Risk Protection Arrangement Cyber Risk Pilot: Cyber Essentials Certification

CPV: Computer audit services · Risk management insurance services · Technical training services

Procedure method

Award procedure without prior publication of a call for competition

Legal basis

CELEX · 32014L0025 Utilities Contracts Regulations 2016 (Directive 2014/25/EU)

Procurement category

Services

Notice status

Awarded without competition

Procurement threshold

Unspecified in notice

Regulatory regime

Standard

Commercial structure

Stand-alone contract (no framework)

Competition type

Direct award (no call for competition)

GPA / WTO covered

Yes (GPA)

Recurring procurement

Unspecified in notice

First published

2 Feb 2021, 22:56 GMT

Last source update

2 Feb 2021, 22:56 GMT

FTS notice number

2021/S 000-002103

Classification (CPV)

Computer audit servicesRisk management insurance servicesTechnical training services

Delivery area

UK

Official registry OCID

ocds-h6vhtk-028f8d Find a Tender

Why no open competition

The procurement falls outside the scope of application of the directive

Published justification

The DfE proposes to award a contract to The IASME Consortium Ltd (IASME) for the supply of the Cyber Essentials Certification as part of the 1-year Risk Protection Arrangement Cyber Risk Pilot.

The DfE believes that there is no other organisation in the market that can satisfy the technical requirements of the contract to award the Cyber Essentials Certification. With effect from 1 April 2020 and following a competitive procurement process, IASME were appointed as the sole body able to award Cyber Essentials Certification, the only government-backed quality assured standard, on behalf of the National Cyber Security Centre (NCSC). It is understood that there is no equivalent certification to the Cyber Essentials scheme available on the market that meets the standards and controls that the NCSC dictates.

It is therefore believed that there is not a market to deliver Cyber Essentials, in that there is only one Cyber Essentials Partner (IASME) that can deliver the scheme and to fit the standards required by the NCSC. The RPA seeks to align to the NCSC assured and established standard, as the subject matter experts within Government to ensure a quality standard for RPA members.

As a result, the DfE believes that Public Contracts Regulations 2015, Regulation 32(2) applies.

Regulation 32(2) states:

“The negotiated procedures without prior publication may be used for public works contracts, public supply contracts and public service contracts in any of the following cases:-

(b) where the works, supplies or services can be supplied only by a particular economic operator for any of the following reasons:-

(ii) competition is absent for technical reasons…”

The DfE is committed to the continued analysis of the longer-term need of Risk Protection Arrangement members and will continue to assess the market after this time-limited pilot. If it is determined via this analysis that an equivalent certification to meet member needs is available and that the DfE intends to continue supporting Risk Protection Arrangement Members in this way, then any further contract will be competed in line with the Public Contract Regulations 2015. This project is to deliver a short, limited pilot that is not expected to have a long-term impact on the market.

• The IASME Consortium Ltd (IASME)Awarded supplier Wyche Innovation Centre, Upper Colwall, Malvern, Malvern, UK

No document links were published on the notice.