Clarifications

108. Please can the following policies as mentioned in the following sections of the "DPS Order Schedule 9 - Security" be provided. a) Security policy b) ICT Policy These artifacts are referenced within the schedule below; Under Page 2 of the "Order Schedule 9 - Security" 2. Complying with security requirements and updates to them - This section makes reference to a "Security Policy". But we have not been provided with the Security Policy to review. 2.2 The Supplier shall comply with the requirements in this Schedule in respect of the Security Management Plan. Where specified by a Buyer that has undertaken a Further Competition it shall also comply with the Security Policy and shall ensure that the Security Management Plan produced by the Supplier fully complies with the Security Policy In addition, Under Section 3 - Security Standards - There is reference to both the "Security Policy" and "ICT Policy". 3.2 The Supplier shall be responsible for the effective performance of its security obligations and shall at all times provide a level of security which: 3.2.1 is in accordance with the Law and this Contract; 3.2.2 as a minimum demonstrates Good Industry Practice; 3.2.3 meets any specific security threats of immediate relevance to the Deliverables and/or the Government Data; and 3.2.4 where specified by the Buyer in accordance with paragraph 2.2 complies with the Security Policy and the ICT Policy.

106. We have been appointed to this DPS- How we will be notified of opportunities/invitations to tender etc? Will we be alerted via the CCS e sourcing suite?

104. Hello, Can all of the clarification questions to date be provided in either Word or Excel format, so they can be easily viewed by other members of the business who not have access to website?

102. Hi, We raised a CQ on 3rd June, but haven't received a response to that. Please if you can reply to our query: Question - In relation to the question 'Does your organisation have a fully comprehensive occupational health screening service in place?', are you looking for data on whether we have an occupational health provision (and then the confirmation letter and contract start and end dates for that), or looking for information on actual health screenings provision such as health assessments? Thanks

101. Can you please confirm what the Management Levy is and how it's calculated for the Automation Marketplace DPS?

100. Clauses 7.1 - Please can the Authority consider that although the Supplier is able to provide reasonable co-operation to the Authority in the event that it receives a claim under pursuant to clause 7.1, the Supplier's contractual obligations should not extend to assisting the Authority in dealing with such claims as that may go beyond the intended scope of services. The Supplier would also not be permitted to disclose information about third parties.

99. We have asked the below questions which have not been answered. Could you please clarify on them (or confirm that Financial Difficulties schedule does not apply on DPS level and we should seek the answers on an Order Contract level)? 1. We refer to DPS Schedule 7 cl. 2.2.1 which allows to reject the bid, but on the other hand as per DPS Schedule 4 cl.3.4 - repeated failure to bid may result in suspension from DPS. Can you please confirm if Supplier can reject the Order? 2. We refer to Joint Schedule 7 (Financial Difficulties) - Annex 2 together with "Credit Rating" definition and "Financial Distress Event" definition, bullet a). As per Annex we should use the "Failure Rating" - we have assumed that to be the failure score, which is a score out of 100 to measure how likely a business is to fail in the next 12 months and gives us the "risk indicator" part of our credit rating. Our current failure score is 97. A 10% fall would take us to 87 - which would still give us a risk indicator of 1 (failure score in the range of 86-100)- the best a company can have - it certainly wouldn't indicate any type of distress, but under current definition it would be. It means that we would need to go into conversation even being in the best score possible, which isn't really pragmatic. Therefore we suggest to use less sensitive measure, like a drop of two or more levels in our credit rating, which would be a more pragmatic approach. Could you consider amending Annex 2 and use "Credit Rating" instead of "Failure Rating" and the threshold being to fall by two levels? 3. We refer to Joint Schedule 7 (Financial Difficulties), part (f) of the Financial Distress definition. The clause refers to "financial indebtedness" but does not define it, nor does it indicate any level of materiality. Would it mean that even £200 would be a trigger? Is there expectation to start discussion with CCS on any such occasion? Could we have a more pragmatic approach and apply any definition of "financial indebtedness" and a level of materiality? 4. We refer to Joint Schedule 7 (Financial Difficulties), Part f of the Financial Distress definition bullet iv - cancellation or suspension of indebtedness - how do things like suspension of VAT payments under COVID19 fit into this - would that be a trigger? 5. We refer to Joint Schedule 7 (Financial Difficulties), all the notification requirements seems onerous and not always possible to comply, especially clause 4.3.1 requesting meeting within 3 Working Days. We would suggest notification requirements of 30 days. 6. We refer to Joint Schedule 7 (Financial Difficulties), clause 3.3 - We wouldn't be able to provide requested information externally based on unpublished results as we are part of a listed Group. We only can provide an audited and published data. Can you confirm that this would be acceptable?

