NSW DCS looks for all-of-govt cybersecurity arrangement

The New South Wales Department of Customer Service (DCS) is calling for expressions of interest (EOI) on the viability and establishment of an All of Government Arrangement (AoGA) for cyber security software and associated services.

This aims to streamline government procurement of cyber security solutions through a multi-tier commercial framework, with greater transparency, better pricing for the government through volume buys, and uniform terms and conditions as well.

Currently, the NSW government is rapidly growing its cybersecurity spend on software and related services.

For the 2023 financial year, NSW spent $66 million, representing a compound annual growth rate (CAGR) of 44.1 per cent from 2021.

Cybersecurity software and purchases are presently procured directly from original suppliers under various framework contracts, or under a pre-existing AoGA.

Channel partners and resellers can also sell cybersecurity software and services to the NSW government.

The first iteration of the arrangement will focus exclusively on cyber security software and associated services, with DCS proposing a two-stage procurement process.

Stage 1 includes the EOI, and seeks to assess the viability of establishing a commercial framework between DCS as the Contract Authority (CA), and original equipment manufacturers (OEMs) of cyber security software, along with their channel partners and resellers.

An approach to Stage 2 activities could require direct negotiation, a closed request for tender or an open market one.

The EOI covers 12 specific cyber security software categories covering applications, cloud, data, identity and access management, endpoints and networks.

Business continuity, complaince and auditing, emerging cybersecurity technoloiges, awareness and training, strategy and governance and security operations are also covered by the EOI.

It also encompasses four types of extended professional services: extended support, implementation, operational support, and business change management.

Products and services would be made available under two distinct modules.

Module 1 covers base cyber security software products only, while Module 2 includes both base cyber security software products and extended professional services.

Using the information returned from the EOI, the DCS project team will assess and finalise the proposed commercial framework and make recommendations on the final SPA scope of products and associated services.

Information gathered during this process may be used to down-select suppliers for a subsequent Stage 2 process.

The EOI requires suppliers to submit responses by 3 pm on April 9.