Clarifications

56. Within Attachment 1 - Cyber Services 3 Filter Matrix v1 you have MPPV (1, 2, 3) standard listed in Filter 3 tab. Please can you confirm that this relates to the NPPV scheme run by Warwickshire police?

55. Hi Team: Core Terms provide for unlimited liability for breaches of, inter alia, data, laws and IP (Core Terms 11.5)). This isn't industry standard for the type of services requested by the ITT and may prevent Tier 1 suppliers from bidding on this framework or subsequent call-off engagements. This further contradicts guidance in the Outsourcing Playbook published by the Government Commercial Function advising government entities not to ask suppliers to accept unlimited liability or to assume unreasonable/ un-quantifiable risk. Please advise whether CCS would consider introducing a reasonable liability cap for these categories or include within the general damages cap on both framework and call-off levels.

52. We have a clarification question on Question 77 Cyber Security Services 3 DPS Registration Questionnaire. Our question : Please can we check that we are interpreting this question correctly. Should we read it as; "Does your organisation have the following standards (certifications)" E.g. Does your organisation have people with DV clearances? Or does it mean "Is your organisation able to certify to these standards?" E.g. Are you able to issue DV clearances? 77. Please select the 'Standards', that your organisation is able to provide 'Non-assured NCSC Services' for. Tick all that apply. Cyber Essentials Plus CREST/Tiger/Cyber/Other Qualified PCI Assessor Project Management - APM Qualified Project Management - PRINCE Qualified Clearance: Counter Terrorist Check Clearance: Security Check Clearance: Developed Vetting MPPV 1,2,3

51. RM3764iii Cyber Services 3 - Dynamic Purchasing Systems Agreement. Selection Questionnaire: Question 1. Question 0.1 Asks, do you want to submit a completed EU ESPD in response to questions 21 through to 103.60 (Sub-Contractor questions) and questions 105 through to 126 (Exclusion Grounds) of this Selection questionnaire? We are not listing or using any Sub-Contractors, therefore not providing a response to questions 21 through to 103.60, but are we still required to provide a response to questions 105 through to 126 (Exclusion Grounds). Question 2. Part 3: For the Relevant Experience Questions 133, 134, and 135 we have responded no, as in Section 4.35 of the Dynamic Purchasing System Agreement, page 15, it states that Part 1, Example 1, 2 and 3, questions Q133, Q134 and Q135, are not applicable to this RM376iii - Cyber Services 3 procurement. Can you please confirm that this is correct

49. For the purpose of the SQ and DPS submission do we need to complete the Financial Assessment Document? We are aware the Subcontractors and Economic attachments should be completed based on the answer in response to this. Could you also confirm where we would upload the document if this is required?

48. Hi, there is not a DPS schedule 3 (DPS Pricing), could you please provide this? Thanks

47. Within the documentation it states the following: Selection Questionnaire - Not Applicable questions: 4.35. There are questions in the Selection Questionnaire that are not applicable for this RM3764iii - Cyber Services 3 procurement, therefore please note, a response is NOT required to the questions as detailed below:  Part 1: (Contract Example 1) - Q133  Part 1: (Contract Example 2) - Q134  Part 1: (Contract Example 3) - Q135  Part 3: (Steel) Q147 - Q149  Part 3: (Supply Chain) Q150 - Q154  Part 3: (NHS Questions) Q157 - Q161 4.36. Evidence submission stage for the following questions  Q166 - Q172;  Q174;  Q176; and  Q179 - Q185 Also it states these questions/questions with evidences are not applicable for this process. Can you confirm for certain this is not required for these questions at the SQ stages. Therefore, if a response/evidenced documentation has not been provided against these we will not be disqualified from the tendering process. Thanks

