· Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any...

113
Project Title School Attendance Monitoring and Absence Notification System for Looked After Children (LAC) Project Reference Number 00003096 1

Transcript of · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any...

Page 1: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Project Title School Attendance Monitoring and Absence Notification System for Looked After Children (LAC)

Project Reference Number 00003096

1

Page 2: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

CONTENTS

General

Procurement TimetableSpecificationInstructions to Applicants

Section 1 Selection Stage

Selection Stage Evaluation ModelApplication Form (This Document to be returned)

Section 2 Award Stage

Award Stage Evaluation ModelMethod Statement – Quality Questionnaire (This Document to be returned)Pricing Schedule (This Document to be returned)Functional Specification (This Document to be returned)

Section 3

Third Party Information Security (This Document to be returned)Compliance Questionnaire

Section 4

Form of Tender (This Document to be returned)Collusive Tendering / Canvassing Certificate (This Document to be returned)Freedom of Information Act Declaration (This Document to be returned)Tender Return Enclosure Checklist (This Document to be returned)

Appendix 1

Contract and Terms and Conditions (This Document to be signed and returned)

2

Page 3: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

The Contract: School Attendance Monitoring and Absence Notification System for Looked After Children (LAC)

Project Reference: 00003096

Contract Duration The initial contract term will be 24 months however the Authority reserves the right to extend the contract by further periods not exceeding a further 24 months at the discretion of the Authority based on the contract performance of the successful applicant

Contract Commencement: As soon as possible and by end August 2015 – to be agreed with the successful applicant

Procurement Timetable

Where indicated * this information is indicative and may be subject to change.

Final date for clarification requests from Applicants 13.00 hrs on 12th June 2015

Deadline for receipt of completed Tenders 13.00 hrs on 19th June 2015

Clarification / Presentation meeting (if required) 9th July 2015* - see note below

Successful / unsuccessful Applicants notified. 16th July 2015*

Applicants should ensure that the person responsible for compiling the bid, together with a member of staff able to demonstrate the functional capabilities of the application proposed are available to attend and present a fully working version of the application to the evaluation panel on 9th July – alternative dates are unlikely to be available.

3

Page 4: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Specification

Introduction

Looked after children (LAC) not attending school are at risk of falling behind with their learning. In addition, statutory guidelines in relation to promoting the education of looked after children state that “As leaders responsible for ensuring that the local authority discharges its duty to promote the educational achievement of their looked after children, Directors of Children’s Services and Lead Members for Children’s Services should ensure that: … Virtual School Heads have robust procedures in place to monitor the attendance … of the children their authority looks after”.Local authority staff including Social Workers will also be concerned that school absence can also lead to an increased risk of harm, including child sexual exploitation.Therefore the local authority wishes to commission a means by which key staff may be notified when a looked after child is absent from school and thus be in a position to respond quickly to any adverse implications of individual absences and patterns of absence including mitigating any increased risk of harm.

Scope

Warwickshire County Council currently has approximately 540 looked after children and young people of statutory school age. Most attend schools in Warwickshire but a significant proportion are educated in other local authority areas. The school attendance and absence notification system would need to alert Warwickshire County Council wherever the child attends school.

Background to the requirement

Currently the Virtual School monitors school attendance via information collected on Personal Education Plans. These are reviewed approximately six-monthly so there is a limited opportunity to intervene when a period of absence begins in order to mitigate any risk of harm or impairment to educational progress. On an ad hoc basis, schools and foster carers may share concerns about a child’s absence from school but notification would be at the discretion of these colleagues so at any time the full picture of school attendance of Warwickshire’s looked after children would be unknown.

Functional Requirements

The requirement is for a system which key professionals are able to check whether any Warwickshire looked after child is in school and study patterns of school attendance for individual children and groups. The attendance data must also record attendance codes, exclusions and whether absences are authorised and unauthorised. The system must be able to quickly provide intuitive and detailed reports which can be filtered by a range of criteria including child name, school, age, SEN and school term etc.

Performance Requirements

Implementation

This procurement is not an opportunity for an Applicant to develop a system to satisfy the specification. The system proposed MUST already be operating effectively with full functionality in a number of local authorities and should be ready to install. Within a short time it should be possible for attendance data for all Warwickshire LAC to be available to Virtual School staff and other staff as required. Full functionality is required from 1 st

September 2015.

4

Page 5: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

The successful applicant should be able to provide training to enable professionals to access data easily, so that in future new users are able to utilise the system with a few minutes of support.

Availability

The absence notification system should be operational for all school days in each school term.  Attendance monitoring records should be available at all times

Other Requirements

1. Data will need to be kept securely with access to personal data limited to assigned professionals etc.

2. The system should be intuitive and data should be easy to access for relevant staff including Virtual School staff and social workers

3. The system should be capable of exporting or importing data easily using other software commonly used e.g. Microsoft Excel.

4. System support for system users at least by telephone and email during the school term5. System support for a minimum of 4 years.6. Absences should be reported as soon as possible and within 3 hours of when children are

registered at school7. Training essential to ensure that the system is operational should be provided before

September 1st 20158. The Council is currently in the process of changing its Social Care Client Information

System to Corelogic Mosaic.  The system will need to be able to integrate well with Corelogic Mosaic. 

5

Page 6: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

WARWICKSHIRE COUNTY COUNCIL(“the Authority”)

All correspondence for this project should be sent via the correspondence function on the Authority’s E Tendering portal https://in-tendhost.co.uk/csw-jets/aspx/Home

If you are unable to access the E Tendering portal for any reason please email: [email protected]

Applicants wishing to tender should ensure that they carefully read the Conditions of Participation as failure to comply with these is likely to disqualify your application

Conditions of Participation

Completing Your Response

1. When posed with YES / NO answers please either circle your answer or clearly delete as applicable. All other questions will require you to input text / numbers, or tick boxes

2. When completing your tender response electronically, answer boxes may be enlarged if there is insufficient space allocated. You must not alter or amend the Invitation to Tender in any other way as doing so will result in the application being rejected.

If you are completing your tender response by hand (i.e. printing the documents off to fill in manually before uploading them), separate sheets may be used to answer questions if the allocated space is insufficient however any separate sheets should be clearly numbered, cross referenced from/to the Invitation to Tender (ITT) and include the applicant company name. Remember to upload and return all of the documents you wish to be considered into the E Tendering portal.

3. To enable us to assess your organisation's suitability, we require you to provide all of the information requested in the ITT. Failure to complete the ITT in full or to provide any of the information requested may result in your application being rejected.

4. Rather than leaving answer spaces blank, if the question does not apply to you please write ‘Not applicable’ or ‘N/A’. If you do not have / know the answer please write ‘Not known’ or ‘N/K’.

5. Even if you have previously or are currently supplying services to the Authority, you must not assume that the tender evaluation panel are aware of your organisations capabilities and therefore please ensure that you provide full and complete answers to all questions. The evaluation panel will only assess your organisation based on the information you provide in your tender response.

6. Except where specifically requested, no supporting documents are required. Where supporting documents are included, these should be clearly cross referenced to the appropriate section of the ITT. The Authority reserves the right to call for further evidence or supporting documents at any stage during the procurement process. Any further evidence or supporting documents requested must be submitted in accordance with the instructions provided by the Authority at the time of making the request.

7. Any financial figures you place in your response should be stated in full and in GBP e.g. £5,456,789.99 not £5.46m.

6

Page 7: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

8. Any information and/or documents submitted in response to this ITT must relate to the applicant only - the applicant being the organisation which it is proposed will enter into a formal contract should their subsequent tender be successful. If you are submitting an ITT on behalf of a consortium of organisations, the lead partner is referred to as the ‘Applicant’ however, all members of the Consortium are required to provide the information required in all sections of the ITT as part of a single composite response to the Authority.

9. Where reference is made within this ITT to any UK standard or legislation and you are not currently subject to UK standards or legislation, you are required to supply details of any equivalent standards or legislation that apply to your organisation.

10. Only the information contained within this ITT, or otherwise communicated in writing to applicants by the Authority should be considered by applicants when making their offer.

11. Any queries or requests for clarification MUST be made in writing via the correspondence function on the E Tendering portal https://in-tendhost.co.uk/csw-jets/aspx/Home. The Authority does not accept, and will not respond to any verbal requests for clarification.

Requests for clarification will be accepted until 13.00 hrs on 9th July 2015.

The closing date and time will be calculated using the system clock within the E-tendering portal. No clarification requests received after the deadline will be responded to.

Responses to clarification questions will be issued via the E Tendering portal ‘Clarifications’ function and applicants are required to check for the Authority’s responses to clarification requests on a regular basis throughout the procurement process. To ensure that all system generated e mail notifications reach your e mail in box you are advised to add the E Mail domain @in-tend.co.uk to your list of safe senders and check your spam filter settings

The information provided in response to a clarification question and the clarification question will be communicated to all applicants

12. Submitted tenders must include the official Form of Tender provided with the ITT which must be fully completed and signed. Tenders not complying with this requirement may be rejected.

13. When submitting your tender electronically it is acceptable to insert a scanned signature or scan in a signed copy of the documents. The Authority will also accept typed signatures on the basis that the successful applicant(s) provide(s) signed copies prior to contract award if requested.

14. In submitting it’s application, the applicant warrants, represents and undertakes to the Authority that:

14.1 All information and representations made to the Authority by the Applicant, its staff or agents in connection with or arising out of this ITT and/ or associated documents, are true, complete and accurate;

14.2 It has made its own investigations and undertaken its own research and due diligence and has satisfied itself in respect of all matters (whether actual or contingent) relating to the Invitation to Tender and associated documents and that it has not submitted its tender in reliance upon any information, representation or assumption which may have been made by or on behalf of the Authority (save in respect of any information which is expressly warranted by the Authority).

14.3 it will notify the Authority promptly (and provide any additional relevant information) if at any stage any information contained in the tender response becomes no longer true or accurate

7

Page 8: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Returning Your Response

1. Applicants are required to answer all of the questions and return their completed response (including any associated documentation) by: -

no later than 13.00hrs on 19th June 2015

via https://in-tendhost.co.uk/csw-jets/aspx/Home.

2. Your tender return must be submitted via the E-tendering portal. You will not be able to upload your tender after the deadline detailed above. Applicants are advised that if their tender response (including any associated documentation) is only partially uploaded within the E-tendering portal by the closing date and time then the system will lock them out and they will not be able to complete their document upload. The Authority reserves the right to only evaluate documents received within the E-tendering portal by the closing date and time and applicants are advised that a partial upload is unlikely to be successful. Applicants are therefore recommended to upload their full tender response well in advance of the closing date and time.

If you are experiencing any difficulties with your upload you must contact the Authority well in advance of the closing date and time

3. For this procurement the closing date and time will be calculated using the system clock within the E-tendering portal.

4. The following document types are acceptable for upload to the E-tendering portal :

Microsoft Word Microsoft Power PointMicrosoft Excel Adobe Acrobat

Where proprietary software is used for structure charts etc., files should be converted to and submitted in pdf format. Please note there is a maximum file upload size of 20mb per document to the E-tendering portal..

General Conditions of Participation

1. Any form of canvassing of Elected Members or Officers of the Authority (or their procuring agents) will automatically disqualify an Applicant from the procurement process. Applicants are required to complete the Canvassing Certificate contained within this ITT and return this as part of their submission. Applicants are able to contact the Authority in order to seek clarification or guidance on the contents of the ITT and details of how this must be done are included in the ‘Completing Your Response’ section above.

2. The publication of this ITT in no way commits the Authority to award any contract pursuant to any procurement process. The Authority reserves the right at its sole discretion: -

to amend the terms, conditions and/or requirements of the ITT or procurement process. Any such amendment will be notified to all applicants before the closing date and time. In completing the Form of Tender, applicants are confirming that it includes for all amendments so notified;

to cancel, postpone or suspend this procurement at any stage. not to accept the lowest or any offer, and reserves the right to accept tenders in whole

or in part.

3. All information provided to the Applicant by the Authority shall be regarded as confidential and used only to prepare a response to the ITT. The tender document remains the property

8

Page 9: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

of the Authority and must be returned upon demand. Applicants must not disclose the contents of the documents, other than on an "In Confidence" basis to those who have a legitimate need to know or whom they need to consult for the purpose of preparing their response. Applicants must not at any time release information concerning the procurement exercise and/or the documents for publication in the press or on radio, television, screen or any other medium without prior written agreement of the Authority.

4. The Authority will not be liable for any costs or expenses howsoever incurred by applicants in completing and submitting a tender.

5. Applicants shall be deemed to have satisfied themselves as to the nature, extent and content of the ITT and to have included in their tender response for all matters that may affect the provision of the service.

6. Whilst the information in the ITT has been prepared in good faith, it does not purport to be comprehensive or to have been independently verified. The Council does not accept any liability or responsibility for the adequacy, accuracy or completeness of such information. The Council does not make any representation or warranty (express or implied) with respect to the information contained in the ITT or with respect to any written or oral information made or to be made available to any tenderer or its professional advisers

7. A submitted tender is an irrevocable offer by the Applicant. Tenders must not be qualified or accompanied by statements or a covering letter that might be construed as rendering the tender equivocal.

8. The Applicant undertakes with the Authority that the tender will remain open for acceptance by the Authority for a period of 90 days calculated from the day following the closing date for receipt of tenders.

9. Where historical data or estimated volumes are stated within the ITT, they are for guidance purposes only and do not form a contractual commitment or guaranteed level of business.

10. The Authority recognises that arrangements in relation to sub-contracting may be subject to future change, and may not be finalised until a later date. However, Applicants should be aware that where information provided to the Authority indicates that subcontractors are to play a significant role in delivering key contract requirements, any changes to those subcontracting arrangements may affect the ability of the Applicant to proceed with the procurement process or to provide the supplies and/or services required. Applicants should therefore notify the authority immediately of any change in the proposed subcontractor arrangements. The Authority reserves the right to deselect the Applicant prior to any award of contract, based on an assessment of the updated information

11. The submission of false or incorrect information or declaration(s) will invalidate your tender and, if not identified by the Authority until after the award of the contract, will be considered a fundamental breach of the contract. Such a submission may also be taken into account when future tenders are considered.

12. The Authority reserves the right (but is under no obligation) to seek clarification from any Applicant, on any aspect of their tender after tenders have been received. The Authority reserves the right to disqualify an Applicant that fails to respond to any such request adequately and/or by the deadline set by the Authority (this applies to the Applicant directly and to any other organisation that the Applicant is relying upon to provide clarification to the Authority’s request).

