BE24204 - NIS Delivery Cyber Security Programme Support

** This is an awarded contract against RM6126 Research and Insights and not a call for Competition** The Department for Energy Security and Net Zero (DESNZ) are seeking to appoint a supplier to assist in the delivery of a feasibility plan and business case for a cyber delivery unit to support the Department's work under the Security of Network & Information Systems Regulations 2018 (NIS Regulations) for the oil and upstream gas energy subsectors.

The proposed NIS Delivery Unit will provide: - Dedicated cyber programme staff and inspectors - A model to deliver inspections on Operators of Essential Service (OES) under NIS Regulations - Support guidance development - OES feedback - Cross-industry engagement The aim of the unit is to provide assurance to government and enhance compliance and cyber resilience across the Operators of Essential Services in Oil and Upstream Gas subsectors.

This feasibility plan and business case will look at potential operating structures of the unit, resource requirements and estimated start-up and running costs with the aim of forming the basis for a fully scoped and costed unit.

Aims and Objectives The project will deliver a feasibility plan and business case for the potential new unit including resourcing requirements, costing for setup and viable delivery models.

Feasibility Study The successful supplier will: - Research and evaluate different delivery models, then articulate a cost-effective approach by which the NIS Delivery Unit can be a vehicle for implementing NIS in the Oil and Upstream Gas subsectors.

A key deliverable will include but is not limited to holistic conceptual model comprising the technical, economic and regulatory implications matched to HMG cyber ambitions. - Enable DESNZ to explore and evaluate different models for improving regulator capacity and decide on which ones to take forward into a business case.

Business Case The successful supplier will: - Develop a detailed business case on 3 models identified during the feasibility stage. - Conduct a Handover of a completed, and fully costed business case to DESNZ to support decision making on how best to improve regulator capacity via a new delivery model. - The business case will include a risk management framework so that the Authority can continuously monitor and address new risks when they arise.