PCD 1331 DPS CONNECT Audit Splunk SaaS BJP (Extremis)

PCD 1331 DPS CONNECT Audit Splunk SaaS BJP (Extremis)

This decision seeks approval to proceed urgently with the purchase of a Splunk Software as a Service (SaaS) solution, hosted within a dedicated secure instance within the London UK Region Amazon Web Services (AWS).   

This is required to enable the Directorate of Professional Standards (DPS) to investigate, monitor and audit the use of CONNECT more efficiently across the Met after CONNECT Drop 1 goes live.   

The Deputy Mayor for Policing and Crime is recommended to:   

1. Approve the purchase and introduction to service of Splunk software required to enable DPS to investigate, monitor and audit the use of CONNECT across the Met.    

2. Approve the initiation and direct award of contract to CDW Ltd (Value Added Reseller), via the Health Trust Europe (H.T.E) Framework for Splunk software for a period of 5 years, at a cost of £1.535m that includes £281k (25%) contingency that has been budgeted for on main Splunk contract due to inflation and devaluation of GB£/US$ since initial quote.  This also includes £500k contract headroom to the contract.   

3. Approve to allocate £2.554m of funding for project revenue of £780,000 in 2022/23 and £1,774,000 ongoing revenue costs over the next five years as this is critical to the wider rollout of CONNECT.  This is funded from the approved Connect project revenue budget, after an uplift of £270,000 from Digital Policing (DP), for the new identified scope from 2022/23.  Post closure Connect will transfer to DP business as usual (BAU), along with remaining revenue budgets. 

PART I - NON-CONFIDENTIAL FACTS AND ADVICE TO THE DMPC 

1. Introduction and background  

1. The upcoming implementation of CONNECT in November 2022 will reduce current DPS auditing capabilities, and have a significant impact on DPS business processes thereby increasing operational, and overall organisational, risk to the Met.   

2. Digital Policing (DP) has worked closely with DPS to understand the gaps within the standard CONNECT audit functionality, looking at how the other Athena and CONNECT forces have addressed the key gaps in CONNECT’s audit functionality, as well as investigating whether any existing tools on the Met estate or the new Cyber suite of tools could resolve these issues.   

3. A key benefit will be the improvement in productivity, as Splunk dashboards will enable the DPS to audit CONNECT more efficiently and effectively.  With this additional audit capability, the majority of incidents and complaints could be investigated by DPS more promptly, potentially avoiding lengthy formal misconduct investigations.   

2. Issues for consideration  

1. There is an urgency to provide approval by 9th November 2022 to take advantage of current pricing, before Splunk’s new 1st November global pricing options from USA come into effect.  The initial quote also offered 10% discount over length of contract, reducing contract costs over 5yrs taking into account recent increases in inflation and devaluation of £GB, as all Splunk quotes are initiated in America.   

2. Contract award in October will also ensure DPS CONNECT Audit Dashboards can be developed, tested and released as soon as practically possible once CONNECT Drop 1 has gone live in November 2022, but most importantly before CONNECT Drop 2 goes live in May 2023.  

3. Additional information is contained in the restricted section of the report. 

3. Financial Comments  

1. The purchase and introduction to service of Splunk software required to enable DPS to investigate, monitor and audit the use of CONNECT across the Met after CONNECT Drop 1 will require project revenue expenditure of £780k in 2022/23 and ongoing revenue expenditure of £1,774k over the next five years (an overall cost of £2.554m). This will be funded from the approved Connect project revenue budget, after an uplift from DP of £270k, in 2022/23 as a contribution to the additional scope. 

4. Legal Comments  

1. The Mayor’s Officer for Policing Crime is a Contracting Authority as defined in the Public Contracts Regulations 2015 (“the Regulations”). All awards of public contracts for goods and/or services valued at £213,477 (inclusive of VAT) or above will be procured in accordance with the Regulations. 

2. The MOPAC Scheme of Delegation and Consent provides the Deputy Mayor for Policing and Crime (“DMPC”) has delegated authority to approve business cases for revenue or capital expenditure of £500,000 and above (paragraph 4.8). 

3. Paragraph 7.23 of the Scheme provides that the Director of Strategic Procurement has consent for the approval of the award of all contracts, with the exception of those called in through the agreed call in procedure.  Paragraph 4.14 of the Scheme provides the DMPC reserves the right to call in any MPS proposal to award a contract for £500,000 or above. 

4. MPS Legal Services have reviewed this request and confirmed that the use of H.T.E Framework is compliant with procurement regulations. 

5. Commercial Issues  

1. This request is through the strategic compliant route to market via the Met’s Value Added Reseller (VAR) CDW Ltd. via a Call-Off contract through the H.T.E Framework.  The contract will be awarded to a single supplier, with a contract term of 5 years.  Subject to timing of contract award, taking advantage of an overall 10% discount, and avoiding standard 9% inflation increase that would usually apply for the additional +1+1 years after the initial 3 year term. 

2. Splunk have offered a special offer to the MPS, including an overall 10% discount when signing upfront for a 5 year Splunk SaaS solution, which has also been extended beyond the standard 30-day validity period.  Note: Initial offer expired several times previously, and was refreshed for the final time with the initial 10% off offer that expire on 30th October 2022.  However, Splunk will endeavor to honour current pricing (shortly after new Splunk pricing models comes into effect on 1st November 2022). Next late November quotes are likely to be substantially more expensive due to increases in inflation and fluctuations with the GB£/US$ exchange rate since initial quotes. 

3. Further information is contained in the restricted section of the report. 

6. GDPR and Data Privacy  

1. The MPS is subject to the requirements and conditions placed on it as a 'State' body to comply with the European Convention of Human Rights and the Data Protection Act (DPA) 2018. Both legislative requirements place an obligation on the MPS to process personal data fairly and lawfully in order to safeguard the rights and freedoms of individuals. 

2. Under Article 35 of the General Data Protection Regulation (GDPR) and Section 57 of the DPA 2018, Data Protection Impact Assessments (DPIA) become mandatory for organisations with technologies and processes that are likely to result in a high risk to the rights of the data subjects. 

3. The Information Assurance and Information Rights units within MPS will be consulted at all stages to ensure the project meets its compliance requirements. 

4. A DPIA has been completed for this project. Any data processing will be compliant with Article 8 and the Data Protection Principles.  Data handling has been confirmed as OFFICIAL – SENSITIVE.   

5. The project will ensure a privacy by design approach, which will allow the MPS to find and fix problems at the early stages of any project, ensuring compliance with GDPR. DPIAs support the accountability principle, as they will ensure the MPS complies with the requirements of GDPR and they demonstrate that appropriate measures have been taken to ensure compliance. 

7. Equality Comments  

1. As this is an extension of an existing service this work does not change any aspects relating to equality or diversity. The proposed Splunk solution is also compliant with the Web Content Accessibility Guidelines (WCAG 2.1). 

8. Background/supporting papers 

1. Report