13. Applicants may be asked to attend tender clarification meetings and/or make a presentation of their tender. Information provided at clarification meetings or presentations may be used to moderate (i.e. adjust up, adjust down, keep same) points/scores previously allocated.

9

Page 10: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Such occasions may require demonstrations and varying levels of sample equipment testing. Applicant attendance at these sessions will be at no cost to the Authority.

14. If there are any individual rates or prices within your tender that appear anomalous, the Authority reserves the right to seek further clarification/justification in relation to these individual rates or prices as part of the tender clarification process.

15. Applicants should note that in the event that the Authority, at its sole discretion, considers a bid to be fundamentally unacceptable (including the submission of unrealistically high or low price and/ or quality bids) then regardless of its other merits that bid may be rejected.

16. The Authority reserves the right to request further documentation and/or re-assess any areas evaluated and accepted as part of the tender evaluation prior to formal award of a contract. Any material differences identified as a result of any re-evaluation may result in your tender not being accepted.

17. The Authority does not undertake to accept any tender but may at its discretion accept in writing all, or part of a tender. The effect of such acceptance shall be to create a contract between the Authority and the Applicant expressly incorporating your tender response, the Form of Tender, the Conditions of Contract, any Special Conditions of Contract and the Specification, (“the Contract Documents”). The Applicant in submitting the Tender undertakes that in the event of the Tender being accepted by the Authority the Applicant will within 14 days of being called upon to do so by the Authority execute formal contracts in the form of contract provided by the Authority.

18. In the event that the Authority issues a notification to the Applicant that it intends to award the Contract to the Applicant but the Applicant subsequently declines to enter into the Contract for any reason, the Authority reserves the right to seek compensation from the Applicant for its losses reasonably incurred in connection with the procurement process and non-commencement of the Contract.

19. The ITT together with any other documents expressed to be incorporated therein, constitutes the entire understanding between the Authority and the applicant relating to the subject matter of this procurement and supersedes all prior writings, negotiations or understandings with respect thereto.

20. The Applicant acknowledges that except for any information which is exempt from disclosure in accordance with the provisions of the Freedom of Information Act, the Authority shall be responsible for determining in its absolute discretion whether any of the content of the Contract Documents (including the tender submission) is exempt from disclosure in accordance with the provisions of the Freedom of Information Act.

Notwithstanding any term of this Invitation to Tender and your tender submission, the Applicant hereby gives their consent for the Authority to publish details of the contract award and the resulting contract in its entirety but with any information which the Authority considers is exempt from disclosure in accordance with the conditions of the FOIA redacted, including from time to time any agreed changes to the Contract.

21. The Authority reserves the right to retain all and any of the information supplied to it by the Applicant.

22. The Authority reserves the right to disclose all or any information supplied by Applicants in their tender response to the Director General of the Office of Fair Trading for the purposes of assisting the Director General in the discharge of his or her duties under the Competition Act 1980 and 1998 and any relevant legislation.

10

Page 11: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

23. Your attention is drawn to the Authority’s Public Interest Reporting Code. The Code covers all employees of the Authority, its suppliers, agency staff and the Authority’s partners. The Code enables both providers to and staff of the Authority to report, confidentially, serious concerns about any aspects of the Authority’s work in which they may suspect criminal behaviour or other forms of malpractice. For further information and guidance along with details as to how to make such a disclosure, please refer to the Authority’s Public Interest Reporting Code policy via the following web link https://www.warwickshire.gov.uk/audit

11

Page 12: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

SECTION 1

Selection Stage

12

Page 13: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Selection Stage Evaluation

All tender submissions will be evaluated by officers of the Authority (and / or their agents) in order to identify the applicants to move forward to the ‘Award’ stage.

Information Only Questions’ (Marked ‘I’ within the Selection Stage questionnaire)

The information provided by applicants in response to these questions is information necessary to support an application however this information is not assessed by the Authority within its scoring framework e.g.

Section 1 Applicant Details All Questions

Mandatory Questions (Marked ‘M’ within the Selection Stage questionnaire)

Mandatory questions are of a ‘pass/fail’ nature. Responses to these questions will usually be assessed centrally prior to tender responses being distributed to the wider evaluation panel for assessment of the ‘scored’ questions. In order to progress to the ‘Award’ stage, applicants must initially satisfy all of the mandatory criteria as detailed below: -

Question

Number

Question Heading

Requirement

1.1 Grounds for Mandatory Exclusion

Any Applicant that answers ‘Yes’ to any question within Section 1.1 should provide sufficient evidence that provides a summary of the circumstances and any remedial action that has taken place subsequently and effectively “self cleans” the situation referred to in that question.

The Applicant has to demonstrate it has taken such remedial action, to the satisfaction of the Authority in each case. If such evidence is considered by the Authority (whose decision will be final) as sufficient, the applicant shall be allowed to continue in the procurement process.

1.2 None payment of taxes

If you answer “yes” to question 1.2 and have not paid or entered into a binding arrangement to pay the full amount, you may still avoid exclusion if only minor tax or social security contributions are unpaid or if you have not yet had time to fulfil your obligations since learning of the exact amount due.

The Applicant has to demonstrate it has taken such remedial action, to the satisfaction of the Authority in each case. If such evidence is considered by the authority (whose decision will be final) as sufficient, the economic operator concerned shall be allowed to continue in the procurement process

1.3 Grounds for Discretionary

Exclusion

Any Applicant that answers ‘Yes’ to any question within Section 1.3 should provide sufficient evidence that provides a summary of the circumstances and any remedial action that has taken place subsequently and effectively “self cleans” the situation referred to in that question.

The Applicant has to demonstrate it has taken such remedial action, to the satisfaction of the Authority in each case. If such evidence is considered by the authority (whose decision will be final) as sufficient, the economic operator concerned shall be allowed to continue in the procurement process.

2.1 Off the shelf solution Applicants must answer ‘Yes’ to Q2.1 in order to pass this question.

2.2Web based and hosted

externally (to the Council).

Applicants must answer ‘Yes’ to Q2.2 in order to pass this question.

3.1Insurance Applicants must answer ‘Yes’ to Q3.1 in order to pass this question.

4.1 Financial Capacity Applicants must answer ‘Yes’ to Q4.1 in order to pass this question.

5.1H&S Applicants must answer ‘Yes’ to Q5.1 in order to pass this question.

5.2 H&S Any Applicant that answers ‘No’ to this question should provide sufficient evidence that provides a summary of the circumstances and any remedial action that has taken place subsequently and effectively “self cleans” the situation referred to in that question.

13

Page 14: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

The Applicant has to demonstrate it has taken such remedial action, to the satisfaction of the Authority in each case. If such evidence is considered by the Authority (whose decision will be final) as sufficient, the applicant shall be allowed to continue in the procurement process.

6.1 Environmental Management

Any Applicant that answers ‘Yes’ to this question should provide sufficient evidence that provides a summary of the circumstances and any remedial action that has taken place subsequently and effectively “self cleans” the situation referred to in that question.

The Applicant has to demonstrate it has taken such remedial action, to the satisfaction of the Authority in each case. If such evidence is considered by the Authority (whose decision will be final) as sufficient, the applicant shall be allowed to continue in the procurement process.

Those Applicants that satisfy all of the mandatory questions will have the scored questions within their submission evaluated. For the avoidance of doubt, any Applicant not satisfying all of the mandatory questions will be eliminated from the procurement at this stage and no further evaluation of the tender will be undertaken.

Scored Questions (Marked ‘S’ within the Selection Stage Questionnaire)

Scored questions require an assessment to be made concerning how well an applicant meets a particular requirement. There are several such criteria, contained within the Selection Stage and these are detailed in the table that follows together with the maximum score available for each question.

Section Question Number Questions Max. Score

Available

Contract Specific

2.4 Relationship management 42.5 Contract Penalties 4

Section Score 8

Risk Management

3.3 Customer Complaints 103.4 Staff Development & Training 43.5 Documented business continuity arrangements 43.6 Business continuity arrangements tested 23.7 Significant disruption(s) 2

Section Score 22Environmental Management 6.2 Sub-Contractor Environmental Management 6

Section Score 6

Equality Legislation

7.1 Employment Tribunal 4Equality Commission 4

7.2 Sub-Contractor Equality 2Section Score 10

Experience8.1 a) and b) Experience 30Linked to 8.1 Reference 1 12Linked to 8.1 Reference 2 12

Section Score 54

Total 100 100

Calculating the Applicants Score for the Scored Questions

1. Each member of the Authority’s evaluation team will allocate points in accordance with the Points Framework below for each question that they have been allocated to mark (applicants are reminded that different evaluators may be marking different questions).

2. The points allocated by each evaluator for each question will then be added together and divided by the number of evaluators for that question to determine the average points for each question (a).

3. The average points for each question will then be converted to a question score (b) using the following formula

(average points (a) ÷ maximum points available for that question (e)) x maximum available score for that question (f)

4. The question scores for each question will then be added together to reach a total score for 14

Page 15: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

each applicant (c).

Applications that have satisfied all of the mandatory questions and achieve a total score for the scored questions greater than or equal to 60 will be awarded a pass for the selection stage and the information provided in response to Section 2 of the ITT (Award Stage) will be evaluated.

For the avoidance of doubt any application that achieves a total score for the scored questions of less than 60 will be awarded a fail at Section 2 Selection Stage as overall the applicant has not met the Authority’s minimum requirements, they will not have the rest of their submission evaluated and they will be excluded from the procurement process at this stage.

Points Framework

2 Points – Exceeds requirements1 Point – Meets requirements 0 Points – Fails to meet requirements / does not answer the question.

Scored questions requiring either a ‘yes’ or ‘no’ or ‘not applicable’ answer will be evaluated as follows

2 Points – Meets requirements or answered ‘not applicable’0 Points – Fails to meet requirements / did not answer the question.

References will be scored based on the overall recommendation rating as follows

Overall Recommendation

Rating

Consequence Outcome

0-3 Automatic Fail Your application will be excluded from further evaluation at this point

4-6 Fails to meet requirements

0 Points

7-8 Meets requirements 1 Point9-10 Exceeds requirements 2 Points

Reference not received by the

stipulated deadline

The Authority is unable to allocate a score in line with the above framework

The Authority will usually assume that failure to secure the required number of references by the stipulated deadline is an indicator of poor performance UNLESS the explanation provided at Q8.1 is acceptable to the Authority (e.g. the Applicant may be a new start-up company). Where the required number of references are not provided, the Authority reserves the right (at its sole discretion) to exclude an Applicant or allocate 0 points based on the explanation provided.

Example Evaluation:

For an evaluation with a ‘pass’ score of 50% for the scored questions:

Bidder A Bidder B Bidder C

Question Number Details

Maximum Points for

this question

(e)

Maximum Score for

this question (f)

Average Points (a)

Question Score (b)

Average Points (a)

Question Score (b)

Average Points (a)

Question Score (b)

1 xxxxx 2 40 0.667 13.333 1.333 26.667 1.667 33.333

15

Page 16: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

2 xxxxx 2 20 1.667 16.667 1.333 13.333 1.000 10.0003 xxxxx 2 15 0.333 2.500 1.000 7.500 1.667 12.5004 xxxxx 2 15 1.000 7.500 1.333 10.000 1.667 12.5005 xxxxx 2 10 0.333 1.667 1.333 6.667 0.667 3.333

Total score (c) 41.667 Total score

(c) 64.167 Total score (c) 71.667

Pass/Fail Fail Pass/Fail Pass Pass/Fail Pass

16

Page 17: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

YOU ARE REQUIRED TO COMPLETE AND RETURN ALL DOCUMENTS FROM THIS POINT ONWARDS VIA THE IN-TEND E PROCUREMENT PORTAL

SECTION A

Applicant (Supplier) Details – Information only

Full name of the applicant completing the PQQ

Registered company address

Website address

Registered company number

Registered charity number

Registered VAT number

Name of immediate parent company

Name of ultimate parent company

Applicant contact details for enquiries about this PQQ

Primary Contact Secondary contact (if primary contact unavailable):

Name

E Mail

Phone

Postal address

Country

Please mark ‘x’ in the relevant box to indicate your trading status

a public limited company

a limited company

a limited liability partnership

other partnership

sole trader

Other (please specify)

17

Page 18: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Please mark ‘x’ in the relevant boxes to indicate whether any of the following classifications apply to you

Voluntary, Community and Social Enterprise (VCSE)

Sheltered workshop

Public service mutual

Other public sector e.g. college, health

Small or Medium Enterprise (SME)

Micro organisation (9 employees or less)

Small organisation (10 - 49 employees)

Medium organisation (50 - 249 employees)

Bidding Model – Please mark ‘X’ in the relevant box to indicate whether you are – Information only

(a) Bidding as a Prime Contractor and will deliver 100% of the key contract deliverables yourself

(b) Bidding as a Prime Contractor and will use third parties to deliver some of the services

If yes to (b), please provide details of your proposed bidding model that includes members of the supply chain, the percentage of work being delivered by each sub-contractor and the key contract deliverables each sub-contractor will be responsible for.

Applicant Response if applicable

(c) Bidding as Prime Contractor but will operate as a Managing Agent and will use third parties to deliver all of the services

If yes to (c), please provide details of your proposed bidding model that includes members of the supply chain, the percentage of work being delivered by each sub-contractor and the key contract deliverables each sub-contractor will be responsible for

Applicant Response if applicable

(d) Bidding as a consortium but not proposing to create a new legal entity

If yes, to (d) please include details of your consortium (consortium members, consortium lead) and explain the alternative arrangements i.e. why a new legal entity is not being created. (Please note that the Authority may require the consortium to assume a specific legal form if awarded the contract, to the extent that it is necessary for the satisfactory performance of the contract).

Applicant Response if applicable

(e) Bidding as a consortium and intend to create a Special Purpose Vehicle (SPV).

If yes, to (e) please include details of your consortium members, current lead member, name of SPV and provide full details of the bidding model

Applicant Response if applicable

18

Page 19: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Grounds for Mandatory Exclusion

You will be excluded from the procurement process if there is evidence of convictions relating to specific criminal offences including, but not limited to, bribery, corruption, conspiracy, terrorism, fraud and money laundering, or if you have been the subject of a binding legal decision which found a breach of legal obligations to pay tax or social security obligations (except where this is disproportionate e.g. only minor amounts involved).