98. Please see clarification questions below: 1. Please clarify what is meant in clause 4.8 by "the supply at cost" "and that cost is reimbursable by the Buyer". 2. In clause 4.11, could CC please explain why "counterclaim" is included in this clause, as it seems reasonable that should the Supplier have a genuine counterclaim, it ought to be able to bring it? 3. Could CCS please clarify the relevance of clause 6.5 in relation to Record Keeping and Reporting? 4. Clause 10.2 - The DPS Optional Extension Period would appear to be open ended. Could CCS please confirm their intention with regard to the likely length of any extension periods? 5. With regard to Core Terms, clause 10.5.7 Please can you confirm if clause 7.2 being included in this list is a mistake? If not a mistake, please con you clarify? In addition to this please can you confirm whether clauses 10.5.7, 19 and 26 have been missed off by mistake. 6. Clause 10.8.2 - Please clarify how the arrangement would work if part only of the DPS Contract was terminated? 7. Please clarify whether it is intended that a Supplier should be jointly and severally liable for other Suppliers which are a party to a Collaboration Agreement under Order Schedule 23? 8. Clause 14 requires the Supplier to process Personal Data (and ensure that Supplier Staff process Personal Data) in line with Joint Schedule 11. Joint Schedule 11 makes clear in para 1 that the Schedule is intended to capture Personal Data being processed in the performance of the parties' obligations under the relevant Contract. This could include the circumstances where the Supplier / Supplier Staff are processing their own Personal Data. We presume that this was not the intention. However, it would be helpful if you could clarify this for us. Please note that, to the extent a sub-contractor of the Supplier is sub-processing Personal Data, any sub-contract will only deal with the Personal Data that the Sub-Contractor is processing on behalf of the Supplier / its customers in relation to the particular sub-contract (it will not cover the sub-contractor's own Personal Data). Clause 14.1 only obliges the Supplier to comply with Joint Schedule 11. However, the Schedule itself includes obligations on CCS / the Buyer. Can you please confirm why clause 14.1 does not oblige both parties to comply with Joint Schedule 11? 9. The reference to clause 14.7 in clause 14.7 would about to be the wrong cross reference. Can you please confirm the correct cross reference? 10. Please provide a definition of "Malicious Software" as used in Special Term 3 contained in the Appointment Form. 11. Clause 15.5 requires disclosure to be under a confidentiality agreement on at least as strict terms as clause 15. However, it does not state that the Disclosing Party will be liable for any breaches of any such confidentiality agreements. Please clarify whether that is the intent? 12. The definition of "Transparency Information" includes the defined term "Commercially Sensitive Information". This is defined as "the Confidential Information listed in the DPS Appointment Form or Order Form (if any) comprising...". However, we note that Joint Schedule 4 appears to include the Commercially Sensitive Information. Does the definition need to be updated to reflect this? 13. Can you please confirm that clause 18 (No other terms apply) is intended to exclude any claims for misrepresentation and limit claims to those arising for breach of contract. Further, can you please confirm that terms implied by statute are intended to be excluded from any Contract under this clause. 14. Can you please confirm that the cross reference to clause 27.4 in clause 27.5 should be to clause 27.3? 15. One of the PIs in para 4 of DPS Schedule 4 requires the Supplier to respond to 95% of Invitation to Tenders issued (within location region) in each Quarter. Please confirm that the Supplier is not obliged to submit bids under the DPS Contract and so a valid response for this PI would be a no bid decision. 16. One of the PIs in para 4 of DPS Schedule 4 measures Satisfaction (based on a % of responders who are satisfied or better). Can you please clarify how "Satisfaction" is to be quantified and any CSAT questions are to be determined. We assume that the same questions will apply to all Suppliers? 