration, apart from the tight timescale? Timescales are the main issue; lack of internal resource to support the migration, lack of migration strategy and migration toolset are both issues. Current Network speeds between our existing DC and MS Azure is a factor that potentially needs to be addressed.
26. Do you have a budget in mind for this requirement? As per question 6, TPR has an approved budget of £400k excluding vat; this figure was TPR's best estimate of cost based on initial analysis prior to obtaining supplier proposals.
27. Having carried out similar engagements in the Azure space with multiple public sector clients, we can definitely recommend what the appropriate team size would be but do you have an idea of the same already?
What experience levels are you looking at?
TPR has no preconceived ideas. TPR have a very small team (3-4) that we are able to provide to assist with the migration. We would be looking to the partner to provide enough resource to facilitate all aspects of the migration with as little input from us as possible.
28. Are you seeking a Delivery Manager as part of this requirement? TPR is seeking a 'Fully Managed' service for this migration, so it will be up to the partner to supply whatever roles they feel necessary.
29. Is this for moving the servers and applications to Azure, or are the applications to be moved by some other team?
What type of applications and workloads are running on these servers?
The migration is to move all of our Server infrastructure and all applications that run upon them between our current datacentre and MS Azure. This would include our Document Management solutions, CRM platform, SQL estate etc. A full list detailing all of our applications will be made available to shortlisted partners, but in number there is approx. 50 applications (including some inhouse built).
30. How long do you expect the initial stage in Brighton to last? As this needs to be a supplier led engagement, we are looking for the partner to take a lead on the delivery. Time spent in Brighton will depend on how the partner has engaged previously with past customers and what their experience shows as the optimal working arrangements.
31. What levels of security clearance will be required? No Security Clearance is required for work at TPR.
32. Do you have a preferred technology stack? We have made the strategic decision to be Microsoft focussed in our technology approach, however this is only the preferred option and are open to using associated technologies in order to facilitate the required outcomes.
33. Is there further information that will be shared with the down-selected suppliers to inform the approach to delivery? We are agnostic about the delivery approach as we are looking for a supplier led engagement which will facilitate our desired outcome. We are of course happy to provide any additional information with the shortlisted organisations that will help inform both parties of the best approach.
34. How does TPR foresee existing staff being engaged in the migration beyond providing domain knowledge/context? Can suppliers assume that any TPR staff will be available to assist with the migration? TPR have a very small technical resource pool to provide support and migration activities with (3-4 individuals). As such we will provide whatever assistance possible, but we would be looking for the partner to provide the bulk of the resources required.
35. Given the intent is to migrate existing services to MS Azure, can you identify those elements of the GDS Service Standards you'd like suppliers to demonstrate experience against? The service standards are there to provide both TPR and the partner a framework of common understanding, as such TPR would be looking for a high level understanding and appreciation of each of the 14 points, but will not expect detailed demonstrable experience against all points in the initial submission.
36. Can TPR confirm whether they wish to own the Azure infrastructure or if they are looking for a managed service? TPR are looking for a delivery only engagement, with on premise staff owning and managing the environment post the engagement. We are not looking for a managed service.
37. Could you confirm if the replatforming of TPR applications, to make them cloud ready, is in-scope? The current application stack is currently housed in a Virtual Private Cloud; the assumption is that the applications are cloud ready and will not need to be adjusted to accommodate the MS Azure platform.
38. Can we assume that the Shared Services Infrastructure systems are included in the count of virtual machines? Or are these in addition to the numbers provided? If so, please can the number of shared services instances be provided? The assumption is correct; the count of the virtual machines includes all Services used by TPR.
39. Is any transformation of components within the 400 machine estate expected or desired, for example, migration to Azure PaaS services? Not initally, this will be a deliverable post project. However, there may be reasons to transform certain components to assist the migration which will be discussed post Current State Analysis.
40. What do you expect the general criteria to be for acceptance of migrated workloads? This is a very broad question; TPR would expect all NFR's to be at least as good as they are today, if not better. NFR's we would be looking at would be: Performance, Scalability, Interoperability, Usability, Security, Maintainability.
41. Can you elaborate on the requirement to work in "multi vendor"? Who/quantity etc? What are their roles in the context of the migration? 'Multi vendor' refers to TPR's use of its DC supplier, our Network and Telephony supplier, our Software partner and other support organisations we have working relationships with. They will not be directly working with TPR and the partner to undertake the migration, but will have an impact/bearing on its success.
42. Can you elaborate how many different environments you have? (DEV/TEST etc.) What is the split of the 400 VMs across those environments? All Numbers are approximate, but the rough split is:
Prod: 130
UAT: 100
SIT: 90
Dev: 70
43. Is DevOps culture transformation required in this effort? TPR currently uses DevOps as a toolset for In house Dev deployment and Test, but would like to use it more for IaC, so whilst not a cultural change for the organisation, some training for 'Infrastructure' resources may be needed.
44. One of your questions states all resource needs to be in the EU. Does this mean that none of this work could be delivered outside of the EU, for example in India?
Financial services, pension and insurance companies all leverage off – shore delivery, as do a number of government departments (DWP, NHS, HMRC) and therefore on the basis that the risk profile of your data is unlikely to be significantly higher than these, would offshoring this work be something you would be willing to consider if more cost effective?
Due to the classification of our data at OFFICIAL – Sensitive we would not be able to commit to any offshoring as this would not be permitted.