If you answer “yes” to question 1.2 on the non-payment of taxes or social security contributions, and have not paid or entered into a binding arrangement to pay the full amount, you may still avoid exclusion if only minor tax or social security contributions are unpaid or if you have not yet had time to fulfil your obligations since learning of the exact amount due. If your organisation is in that position please provide details in the space provided at Q1.2

1.1 M Within the past five years, has your organisation (or any member of your proposed consortium, if applicable), Directors or partner or any other person who has powers of representation, decision or control been convicted of any of the following offences?

(a) conspiracy within the meaning of section 1 or 1A of the Criminal Law Act1977 or article 9 or 9A of the Criminal Attempts and Conspiracy (NorthernIreland) Order 1983 where that conspiracy relates to participation in a criminalorganisation as defined in Article 2 of Council Framework Decision 2008/841/JHA on the fight against organised crime

YES / NO

(b) corruption within the meaning of section 1(2) of the Public Bodies Corrupt Practices Act 1889 or section 1 of the Prevention of Corruption Act 1906; YES / NO

(c) the common law offence of bribery YES / NO

(d) bribery within the meaning of sections 1, 2 or 6 of the Bribery Act 2010; or section 113 of the Representation of the People Act 1983 YES / NO

(e) any of the following offences, where the offence relates to fraud affecting the European Communities’ financial interests as defined by Article 1 of the Convention on the protection of the financial interests of the European Communities

i. the offence of cheating the Revenue; YES / NO

ii. (ii) the offence of conspiracy to defraud; YES / NO

iii. (iii) fraud or theft within the meaning of the Theft Act 1968, the Theft Act (Northern Ireland) 1969, the Theft Act 1978 or the Theft (Northern Ireland) Order 1978; YES / NO

iv. (iv) fraudulent trading within the meaning of section 458 of the Companies Act 1985, article 451 of the Companies (Northern Ireland) Order 1986 or section 993 of the Companies Act 2006;

YES / NO

v. fraudulent evasion within the meaning of section 170 of the Customs and Excise management Act 1979 or section 72 of the Value Added Tax Act 1994 YES / NO

vi. an offence in connection with taxation in the European Union within the meaning of section 71 of the Criminal Justice Act 1993 YES / NO

vii. destroying, defacing or concealing of documents or procuring the execution of a valuable security within the meaning of section 20 of the Theft Act 1968 or section 19 of the Theft Act (Northern Ireland) 1969

YES / NO

viii. fraud within the meaning of section 2, 3 or 4 of the Fraud Act 2006; or YES / NO

ix. the possession of articles for use in frauds within the meaning of section 6 of the Fraud Act 2006, or the making, adapting, supplying or offering to supply articles for use in frauds within the meaning of section 7 of that Act;

YES / NO

(f) any offence listed—

i. in section 41 of the Counter Terrorism Act 2008; or YES / NO

ii. in Schedule 2 to that Act where the court has determined that there is a terrorist connection YES / NO

19

Page 20: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

(g) any offence under sections 44 to 46 of the Serious Crime Act 2007 which relates to an offence covered by subparagraph (f); YES / NO

(h) money laundering within the meaning of sections 340(11) and 415 of the Proceeds of Crime Act 2002; YES / NO

(i) an offence in connection with the proceeds of criminal conduct within the meaning of section 93A, 93B or 93C of the Criminal Justice Act 1988 or article 45, 46 or 47 of the Proceeds of Crime (Northern Ireland) Order 1996;

YES / NO

(j) an offence under section 4 of the Asylum and Immigration (Treatment of Claimants etc.) Act 2004; YES / NO

(k) an offence under section 59A of the Sexual Offences Act 2003; YES / NO

(l) an offence under section 71 of the Coroners and Justice Act 2009 YES / NO

(m) an offence in connection with the proceeds of drug trafficking within themeaning of section 49, 50 or 51 of the Drug Trafficking Act 1994; or YES / NO

(n) any other offence within the meaning of Article 57(1) of the Public Contracts Directive—

i. as defined by the law of any jurisdiction outside England and Wales and Northern Ireland; or YES / NO

ii. created, after the day on which these Regulations were made, in the law of England and Wales or Northern Ireland. YES / NO

Any Applicant that answers ‘Yes’ to any question within Section 1.1 should provide sufficient evidence below, that provides a summary of the circumstances and any remedial action that has taken place subsequently and effectively “self cleans” the situation referred to in that question.

The supplier has to demonstrate it has taken such remedial action, to the satisfaction of the authority in each case. If such evidence is considered by the authority (whose decision will be final) as sufficient, the economic operator concerned shall be allowed to continue in the procurement process.

In order for the evidence referred to above to be sufficient, the Supplier shall, as a minimum, prove that it has;

paid or undertaken to pay compensation in respect of any damage caused by the criminal offence or misconduct;

clarified the facts and circumstances in a comprehensive manner by actively collaborating with the investigating authorities; and

taken concrete technical, organisational and personnel measures that are appropriate to prevent further criminal offences or misconduct.

The measures taken by the Supplier shall be evaluated taking into account the gravity and particular circumstances of the criminal offence or misconduct. Where the measures are considered by the Authority to be insufficient, the Supplier shall be given a statement of the reasons for that decision.

Applicant Response if applicable

20

Page 21: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

1.2 M Non-payment of taxes - Has it been established by a judicial or administrative decision having final and binding effect in accordance with the legal provisions of any part of the United Kingdom or the legal provisions of the country in which your organisation is established (if outside the UK), that your organisation is in breach of obligations related to the payment of tax or social security contributions?

YES / NO

If you have answered Yes to this question, please use this space to provide further details. Please also use this space to confirm whether you have paid, or have entered into a binding arrangement with a view to paying, including, where applicable, any accrued interest and/or fines?

Applicant Response if applicable

21

Page 22: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Grounds for Discretionary Exclusion

The authority may exclude any Applicant who answers ‘Yes’ in any of the following situations set out in paragraphs (a) to (i);

1.3 M Within the past three years, please indicate if any of the following situations have applied, or currently apply, to your organisation:-

(a) your organisation has violated applicable obligations referred to in regulation 56 (2) of the Public Contract Regulations 2015 in the fields of environmental, social and labour law established by EU law, national law, collective agreements or by the international environmental, social and labour law provisions listed in Annex X to the Public Contracts Directive as amended from time to time;

YES / NO

(b) your organisation is bankrupt or is the subject of insolvency or winding-up proceedings, where your assets are being administered by a liquidator or by the court, where it is in an arrangement with creditors, where its business activities are suspended or it is in any analogous situation arising from a similar procedure under the laws and regulations of any State;

YES / NO

(c) your organisation is guilty of grave professional misconduct, which renders its integrity questionable; YES / NO

(d) your organisation has entered into agreements with other economic operators aimed at distorting competition; YES / NO

(e) your organisation has a conflict of interest within the meaning of regulation 24 of the Public Contract Regulations 2015 that cannot be effectively remedied by other, less intrusive, measures;

YES / NO

(f) the prior involvement of your organisation in the preparation of the procurement procedure has resulted in a distortion of competition, as referred to in regulation 41, that cannot be remedied by other, less intrusive, measures;

YES / NO

(g) your organisation has shown significant or persistent deficiencies in the performance of a substantive requirement under a prior public contract, a prior contract with a contracting entity, or a prior concession contract, which led to early termination of that prior contract, damages or other comparable sanctions;

YES / NO

(h) your organisation

(i) has been guilty of serious misrepresentation in supplying the information required for the verification of the absence of grounds for exclusion or the fulfilment of the selection criteria; or(ii) has withheld such information or is not able to submit supporting documents required under regulation 59 of the Public Contract Regulations 2015; or

YES / NO

(i) your organisation has undertaken to

(aa) unduly influence the decision-making process of the contracting authority, or YES / NO

(bb) obtain confidential information that may confer upon your organisation undue advantages in the procurement procedure; or YES / NO

(j) your organisation has negligently provided misleading information that may havea material influence on decisions concerning exclusion, selection or award. YES / NO

22

Page 23: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Any Supplier that answered ‘Yes’ to any question within section 1.3 should provide sufficient evidence below, that provides a summary of the circumstances and any remedial action that has taken place subsequently and effectively “self cleans” the situation referred to in that question.

The supplier has to demonstrate it has taken such remedial action, to the satisfaction of the authority in each case. If such evidence is considered by the authority (whose decision will be final) as sufficient, the economic operator concerned shall be allowed to continue in the procurement process.

In order for the evidence referred to above to be sufficient, the Supplier shall, as a minimum, prove that it has;

paid or undertaken to pay compensation in respect of any damage caused by the criminal offence or misconduct;

clarified the facts and circumstances in a comprehensive manner by actively collaborating with the investigating authorities; and

taken concrete technical, organisational and personnel measures that are appropriate to prevent further criminal offences or misconduct.

The measures taken by the Supplier shall be evaluated taking into account the gravity and particular circumstances of the criminal offence or misconduct. Where the measures are considered by the Authority to be insufficient, the Supplier shall be given a statement of the reasons for that decision.

Applicant Response if applicable

23

Page 24: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

SECTION B

2 Contract Specific Criteria

2.1 M I/We confirm that we are able to supply an ‘off the shelf’ solution (that can be adapted and developed to meet the needs of WCC) which already has a track record of successful performance as evidenced by referees from current clients identified at section 8. For the avoidance of doubt, the Authority will not consider solutions that are either in development or being considered for development.

YES/NO

2.2 M I/We confirm that our existing solution for school attendance and absence monitoring is web based and is hosted externally (to the Council). YES/NO

2.3 I To the best of your knowledge does any Warwickshire County Council Councillor or Officer have any connection (e.g. personal, financial, trustee etc.) with your organisation, its owners, its directors or its senior officers

YES/NO

If you answered YES to Q2.3 please provide details of the Warwickshire County Councillor or Officer and detail their connection

Applicant Response if applicable

2.4 S Describe how you have managed contractual relationships with the main client (i.e. not relationships with individual customers) including dealing with conflict, dispute or disagreement on other contracts including any contracts currently or previously held with the Authority.

Applicant Response

2.5 S Has your Organisation, within the last three years:

Incurred contract penalties, default notices or paid liquidated damages? YES/NO

Been served with notice requiring improvement for not performing to the required contract standards? YES/NO

Had any contract not renewed for failure to perform to the terms and conditions of the contract? YES/NO

For any question in Section 2.5 where the answer is YES, please give details below

2.6 S When delivering contracts of this type, what sorts of social benefits have you been able to provide to the contracting authorities e.g. creation of apprenticeships, traineeships, engagement with local schools, jobs for local people, use of local supply chains etc.

Applicant Response

24

Page 25: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

3 Risk Management

3.1 M Please self-certify whether you already have, or can commit to obtain, prior to the commencement of the contract, the levels of insurance cover indicated in 3.2 below:

(NOTE that evidence of sufficient cover will be required from the successful Applicant prior to contract award)

YES / NO

3.2 I In the table below, please provide details of all insurance cover currently in force.

Note It is a legal requirement that all companies hold Employer’s (Compulsory) Liability Insurance of £5 million as a minimum. Please note this requirement is not applicable to Sole Traders.

Type of Insurance Minimum Level of Cover Required (£m) Level of Cover Currently Held (£m)

Public Liability £5 million in respect of any claim (with no overall limit)

Employer’s Liability £5 million in respect of any claim (with no overall limit)

3.3 S Describe how your organisation manages customer complaints. Include in your response any complaint escalation procedures that are in place and also how you have used customer complaints to develop your services.

Applicant Response

3.4 S Describe the procedures your organisation has in place for on-going staff development and training

Applicant Response

3.5 S Does your Organisation have documented business continuity arrangements in place? YES / NO

3.6 S Are your business continuity arrangements tested at least annually? YES / NO

3.7 S Have you experienced any significant service disruption(s) within the past three years? YES / NO

If you answered yes to Q3.7, please describe the cause of the service disruptions, the duration, the action taken to recover service delivery and the business changes made to ensure no reoccurrence of the event:

Note: If you answered yes to Q3.7 but the supplementary information provides the Authority with the confidence that the Applicant takes business continuity seriously and learns from business continuity issues, a score of higher than zero will be given.

25

Page 26: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

4 Financial Capacity

4.1 M

The Authority will initially take a commercial risk reference of your organisation from Creditsafe to determine whether it needs to undertake any further form of financial assessment of your company. The Organisation agrees that if it receives a commercial risk reference which indicates there is doubt about their ability to fulfil delivery of the contract or no Creditsafe reference is available, the Organisation will submit any information requested by the Council in order that financial capacity can be assessed

YES / NO

Please confirm which of the following can be provided should the Authority decide to request them.

(a) A copy of the audited accounts for the most recent two years

(b) A statement of the turnover, profit & loss account, current liabilities and assets, and cash flow for the most recent year of trading for this organisation(c) A statement of the cash flow forecast for the current year and a bank letter outlining the current cash and credit position(d) Alternative means of demonstrating financial status if any of the above are not available (e.g. Forecast of turnover for the current year and a statement of funding provided by the owners and/or the bank, charity accruals accounts or an alternative means of demonstrating financial status).(e) Other appropriate information to confirm your financial standing

5 Health & Safety

5.1 M Please self-certify that your organisation has a Health and Safety Policy that complies with current legislative requirements. YES / NO

5.2 M Has your organisation or any of its Directors or Executive Officers been in receipt of enforcement/remedial orders in relation to the Health and Safety Executive (or equivalent body) in the last 3 years?

YES / NO

If your answer to this question was “Yes”, please provide details below of any enforcement/remedial orders served and give details of any remedial action or changes to procedures you have made as a result.

The Authority will exclude bidder(s) that have been in receipt of enforcement/remedial action orders unless the bidder(s) can demonstrate to the Authority’s satisfaction that appropriate remedial action has been taken to prevent future occurrences or breaches.

Applicant Response

26

This procurement is assessed as low value

and low risk and no financial assessment of tenderers is required for

the procurement process

Note that you must still include Fig 5 within your documentation

This procurement is assessed as low value

and low risk and no financial assessment of tenderers is required for

the procurement process

Note that you must still include Fig 5 within your documentation

This procurement is assessed as low value

and low risk and no financial assessment of tenderers is required for

the procurement process

Note that you must still include Fig 5 within your documentation

Page 27: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

6 Environmental Management

6.1 M Has your organisation been convicted of breaching environmental legislation, or had any notice served upon it, in the last three years by any environmental regulator or authority (including local authority)?