17. Para 3.4 of DPS Schedule 4 includes the following: "Suppliers should participate in further competitions when identified by appropriate filters using the Platform. A repeated failure to bid on further competitions without an acceptable reason may result in the Supplier being suspended from the DPS, in accordance with Clause 10.8 (Partially ending and suspending the contract), for a period as decided by CCS." 18. Is the first sentence intended to be an absolute obligation on the Supplier to bid for all work (this would appear to be inconsistent with para 2.2 of DPS Schedule 7 which allows a Supplier to no bid)? 19. We note the language used here is "should" not "shall" or "must", further the second sentence appears to recognise that even with repeated failures, if there is an acceptable reason, then no remedy should result. This would appear to support the position that the first sentence is not an absolute obligation. Can you please confirm that this is the case? Regardless, can you please clarify what would constitute "a repeated failure" in this context (entitling CCS to suspend) and confirm if this is defined anywhere in the Contract? Similarly can you please clarify what an unacceptable reason would be in this context and again confirm if this is defined anywhere in the Contract. For example, would a decision to no bid because the terms of the proposed Order Form are unacceptable be an acceptable reason? 20. Paras 2.2.2(e) and 3 of DPS Schedule 7 both talk about the Supplier including in its response any discounts the Buyer may be entitled to under DPS Schedule 3. DPS Schedule 3 includes only a maximum daily rate. It makes no provision for discounts. Can you please confirm that discounts are not relevant for this DPS Contract? 21. The Self Audit Certificate in DPS Schedule 8 requires us to confirm that "...the orders and invoices have been procured under an appropriate and legitimate procurement route and could not have been procured under the DPS Contract." This does not appear to cater for the situation where the Goods / Services could have been procured under the DPS Contract, however, the Buyer elected to procure them elsewhere. Please confirm how this should be addressed in our certificate. 22. DPS Schedule 9 refers to Sub-contractors who "Process Cyber Essentials Data". This term does not appear to be defined in Joint Schedule 1. Please could you confirm where this is defined. 23. For any new Key Sub-contractors, the Supplier is expected to flow down a significant number of terms. The definition of a Key Sub-Contractor is very wide and includes e.g. where any Sub-Contractor is accountable for only 10% of the projected Order Contract value. Flowdown will not be possible where any Supplier is contracting with equipment vendors and resellers etc who contract on their standard terms. Yet such companies would fall within the definition of Key Sub-Contractor / Sub-Contractor. Can you please confirm that this is not the intention. 24. A number of other provisions included throughout the Contract make reference to Supplier Staff. To take just one example, clause 14.1 makes reference to Supplier Staff in the context of the data protection provisions. This term includes all sub-contractors. Again, it will not be possible to flow down the provisions that mention Supplier Staff where any Supplier is contracting with equipment vendors and resellers etc who contract on their standard terms. Can you please confirm that this is not the intention. 25. Joint Schedule 11 - Please confirm how you intend Subject Access Requests to be dealt with? Please confirm whether you envisage a joint controller agreement being entered into? 26. There are some references to Commencement Date in Order Schedule 2. We assume that this is incorrect, as the term is not defined and that for para 1.4 of Part C at least this is intended to be a reference to the transfer date? 27. The term "Delay" is used in Order Schedule 13. This term is not defined. We assume that this is intended to be a failure to meet a Milestone by the Milestone Date. 28. Under para 3.2 of Order Schedule 15, the Buyer can "provide revised instructions" to the Supplier's Contract Manager and the Contract Manager is then expected to implement them. It is unclear what this is intended to cover. Clearly the Supplier is required to comply with the Order Contract. This appears to suggest that the Buyer could give the Supplier any instructions and the Supplier has to comply. Can you please clarify what this is intended to cover. Thank you.