46. Are there any logos we can use once appointed to advertise the fact that we are on this DPS?

44. In the Bid Pack document: READ FIRST RM3764iii Cyber Services DPS Needs v1 you say: "You need to send your questions through the DPS Marketplace clarification link (on SRS) or the DPS Mailbox address info@crowncommercial.gov.uk and as detailed in the OJEU Contract Notice. Both options can be used to communicate with us." As far as we can see, there is no DPS Marketplace clarification link on SRS and our attempt to use Live Chat (ref 10302401) did not get a response, so we are hoping that you will be able to route our questions to the appropriate person via this general mailbox. Here are the questions: 1. The online Selection Questionnaire HMG_UNIT_SQ-363-v8 seems to include questions on which CESG cyber certifications we hold, but these questions are not in the pdf version of the SQ in the RM3764iii Cyber Services DPS bid pack and do not appear to be referenced anywhere else in the documentation. Can you clarify please? The pdf version of the SQ does reference NCSC Assured and Non-assured services (Q65-77 in the Registration Questionnaire section) and they are included in Attachment 1 - Cyber Services 3 Filter Matrix v1. However there is no mention of them in the mandatory requirements (RM3764iii Cyber services 3 DPS Buyer Needs v1, section 3). Bramble Hub uses sub-contractor partners to deliver its services, who have NCSC certified specialists (CPP )and products (CAPS). Are we correct in understanding that we can bid for the framework?

43. Please could you provide an ETA / timeframe that clarification questions are responded to? We were hoping to submit our response on the 13th, however are unable to do so without having confirmed and completed documentation to meet Framework requirements.

42. In relation to Clause 10.5.2 - where it states that payment obligations stop immediately on termination save for any accumulated rights. Can you confirm that the Buyer is still liable for payment of work performed up until termination?

41. In relation to Core Term 14.3 - can you confirm that this is only related to engagements where we (the Supplier) would be the only holder of the data such as a managed service.

40. Hi, we have been accepted onto the Cyber Security Services 3 DPS, as an Appointed Supplier. However we are unable to see where we upload service definitions etc. We clicked on the Update Evidence button on our dashboard profile however it advised that no evidence is required. If this is the case please advise if there are any other actions we need to do at this stage, thanks

39. With regards to Joint Schedule 4 (Commercially Sensitive Information) which applies to both a call off/and the framework contract. Could you confirm if suppliers are required to complete the order form template at this stage?

38. There is a Guarantee in Joint schedule 8. Can you clarify that a DPS Guarantee is not required as a condition of the award of the DPS Contract?

37. 1. Can we bid on one lot and subsequently bid/ add to the lots as and when? For example if we bid on Lot 1 now and are live and active, perhaps 2 months later wish to be on Lot 2 and 3 - will this be possible to be added as a supplier at any time during the DPS Agreement? 2. Can you clarify what is the assessment timelines from when a DPS is submitted to award selection? 3. How long does the assessment of the evaluation take from submission to when a supplier can be approved under the DPS and be live?

36. With regards to Joint schedule 3 (Insurance), Clause 7.2 - Except where the Relevant Authority is the claimant party, the Supplier shall give the Relevant Authority notice within twenty (20) Working Days after any insurance claim in excess of 10% of the sum required to be insured pursuant to Paragraph 5.1 relating to or arising out of the provision of the Deliverables or this Contract on any of the Insurances or which, but for the application of the applicable policy excess, would be made on any of the Insurances and (if required by the Relevant Authority) full details of the incident giving rise to the claim. Can you please clarify that this notification is only applicable to third party claims which would have the effect of reducing the level of minimum cover available for any claims under a Contract?

35. Bid pack Attachment 6 Selection Questionaire PDF (inf only) - lists Joint Schedule 5 (Corporate Social Responsibility) RM3764.iii. Where is this document as we cannot locate in the bid packs. Thank you

34. Good afternoon, Clause 14.8 of the DPS Core Terms v1.0 indemnifies CCS and each Buyer against any and all Losses incurred if the Supplier breaches Clause 14 and any Data Protection Legislation. Clause 11.5 states that this would be on an uncapped basis. Can you please confirm this is correct or can the indemnity be made subject to a liability capping formula?

33. Awaiting response to the question on Attachment 1 - Cyber Services 3 Filter Matrix v1 lists the CNI sectors. Row 11 contains "Civil Nuclear Communications". Is this a typographical error and should read "Civil Nuclear" and "Communications" as a separate entry?