Type of document: Contract Notice
Country: United Kingdom
1. Title: DEFENCE PUBLIC KEY INFRASTRUCTURE (DPKI) SUPPORT SERVICE
2. Awarding Authority: Strategic Command (Defence Digital) – Ministry of Defence, GB. Web:
3. Contract type: Service contract
4. Description: The Awarding Authority requires external assistance with PKI experience in order to run the Defence Public Key Infrastructure service. This work involves operating the PKI service whilst supporting our customers. Key areas involve identifying and reducing risks, resolving incidents, help desk requests and change request as when directed by the authority
5. CPV Code(s): 72000000, 72260000
6. NUTS code(s): UKI, UKI3, UKI32, UKK
7. Main site or location of works, main place of delivery or main place of performance: Location South West England
Work setup
Address where the work will take place MOD Corsham will be the primary working location. T&S will not apply to this requirement.
Working arrangements In order to support this solution the team must have regular access to the hardware (weekly for level 1 Certificate Authority). Some of the elements of delivery may be delivered offsite if the supplier can prove it won’t negativily impact security, delivery or service to customers.
Security clearance All members of the team must be a minimum of SC cleared. Those who will support the Certificate Authority and Root will require DV clearance with UKSV. DV/SC clearance must be held prior to start date – evidence of validity is required.
8. Reference attributed by awarding authority: Not provided.
9. Estimated value of requirement: Budget range A maximum of £68,500 per month excluding VAT
10. Closing date for applications 13.2.2020 (11:59pm).
11. Address to which they must be sent: For further information regarding the above contract notice please visit
12. Other information: Published Thursday 30 January 2020
Latest start date Monday 13 April 2020
Expected contract length 15 months, with an option for a 3.75 month extension – priced separately as part of this tender
About the work
Why the work is being done Strategic Command provides the MODs PKI service, this is a critical service that supports operational & deployed activities. The PKI solution for the Ministry of Defence is currently undergoing a change programme, in order to provide service assurance around the current solution it has been identified that external support is required.
Problem to be solved In order to continue to support the Ministry of Defences critical PKI Solution service we require a highly skilled team with experience of managing PKI. This work involves operating the PKI service whilst supporting our customers. Key areas involve identifying and reducing risks, resolving incidents, help desk requests and change request as when directed by the authority. The team will need to provide advice and guidance to the project team delivering the updated service. The team will also be required to actively work to continually improve the service provided to the customers.
Who the users are and what they need to do As a service/system provider I need to get certificates processed, renewed, revoked, and signed so that my service continues to provide the necessary assurance to our customers.
Early market engagement N/A
Any work that’s already been done This requirement is for the take on of an already in-service solution that issues approximately 5,000 certificates a year. Root Authorities and Certficiate Authorities are already operational along with existing helpdesk services.
Existing team The team will be required to work under the authority of the existing custodians, whom will be responsible for the transition of responsibilities and providing crown oversight. There is also an Infrastructure Engineer who is responsible for the hardware layer of the solution, the team will need to work with this individual in order to deliver the service. The team will also be required to support the team delivering the updated PKI solution, providing advice and guidance on PKI at an SME level.
Current phase Live
Additional information
Additional terms and conditions IR 35 information: The intermediaries legislation doesn’t apply to this engagement.
Suppliers must use the Authority’s Purchase to Payment Tool CP&F or be prepared to sign up to the tool.
In accordance with DEFCON 658 a Cyber risk assessment has been undertaken
REF: RAR-6NZ4YRCF
Potential bidders are required to complete an assurance questionnaire against the security controls appropriate to the risk level. Further information can be found at
Skills and experience
Buyers will use the essential and nice-to-have skills and experience to help them evaluate suppliers’ technical competence.
Essential skills and experience
Experience and knowledge of creating and managing PKI systems, Including Entrust software and Gemalto hardware.
Ability to encode certificate profiles in ASN1 format without internet based tools.
Ensure all work is carried out and documented in accordance with required standards, methods and procedures.
Experience of supporting IT Services via a Helpdesk.
Ability to provide PKI Advice and guidance to the authority, customers and project team.
Ability to provide a service during UK office hours (9-5).
Experience of providing management information on service data and customer interactions.
Ability to be proactive, ensuring that customers are advised with plenty of time that certificates are expiring and are chased.
Ability to and experience of improving services, e.g. introduction of request priority system.
Ability to provide the PKI Service in line with Service Level Agreements. (Listed below).
Response & Provisioning times – Acknowledge contact: within 1 hour/Respond to urgent request: within 1 hours/Respond to routine request: within 4 working hours/Respond to query: within 4 working hours.
Routine certificate requests fulfilled within 10 working days of receipt of a valid application and CSR (Certificate Signing Request).
Notification of rejected application within 1 working day of receipt/Urgent requests fulfilled within 6 hours of the receipt of a valid application and CSR
Routine certificate revocations take place within 5 working days of valid application.
Submission of requests for new level 1 issuing CAs passed to the DPMA (Policy Management Authority) within 5 working days of receipt
New level 1 Issuing CA certificates issued within 20 working days of the receipt of approval from the DPMA
Evidence that valid SC-DV level Security Clearances are currently in place and will be held for the duration of the contract
Evidence for completion of Cyber risk assessment REF: RAR-6NZ4YRCF
Confirmation that the full team will be available on contract start date.
Nice-to-have skills and experience
Experience of virtualised environments
Experience of command line interaction with utilities such as OpenSSL.
Experience of supporting IT Services within the Ministry of Defence or a similar department.
ITIL Service Management knowledge and experience.
How suppliers will be evaluated
All suppliers will be asked to provide a written proposal.
How suppliers will be evaluated
Opportunity attribute name Opportunity attribute value
How many suppliers to evaluate 6
Proposal criteria
Technical ability and knowledge – 40%
Quality and Governance – 15%
Staffing approach and team structure – 15%
Cultural fit criteria
Work as a team with our organisation and other suppliers – 1%
Be transparent and collaborative when making decisions – 1%
Take responsibility for their work – 1%
Share knowledge and experience with authority and customers – 1%
Can work with stakeholders with low technical expertise – 1%
Payment approach Fixed price
Additional assessment methods Presentation
Evaluation weighting
Technical competence
70%
Cultural fit
5%
Price
25%
TKR-2020131-EX-1273763
