Clarifications

24. Schedule 8 Schedule 8 describes the requirements of a Guarantee but does not obligate a Supplier at this point. In what specific circumstances would a Guarantee typically be required? If the Supplier is able to demonstrate financial standing/viability by other means (i.e sharing previous years' account history), would any Guarantee still be a necessity?

23. 14.3 Core Terms In consideration of the protection GDPR provides, why is it necessary that 'the Supplier must make accessible back-ups of all Government Data, stored in an agreed off-site location and must send to the Buyer copies every 6 Months'.

22. 11.5 Core Terms We note that the Supplier's liability relating to data protection, as per Article 11.5 of the Core terms are uncapped, thereby subjecting potential supplier's to a disproportionate amount of risk for this opportunity. This would appear to be out of step with the accepted normal contracting practice in the industry and may potentially require supplier's to account for contingency measures which could further increase cost in later opportunities. We would request that this be reconsidered as capped. 11.5 Core Terms Further, it is also stated that liability is uncapped for claims regarding an act or omission of the Supplier, any wilful misconduct and any Default by the Supplier relating to any applicable Law to do with the Contract. It further removes a cap for any non-payment of tax and Supplier transfer. The inclusion of such broad terms effectively negates the limit of liability for Suppliers as denoted in 11.2 and therefore again introduces added risk. We would request that these items are limited inside the stipulated cap.

21. 10.5.2 Core Terms 10.5.2 stipulates that when the contract ends, the Buyer's payment obligations under the terminated Contract stop immediately. Could you please clarify if that applies to obligations completed by the Supplier for which payment is due?

20. 10.7 Core Terms It is understood that within the public sector, consent with regards to Key Subcontractors is often a requirement. However, the contract stipulates 'at the Buyer's request, the Supplier must terminate any Subcontracts if there is a Change of Control of a Subcontractor which isn't pre-approved by the Relevant Authority in writing. What specific circumstances would cause a Buyer to request such termination?

19. 4.8 Core Terms 4.8 stipulates that if CCS or the Buyer can get more favourable commercial terms for the supply at cost of any materials, goods or services used by the Supplier to provide the Deliverables and that cost is reimbursable by the Buyer, then CCS or the Buyer may either require the Supplier to replace its existing commercial terms with the more favourable terms offered for the relevant item or enter into a direct agreement with the Subcontractor or third party for the relevant item. This clause seems conditional upon being 'reimbursable by the Buyer', in what circumstances would that arise? Additionally this does not factor into account all variables of the commercial terms a Buyer might achieve Vs what we as a Supplier achieve. All opportunities are won in competition so this does not accurately represent a 'level playing field'.

18. General Are all of the terms and schedules provided non-negotiable? Are terms negotiable at the order Form stage?

17. There are two Questionaires to fill in; Attachment 6 referred to in a previous questions is the SQ with no DPS specific questions. Where can you get digital access to the DPS SQ?

16. We have just registered and been approved as a supplier to the DPS. However - within the questionnaire, there is no-where for us to specify, that we are NCSC approved for Data Destruction services? All those listed for CESG services, do not relate to Data Destruction? We are a CAS-S supplier and can therefore destroy data, to secret level, but there was no where within the questionnaire to specify this service? Also when completing the questionnaire, under "CESG approved services" data destruction was greyed out? Who should I speak to about this please? I obviously want to ensure we are listed, for the services we can provide?

15. For question 130 and 131 in Part 3: Economic and Financial Standing of the Standard Questionnaire, we have responded with "no" as we do not have an ultimate parent company. In this case, is that what you would expect as the response?

14. Hi, In reference to the document "READ FIRST RM3764iii Cyber Services DPS Needs v1.PDF": - Paragraph 4.35 states various questions which are NOT required for submission. - For Paragraph 4.36, can you please clarify if the questions numbers listed (i.e. Q166 - Q172, Q174, Q176, Q179 - Q185) are Required or NOT-Required for submission? Many thanks

13. Referring to the "Read First" document, page 15 and 16 - Selection Questionnaire - Not Applicable questions: 4.36 Evidence submission stage for the following questions • Q166 - Q172; • Q174; • Q176; and • Q179 - Q185 Can you please clarify if we are required to submit evidence against these questions? If we do not need to provide evidence here, can you please advise on how we can proceed through the questionnaire as there is no N/A option?

12. Re - 'Please provide a description for this standard Selection Questionnaire' (step 2 of SQ) is this the description that will be shared with buyers or is this for our own SQ tracking purposes only? Thanks

11. Hi, I am in the process of completing our Supplier Questionnaire, which is showing as 'complete' however it is not completed and I am still working through this. Could you please confirm the date we are able to continue making edits until? Thank you

10. Timings. In the "Read First" document it is specified that the DPS is open to buyers competition from 13/02/2020. Could you please confirm how long does the assessing of applications take by CCS? What are the timeframes between the "Assessing" status flag and the "Agreeing" status flag?

9. I have downloaded a copy of the Selection Questionnaire as a document. Is the DPS Questionnaire included as part of the above document? Or is the DPS Questionnaire a new set of different questions please?

8. Hi Team: Question on Attachment 1 - Cyber Services 3 Filter Matrix v1 lists the CNI sectors. Row 11 contains "Civil Nuclear Communications". Is this a typographical error and should read "Civil Nuclear" and "Communications" as a separate entry?

7. Your emailed response to a Cyber Services 3 DPS clarification question today did not indicate which framework this was for, which is confusing for anone registered on more than one. Please can you include the relevant reference in future?

6. Dear CCS, Please confirm within parts 3 and 4, whether the following documents are to be added, or intentially missing: Part 3 - Doc 9 Part 4 - Docs 3 and 11 Many thanks!

5. nothing seems to be on DPS Schedule 2 (DPS Application) from attachment 7b, is this correct?