DMFD296 Procurement of cyber security services

1.1.    As a Category 1 responder, London Fire Brigade (LFB) must maintain secure and resilient Information and Communications Technology (ICT) systems. LFB operates a large and complex ICT environment that underpins its corporate and front-line functions. This includes physical infrastructure and devices, operating systems and cloud services. 

1.2.    LFC-26-051 sets out how cyber threats to LFB are becoming increasingly challenging. Risks include ransomware, data loss and service disruption. LFB identifies cyber consultancy and penetration testing as essential tools to: 

•    identify vulnerabilities in its systems
•    support remediation
•    provide independent assurance of security controls
•    meet governance and audit requirements. 

1.3.    LFB currently commissions these services on an ad hoc basis; but finds that this creates inefficiencies and delays. LFB reports that demand on its ICT security team (particularly from procurement activity), has led to backlogs. As such, it needs a formal contract for timely and cost-effective access to specialist support.
 

2.1.    LFB’s primary objective is to establish a compliant, flexible contract that enables the London Fire Commissioner (LFC) to access cyber security penetration testing and consultancy services, as required, to supplement its internal capability; and support specialist work.

2.2.    LFB expects that the proposed contract will reduce procurement and security timescales for LFB projects, as internal resources are limited and under pressure to meet increasing demands. 
 

3.1.    The LFC, and the Deputy Mayor for Planning, Regeneration and the Fire Service (the Deputy Mayor), are required to have due regard to the Public Sector Equality Duty (section 149 of the Equality Act 2010) when taking decisions. The Public Sector Equality Duty requires the identification and evaluation of the likely potential impacts, both positive and negative, of the decision on those with protected characteristics (see paragraph 3.3).  

3.2.    It is important to note that consideration of the Public Sector Equality Duty is not a one-off task. The duty must be fulfilled before taking a decision; at the time of taking a decision; and after the decision has been taken. 

3.3.    The protected characteristics are: age, disability, gender reassignment, pregnancy and maternity, marriage and civil partnership (but only in respect of the requirements to have due regard to the need to eliminate discrimination), race (ethnic or national origins, colour or nationality), religion or belief (including lack of belief), sex, and sexual orientation. 

3.4.    The Public Sector Equality Duty requires decision-takers in the exercise of all their functions, to have due regard to the need to: 

•    eliminate discrimination, harassment and victimisation and other prohibited conduct 
•    advance equality of opportunity between people who share a relevant protected characteristic and persons who do not share it 
•    foster good relations between people who share a relevant protected characteristic and persons who do not share it. 

3.5.    Having due regard to the need to advance equality of opportunity between persons who share a relevant protected characteristic and persons who do not share it involves having due regard, in particular, to the need to: 

•    remove or minimise disadvantages suffered by persons who share a relevant protected characteristic where those disadvantages are connected to that characteristic 
•    take steps to meet the needs of persons who share a relevant protected characteristic that are different from the needs of persons who do not share it 
•    encourage persons who share a relevant protected characteristic to participate in public life or in any other activity in which participation by such persons is disproportionately low. 

3.6.    The steps involved in meeting the needs of disabled persons, that are different from the needs of persons who are not disabled, particularly include steps to take account of disabled persons’ disabilities. 

3.7.    Having due regard to the need to foster good relations between persons who share a relevant protected characteristic and persons who do not share it involves having due regard, in particular, to the need to: 

•    tackle prejudice  
•    promote understanding. 

3.8.    LFB reports that it has not carried out an Equalities Impact Assessment. Due to the nature of the procurement, there will be no impact in respect of persons with the protected characteristics of age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex and sexual orientation.
 

Procurement comments

4.1.    LFB will use the government Commercial Agency Cyber Security Services 3 Framework to establish a structured multi-supplier model via further competition. LFB expects that this framework will provide access to services including penetration testing, risk assessment and security consultancy.

Sustainability comments

4.2.    LFC-26-051 reports that this proposal does not introduce any significant sustainability impacts; and that LFB’s sustainable development team is involved in considering social value and responsible procurement within its procurement process. 

Conflicts of interest 

4.3.    There are no conflicts of interest to declare from those involved in the drafting or clearance of this decision.
 

5.1.    LFC-26-051 seeks authority to commit revenue expenditure to procure a new contract for security penetration testing and cyber security consultancy services. This will initially be for three years, with options to extend for up to a further two years. The funding source is the LFB ICT department’s revenue budget.

5.2.    If a budgetary risk materialises (dependent on the new contract price), LFB proposes to mitigate it through regular monitoring and reporting on LFB’s revenue budget; and by making prudent assumptions in future budget cycles.
 

6.1.    LFB’s General Counsel’s department has confirmed the following. 

6.2.    LFC-26-051 seeks approval to commit expenditure up to the amount set out in the part 2 report. This will be used to procure and award a contract for cyber security consultancy services.

 
6.3.    Under section 9 of the Policing and Crime Act 2017, the LFC is established as a corporation sole with the Mayor appointing the occupant of that office. 

6.4.    Pursuant to section 327D of the Greater London Authority Act 1999, as amended, the Mayor may issue to the LFC specific or general directions as to the manner in which the holder of that office is to exercise his or her functions. 

6.5.    By direction dated 1 April 2018, the Mayor set out those matters for which the LFC would require the prior approval of either the Mayor or the Deputy Mayor. In particular, paragraph (b) of Part 2 of the said direction requires the LFC to seek the prior approval of the Deputy Mayor before “[a] commitment to expenditure (capital or revenue) of £150,000 or above is identified in accordance with normal accounting practices”. The proposed expenditure which is set out in Part 2 of the report exceeds this financial threshold; accordingly, prior approval from the Deputy Mayor is sought.

6.6.    The report confirms the cyber security consultancy services required will be procured compliantly under an accessible Framework, and that such services are necessary to ensure LFB can continue to operate both efficiently and effectively.