The Authority will not select bidder(s) that have been prosecuted or served notice under environmental legislation in the last 3 years, unless the Authority is satisfied that appropriate remedial action has been taken to prevent future occurrences/breaches

YES/NO

If your answer to this question is “Yes”, please provide details in the space below of the conviction or notice and details of any remedial action or changes you have made as a result of conviction or notices served.

Applicant Response

6.2 S If you use sub-contractors, do you have processes in place to check whether any of these organisations have been convicted or had a notice served upon them for infringement of environmental legislation?

YES / NO / N/A

7 Compliance with Equality Legislation

7.1 S (a) In the last three years, has any finding of unlawful discrimination been made against your organisation by an Employment Tribunal, an Employment Appeal Tribunal or any other court (or in comparable proceedings in any jurisdiction other than the UK)?

YES / NO

(b) In the last three years, has your organisation had a complaint upheld following an investigation by the Equality and Human Rights Commission or its predecessors (or a comparable body in any jurisdiction other than the UK), on grounds or alleged unlawful discrimination?

YES / NO

If you have answered “yes” to one or both of 7.1 (a) or (b) please provide in the space below, a summary of the nature of the investigation and an explanation of the outcome of the investigation to date.

If the investigation upheld the complaint against your organisation, please explain what action (if any) you have taken to prevent unlawful discrimination from reoccurring.

Applicant Response if applicable

Note: If you answered yes to Q7.1 (parts (a) and/or (b)) but the supplementary information provides the Authority with the confidence that the Applicant learns from any breaches, a score of higher than zero will be given. You may be excluded if you are unable to demonstrate to the Authority’s satisfaction that appropriate remedial action has been taken to prevent similar unlawful discrimination reoccurring

7.2 S If you use sub-contractors, do you have processes in place to check whether any of the above circumstances apply to these other organisations? YES / NO / N/A

27

Page 28: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

8 RELEVANT EXPERIENCE AND CONTRACT EXAMPLESPlease provide details of up to three contracts – STEVE DO YOU WANT 2 OR 3?, in any combination from either the public or private sector, that are relevant to the Authority’s requirement. Contracts for supplies or services should have been performed during the past three years. Works contracts may be from the past five years, and VCSEs may include samples of grant funded work.

The named customer contact provided should be prepared to provide written evidence to the Authority to confirm the accuracy of the information provided below.

Consortia bids should provide relevant examples of where the consortium has delivered similar requirements; if this is not possible (e.g. the consortium is newly formed or a Special Purpose Vehicle will be created for this contract) then three separate examples should be provided between the principal member(s) of the proposed consortium or Special Purpose Vehicle (three examples are not required from each member).

Where the Supplier is a Special Purpose Vehicle, or a managing agent not intending to be the main provider of the supplies or services, the information requested should be provided in respect of the principal intended provider(s) or sub-contractor(s) who will deliver the supplies and services.

If you cannot provide at least one example for question 8.1a, in no more than 500 words please provide an explanation for this below e.g. your organisation is a new start-up.

Applicant Response if applicable

8.1a S Contract 1 Contract 2 Contract 3

Name of customer organisation

Point of contact in customer organisation

Position in the organisation

E-mail address

28

Page 29: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Contract start date

Contract end date

Total Contract Value

In no more than 500 words, please provide a brief description of the contract delivered including evidence as to your technical capability in this market

8.1b Please provide summary information of all of your Organisation’s other relevant experience (in either the public or private sectors) of providing contracted products, services, or works similar to those being sought in this contract during the past 3 years: Please note that the Authority may (but is under no obligation) to approach any of the Organisations customers detailed in Q8.1b or 8.2 for a reference. If references are obtained they will be scored as detailed in the Selection Stage Evaluation section.

Name of Organisation including main Client contact details - (E mail and Telephone)

Description of products, services or works provided Contract dates (From – To)

Annual Value of Contract (£) – excl VAT

29

Page 30: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

SECTION 2

Award Stage

Page 30 of 81

Page 31: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

Award Stage Evaluation

Section WeightingMandatory Question Pass / FailFunctional SpecificationSteve updating for 1.6.15

80% compliance with ‘Must Haves’ at contract award and a commitment to deliver 100% compliance by contract go-live.

Quality (Non Cost) 60%Cost 40%System Presentation and Clarification Meeting

There may be a clarification meeting to confirm scores awarded elsewhere within the evaluation. Clarifications provided at the meeting may be used to moderate evaluation scores previously awarded.

Tenderers will also be able to demonstrate their proposed solution at this session

Mandatory Question - IT Security and the Council’s Third Party Supplier Security Questionnaire

Regardless of the merits of your tender at both Selection and Award stages, any contract award is conditional on the preferred supplier completing a ‘Third Party Supplier Security Questionnaire’ and having this approved by the Council see Section 5 of the ITT.

Tenderers are required to complete and return the Third Party Supplier Security Questionnaire with their tender however it will not be evaluated until after the evaluation of the Selection and Award criteria has been completed and prior to a contract being awarded. For the avoidance of doubt, Tenderers will have to satisfy the Council as to its system security in order to be awarded a contract. The Council’s decision is final in this regard and any organisations failing to satisfy the Council’s system security requirements will not have met the Council’s minimum requirements and will not be awarded a contract.

You are required to accept this condition at Q1 of the Method Statement – Quality questionnaire.

Functional Specification

Tenderers are required to be able to deliver 80% compliance with the ‘Must Haves’ at contract award and be able to commit to delivering 100% compliance with all ‘Must Haves’ by contract go-live

Method Statement – Quality Questions (Non Cost)

Each member of the Council’s evaluation team will allocate a score between 0-5 for each answer which will then be multiplied by the question weighting to achieve a weighted score for each question for each evaluator. The weighted scores for each question will then be added together to reach a total weighted score for each evaluator. All total weighted scores (by Tenderer) will then be added together and divided by the number of evaluators to reach a total average weighted score for each organisation. The total average weighted score will then be multiplied by 0.6 to provide a mark out of 60 (the percentage of the overall marks available for this section)

Evaluators will allocate scores based on the following Scoring Framework: -

Standard Description Score

Page 31 of 81

Page 32: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

Excellent Very high quality submission that exceeds specified requirement and is innovative. No reservations. 5

Good High standard, exceeding specified requirements. Some minor reservations. 4

Satisfactory Satisfactory standard, meeting specified requirements. A few reservations 3

Poor Does not meet the specified requirements. Several reservations 2

Very Poor Does not meet the specified requirements. Multiple reservations. Lacking in evidence that specified requirements can be met. 1

Unacceptable Not acceptable – major omissions and insufficient evidence to assure the Authority that the specified requirements can be met. 0

A detailed breakdown of the weightings allocated and the total marks available for each question is included within the Method Statement – Quality document.

Each of the questions is scored independently of the others, and potentially by a different individual in the evaluation panel, therefore you will need to complete each question in full even if it is repeating text in a previous response

Even if you have previously or are currently supplying services to the Council, you must not assume that the evaluation panel are aware of your organisations abilities and therefore please ensure that you provide full and complete answers to all questions. The evaluation panel will only assess your organisation based on the information you provide in the ITT and no prior information about your organisation will be considered.

Price Evaluation

The Council will evaluate the price element of tenders based on the following methodology

Lump Sum cost (Item 1 of Pricing Schedule) +Cost of training (Item 2 of Pricing Schedule) x 10 +Any additional costs identified (Items 3,4 and 5 of the Pricing Schedule)

To identify the total annual cost.

The lowest total annual cost will be awarded the maximum available marks for this element of the evaluation (40). Other tendered prices will be allocated a score out of 40 based on their relative cost to the lowest tendered price using the following formula. 40 x (Lowest Tendered Price / Tenderers Price)

Page 32 of 81

Page 33: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

Method Statements - Quality - (This document is to be completed and returned)

Question 1 – Mandatory Requirement

I/We confirm that I/we have included a completed Third Party Supplier Security Questionnaire with our tender and that I/we agree that if I/we are unable to satisfy the Council’s IT security requirements (at the sole discretion of the Council) then regardless of the other merits of our tender we will not be awarded a contract.Agree

Disagree

Question 2 – Scored (Question Weighting High - Maximum marks available 25)

Describe your implementation plan and to support this, provide a Gantt chart with full detail. In your response you should highlight the support that you will require from the Authority in order to fully implement the system.

Response     

Question 3 – Scored (Question Weighting High - Maximum marks available 25)

Describe your plans for system integration with Care First and Corelogic/Mosaic. You should include in your response references to successful interfaces with these systems with other clients.

Response     

Question 4 – Scored (Question Weighting Medium - Maximum marks available 12)

Detail the commitments you are prepared to make to the Authority in terms of adapting the software to meet the needs of the Authority and describe how you would anticipate the change process working. STEVE – DIFFERENT QUESTION?

Response     

Question 5 – Scored (Question Weighting Medium - Maximum marks available 12)

Describe how you will provide technical and general on-going system support to the Authority. Also describe how you will manage system downtime within the criteria that the Authority has specified for system availability.

Page 33 of 81

Page 34: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

Response     

Question 6 – Scored (Question Weighting Medium - Maximum marks available 12)

Describe how you will deliver and asses the effectiveness of the training you provide to the Council

Response     

Question 7 – Scored (Question Weighting Low - Maximum marks available 7)

Describe your plans for further system development over the potential life of this contract including how you will prioritise and implement any new legislation or guidance in this area.

Response     

Question 8 – Scored (Question Weighting Low - Maximum marks available 7)

Describe your arrangements for the provision of system support, help and guidance to users.

Response     

Page 34 of 81

Page 35: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

PRICING SCHEDULE

All Prices submitted must be exclusive of VAT

All costings provided below must include for All service requirements and expectations as detailed in the service specification and be fixed for the initial 2 year period of the contract. After this period, any applications for price increases must be submitted at least 60 days before they proposed to become effective and must be agreed by the Authority before they can be applied.

1

Lump sum cost to include for All service requirements and expectations as detailed in the service specification and the provision of licences for up to 700 children and their associated team of professionals

£……….. …..Lump sum per annum

2Cost of up to 10 days training including all associated costs of delivery e.g.travel, accommodation subsistence etc. if not included in 1 above

£…………… per day

3

Any additional costs associated with system adaptation to meet Council requirements (please detail)1.2.3.

£……….. ………..£……….. ………..£……….. ………..

4

Any additional costs associated with implementation (please detail)1.2.3.

£……….. ………..£……….. ………..£……….. ………..

5

Any other costs not reflected elsewhere (please detail)1.2.3.

£……….. ………..£……….. ………..£……….. ………..

For information – not part of the tender evaluation

6Day rate applicable for any additional training requested by the Council (over and above the training required to be delivered at point 2 above)

£……….. ………..

Signed ………………………………………………….………..

On behalf of …………………………………………………………….

Page 35 of 81

Page 36: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

Functional Specification Steve Pendleton reviewing functional specification for 1.6.15 Steve - should this be incorporated into the specification too?

The following table describes the functional requirements of the system. The table uses the MoSCoW scheme: this means that, while all requirements are important, they are prioritised to deliver the greatest and most immediate business benefits early.

Must Have: The requirement is essential, key stakeholder needs will not be satisfied if this requirement is not delivered and the project will be considered to have failed

Should Have: This is an important requirement but if it is not delivered within the current phase, there is an acceptable workaround until it is delivered during a subsequent phase

Could Have: This is a ‘nice to have’ requirement; we have estimated that it is possible to deliver this in the given time but will be one of the requirements de-scoped if we have underestimated

Won't Have: The full name of this category is ‘Would like to have but Won’t Have during this phase; requirements in this category will not be delivered within the phase that the prioritisation applies to

Key areas to consider are:

Key user interactions with the system (things that the user will do on the system)

Any special administrative functions required (e.g. creating user accounts)

Maintenance functions required (e.g. running a system backup)

These functional requirements could cross reference against a business process (since an action-step in a business process may relate to a system function): enter in Notes/Comments as appropriate

Page 36 of 81

Page 37: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

Requirement Description Priority Notes / Comments

Ability to MeetRequirement Y/N Plus Narrative

School attendance and absence monitoring System Access

PS1 Multi layered secure access with user defined login based on user roles

Must

PS2 The solution will provide a mechanism to authenticate the user at logon, and to maintain logon details when a user fails authentication and locks their account

Must Passwords must be secure

PS3 The solution will provide a mechanism to reset passwords. Must

School attendance and absence monitoring System functionality

PF9 Export facility on all reports to standard packages e.g. Microsoft word, Microsoft excel, pdf

Must

School attendance and absence monitoring System Functionality – Functional Requirements

PF10 Front end must be easy to access and use via world wide web and use secure protocols which has a proven history

Must Use of https://

PF11 All data transfer must be via secure transfer protocol Must Use of https:// PF12 System must be able to be used on a range of platforms including

but not limited to Windows (all versions) and a range of Browser versions, including as a minimum Internet Explorer (all versions)

Must

PF13 Integration with WCC Social Care systems – Corelogic (mosaic) Should Not expected at commencement date but to be developed for later implementation

Page 37 of 81

Page 38: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

PF14 System must be intuitive to navigate and have a look and feel which reflects the needs of users

Must

School attendance and absence monitoring System Functionality – Sharing Knowledge with Other Local Authorities

PF15 Work with other LAs who use the system – meet, discuss, share ideas

Could

PF16 If changes are made to system for one user these changes should be made known and available for other users if appropriate

Should

School attendance and absence monitoring System Functionality – Support and Maintenance PF17 Sufficient staff employed to support the product by provider Must

PF18 There is a process for raising support incidents Must

PF19 There is a standard SLA for incident management Must To be agreed with the Authority as part of implementation

PF20 There are procedures for incident resolution Must PF21 There are clear lines of communication and “point of contact”

detailsShould

Additional requirements

AR1 The system will have an online comprehensive help function available to assist with completion of all areas

Must

AR2 Comprehensive user manual Should

Non-functional Requirements NFR1 Security mechanisms are in place to prevent unauthorised

access and use Must

Page 38 of 81

Page 39: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

NFR2 The provider will supply training to the WCC team and will provide training materials suitable for use in delivery of training

Must.

Page 39 of 81

Page 40: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

Section 3

Third Party Information Security Compliance Questionnaire

Company NameCompany Address

Name and contact details of person to contact regarding the Third Party Information Security Questionnaire (phone and e mail)

Introduction

The objective of this questionnaire is to perform a preliminary security review of third party partners connecting to the Warwickshire County Council network or providing a service or support function to Warwickshire County Council.

