Clarifications

89. If the main bidder has Cyber Essentials and we plan to use a sub-contractor in the EU, do they also need to obtain Cyber Essentials, or can EU firms rely on ISO27001?

88. We are going through the SQ process currently. Can you explain "Part 1 Professional or Trade Registers Details", where it asks "1.2.1. What is the name of the register?" - can you advise on which register this refers to?

87. The bid pack makes reference to the supplier's "Data Protection Officer" in the DPS Joint Schedules (1 and 11); the Appointment Form; and DPSQ (question 78). In the Joint Schedules 11, clause 11 it appears that a DPO only needs to be appointed where required by law. The other references appear to make it mandatory to have a DPO in order to register under the DPS. We do not have a DPO because we are not legally required to have one for the work we currently undertake. We would not apply for any work under the DPS which legally required us to have a DPO. Please could you clarify whether it is a requirement to have a DPO in order to register with the DPS and/or whether it is necessary to enter into a contract with a buyer. If it is not mandatory we assume that we can answer DPSQ question 78 and the appointment form fields with 'N/A'.

86. The 'Buyer Needs' document lists several technical standards which must be complied with in order to register with the DPS. ("comply with the appropriate Standards (or equivalent)") Please could you confirm whether the supplier must hold a certificate for each of these standards in order to register with the DPS. Please could you confirm whether the supplier must hold a certificate for each of these standards in order to enter into a contract with a buyer. The relevant standards are:- BS EN ISO 9001; BS 7858:2012; ISO 10007; BS EN ISO 14001; ISO/IEC 13066-1:2011; and ETSI TS 103 645.

85. How can Suppliers know their specified minimum financial threshold score? Can you provide any website links for accessing this information? Additionally, our UK entity has an annual turnover of £700,000, while our headquarters reports a turnover of £8,229,462.

84. In the Supplier Needs document, there is a selection process that includes Pass/Fail questions concerning a specified minimum financial threshold. The supplier must satisfy this requirement. Could you kindly guide how the supplier can achieve a minimum score of 35? Your assistance in this matter would be highly valued.

83. Is it possible to view Contract Notices from the previous year that pertain to contract values associated with a Dynamic Purchasing System (DPS)? Can you provide guidance on how to access this information?

81. I've reviewed the DPS Supplier Needs document. Do we need to submit the Cyber Essentials certification only after being appointed as a supplier, or do we need to provide it when applying in response to the Selection question? Please confirm.

80. Regarding supporting evidence documents, is it sufficient to provide only the Cyber Essentials certification, or are there any additional supporting documents required? Please clarify.

79. As a service-oriented organization, we intend to provide services exclusively under this contract. Is it truly necessary for us to acquire a product liability insurance certificate, or can we proceed without it?

78. We have completed the standard selection questionnaire and can click on 'save and continue'. When we do we are directed to the start of another questionnaire - however it is not labelled DPSQ anywhere. In fact we are asked to give the questionnaire a name and description which doesn't sound right. Can you confirm that we should see DPSQ referenced somewhere? If this sounds like something has failed, can you advise us what we need to do to be able to access the DPSQ?

77. In relation to obtaining the Cyber Essentials Basic certification, we are currently certified under the ISO 27001 standard and have structured our security protocols according to the guidelines of the NIST Cybersecurity Framework. Furthermore, our ISO 27001 certification, which has been granted by a trusted third party, explicitly verifies that we fulfill all five stipulations outlined in the Cyber Essentials scheme. Is it possible for us to move forward with these existing certifications as part of our application for the Cyber Essentials Basic certification? Your guidance and support in this matter would be highly valued.

76. Hi there, is there any scope for the Supplier to raise any deviations to the Terms & Conditions as part of our response? If so, at what point of the process between submitting the SQ+DPSQ and signing a call-off agreement with a buyer would we able to raise these? Thank you.

75. Good afternoon, as part of our submission we are proposing a subcontractor who does not yet have the Cyber Essentials accreditation. As per the guidelines they will certify to state that they will achieve this by award onto the DPS and they are currently in the process of completing their Cyber Essentials application. If, for example, they do not achieve certification by the required time, will this void our whole application onto the DPS Framework, or will they just be removed as a subcontractor from our application?

74. Hi. We have reviewed the Schedules and wanted to clarify at what point in the application would we be required to define our Special Terms to incorporate into the Appointment Form with CCS?

73. Are the RFP opportunities listed in DPS exclusively accessible to DPS-appointed suppliers, or are they also available through other channels?

72. Regards Q9.1 Cyber essential. Our Artificial intelligence device it is a stand-alone device (hardware and software are together) that physically connects to endoscopy devices, giving real time diagnostic support to clinician during endoscopy procedures. It does not connect to or network with any other software system. It does not collect or store data and does not transfer data to our AI device to be held for any purpose. This would appear to place us and the device out of scope of cyber essential certification, so can please discuss how we manage this with our framework submission.

71. One of our subcontractors is based in the US and states that they do not have a Company Registration Number. Can you advise how we can answer the question where this is requested within the Supplier Questionnaire as we cannot progress without entering a number here that meets the format requested. Kind regards

70. We note in the clarification responses already published it is stated that suppliers do not need to answer question 133, 134 and 135 in regards to contract examples. Q137 relates back to these three questions, therefore how do you wish suppliers to answer or should we put not applicable? Kind regards.

69. We intend to use a subcontractor that is not based in the UK however the online questionnaire will not accept the format of the postcode and will not let us progress. Can you advise what we should do in this instance please. We note the other questions that advise to use the postcode used when originally setting up an account however this question is in relation to the subcontractor postcode.