Continuation of Support for cyber assessment framework in Welsh Local Government - Contract details notice

Procurement reference

WLGA Cyber 02

Procurement description

Notice to Direct award contract for the continuation of works to support the implementation of the Cyber assessment framework (CAF) in Welsh local government, provided by Bridewell Consulting Ltd. Direct award justification - Continuation of Existing SupplyChange of supplier would cause incompatibility or disproportionate technical difficulty.WLGA proposes to directly award the next phase of the Cyber Assessment Framework (CAF) support contract to Bridewell Consulting Ltd on the basis that changing supplier at this stage would create significant technical, operational and cyber security risks that outweigh any potential benefits of a competitive procurement exercise.The supplier has developed substantial programme-specific knowledge, methodologies, tooling, templates, dashboards and sector intelligence throughout delivery of the CAF programme across Welsh local authorities and Fire and Rescue Services. The supplier has supported organisations through assessment, quality review, critical system mapping, independent feedback and improvement planning activities. As a result, they now possesses a unique understanding of the sector baseline, organisational maturity positions, critical system dependencies and programme governance arrangements.Replacing the current supplier with an alternative supplier would create incompatibility with the existing programme infrastructure, methodologies and assessment approaches already embedded across participating organisations. Significant effort would be required to transfer knowledge, validate prior outputs and align a new supplier to established ways of working, creating a risk of inconsistency in assessment outcomes and reducing comparability with work already completed. This would undermine the continuity and integrity of the national programme.A change of supplier would also introduce material cyber risk. The current programme supports the cyber resilience of critical public services across Wales and provides visibility of sector-wide risks, vulnerabilities and areas requiring intervention. Any interruption to delivery, loss of organisational context or reduction in oversight during transition could weaken security visibility across the sector and delay the identification and mitigation of emerging risks. A prolonged mobilisation period would leave organisations without the level of support and assurance currently available through the programme.In addition, a transition to a new supplier would cause significant service disruption. A full procurement exercise, mobilisation period and knowledge transfer programme would delay delivery of planned activities and divert resources away from improvement work. Participating organisations would experience disruption at a critical stage in their CAF journey, potentially delaying assurance activities, improvement planning and the implementation of risk reduction measures

WLGA

Bridewell Consulting Ltd

Procedure type

Direct award

Description of how these justifications apply

The supplier has developed substantial programme-specific knowledge, methodologies, tooling, templates, dashboards and sector intelligence throughout delivery of the CAF programme across Welsh local authorities and Fire and Rescue Services. The supplier has supported organisations through assessment, quality review, critical system mapping, independent feedback and improvement planning activities. As a result, they now possesses a unique understanding of the sector baseline, organisational maturity positions, critical system dependencies and programme governance arrangements. Replacing the current supplier with an alternative supplier would create incompatibility with the existing programme infrastructure, methodologies and assessment approaches already embedded across participating organisations. Significant effort would be required to transfer knowledge, validate prior outputs and align a new supplier to established ways of working, creating a risk of inconsistency in assessment outcomes and reducing comparability with work already completed. This would undermine the continuity and integrity of the national programme. A change of supplier would also introduce material cyber risk. The current programme supports the cyber resilience of critical public services across Wales and provides visibility of sector-wide risks, vulnerabilities and areas requiring intervention. Any interruption to delivery, loss of organisational context or reduction in oversight during transition could weaken security visibility across the sector and delay the identification and mitigation of emerging risks. A prolonged mobilisation period would leave organisations without the level of support and assurance currently available through the programme. In addition, a transition to a new supplier would cause significant service disruption. A full procurement exercise, mobilisation period and knowledge transfer programme would delay delivery of planned activities and divert resources away from improvement work. Participating organisations would experience disruption at a critical stage in their CAF journey, potentially delaying assurance activities, improvement planning and the implementation of risk reduction measures For these reasons, the contracting authority considers that competition is not feasible at this time without disproportionate disruption. This direct award is strictly limited to the period of the financial year 26-27, after which a review of activities and dependencies will be undertaken to allow for open market engagement in subsequent support engagements for cyber support in Welsh local government The contract duration reflects the minimum period necessary to ensure continuity within the current programme of work to avoid disruption and potential risk to cyber resilience

Direct award justification

Additional repeat extension partial replacement