It forms the basis of an on-going security audit and Risk Assessment of any such partnerships. The purpose of this questionnaire is to allow Warwickshire County Council’s ICT Security Team to quickly assess security measures that have been deployed within your organisation, at minimal cost and inconvenience to your organisation. The questions are based on best practice from the Tif Information Security Service (tISS) as well as identifying requirements as part of ISO 27001. Subsequent to the receipt of information requested in this document, Warwickshire County Council’s ICT Security Team may request further supporting documentation or clarification on particular areas.

There are 3 Sections: Section 1 is mandatory, whereas 2 and 3 have specific aims. If you are processing customer data, you MUST complete Section 2. If you are hosting any service, you MUST complete Section 3.

Finally, there is an area to document any known risks, along with risk treatment plans and accepted risks.

Page 41: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

Third Party Information Security Compliance Questionnaire Section (i)To be filled out by ALL Parties

Security Organisation Ask Charles Hunter, doesn’t make sense?

1. Are any employees within your organisation solely dedicated to Information Security? If yes, how many? If no, then how many have some responsibilities for Security?

2 Is the information / data security function at your organisation centralised or decentralised?

3. Does your organisation outsource information system functions? If yes, please provide a list, indicating in bold any information security functions.

4. Has your organisation suffered information security related incidents over the past two years? If yes, can it be attributed to any of the following?

(NB. This information will be held in strictest confidence)

Malicious acts/outside – Malicious acts/employees. – Inadvertent errors – Lack of systems or telecommunications availability - Natural disaster - Viral infection – Unknown source –

5. What audit information could you provide us, in the event of a possible security problem, that enables us to jointly resolve said issues?

5.1 Who has access to that audit information?

5.2 Who has access to the security information contained within?

5.3 Where is that audit information physically stored?

6. What policy and procedures are in place to grant and revoke access to the security information?

7. Is the system / platform/service you are providing supported 24 x 7? If yes, is the support on-call or on site?

8. Do you have defined and documented escalation procedure for fault management and major incident / security incident handling?

Page 42: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

9. Is the computer hardware locked in a physically secure environment?

If yes, please describe e.g. lockable racks, cage, dedicated area, CCTV?

9.1

What system of physical access control to the secure environment is deployed? (e.g. swipe cards, PIN code, biometric readers?)

9.2 Are all accesses logged and retained with the individual’s details and a time and date stamp?

10. Is the computer hardware protected against:

Interruption/Loss of power?

Fire?

Flood?

11. Are off-site backup storage facilities used? If yes, what physical security measures are in place and how is access controlled?

12. Is the platform / service hosted at a site managed by a 3rd party?

13. Are the operational staff who manage the platform / service located in the same premises as the platform / service infrastructure?

14. Do you have documented Security Policy / Standards to provide requirements for the platform / service and its operation?

If so, how often are they reviewed and updated?

15. Is this based on any standard for example BS7799? If so please provide details of which standard?

16. Can Warwickshire County Council have a copy of your policy documents, if required?

If yes, then please forward them to the Warwickshire County Council Information Security.

Page 43: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

17. Do your employees (permanent, contract and temporary) sign a document indicating that they are aware of your organisation’s security and privacy policies?

18. Is a review of system and application security included in the system development process? Is security sign-off or review required?

Page 44: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

Third Party Information Security Compliance Questionnaire Section (ii)

To be completed if processing Customer Data

1. Does the platform / service hold customer/personal data or does customer data transit the platform / service?

If yes, please specify what customer/personal data is held and for how long:

2. If customer/personal data does transit your platform / service is it encrypted at all times? If not please describe: If so, what encryption is deployed?

3. How is a customer identified to the platform / service? (for example, user name? PURN number?)

3.1 What information does the customer need to enter to access the system? (Username &/or password)?

4. Where is the customer information stored in terms of logical and physical location?

4.1 Who has access to customer data, operational staff / development Staff / 3 rd party suppliers / customer service advisers? (Please list all that apply)

4.2 How is access to customer information controlled?

5. How are customers tracked whilst logged in to the system – session ID and/or cookies?

6. How does the system defend against brute force attacks?

Page 45: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

7. Does the service fully comply with regulatory requirements? For example, the UK Data Protection Act.

Are you BS7799/ISO 27001 certified?

8. Do you use “data/information classification” methodology?

How will Warwickshire County Council data be classified and protected?

What is your data handling, storage & disposal process?

9. Does your service process financial or operations data on LAN systems, UNIX, others (please specify)?

10. Who has access to customer financial / billing information?

11. What controls are in place to mitigate the risk of fraud?

12. Do programmers have access to production data / production servers / routers / network equipment? If yes, please specify:

13. Does your Organisation allow “all powerful” or high privileged accounts on the system? If yes, how many people hold such an account?

13.1 Is the use of these accounts restricted and monitored?

14. Is there a formal process for granting, enabling, requesting, authorising, monitoring and deleting access to Warwickshire County Council data?

15. Does your organisation have a formal Change Control process that requires change approvals?

Are changes vetted for security vulnerabilities?

16. Does your organisation have separate test and production environments?

17. Is a single sign-on solution used? If so, please describe:

Page 46: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

18. How is remote access securely managed? Who is granted access?

18.1 Who is granted remote access?

18.2 Will Warwickshire County Council have access to the platform?

If yes, how and for what purpose?

19. Do you have documented Security processes and operational procedures?

20. Do you regularly audit the platform service? If yes, at what intervals?

21. Do you scan network and system boxes for known vulnerabilities?

If yes, at what intervals?

22. What measures are deployed to ensure that any compromise of your site does not threaten Warwickshire County Council or it’s data?

23. Is the data transfer encrypted (symmetric / asymmetric) and what protocols are used?

24. Are certificates used? If so, please describe distribution and management process.

25. Are any validation checks (i.e. hashing) carried out to ensure the integrity of the data?

26. In case of communications failure of the primary connection, are alternate routing mechanisms (i.e. ISDN backup) deployed?

27. Are operating systems, databases and applications hardened to a standard build configuration?If so, please provide details.

28. What is your security patch management strategy?

29. What virus detection software do you employ?

Page 47: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

30. Please describe your backup and recovery strategy:

30.1 Are backups tested?

Page 48: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

Third Party Information Security Compliance Questionnaire Section (iii)To be completed if hosting any service

1. Is the service / platform connected to the Internet?

2. Who will host this service?

3. Is customer/personal data presented only on a secure channel?

4. What customer/personal data is not presented on a secure channel?

5. What types of secure channels are used and what is the level of encryption?

6. Where will the data be held? (Web server / Back End System etc.)?

7. Is the site protected by a firewall? If yes, what type?

8. Are internal firewalls deployed to provide protection against internally generated attacks?

9. Has independent penetration testing of the firewalls and associated applications been carried out and has this validated the configuration? Has an external audit been carried out recently?

9.1 What vulnerabilities did the penetration test reveal?

9.2 Have any such vulnerability been addressed?

10 What security model is used for router access?

11. What additional security is used for transit data e.g. ACL?

12. Are any 3rd parties connected to the network and are such connections ongoing?

12.1 How do they interconnect?

Page 49: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

12.2 Has your organisation audited the interconnected site(s)?

12.3 Are any security controls deployed at the interconnected sites?

13. Do you have IDS or IPS systems installed and, if so, are they host or network based?

14. What policies and procedures relate to IDS / IPS?

15. How often is the IDS / IPS system updated?

16. Does your organisation use any other products to monitor the system and/or networks? If yes, please specify.

17. What measures are deployed to ensure that any compromise of your site does not threaten Warwickshire County Council or it’s data?

18. Is the data transfer encrypted (symmetric / asymmetric) as and what protocols are used?

19. Are certificates used? If so, please describe distribution and management process.

20. Are any validation checks (i.e. hashing) carried out to ensure the integrity of the data?

21. In case of communications failure of the primary connection, are alternate routing mechanisms (i.e. ISDN backup) deployed?

22. Are operating systems, databases and applications hardened to a standard build configuration?

23. What is your security patch management strategy?

24. What virus detection software do you employ?

25. Please describe your backup and recovery strategy:

25.1 Are backups tested?

26. Please describe your disaster recovery procedure or processes:

Page 50: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

27. What are the recovery timescales?

28. Has this process been tested recently (last 12 months)?

Other Risks

Please specify any risks that Warwickshire County Council should be aware of and indicate whether these risks are being mitigated (with evidence, if possible)

Thank you for your cooperation in answering these questions. Information received will be treated in strictest confidence.

Page 51: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

Section 4

Compliance Documentation

Page 52: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

FORM OF TENDER

Contract For: School Attendance Monitoring and Absence Notification System for Looked After Children (LAC)

Project Reference: 00003096

DECLARATION

1. I/We hereby offer to provide the School Attendance Monitoring and Absence Notification System for Looked After Children (LAC) as detailed in the Specification and perform, fulfil and keep all the obligations of the Contractor in accordance with the provisions of the Contract Documents, all for the sums properly due under the contract as calculated in accordance with the Pricing Schedule submitted as a part of my/our tender.

2. I/We confirm that:

a) I/We are fully conversant with and accept the entire Invitation to Tender and this tender is submitted strictly in accordance with the Invitation to Tender including the Conditions of Participation, Contract Terms and is without any conditions or qualifications whatsoever.

b) I/We have enclosed with this Form of Tender all of the required documents and information in accordance with the Invitation to Tender which together with this Form of Tender constitutes my/our tender.

c) In submitting my/our tender I/we have not relied on any oral or written representation or warranty made by the Authority or its Officers except those expressly incorporated by reference into the Tender Documents. In particular, I/we confirm that any information given to me/us by way of guide quantities in the Invitation to Tender was given as a guide only and I/we acknowledge that the Authority has not made any warranty or representation as to the actual quantities that will be commissioned under the contract.

d) The information supplied is accurate to the best of my/our knowledge and I/we undertake to notify the Authority immediately of any changes of information and/or circumstances occurring at any time after the submission of this Invitation to Tender. I/We understand that failure to notify the Authority of any changes of information or the provision of false information could result in my/our exclusion from further participation in this and future tender processes.

e) In the event of the Authority entering into a contract with me/us the responses to the questions set out in this Invitation to Tender will be binding upon me/us and any misrepresentation may lead to termination of the contact.

f) I/We understand that the Authority is not obliged to accept any proposal submitted or to enter into a contract with any contractor and I/we have no claim against the Authority for any costs or expenses incurred in submitting my/our Tender.

.

Page 53: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

FORM OF TENDER (Continued)

Contract For: School Attendance Monitoring and Absence Notification System for Looked After Children (LAC)

Contract Reference: 00003096

SIGNATURE INFORMATION PAGE

To be signed by the person(s) tendering or, in the case of a firm or company, by a Contractor(s) or authorised representative(s) thereof respectively in his (their) own names(s) and on behalf of such firm or company.

Signed on behalf of the applicant.

I have read the declaration contained on page 1 of this Form of Tender and I agree to be bound by its terms as evidenced by my signature below.

Dated this ……………………. Day of……………………………………….. 20……..

Signature …………………………………………………………………….

Full Name …………………………………………………………………..

Position in Company ……………………………………………………….

On behalf of (company name) ………………………………………………

Postal Address or Registered Office

………………………………………………………………………….

………………………………………………………………………...

…………………………………………………………………………

…………………………………………………………………………

Page 54: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

Contract For: School Attendance Monitoring and Absence Notification System for Looked After Children (LAC)

Project Reference: 00003096

Anti-Collusion

The essence of selective tendering is that the Authority shall receive bona fide competitive tenders from all persons tendering. In recognition of this principle:

I/We certify that this is a bona fide Tender, intended to be competitive and that I/we have not fixed or adjusted the contents by or under or in accordance with any agreement or arrangement with any other person or organisation.

I/We also certify that:

(a) I/We have not entered into, nor know of, any agreement or arrangement with any other person or organisation that is intended to, or will have the effect of, preventing, restricting, or distorting the competitiveness of this procurement process; and

(b) I/We am/are not aware of any investigations or pending investigations by the Office of Fair Trading, or other relevant body, into suspected anti-competitive behaviour affecting this procurement process or my/our business in general.

I/We also certify that I/we have not done and undertake that I/we will not do at any time any of the following acts:

(a) enter into any agreement or arrangement with any other person or organisation that he / they shall refrain from participating in this procurement process; or

(b) offering or agreeing to pay or to give or paying any sum of money, inducement or valuable consideration directly or indirectly to any person or organisation for doing or having done or causing or having caused to be done in relation to any other tender or proposed tender for the services any act or omission.

Canvassing

I/We hereby certify that I/we have not canvassed or solicited any Member, officer, employee or advisor of the Authority/s in connection with the award of this tender or any other tender or proposed tender for the services and that no person employed by me/us or acting on my/our behalf has done any such act.

I/We further hereby undertake that I/we will not in future canvass or solicit any Member, officer, employee or advisor of the Authority/s in connection with the award of this tender or any other tender or proposed tender for the services and that no person employed by me/us or acting on my/our behalf will do any such act.

I/We hereby confirm that no director or senior officer employed by me/us has any personal or financial connection with any Member, officer, employee or advisor of the Authority which would constitute a conflict of interest

Signed……………………………………… Date…………………………..

Position…………………………………..

For and on behalf of …………………………………………………………

Page 55: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

Freedom of Information Act

Contract For: School Attendance Monitoring and Absence Notification System for Looked After Children (LAC)

Project Reference: 00003096

Under the provisions of the Freedom of Information Act 2000 (FOIA) the public including private companies, journalists etc., have a general right of access to information held by The Authority. Information about an Applicant which the Authority may receive during the bidding process may be subject to disclosure in response to a request unless one of the statutory exemptions applies.

In certain circumstances, and in accordance with the code of practice issued under section 45 of the Act, the Authority may consider it appropriate to ask Applicants’ views as to the release of any information before a decision is made as to how to respond to a request. In dealing with requests for information under the Act, the Authority has to comply with a strict timetable and therefore expects a response to any such consultation within five Working Days.

If, at any stage of this tendering process, Applicants provide any information to The Authority in the expectation that it will be held in confidence, then it must be made clear in Applicants’ documentation to which information a duty of confidentiality applies. The use of blanket protective markings such as “commercial in confidence” will not be appropriate and a clear indication as to what material is to be considered confidential and why should be given. Applicants should identify in the space provided below what information, if any, they consider to be exempt from release under the FOIA.

The Authority will not be able to accept that trivial information or information which by its very nature cannot be regarded as confidential should be subject to any obligation of confidence.