97. Can CCS please confirm that a Parent Company Guarantee is not required to accept a place on the DPS?

96. Apologies for chasing this, however, we are still awaiting a response to the clarification questions below. Can you please provide an update on when we can expect a response to these queries; 1. Third party rights. Under clause 19, third party rights are excluded under each Contract "unless stated (referring to CRTPA)". A number of the provisions in the Core Terms and certain Schedules are in favour of CCS and the Buyer and relate to the Goods and Services being provided under the Order Contact. We assume that this is not intended to give the Buyer the ability to make a claim under the DPS Contract - or CCS the ability to make a claim under the Order Contract - given that these provisions do not refer to CRTPA (with the exception of the guarantee - see below our comments in relation to Joint Schedule 8) and there are no provisions dealing with double recovery. Can you please confirm that our understanding is correct? Can you also please confirm that the Buyer can agree changes with the Supplier under the Order Contract without the express consent of CCS. If our understanding above is not correct and there are effectively two rights of recovery in some cases (i.e. the Buyer and CCS can pursue the Supplier under both the Order Contract and the DPS Contract), then can you please advise on the following: i) Where CCS make a claim under the Order Contract, can you please confirm that the terms of the Order Contract would be as agreed between the Buyer and the Supplier, that the Supplier's aggregate liability to both parties will be the lability that it has in clause 11 in respect of the Order Contract and that in line with general legal principles there can be no double recovery (whether under the Order Contract and/or the DPS Contract); and (ii) Where the Buyer has agreed changes to the terms in the Order Contract and the Buyer makes a claim under the DPS Contract, it would appear that the Buyer can potentially pursue the Supplier on the basis of the unamended terms. We assume that this cannot have been the intention, and that this supports the case that the Buyer can only make a claim under the Order Contract. Please confirm that our understanding is correct. If our understanding is not correct and the Buyer could pursue the Supplier on the basis of the unamended terms under the DPS Contract, please confirm that the Supplier's aggregate liability to both parties shall be the lability that it has in clause 11 in respect of the DPS Contract and that in line with general legal principles there can be no double recovery (whether under the DPS Contract and/or the Order Contract). Finally, whilst not specifically relating to third party rights, but a on a related point, where the Buyer has agreed changes to the terms in the Order Contract, can CCS make a claim under the DPS Contract on the basis of the unamended terms? As noted above, a number of the provisions cover the provision of the Goods and Services and this would appear to give CCS the ability to make a claim under the DPS Contract in relation to the Supplier's failure to deliver Goods / Services to a particular Buyer (see e.g. clause 3.1.1). We assume that this is not the intention and that CCS should only pursue the Supplier under the DPS Contract where the Supplier has failed to comply with an obligation affecting CCS. If this is not correct and CCS could make such a claim under the DPS Contract in relation to the Supplier's failure to deliver Goods / Services to a particular Buyer, then we assume that the Supplier's liability to both parties would still be capped in line with the liability cap under clause 11.1 of the DPS Contract. Please confirm that this is the case. However, is it intended that the Buyer's losses would be recoverable under the DPS Contract by CCS pursuant to clause 11.3? Further, certain of the indemnities are unlimited and not subject to the carve out in clause 11.3, this could result in the situation where CCS could pursue the Supplier on an unlimited basis in respect of a obligation / event where the Buyer had agreed a different approach (e.g. the Buyer could agrees to change the definition of an IPR Claim for the purposes of clause 9.5). Again, this does not appear to be equitable and so we assume that this was not the intention and supports the position that CCS cannot make a claim under the DPS Contract in respect of losses suffered by a Buyer (which should rightly be recoverable under the Buyer Contract). We would appreciate it if you could confirm that this is the case. 2. Guarantee Can you please confirm what criteria will be used to determine whether or not a DPS Guarantee will be required for the DPS Contract pursuant to Joint Schedule 8? Under Joint Schedule 8 "DPS Guarantee" means a deed of guarantee in favour of CCS and all Buyers..." . Can you please explain why this definition refers to all Buyers. Each Buyer is able to require an Order Guarantee. This definition suggests that, where a DPS Guarantee is required, the Supplier is effectively giving a guarantee in respect of all future Buyers. Is that the intention? The same issue arises in relation to the definition of "Beneficiary(s)". Para 2.4 of Joint Schedule 8 states that notwithstanding Clause 19 (Other people's rights in this contract), this Schedule (Guarantee) is intended to confer benefits on Buyers and is intended to be enforceable by Buyers by virtue of the CRTPA." The template guarantee also recognises the third party rights of the Beneficiary. The Schedule requires the Supplier to provide a DPS Guarantee (where required by CCS) and an Order Guarantee (where required by the Buyer) and the Schedule is common to both the DPS Contract and the Order Contract. As such, on the face of it, no third party rights are required. Is the intention here to allow all Buyers to pursue the DPS Guarantor under the DPS Guarantee (even although the Buyer can elect to put in place an Order Guarantee)? If that were to be the case, the same issues that we flagged in relation to Clause 19 would arise (namely (i) the Buyer will be able to pursue the DPS Guarantor in respect of the unamended terms of the DPS Contract, in circumstances where the Buyer has agreed changes to the terms with the Supplier in respect of their Order Contract; (ii) there are no provisions dealing with double recovery; and (iii) there are no provisions making clear that the Supplier's aggregate liability to CCS and All Buyers shall be no more than it would have been under the DPS Contract). We note that paragraph 3 in Joint Schedule 8 is numbered paragraph 2. We assume that this is an error.

