10 - RC-CPU-23-313 - Board Paper - Phishing Software - FINAL UPDATED
Renfrewshire Council · 13 June 2024
Back to Finance, Resources and Customer Services Policy Board — 13 June 2024 and its agenda
Text extracted from the council's PDF. Layout and reading order may differ from the original.
Page 1
___________________________________________________________________ To: Finance, Resources and Customer Service Policy Board On: 13 June 2024 ___________________________________________________________________ Report by: Director of Finance and Resources ___________________________________________________________________ Heading: Contract Authorisation Report for the Provision of Phishing Prevention Software (Reference: RC-CPU-23-313) ___________________________________________________________________ 1. Summary 1.1 The purpose of this report is to seek the approval of the Finance, Resources and Customer Services Policy Board to award a Contract for the Provision of Phishing Prevention Software to Softcat PLC. 1.2 The procurement exercise was conducted as a further competition in accordance with the Call-Off award procedure under the Crown Commercial Services (CCS) Framework Agreement for Technology Products & Associated Services 2 RM6098 (“Framework”) Lot 3 (Software) (“Lot 3") and Renfrewshire Council’s Standing Orders Relating to Contracts for an above Threshold Supplies Contract. 1.3 A Contract Strategy was approved by the Head of Digital, Transformation and Customer Services and Corporate Procurement Manager on 30 April 2024. ___________________________________________________________________ 2. Recommendations It is recommended that the Finance, Resources and Customer Services Policy Board:
Page 2
2.1 Authorises the Head of Corporate Governance to award the Contract for the Provision of Phishing Prevention Software to Softcat PLC, being a Call-Off Contract made under Lot 3 of the Crown Commercial Services (CCS) Framework Agreement for Technology Products & Associated Services 2 RM6098, in accordance with the Framework Call-Off Award Procedure 2.2 Authorises the initial Contract Term of three years with the option to extend the Contract for a period of two years on two separate occasions. The proposed Call-Off Start Date is 8 July 2024 however, the actual date will be confirmed in the Order Form in accordance with the Framework Call-Off Award Procedure. 2.3 Authorises the maximum approved contract value of £667,284.43 (excluding VAT) for the full Call-Off Contract period, including any extensions (7 years in total). This includes fixed price of £254,457 (excluding VAT) for the initial 3-year term plus an 8% contingency per annum in each of the extension years (4 to 7). 2.4 Authorises the Core Terms of the Framework Agreement aggregate liability cap for this Contract which will not exceed the greater of £5 million or 150% of the Estimated Yearly Charges. _________________________________________________________ 3. Background 3.1 Whilst Microsoft security technologies filter out the majority of threats, cyber criminals recognise that Microsoft 365 (M365) is the most commonly used email and communications solution for businesses globally and have designed threats and campaigns designed to evade Microsoft’s detection capabilities. The attack formula has also changed. Whilst the volumetric, less sophisticated attacks were once the most common and are still prevalent, now far more concerning are advanced attacks that perimeter defences (by nature of design) are unable to stop e.g., Impersonation, Business Email Compromise, Supply Chain Compromise, Social Engineering or Zero-Day attacks. These attacks increase the threat of a human being unable to recognise a phishing attack and therefore triggering a wider attack such as those mentioned above which can result in further risks like ransomware. Ransomware could have a crippling impact on service delivery through e.g. loss of systems or access to data, data exfiltration, extortion, recovery costs and reputational damage to the Council.