In certain circumstances where information has not been provided in confidence, The Authority may still wish to consult with Applicants as to the application of any other exemption such as that relating to disclosure that will prejudice the commercial interests of any party. However the decision as to what information will be disclosed will be reserved to The Authority acting in its absolute discretion.

If there is no information considered confidential or commercially sensitive within your tender, please insert N/A in the box below. Where you have inserted N/A below, you must still return the Freedom of Information form with your tender.

Details of the Freedom of Information Act 2000 can be found at: www.informationcommissioner.gov.uk

     

THANK YOU FOR TAKING THE TIME TO COMPLETE THIS INVITATION TO TENDER.

Page 56: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

To ensure your application is evaluated properly, Warwickshire County Council needs to have a complete response from you. Before uploading your tender, please check you have answered all questions and ensure that you have enclosed all relevant documents by completing the checklist below: CHECKLIST:

Document(s) X if enclosed

Selection Stage Application Form

Method Statement – Quality Questionnaire

Gantt Chart (Method Statement – Quality Questionnaire Question 6 refers)

Pricing Schedule

Functional Specification

Third Party Information Security Compliance Questionnaire

Form of Tender

Collusive Tendering Certificate

Canvassing Certificate

Freedom of Information Act Declaration

Signed Contract Terms & Conditions

Page 57: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

APPENDIX 1

CONTRACT TERMS & CONDITIONS

Page 58: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

WARWICKSHIRE COUNTY COUNCIL and

ICT CONTRACT

D. G. CarterStrategic Director of the Resources GroupWarwickshire County CouncilShire Hall WarwickCV34 4RR

Page 59: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

Terms and Conditions of Contract of Warwickshire County Council

This Contract is entered into on:………………………………………….2015

Between:

(1) WARWICKSHIRE COUNTY COUNCIL of Shire Hall Warwick CV34 4RR (“Authority”)

and

(2) ● whose company registered number is ● and whose registered office address is ● (“Supplier”)

Whereas

1. Definitions

Authority means Warwickshire County Council of Shire Hall, Warwick CV34 4RR

Authority’s Tender the Authority’s tender documents as set out in the Specification

Contract means the agreement between the Authority and the Supplier consisting of these Terms and Conditions and related Specification but excluding any terms and conditions of sale and/or supply of the Supplier

Commencement Date means [ insert date ]

Contract Price means the price for the Goods and/or Services set out in the Specification

Confidential Information means any information which has been designated as confidential by either Party in writing or that ought to be considered as confidential (however it is conveyed or on whatever media it is stored) including information which relates to the business affairs properties assets trading practices services developments trade secrets Intellectual Property Rights know-how personnel Authority’s and Suppliers or either Party all personal data and sensitive personal data within the meaning of the Data Protection Act 1998 and commercially sensitive information

Default means any breach of the obligations of the Supplier (including but not limited to fundamental breach or breach of a fundamental term) or any default act omission negligence or statement of the Supplier its employees agents or sub-contractors in connection with or in relation to the subject matter of the Agreement and in respect of which such Party is liable to the other

Default Notice means a notice which sets out the nature of the Default committed whether or not it is a Serious Default what remedial action is required and the timescale within which the remedial action must take place

Goods means the goods, if any, to be supplied by the Supplier and identified in the Specification

Information has the same meaning as provided under section 84 of the Freedom of Information Act 2000

Page 60: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

Intellectual Property Rights means patents inventions trade-marks service marks logos design rights (whether registerable or otherwise) and applications for any of the foregoing; copyright database rights domain names trade or business names moral rights and other similar rights or obligations whether registerable or not in any country (including but not limited to the United Kingdom) and the right to sue for passing off.

Maintenance and Support means any error corrections, updates and upgrades that the Supplier may provide or perform with respect to the Software and Services, as well as any other support or training services provided to the Authority under this Agreement and in accordance with the Specification

Persistent Default means where the Supplier commits on two or more occasions during any consecutive period of 3 months whether or not these are the same or different Defaults and even if the Supplier rectifies the Default each time

Specification means the Specification used by the Authority for the Goods and/or Services and includes without limitation the Authority’s Tender and the Supplier’s Tender Response

Serious Default means a default on the Supplier’s part which in the Authority’s reasonable opinion has a material effect on the delivery of the Service

Services means the provision of the Software, Hosting Services and Maintenance and Support services as is more particularly described in the Specification attached to this Agreement

Set Up Services means the services that the Supplier provides to allow the Authority to access and use the Software, including hosting set-up and on-going services

Software means the Supplier’s proprietary software, including any error corrections, updates, upgrades, modifications and enhancements to it

Subcontractors means the contractors or providers engaged by the Supplier to provide services to, for or on behalf of the Supplier for the purposes of providing the Service to the Authority

Supplier means the person, firm or company with whom the Authority enters into the Contract.

Supplier’s Tender Response means the Supplier’s tender response as set out in the Specification

Tax means Value Added Tax, customs duties and any other taxes or duties.

Virus means anything or device (including any software, code, file or programme) which may: prevent, impair or otherwise adversely affect the operation of any computer software, hardware or network, any telecommunications service, equipment or network or any other service or device; prevent, impair or otherwise adversely affect access to or the operation of any programme or data, including the reliability of any programme or data (whether by re-arranging, altering or erasing the programme or data in whole or part or otherwise); or adversely affect the user experience, including worms, Trojan horses, viruses and other similar things or devices.

1.2 Reference to numbered clauses or appendices are to the relevant numbered clauses or appendices in this Agreement.

1.3 The headings are included for ease of reference only and shall not affect the interpretation or construction of the Agreement.

Page 61: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

1.4 References to the singular shall include the plural and references to the masculine shall include the feminine and the neuter and vice versa in each case.

1.5 References to a statute statutory instrument regulation order or quality standard shall be construed as a reference to such statute statutory instrument regulation order or quality standard as amended or re-enacted or updated or superseded from time to time.

1.6 References to any person shall include natural persons and partnerships firms and other incorporated bodies and all other legal persons of whatever kind and however constituted and their successors and permitted assignees or transferees.

1.7 In the event of any contradiction or inconsistency between this Agreement and the Specification the terms and conditions of this Agreement shall take precedence.

1.8 No terms and conditions of the Supplier whether stated on an invoice in a catalogue or other literature shall apply override or supersede any of the terms of this Agreement.

2. Supply of Goods and/or Services.

2.1 The Supplier shall provide the Goods and/or Services on the terms and conditions set out in the Contract. Subject to the Supplier fulfilling its obligations under the Contract the Authority shall pay the Supplier in accordance with the terms of the Contract.

2.2 In providing the Goods and/or Services, the Supplier shall comply with and take into account all applicable laws, enactments, orders, regulations and other similar instruments, the requirements of any court with relevant jurisdiction and any local, national or supranational agency, inspectorate, minister, ministry, official or public or statutory person of the government of the United Kingdom or of the European Union.

3. Contracts for Goods

3.1 The Goods shall be to the reasonable satisfaction of the Authority, shall conform to any particulars specified in the Specification, shall be free from defects and be fit and sufficient for all the purposes for which such Goods are ordinarily used and for any particular purpose made known to the Supplier by the Authority.

3.2 The Goods shall be delivered to the location(s), and at the times and dates specified in the Specification, and time of delivery shall be of the essence. If no times and dates are specified, the Goods shall be delivered promptly following the Supplier’s receipt of the Specification. Except where otherwise provided in the Specification, delivery shall include the unloading, stacking or installation of the Goods by Supplier at such place as the Authority shall reasonably direct.

3.3 Property and risk in the Goods shall without prejudice to any other rights or remedies of the Authority pass to the Authority at the time of acceptance. The Goods shall be packed and marked in a proper manner and in accordance with the Authority's instructions and any statutory requirements and any requirements of carriers.

3.4 The Authority may by reasonable written notice to the Supplier reject any of the Goods which fail to meet the requirements specified herein, and shall be entitled (without prejudice to other rights and remedies) either to have the Goods repaired or replaced (at the option of the Authority) or to treat the Contract as discharged and seek damages from the Supplier. The issue by the Authority of a receipt note for the Goods shall not

Page 62: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

constitute any acknowledgement of the condition or nature of those Goods.

4. Contracts for Services

4.1 The Supplier shall provide the Service for the duration of the Contract in accordance with the Authority’s requirements as set out in the Specification, and the terms of this Agreement. Timely provision of the Services shall be of the essence of the Contract, including in relation to commencing the provision of the Services.

4.2 The Supplier shall perform the Services with all reasonable care, skill and diligence, and in accordance with good industry practice. Supplier warrants and represents that all persons engaged by the Supplier for performance of the Services have the qualifications, skill and experience necessary for the proper performance of the Services.

4.3 If the Authority informs the Supplier that the Authority considers any part of the Services to be inadequate, without prejudice to Clause 4.5 below, the Supplier shall at its own expense re-schedule and perform the work correctly within such reasonable time as may be specified by the Authority.

4.4 Without prejudice to the Authority’s other rights and remedies, the Supplier shall reimburse the Authority for all reasonable costs incurred by the Authority which have arisen as a direct consequence of the Supplier’s delay in the performance of the Contract.

4.5 In the event that the Authority is of the opinion that there has been a Default by the Supplier in respect to the Services, then the Authority may, without prejudice to its other rights herein:

(a) make such deduction from the Contract Price as the Authority shall reasonably determine in respect of such of the Services as the Supplier shall have failed to provide; or

(b) provide or procure the provision of part of the Services; or

(c) terminate the Contract in respect of part of the Services only (whereupon a corresponding reduction in the Contract Price shall be made) and thereafter itself provide or procure a third party to provide such part of the Services; and/or

(d) terminate, in accordance with Clause 20.

4.6 The Authority may charge to the Supplier any cost reasonably incurred by the Authority and any reasonable administration costs in respect of the provision of any part of the Services by the Authority or by a third party to the extent that such costs exceed the payment which would otherwise have been payable to the Supplier for such part of the Services.

5. Duration

5.1 This Contract shall take effect on the Commencement Date and shall continue until the [ insert date 3 years on ] subject to the notice provisions at clause 19 to 21.

5.2 The Authority may extend the Contract for a further two additional periods each of up to one year’s duration upon expiry of the initial term of the Contract upon 3 months prior written notice.

6. Contract Price

6.1 In consideration of the satisfactory performance of the Supplier’s obligations under the

Page 63: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

Contract by the Supplier, the Authority shall pay the Contract Price.

6.2 The Authority shall pay the Supplier, in addition to the Contract Price, a sum equal to the Tax chargeable on the value of the Goods and/or Services provided in accordance with the Contract.

6.3 Payment of invoices accepted by the Authority will be made in cleared funds within 30 days of receipt and agreement of invoices, submitted in arrears, for work completed to the satisfaction of the Authority.

6.4 Wherever under the Contract any sum of money is recoverable from or payable by the Supplier, the Authority may unilaterally deduct that sum from any sum then due, or which at any later time may become due to the Supplier under the Contract or under any other agreement or contract with the Authority.

7. Data Protection, Information sharing and confidentiality

7.1 The Supplier shall at all times fully comply with the provisions of Schedule 4. 7.1A The Supplier shall comply in all respects with the provisions of the Data Protection Act

1998 as amended and shall indemnify the Authority against all actions, costs, claims proceedings or demands that may be brought or made against the Authority under the Act which arises from the improper use loss disclosure or transfer of personal data by the Supplier.

7.1B Without prejudice to the generality of Clause 7.1A the Supplier shall:

Data Security

7.1B.1 take appropriate technical and organisational measures against unlawful and unauthorised processing of the personal data and against accidental loss, destruction of and damage to the personal data. In particular, the Supplier required to:

7.1B.1.1 keep the personal data strictly private and confidential and secure;

7.1B.1.2 minimise disclosure of the personal data to third parties to the fullest extent possible;

7.1B.1.3 allow access to the personal data strictly on a 'need to know' basis and use appropriate access controls to ensure this requirement is satisfied;

7.1B.1.4 ensure that any of the Supplier’s staff or permitted subcontractors with access to the personal data are subject to a binding duty of confidentiality in relation to the data;

1.Personnel

7.1B.2 take reasonable steps to ensure the reliability of all of its personnel (whether employees or contractors) that may have access to the personal data and to ensure that they are adequately trained in the good handling of personal data; and

Instructions

7.1B.3 act only in accordance with the Authority’s instructions in relation to the personal data and will not use the personal data for any purpose other than to provide the Services

Page 64: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

under the Agreement.

Subcontractors

7.1C Without prejudice to Clause 11, the Supplier is only permitted to subcontract activities that will involve a third party processing the personal data if the third party has been approved by the Authority and the Supplier. If the Supplier engages a third party to process the personal data, the Supplier shall:

7.1C.1 only choose a third party who will provides sufficient guarantees regarding the security measures it is required to take for the processing of the personal data. The Supplier agrees to take reasonable steps to ensure the third party's compliance with those measures;

7.1C.2 ensure that the processing is carried out under a written contract in which the provisions relating to the personal data are enforceable directly by the Authority;

7.1C.3 require the third party to comply with the same obligations in this Clause 7 that apply to the Supplier as if the third party were in the Supplier’s place.

Transferring personal data outside the European Economic Area

7.1D The Supplier shall not transfer or permit the transfer of personal data to any territory outside the European Economic Area without the Authority’s prior written consent.

Providing assistance

7.1E The Supplier shall assist the Authority promptly with all subject access requests which may be received from individuals whose personal data the Supplier is processing for the Authority.

7.1F The Supplier shall promptly amend, transfer or delete any personal data that it is processing for the Authority if the Authority by writing requires the Supplier to do so.

7.1G The Supplier shall notify the Authority immediately of all communications the Supplier receives from any person which suggests non-compliance with the Data Protection Act and the Supplier shall not do anything or enter into any communication about it unless the Authority expressly authorises the Supplier to do so.

Audit

7.1H The Supplier shall permit the Authority to monitor the Supplier’s compliance with the terms of this Clause 7 which may involve the Authority or its nominated representative coming onto any premises where the personal data are being processed.

Termination

7.1I In the event that the Supplier fails to comply with this Clause 7, the Authority reserves the right to terminate the Contract by giving notice in writing to the Supplier.

Continuing obligations

7.1J The provisions of Clause 7 shall apply during the continuance of the Contract and indefinitely after its expiry or termination.

Page 65: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

8. Freedom of Information

8.1 When required to do so by the Authority, the supplier shall assist the Authority at no additional charge in meeting its obligations under the Freedom of Information Act 2000 or any statutory modification or re-enactment thereof of any related guidelines or codes of practice.

