MFA, Email &SMS Campaigns and Multi Device Messaging

The Authority is looking to identify a Supplier to take on and transform the existing services including; MFA SMS (OTP) and Voice Calling, outbound email and SMS capabilities (including multi device messaging), currently supported by multiple Suppliers. This new combined email and text service will be a part of a range of Communication Services that will support The Authority’s strategy of communicating with the right customer at the right time through the right channel. Currently approximately 94 million SMS, 8 million voice calls and 220 million emails are issued per annum on behalf of HMRC.

The current scope for the SMS and Voice Calling as part of the Multi-Factor Authentication service is:

•To send a unique six (6) digit access code to a customer. The Authority will be responsible for the creation and duration of the validity of any access code e.g. 15 minutes.;

•The code must be sent to a landline or mobile via SMS (“transactional route”) or Voice;

•The user could be in the UK or abroad (anywhere in the world);

•The SMS is sent using a single unique short code / unique Sender ID associated with The Authority – this must be provided by the Supplier;

The current scope for Email and SMS campaigns is to provide:

•help and support to our customers

•nudges and prompts

•provide reassurance and prevent progress chasing; and

•seek customer feedback to help improve our services.

The successful Supplier must deliver the new service in two phases:

Phase 1: Transition of the existing range of services to one service solution.

Phase 2: We are looking to exploit the top quartile capabilities provided in the solution to develop new and innovative ways of communicating with our customers, whether that be on a 121 or 1 to many basis, in a way that work seamlessly and through standard interfaces where necessary with The Authority’s other Communication and Communication management services.

HMRC requires potential providers to comply with the relevant essential requirements below or equivalent:

a.) ISO-27001 Certification as accredited by UKAS or a comparable body,

b.) Cyber Essentials Certification

c.) Cyber Essentials Plus Certification

d.) CHECK approved Pen Testers on an annual basis or such time as both Parties agree, for both internal and external system IP’s. Tested to OWASP latest guidelines

e.) Cyber Risk Insurance.

f.) Security Patch Management System

h) data centres in the UK, with no data leaving the UK

HMRC reserves the right to make services procured available to other publicly funded bodies including RCDTS, its wholly owned subsidiary company working on behalf of HMRC.

**This contract is for a period of 24 months with approx. value of £6.5m with the provision to extend for a further 12 month term, total value of 24 month term with 12 month extension approx. £9.75m**