95. Reference DPS Schedule 4 (DPS Management) Para 4 How the Supplier's Performance will be measured Performance Criteria Item 9 Responsiveness to Invitation to Tenders Responding to Invitations to Tender issued via the agreement on 95% of Order Procedures, (within location region) Can you please advise if a Supplier response, advising a Buyer that it does not intend to bid for an Invitation would be considered as a valid response and hence positively included in the measure?

94. Can you provide further information as to what a relevant example contract would be, are you looking for examples of where we have done similar automation work before?

93. Limitation of liability: Clause 11.2 under the 'CCS Core Terms' states that the mutual liability cap will be £5M or 150% of the estimated yearly charges unless otherwise specified in the Order Form. We note that if the 'DPS Special Terms' ('Special Term 1') are to take precedence then the liability cap will be reduced to the greater of £1M or 100% of yearly charges. We would therefore like to confirm whether this 'DPS special term' will apply in all circumstances?

92. 'DPS Special Term 2' states that in spite of clauses 11.1 and 11.2 (of the 'CCS Core Terms') but subject to clauses 11.3 and 11.4 (of the 'CCS Core Terms') the supplier's aggregate liability in each and any contract year under each contract under clause 14.8 ('CCS Core Terms') shall in no event exceed £10Million. We would therefore like to confirm whether the indemnity for Data Protection breaches (Clause 14.8 in the 'CCS Core Terms') can be subject to 'DPS Special Term 1' (greater of £1M or 100% of yearly charges)?

91. Applicable law: - We note that the indemnity for applicable law (clause 12.2 of the 'CCS Core Terms') is excluded from the CCS Core Terms cap (greater of £5M or 150%). Can you please confirm this indemnity be brought under a mutually agreeable liability cap?

90. In looking through the criteria and requirements I notice several elements that would be incredibly onerous for a small business (e.g. 5-10 employees) to meet, despite potential alignment of their service with the needs of the marketplace, to comply. Specifically, for example I note the requirement of Cyber Essentials and several ISO standards which, we a small business can meet, but will take a long time to get into place. Is there advice, guidance or specific arrangements for small enterprises considering this marketplace?

89. Good afternoon, in relation to the clarification response on the DPS Order Schedule 8 (Business Continuity) being replaced by DPS Order Schedule 14 (Service Levels) on the portal, having just downloaded the schedules, it appears that the detail in the DPS Order Schedule 8 (Business Continuity) contains the detail from DPS Order Schedule 14 (Service Levels). Can you please provide the detail for DPS Order Schedule 8 (Business Continuity).

88. I am contacting you today about the Automation Marketplace Dynamic Purchasing System contract, with regards to establishing whether there is any future procurement activity planned relating to this project. If so, could you please confirm any approximate timescales that have been established for when this may be due to occur?

87. Re Certifications, thank you for you clarification regarding Cyber Essentials, can you please also confirm if there are any other certifications required for inclusion on the DPS, as in the Specification it mentions numerous standards on pages 8 and 9. Please clarify.

86. For the avoidance of doubt, please confirm no other certifications other than Cyber Essentials are required, as in the specification Schedule, it mentions other on page 8, please clarify.