8.2 The Supplier shall keep confidential all information belonging to or provided by the Authority in connection with this contract and shall not further use or disclose it to any third party without the express consent of the Authority or except to the extent permitted by law.

9. General Security.

The Supplier shall comply with all reasonable security requirements of the Authority while on the Authority’s premises, and shall procure that all of its employees, agents, servants and sub-contractors shall likewise comply with such requirements. The Authority shall provide the Supplier upon request copies of its written security procedures. The Authority reserves the right to refuse to admit to, or to withdraw permission to remain on, any of its premises, the Supplier or any sub-contractor, agent or servant of the Supplier.

10. Intellectual Property Rights

10.1 The Supplier grants to the Authority a perpetual, irrevocable and royalty free licence to use the software that comprises the Goods. Any requirements relating to Authority user numbers are set out at the beginning of the Specification in the section dealing with the Goods. Any provisions relating to a one off payment for the licences are set out in the Specification in the section dealing with the Contract Price.

10.2 It shall be a condition of the Contract that the Goods and/or Services will not infringe any Intellectual Property Rights of any third party and the Supplier shall fully indemnify and keep indemnified the Authority against all actions, suits, claims, demands, losses, charges, costs and expenses which the Authority may suffer or incur as a result of or in connection with any breach of this Clause.

10.3 In relation to any specially written software and its supporting materials only, all Intellectual Property Rights in any software, specifications, instructions, plans, drawings, patents, patterns, models, designs or other material prepared by or for the Supplier for use, or intended use, in relation to the performance of the Contract shall belong to the Authority.

11. Assignment and Sub-Contracting.

The Supplier shall not assign, sub-contract or in any other way dispose of the Contract or any part of it without the prior written consent of the Authority.

12. Waiver.

The failure to insist upon strict performance of any provision of the Contract or to exercise any right or remedy shall not constitute a waiver of that right or remedy. No waiver shall be effective unless it is expressly stated to be a waiver and communicated to the other party in writing, and a waiver of any right or remedy shall not constitute a waiver of any right or remedy arising from any other or subsequent breach of the Contract.

Page 66: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

13. Variation.

The Contract shall not be varied or amended unless such variation or amendment is agreed in writing by the Authority and the Supplier.

14. Severability. If any provision of the Contract is held invalid, illegal or unenforceable for any reason by any court of competent jurisdiction, such provision shall be severed and the remainder of the provisions of the Contract shall continue in full force and effect as if the Contract had been executed with the invalid, illegal or unenforceable provision eliminated.

15. Remedies Cumulative.

Except as otherwise expressly provided by the Contract, all remedies available to either party for breach of the Contract are cumulative and may be exercised concurrently or separately, and the exercise of any one remedy shall not be deemed an election of such remedy to the exclusion of other remedies.

16. Indemnity and Insurance

16.1 Notwithstanding any other provision of this Agreement no party excludes or limits liability to the other party for

a) death or personal injury caused by its negligence; or

b) for any breach of any obligations implied by Section 12 of the Sale of Goods Act 1979 or Section 2 of the Supply of Goods and Services Act 1982; or

c) fraud or fraudulent misrepresentation; and

d) liability which may not be limited under the law.

16.2 The Supplier shall be liable for and shall indemnify and keep indemnified the Authority against all and any direct losses suffered or incurred by the Authority and claims or demands made against the Authority or the Supplier arising directly from any defect in the Service or any act or omission by the Supplier or incorrect statement or incorrect information supplied to the Authority by the Supplier in connection with the performance of the Service.

16.3 The Supplier shall indemnify and keep indemnified the Authority against injury (including death) to any persons or loss of or damage to any property which may arise out of the act default or negligence of the Supplier, any sub-contractor or their respective employees or agents, and against all claims demands proceedings damages costs charges and expenses whatsoever in respect thereof or in relation thereto arising from the provision of the Goods and/or Services.

16.4 Without thereby limiting his responsibilities under Clause 16.2 the Supplier shall before commencing the execution of the Contract insure with a reputable insurance company against all loss of and damage to property and injury to persons (including death) arising out of or in the consequence of the Supplier’s obligations under the Contract and against all actions claims demands costs and expenses in respect thereof.

16.5 Such insurance in respect of Clause 16.3 shall be for a minimum of £5,000,000 (five million pounds) in respect of any one act or default and the said insurance policy or

Page 67: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

policies shall be extended for the purpose of the Contract by endorsement or otherwise so as effectually to indemnify the Authority against all claims aforesaid and copies shall be produced to the Authority’s Contract Manager together with the receipt or receipts for the premiums at such times as may be reasonably required by the Authority.

16.6 If so required by the Authority the Supplier shall procure and maintain Employers Liability insurance with a minimum level of £5,000,000 per claim or series of claims.

16.7 If so required by the Authority the Supplier shall procure and maintain during the currency of the Contract a policy of professional indemnity insurance to cover its liability under the Contract in respect to the Services with a minimum level of indemnity of £2,000,000 per claim or series of claims. The Supplier shall maintain insurance at this level for a period of ten years after the end of this Contract and shall notify the Authority in writing immediately should such insurance cover cease.

16.8 If so required by the Authority the Supplier shall procure and maintain during the currency of this Contract a policy of product liability insurance to cover its liability under the Contract in respect to the Goods with a minimum level of indemnity of £2,000,000 per claim or series of claims. The Supplier shall maintain insurance at this level for a period of ten years after the end of this Contract and shall notify the Authority in writing immediately should such insurance cover cease.

16.9 If so required by the Authority the Supplier shall furnish the Authority with Certificates of Insurance together with the receipt or receipts for premiums evidencing that the relevant insurances are in force

17.1 Warranties

17.1 The Supplier warrants it has the absolute and unfettered right to supply the Service to the Authority and no consent licence or permission is necessary from any third party for the supply of the Service to the Authority, or that the Supplier owns or has obtained valid licences, consents, permissions and rights to use, and where necessary to licence to the Supplier, any materials reasonably necessary for the fulfilment of all its obligations under this agreement, including any third-party licences and consents in respect of any Authority software.

17.2 The Supplier warrants that the Authority’s use of any third-party materials, including any materials supplied the Supplier to the Authority, shall not cause the Authority to infringe the rights, including any Intellectual Property Rights, of any third party.

17.3 The Supplier warrants that any Software, system or telecommunications provided by or on behalf of the Supplier will be tested for Viruses and any identified Viruses deleted in accordance with good industry practice before the date of delivery or use of such Software, systems or telecommunications by the Authority.

17.4 Each of the representations and warranties contained in this Agreement shall be construed as a separate representation or warranty and shall not be limited by any other term of this Agreement.

17.5 The Supplier acknowledges that the Authority has entered into this Agreement in reliance on the Warranties.

17.6 The Warranties shall continue in full force and effect notwithstanding delivery and payment for the Services and notwithstanding termination of this Agreement for any

Page 68: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

reason.

18. Default Notices

18.1 If the Authority suspects that the Supplier has committed a Default the Authority shall be entitled to serve a Default Notice upon the Supplier. This will be without prejudice to any other right or remedy which may be available to the Authority either under this Agreement or at law.

18.2 When the Authority serves a Default Notice the Supplier shall take such remedial action as is specified in the Default Notice within the timescale set out and at the Suppliers sole cost.

18.3 If the Supplier fails to complete the remedial action within the specified time detailed in the Default Notice then the Authority shall be entitled to suspend the Service until the Supplier has satisfactorily completed the remedial action.

19. Termination on bankruptcy or insolvency.

19.1 The Authority may terminate the Contract by notice in writing with immediate effect where:-

a) a petition is presented for the Supplier's bankruptcy, or

b) a bankruptcy order is made against the Supplier, or

c) the Supplier makes any composition or arrangement with or for the benefit of creditors, or

d) if the Supplier passes a resolution for winding up or dissolution (otherwise than for the purposes of and followed by an amalgamation or reconstruction) or

e) an application is made for an administration order in relation to it, or

f) any party gives or files notice of intention to appoint an administrator of it or such an administrator is appointed, or

g) the court makes a winding-up order, or

h) an administrative receiver, receiver, manager or supervisor is appointed by a creditor or by the court, or

i) the Supplier is unable to pay its debts within the meaning of section 123 of the Insolvency Act 1986, or

j) any similar event occurs under the law of any other jurisdiction within the United Kingdom.

19.2 The Supplier shall notify the Authority immediately when any change of control in the ultimate parent company of Supplier occurs.

20. Termination on Default

20.1 The Authority may terminate this Agreement with immediate effect in the event that;

Page 69: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

20.1.1 the Supplier has failed to take steps to rectify a Default within 10 Working Days after issue of a written notice specifying the Default and requesting it to be remedied; or

20.1.2 the Supplier commits a Persistent Default; or20.1.3 the Supplier has been shown to have committed a Serious Default

21. Termination without Default

21.1 The Authority may terminate this Agreement or any part at any time on giving not less than 3 months notice to the Supplier.

21.2 In entering into this Agreement the Authority has relied on the information provided or representations made by the Supplier and any material or fraudulent misrepresentation therein shall entitle the Authority but not unreasonably or vexatiously to rescind the Agreement or at its option to terminate the Agreement.

21.3 For the avoidance of doubt, if the Authority terminate the software support element of this Contract such termination of the software support element shall not affect the licences granted hereunder.

22. Consequences of Termination.

22.1 Where the Authority terminates all or part of the Contract under Clause 20, and makes other arrangements for the provision of Goods and/or Services, the Authority shall be entitled to recover from the Supplier the cost of making those other arrangements and any additional expenditure incurred by the Authority throughout the remainder of the contract period, and no further payments shall be payable by the Authority to the Supplier until the Authority has established the final cost of making those other arrangements.

22.2 Termination (for whatever reason) or expiry of this Contract is without prejudice to the accrued rights of the parties.

23. Force Majeure.

Neither party shall be liable to the other party for any delay in or failure to perform its obligations under the Contract (other than a payment of money) if such delay or failure results from an event beyond the reasonable control of such party. If such event of force majeure continues for a period of 90 days either party may terminate this Contract by notice in writing to the other party. The party suffering the event of force majeure shall take all reasonable steps to mitigate such delay or failure.

24. Anti-bribery and Corruption.

The Authority may cancel the contract and recover from the Supplier the amount of any loss resulting from the cancellation if at any time it becomes known to the Authority that the Supplier or any person employed by the Supplier or acting on his behalf whether with or without the knowledge of the Supplier has:

24.1 Offered, given or agreed to give any inducement or reward to any person or body in relation to the obtaining or execution of this Contract or any other contract with the Authority;

24.2 Favoured or discriminated against any person in relation to this Contract or any other contract with the Authority

Page 70: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

24.3 Committed an offence in relation to any contract with the Authority under the prevention of the Bribery Act 2010;

24.4 Communicated to any person other than the Authority the details of the Supplier’s proposed tender (other than in confidence in order to obtain quotations necessary for the preparation of the Supplier’s tender)

24.5 entered into any agreement or arrangement with any person or body that he shall refrain from tendering or as to the amount of any proposed tender.

25. Disclosure Barring Service.

The Suppler shall ensure that in respect of any its servants employees agents or subcontractors whom in performing Services for the Authority under this Contract may come into contact with children or vulnerable adults:

25.1 Wherever possible prior to such a person commencing the performance of the Services, the Supplier shall undertake a check of the person’s previous convictions and criminal records history of the most extensive available kind made with the Disclosure Barring Service (‘DBS’) provided always that:

25.1.1 The Authority shall provide reasonable assistance where necessary to secure the obtaining of such DBS checks where the Supplier is unable to obtain such checks. The Supplier shall reimburse the Authority’s reasonable costs in providing such assistance;

25.1.2 A copy of the results of such checks are, with the consent of the individual concerned, notified to the Authority

25.2 Where it is not possible to obtain the results of a check of the most extensive kind made with the DBS prior to such person commencing the performance of the Services, the Supplier shall promptly notify the Authority of this fact and shall:

25.2.1 Procure that at all times such person referred to in clause 25.2 is accompanied by a member of the Suppliers or the Authority’s staff who has already passed a check of the most extensive kind available with the DBS; and

25.2.2 If so requested by the Authority conduct a check of the most extensive available kind with the DBS as soon as reasonably practicable and deliver a copy the results of such check to the Authority immediately it is received by the Authority

25.3 In the event that such a person discloses or as a result of a DBS check is found to have a conviction, caution, pending prosecution, binding over order or other criminal record (‘conviction’) or refuses to complete a DBS check of the most extensive kind, the Supplier shall not engage such a person in the performance of the Services without the prior written approval of the Authority.

25.5 The Supplier shall indemnify and keep indemnified the Authority against any loss arising out of any claim by any person in respect of whom the Authority does not consent to being engaged in the performance of Services as a result of such a person disclosing or receiving a Conviction in accordance with any of the provisions of this clause.

26 Equality in Contracting

The Supplier shall comply with all current legislation relating to non discrimination and

Page 71: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

equality in employment, including but not limited to the Equality Act 2010.

26.1 Where any investigation is undertaken by a person or body empowered to conduct such investigation and/or proceedings are instituted in connection with any matter relating to the Supplier being in contravention of any equalities legislation, the Supplier shall, free of charge:

26.1.1provide to the Authority any information requested by it within the prescribed timescale;

26.1.2 attend any meetings as required and permit any servants employees agents or sub-contractors to attend the same;

26.1.3 promptly allow access to and investigation of any documents or data deemed to be relevant;

26.1.4 allow any servants employees agents or sub-contractors to appear as witnesses in any ensuing proceedings; and

26.1.5 cooperate fully and promptly in every way required by the person or body conducting such investigation during the course of that investigation.

26.2 Where any investigation is conducted or proceedings are brought under equalities legislation which arise directly or indirectly out of any act or omission of the Supplier, its servants employees agents or sub-contractors, and where there is a finding against the Supplier in such investigation or proceedings, the Supplier shall indemnify the Authority with respect to all costs charges and expenses (including legal and administrative expenses) arising out of or in connection with any related loss the Authority may suffer including the payment of costs, expenses or compensation to any third party.

26.3 The Authority may cancel this Contract and any other contracts entered into with the Supplier or discount the Supplier from any ongoing procurement process involving the Authority if at any time the Supplier is found to be in contravention of any equalities legislation.

26.4 The Supplier warrants that the information, representations and other information provided to the Authority by the Supplier in connection with or arising out of this Contract are true and complete in all material respects.

