Awarded to Computer Task Group (UK) Limited

Start date: Wednesday 16 October 2019
Value: £100,000
Company size: SME
National Crime Agency

Internet Connection Record

4 Incomplete applications

3 SME, 1 large

7 Completed applications

2 SME, 5 large

Important dates

Tuesday 25 June 2019
Deadline for asking questions
Tuesday 2 July 2019 at 11:59pm GMT
Closing date for applications
Tuesday 9 July 2019 at 11:59pm GMT


Summary of the work
The type of research which requires technical support includes, but is not limited to:

analysis of new, priority applications and services;

trialling, assessment, development, and integration of new tools, techniques and tradecraft;

network event analysis capability – both development and exploitation.
Latest start date
Wednesday 31 July 2019
Expected contract length
March 2020
Organisation the work is for
National Crime Agency
Budget range

About the work

Why the work is being done
The NCA is developing requirements for the Internet Connection Record National Service to be delivered by Home Office. The ability to require Telecommunications Operators (TOs) to retain limited information about a person/ device’s internet activity came about as a result of passage of the Investigatory Powers Act 2016. As part of developing those requirements and enhancing our understanding of associated risk, issues and dependencies, it is proposed to run a limited ‘live trial’ of ICR capability over a six month period from August 2019, with one or more UK TOs. This trial will run from the NCA.
Problem to be solved
The IDU needs to conduct analysis and enrichment of the data outputs of the ICR trial and provide this to officers for intelligence reporting.
There are significant dependencies on the trial for proving the technical achievability, and operational value of ICRs.
The service provider must therefore have experience analysing network flow, and be comfortable with a range of analytical tools including Kibana, Tableau, i2, SPSS, Excel, etc. in order to assess the data outputs and transform them into a useable format for officers.
Who the users are and what they need to do
The recipients of the outputs of this work will be the project team for the trial activities
Early market engagement
Enquiries have indicated that the required resource is available from companies on the DOS3 Framework.
Any work that’s already been done
Significant work has already been invested in ICR service provision by a joint Home Office and NCA team and from which this Live Trial has been developed.
Existing team
IDU CCIC staff will support the trial.
Current phase

Work setup

Address where the work will take place
IDU CCIC, Spring Gardens Estate, London
Working arrangements
The researcher service is expected to be provided during standard NCA working hours in support of the operational teams.
Security clearance
Minimum SC cleared with NCA Top Up.

Additional information

Additional terms and conditions
Additional terms will be sent out shortlisted suppliers.
These will include FOIA terms as the NCA is not subject to FOI requests.
Security terms to include Security aspects letter, information security.
Shortlisted suppliers will be required to utilise Bravo during the assement stage.

At this stage you will need to create an account on the Bravosolutions E-Sourcing portal.

Skills and experience

Buyers will use the essential and nice-to-have skills and experience to help them evaluate suppliers’ technical competence.

Essential skills and experience
  • Experience in the security and defence sector - 10 points
  • Experience performing data analysis, particularly on network flow (and equivalent), and be comfortable using analytical tools including Tableau, i2, SPSS, Excel, etc. - 30 Points
  • Experience of creating data visualisations using tools such as those specified above - 15 Points
  • Understanding of IP and URL filtering and categorisation - 15 Points
  • Experience researching networking protocols including use of Wireshark and other toolsets - 30 Points
  • Working knowledge of both Elasticsearch and Kibana - 15 Points
  • Programming experience (must include Python) - 15 Points
Nice-to-have skills and experience
  • Solution Architecture - 5 Points
  • Business Analysis - 1 point
  • Knowledge and experience of Law Enforcement investigative practices and operating models - 8 Points
  • Stakeholder engagement and communication skills - 5 Points
  • Preparation of detailed and accurate requirement specification documentation, user interface guides and functional / non-functional specification documents - 3 Points
  • Working knowledge of Android, iOS, Linux, and Windows operating systems - 5 Points
  • Relevant knowledge of Investigatory Powers Act capabilities - 2 Points

How suppliers will be evaluated

How many suppliers to evaluate
Proposal criteria
  • Evidence of prior experience of the essential skills above - 15 Points
  • The proposed approach and methodology - 8 Points
  • How the approach or solution meets user needs - 5 Points
  • Other relevant skills and experience which may be of benefit to operational activities - 5 Points
Cultural fit criteria
  • Evidence of working with a diverse (multi-organisation) team - 5 Points
  • Willingness to be flexible to accommodate the needs of the organisation - 5 Points
Payment approach
Time and materials
Assessment methods
  • Written proposal
  • Case study
  • Work history
Evaluation weighting

Technical competence


Cultural fit




Questions asked by suppliers

1. What is your allocated budget?
Have specified the FTE time required for each role and would expect suppliers to provide at published rate card.
2. Will you support the SC clearance for the successful candidate?
Our funding timescales mean that facilitating clearance, which will take several months, is probably not viable. However, if insufficient suitable candidates are forthcoming we may consider accepting the Risk of non cleared resource and supporting that clearance process.
3. Please can you clarify if this work needs to be undertaken at IDU CCIC, Spring Gardens or whether a percentage, or majority, of the work can be delivered remotely. In addition, will the supplier be required to use their own ICT equipment or NCA's when working at Spring Gardens.
For the specialist integration resource - all wpork will be at Spring Gardens on NCA supplioed equipment. For the researcher role some limited work could be completed off site but our preference is for on site where collaboration with operational and developer colleagues can be better managed.
4. Can the authority please confirm whether they are happy for suppliers to have SC Cleared staff and to undergo the NCA top up either during contract negotiation or once the contract is awarded?
Yes, SC is fine and we will manage risk whilst top ups are carried out.
5. Are you using standard scoring and, if so, how does a supplier achieve a 3 versus a 2 on this opportunity for the essential and nice-to-haves? If you are not using standard scoring, can you please explain your scoring methodology?
The NCA will be using the standard scoring card as per the DoS 3 framework guidance but we have provided some clarification below on our interpretation of the scores.
0. The response provides information of such a poor standard as to provide no confidence that the service meets the requirement.
1. The suppliers response provides some clear strengths but giving some concern.
2. A good response where strengths clearly outweigh any minor weaknesses.
3. Robust and fully comprehensive response.
6. In question response 3, you talk about an integration resource and a researcher role. Is the Integration resource referring to the Internet Connection Record 2 opportunity? If this opportunity is just for the Researcher role, can you confirm if you are expecting a single resource or multiple resources to deliver.
Both resources are aligned to the Internet Enabled Investigation portfolio of work, which includes ICRs. The extent to which the resources will be applied to the ICR work specifically is dependent on how quickly they are engaged amongst - other factors. In order to keep the impact on colleagues in the unit concerned to a minimum, and for security reasons, our preference would be for the same resources to manage the work throughout the contract.
7. You mention in the first question response: "Have specified the FTE time required for each role". For the ICR 2 opportunity, 40 days is mentioned.
However, there doesn't appear to be a number of days specified for this opportunity. Are you able to give an indicative number of days for this opportunity?
The contract is until end March 2020 at up to five days per week.
8. The NCA would like to confirm that this requirement is being conducted as per the guidance of the DoS 3 framework and as such the evaluation process will be fair, open and transparent.
The NCA would like to confirm that this requirement is being conducted as per the guidance of the DoS 3 framework and as such the evaluation process will be fair, open and transparent.