Page 3
3.2 The Council seeks to award a contract for an Intelligent Email Security solution as a second layer of anti-phishing protection which currently or in future will have capability across the M365 suite to capture phishing attacks that are not trapped by M365 scans and enhance user education and awareness in real time. 3.3 A review of the procurement options identified that the Crown Commercial Services (CCS) Framework Agreement Technology Products & Associated Services 2, RM6098 (“the Framework”) could be utilised. The procurement exercise for this Contract was conducted in accordance with the Call-Off Award Procedure as a further competition under Lot 3 of the Framework and in accordance with the procedures for use of a third-party framework under the Council’s Standing Orders Relating to Contracts. 3.4 The further competition documentation was issued to all 43 Suppliers on Lot 3 of the Framework via the Public Contracts Scotland – Tender portal on 30 April 2024 with the submission deadline of 12 noon on 14 May 2024. One Supplier response was received in response to this further competition. Suppliers who failed to respond were approached for feedback and lack of capacity was the primary reason cited for not bidding. 3.5 The Supplier selection requirements contained in the SPD were already met at the Framework Award stage. 3.6 The Call-Off Tender received was evaluated against the further competition Award Criteria of 80% Quality and 20% Price. The score relative to the Award Criteria for the tender responses are noted below: Tenderers Name Quality Score (80%) Price Score (20%) Total Score (100%) Softcat PLC 62.75% 20% 82.75% 3.7 It is recommended that the Call-Off Contract under Lot 3 of the Framework, is awarded to Softcat PLC, who were the only Supplier to respond to the further competition and are deemed to have met all requirements. The Call-Off Contract will be formed in accordance with the Framework Award Procedure. 3.8 The cost for this Call-Off Contract will be funded by the ICT Revenue Budget.
Page 4
3.9 Community benefits were requested as part of the Further Competition Procedure and Softcat PLC have committed to deliver the following community benefits as part of this Call-Off Contract: Community Benefit Number of People/Activity Business advice/support to an SME /Social Enterprise/ Voluntary organisation 3 Event to promote supply chain opportunities 3 Non-financial support for a Social Enterprise within Renfrewshire 2 ___________________________________________________________________ Implications of the Report 1. Financial – The maximum contract value is £667,284.76 for the full Contract duration, including all extension. This includes a fixed price of £84,825 per annum for the first three years (£254,457 in total) and the includes contingency for annual price increases during years 4-7 of up to 8%. The anticipated start date of the Contract is 8 July 2024. 2. HR & Organisational Development - No HR & Organisational development implications have arisen or are anticipated. 3. Community/Council Planning – Working together to improve outcomes – the outcome of this Contract will mitigate against the risk of the Council being unable to deliver services due to staff falling victim to cyber-attacks via spam email. 4. Legal - The procurement for this Contract was carried out in accordance with the further competition requirements under the CCS Framework Agreement for Technology Products & Associated Services 2, RM6098 Lot 3 and Renfrewshire Council’s Standing Orders Relating to Contracts for a Supplies contract above GPA Threshold. 5. Property/Assets - The outcome of this Contract seeks to protect Council property and assets by mitigating against potential cyber- attacks.
Page 5
6. Information Technology - ICT Staff have been involved in this procurement exercise as the outcome of this Contract involves the implementation of new software that must be compatible with the Council’s current infrastructure and impacts the Council’s ability to enhance cyber-security. 7. Equality & Human Rights - The recommendations contained within this report have been assessed in relation to their impact on equalities and human rights. No negative impacts on equality groups or potential for infringement of individuals’ human rights have been identified arising from the recommendations contained in the report. If required following implementation, the actual impact of the recommendations and the mitigating actions will be reviewed and monitored, and the results of the assessment will be published on the Council’s website. 8. Health & Safety - There are no health and safety implications associated with the award of this Contract. 9. Procurement – The procurement exercise was conducted in accordance with the Call-Off award procedure as a further competition under the Crown Commercial Services (CCS) Framework Agreement for Technology Products and Associated Services 2, RM6098 Lot 3 (Software) and Renfrewshire Council’s Standing Orders Relating to Contracts. 10. Risk - The insurance cover held by Softcat PLC were assessed as part of their appointment on to the Framework. An aggregate liability cap which will not exceed the greater of £5 million or 150% of the Estimated Yearly Charges as per the conditions set out in the Core Terms of the Framework Agreement applicable to both the Framework and any Call-Off Contract made under it. 11. Privacy Impact – Softcat PLC is required to adhere to the Framework conditions and Call-Off terms which include provision for Data Protection which will be contained in Joint Schedule 11 - Processing Data of the Order From agreed between the parties 12. Cosla Policy Position – No Cosla Policy Position implications have arisen or are anticipated. 13. Climate Risk – The level of impact associated with provision of this service has been assessed using the Scottish Government Sustainability Test and is considered to be low risk. _________________________________________________________
Page 6
List of Background Papers None ___________________________________________________________________ Author: Rachel Davison, Digital Category Manager, Corporate Procurement Unit, rachel.davison@renfrewshire.gov.uk