27 Acceptance Testing

27.1 All Goods and/or Services to be provided by the Supplier pursuant to this Agreement shall (where applicable) be subject to acceptance testing by the Authority, pursuant to this Clause 27.

27.2 The Authority shall determine the acceptance testing criteria to be applied to any Goods and/or Services produced or supplied by the Supplier.

27.3 Acceptance testing will be carried out by the Authority as soon as reasonably possible after delivery or notification by the Supplier that the Goods and/or Services are ready for testing.

27.4. The Supplier shall provide the Authority with such assistance as it may reasonably require in connection with the conduct of the acceptance tests. The Authority shall not unreasonably withhold or delay any confirmation that the Goods and/or Services have

Page 72: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

passed such acceptance tests.

27.5 If the Goods and/or Services fail to pass the relevant acceptance tests, the tests shall be repeated within a reasonable period thereafter, up to a maximum of three (3) such repeated tests for such Goods and/or Services. In the event that the Goods and/or Services have still failed to pass the relevant acceptance test following such repeat tests, the Authority may reject the Goods and/or Services and/or terminate this Agreement with immediate effect by notice in writing.

28. Notices.

Any notice which is to be given by either party to the other shall be given by letter (sent by hand, post, registered post or by the recorded delivery service), by facsimile transmission or electronic mail (confirmed in either case by letter), to the addresses/numbers set out on the Specification, and such notice or communication shall be deemed to have been given 2 working days after the day on which the letter was posted, or four hours, in the case of electronic mail or facsimile transmission or sooner where the other party acknowledges receipt of such letters, facsimile transmission or item of electronic mail.

29. The Contracts (Rights of Third Parties) Act 1999.

A person who is not a party to the Contract shall have no right to enforce any term of the Contract, which expressly or by implication, confers a benefit on him without the prior agreement in writing of both parties.

30. Conflicts

30.1 In the event of any conflict or inconsistency between the the Supplier’s Tender Response and any other part of this Contract, the latter shall take priority.

31. Governing Law.

This Contract shall be governed by and interpreted in accordance with English law and the parties submit to the exclusive jurisdiction of the courts of England and Wales.

32. Entire Agreement.

The Contract constitutes the entire agreement between the parties relating to the subject matter of the Contract. The Contract supersedes all prior negotiations, representations and undertakings, whether written or oral, except that this Clause shall not exclude liability in respect of any fraudulent misrepresentation.

Page 73: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

IN WITNESS WHEREOF the Authority and the Supplier have executed this Contract as a Deed the day and year first before written.

THE COMMON SEAL OF )WARWICKSHIRE COUNTY )COUNCIL was hereunto )Affixed in the presence of )

Designated Officer

EXECUTED AS A DEED1 ) on behalf of ● )by: ) )

……………………………………………Director

……………………………………………Director/Company Secretary

1 Execution clause to be used if Contractor is a limited company.

Page 74: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

Schedule 1

Specification & Price

[Insert]

Page 75: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

Schedule 2

Authority’s Tender

[Insert]

Page 76: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

Schedule 3

Supplier’s Tender Response

[Insert]

Page 77: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

Schedule 4 Data Protection

1. This Schedule shall survive termination of the Contract and continue until the earlier of (1) the date it is expressly terminated pursuant to written agreement or (2) at the point the Supplier has destroyed all Personal Data.

2. For the purposes of this Agreement:2.1 where Personal Data derives from existing databases or records owned by

the Supplier, the Supplier shall act as joint data controller with the Council;

2.2 where Personal Data (including information on Authorised Users, where applicable) derives from existing records owned by the Authority or is created by the Supplier for the Service, the Authority shall be the data controller and the Supplier shall be data processor the Council, processing such information in accordance with this Schedule.

3. Where the Parties are acting as joint data controllers, the Supplier must ensure that all Personal Data processed by them in the course of delivering the Service is processed in accordance with the relevant Parties’ joint obligations under the Data Protection Act 1998 (“DPA”).

4. The Supplier’s obligations in relation to Personal Data processed by the Supplier in the course of delivering the Service include:

4.1 publishing, maintaining and operating policies relating to confidentiality, data protection and information disclosures that comply with the Law and Good Industry Practice;

4.2 publishing, maintaining and operating polices that describe the personal responsibilities of Employees for handling Personal Data and applying those policies conscientiously;

4.3 publishing, maintaining and operating agreed protocols to govern the disclosure of Personal Data;

4.4 where appropriate, having a system in place and a policy in relation to the recording of any telephone calls in relation to the Service (in particular (but not strictly limited to) the Support Service), including the retention and disposal of those recordings.

5. The Supplier must have in place a communications strategy and implementation plan to ensure that Authorised Users are provided with, or have made readily available to them, the information specified in paragraph 2(3) of Part II of Schedule 1 DPA.

6. Where the Authority requires information for the purposes of quality management of the Service, the Supplier must provide anonymised, pseudonymised or aggregated data, and must not disclose that Personal Data to the Authority for those purposes without written consent or some other lawful basis for disclosure.

7. For the avoidance of any doubt, all Personal Data derived from existing databases or records owned by the Supplier, is the property of the Supplier.

8. Where the Authority is deemed to be the data controller and the Supplier is acting as the data processor for the Council, the Supplier warrants that:

Page 78: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

8.1 it will only Process the Personal Data on instruction from the Authority and in particular (without limitation) shall:

8.1.1 not allow the Personal Data to be seen by any third party other than in accordance with Paragraph 12 (if no entity is specified as a Third Party within the ‘Appendix to the Data Protection Schedule’ then the Supplier shall not pass the Personal Data to any third party); and

8.1.2 delete or amend the Personal Data pursuant to this Contract or otherwise (only) on the instructions of the Council. The Supplier shall ask the Authority whether it should destroy Personal Data where the Supplier has reason to believe that it may be storing the Personal Data for longer than a Data Controller would be able to keep it in compliance with the fifth principle of the DPA; and

8.1.3 perform its obligations in accordance with the DPA and related guidance from the Office of the Information Commissioner; and

8.1.4 comply with any systems or procedures which the Authority may introduce from time to time in respect of the Processing of the Personal Data;

8.2 It will take such security measures as may be required to enable it to Process the Personal Data in compliance with obligations equivalent to those imposed on the Authority by the Seventh Principle of the DPA.

8.3 It will, as soon as reasonably practicable after a written request from the Authority:

8.3.1 provide such information as is reasonably necessary to enable the Authority to satisfy itself of the Supplier’s compliance with this Data Protection Schedule or a Third Party’s compliance with its Third Party Agreement;

8.3.2 allow (or arrange permission for) the Authority, its employees or authorised agents or advisers, reasonable access to any relevant premises (including those of a Third Party), during normal business hours, to inspect the procedures and measures that are in place to comply with this Data Protection Schedule provided that the Authority agrees to carry out such inspection with minimum disruption to the Supplier’s (or Third Party’s) day to day business.

8.4 It will bring an end to any Information Loss and shall use its Best Endeavours to, as appropriate, recover and/or destroy Personal Data and has escaped from its control. The Supplier shall notify the Authority forthwith if there has been any actual or suspected Information Loss.

8.5 (without prejudice to the generality of Paragraph 8.2) it will store Personal Data securely (for example, without limitation, encrypting the Personal Data appropriately, maintaining anti-Malware technology, taking measures against digital eavesdropping and operating reasonable data back-up processes all in accordance with Good Industry Practice).

Page 79: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

8.6 pass Personal Data to the Authority as soon as reasonably practicable after a request from the Authority to do so.

9. Following termination of the Agreement, howsoever arising, the Supplier shall pass all Personal Data originally derived from existing records owned by the Authority or is created by the Supplier for the Service to the Authority and may continue to Process the Personal Data only for so long as may be necessary for the purpose of defending any legal proceedings that may be brought against the Supplier by any person or body in relation to the Services or as is required by law or any regulatory body or recommended by any relevant UK governmental code of practice. The Supplier will not otherwise retain any copy, abstract, precis or summary of any Personal Data and will destroy its records and documentation accordingly on the expiry of such period.

10. The Supplier will at all times comply with any agreement between the Authority and any Authorised User and/or other individual who is the subject of Personal Data in relation to any Processing which causes or is likely to cause substantial and unwarranted damage or distress to the individual; or any requirement of the Information Commissioner relating directly or indirectly to the Personal Data; or any Court order requiring the rectification, blocking, erasure or destruction of any Personal Data notified to the Supplier by the Authority in writing from time to time. For the avoidance of doubt this Clause does not affect the parties’ agreement that the Supplier will follow the Council’s instructions in relation to general compliance with the fifth data principle (such as, without limitation, to update Personal Data).

11. For the avoidance of doubt the parties acknowledge that all the Personal Data derived from existing records owned by the Authority or is created by the Supplier for the Service is the property of the Council.

12. The exception to the restriction contained in Paragraph 8.1.1 is (only) on the following bases:

12.1 The Authority authorises the Supplier to pass any type of Personal Data specified in the ‘Appendix to the Data Protection Schedule’ to the relevant Third Party, provided always that:

12.1.1 such Personal Data is passed to the Third Party pursuant to a Third Party Agreement; and

12.1.2 in a manner that will enable the Third Party to comply with its obligations under the Third Party Agreement; and

12.1.3 the Supplier monitors (and where appropriate enforces) the Third Party’s compliance with the Third Party Agreement’s Personal Data protection provisions.

12.2 The Supplier shall inform the Authority if the Third Party appears to be Processing Personal Data while taking unreasonable data security risks.

12.3 The Authority shall be entitled to revoke the authorisation provided for by this paragraph 12 in whole or in part forthwith by notice in writing where the Authority has reasonable cause to believe that the Personal Data is or has been placed at risk by a Third Party or the Third Party is in breach of the Third Party Agreement.

12.4 Where notice has been served pursuant to paragraph 12.3 or the Third Party

Page 80: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

Agreement has come to an end the Supplier shall use its Best Endeavours to ensure that the Third Party does not retain any Personal Data longer than is strictly permitted by the Third Party Agreement.

13. Transportation of any Personal Data under this Agreement shall:

13.1 in electronic format only be made in one of the following ways:

13.1.1 through an Encrypted VPN Connection, or

13.1.2 through a secure file transfer facility provided by the Council, or

13.1.3 through such other method as may be expressly approved by the Authority in writing.

13.2 in a physical form only be delivered (including transportation) by hand by the Supplier or a courier approved by the Council;

and in any case be protected in accordance with Good Industry Practice.

14. In this Schedule the terms “Personal Data”, “Sensitive Personal Data”, “Data Processor”, “Process”, “Processing” and “Data Controller” are as defined in the DPA.

References to “Personal Data” and “Sensitive Personal Data” within this Schedule are in connection with data relating to the Services.

‘AES’ means the standard of encryption that the FIPS* (or any successor standard) for the time being approved as suitable for use by US federal departments when such departments determine that sensitive (unclassified) information requires cryptographic protection. At the date of this Contract it is a symmetric key block encryption standard called ‘Rijndael’ more commonly known as the Advanced Encryption Standard. {*’FIPS’ means the Federal Information Processing Standards, which are standards that are developed and published by means the US government’s National Institute of Standards and Technology for use by all non-military government agencies and by government contractors.}

‘Best Endeavours’ means taking all the steps which a diligent, prudent, determined and tenacious person acting in own interests and anxious to achieve the desired objective would take.

‘Destroy’ means in relation to electronically held data to delete such data by a secure method conforming at a minimum to HMG Infosec Standard 5 (Enhanced Level) such that the data is irrecoverable. In relation to data held in hard copy format to ‘Destroy’ means to destroy such information by shredding the records to a minimum standard of DIN 32757 level 3 cross cut and then mixing the remnants in what the Supplier may reasonably regard as a secure environment so that the particles containing parts of information are likely to have been dispersed away from the particles that they were originally adjacent to.

‘Encrypted VPN Connection’ means a secure encrypted ‘tunnel’ between two known points that are IPSec or SSLvs3 portal VPNs or in the case of web applications SSLvs3 tunnel VPNs.

‘Good Industry Practice’ means that degree of skill, care, prudence and foresight and operating practice which would reasonably and ordinarily be expected from time

Page 81: · Web view12.2 Has your organisation audited the interconnected site(s)? 12.3 Are any security controls deployed at the interconnected sites? 13. Do you have IDS or IPS systems installed

Invitation to Tender: LAC School Attendance and Absence Monitoring SystemReference: 00003096

to time of a skilled and experienced contractor engaged in the same type of undertaking as that of the Supplier endeavouring to protect information under the same or similar circumstances (currently for example, without limitation, this means in relation to encryption to use 256 bit AES encryption, to use out of bands password exchange, to use products that have a good reputation within the data security industry and to incorporate Strong Password Protection). To use Good Industry Practice is to include meaning to at least follow all relevant guidance issued by the UK Information Commissioner’s Office (or any successor body).

‘Information Loss’ means where Personal Data held or accessed by the Supplier exits from the security of the arrangements provided for directly or indirectly by this Schedule.

‘Malware’ includes computer viruses, worms, Trojan horses, spyware, dishonest adware, crimeware, most rootkits, and other malicious and unwanted software.

‘Services’ has the same meaning as the definition in Clause 1 of the main terms of the main Agreement.

‘Third Party’ means the third party (or parties) other than employees, if any, who the Supplier is authorised to pass the Personal Data) to in accordance with the terms of Paragraphs 8 and 12 above who is (or are) described in the ‘Appendix to Schedule 1’ below (if the table in that appendix is empty there is no Third Party).

‘Third Party Agreement’ means a legally binding agreement between the Supplier and the Third Party which shall provide the Authority with protection regarding Personal Data as between the Authority and the Third Party to a similar extent as this Contract provides for the Authority as between the Authority and the Service Provider. The provisions of the Third Party Agreement relating to such protection shall be in force at all times when the Third Party is Processing Personal Data which has been passed to it pursuant to Paragraphs 8 and 12 of this Schedule.

‘Strong Password Protection’ means password protection where the password: is at least eight characters long is not valid for more than 40 days and a password is not reused until after 5

other passwords have been used incorporates numbers and (case sensitively) uppercase and lowercase letters does not incorporate:

o dictionary words in any languageo words spelled backwards, common misspellings, and common

abbreviationso sequences or repeated characters (e.g. 12345678, abcdefg) or

adjacent letters on the keyboard (e.g. qwerty)o more than three letters from the user’s account nameo Personal information.

AND the user’s account/target application is locked for 30 minutes after five consecutive invalid password entries.