Skip to content

Provision of Cyber Security Regulatory Support Services to ONR - Supplier Qualification Stage - Successful Tenders

Date released
17 March 2020
Request number
202001056
Release of information under
Freedom of Information Act 2000

Information requested

Copies of the suppliers’ SQ bids which were successfully shortlisted to tender.

Information released

I confirm that under Section 1 of the FOIA, that we hold the information related to your request.
 
As we set out in our previous response to you in FOI202012054, ONR undertook a two stage tender process, whereby we shortlisted suppliers from an original number of bids received from a Pre-Qualification stage (Selection Questionnaire or ‘SQ’) of the process. Four suppliers were shortlisted from the SQ stage.

These suppliers were PricewaterhouseCoopers LLP (PwC), Context Information Security Limited (Context), PA Consulting Services Limited (PACS), and Decision Analysis Services Ltd (DAS). Although DAS was shortlisted, it later withdrew their bid from the procurement process.

We have therefore identified four documents from these suppliers, each of which we are releasing in part and have attached to this response.

  1. Document One - PwC - ONR T508
  2. Document Two - Context Information Security - ONR T508
  3. Document Three - PA Consulting - ONR T508
  4. Document Four - Decision Analysis Ltd - ONR T508

Some information has been withheld because it contains personal data. The personal data has been withheld using the exemption section 40(2) of the FOIA. In particular, release of the information would breach principle (a) of GDPR (lawfulness, fairness and transparency) on the grounds that there is no lawful basis to process this data. In addition, releasing this personal data would also breach principle (b) of GDPR (purpose limitation) as the data was provided solely for the purposes of the bid.

Some information is being withheld under the following sections of the FOIA:

Section 41 FOIA – Information provided in confidence

Section 41 FOIA sets out an exemption from the right to know where the information was provided to the public authority in confidence. This applies to information which was obtained by ONR from any other person, its disclosure would constitute a breach of confidence, or a legal person could bring a court action for that breach of confidence and that court action would be likely to succeed.

We consider that the information in relation to third parties in the bid documents has the necessary quality of confidence and given to ONR in circumstances imparting an obligation of confidence. In addition, we consider that disclosure would be an unauthorised use of the information to the detriment of the suppliers’ information contained in the bids.

This is because information relating to contracts with other customer organisations is subject to a duty of confidentiality in non-disclosure agreements between the supplier and those customer organisations. In addition, disclosure of sensitive information that was obtained in circumstances importing confidence from the supplier to third parties, in relation to their cyber security arrangements and projects, would be an unauthorised use of the information to the detriment to the confider. As this information was provided to ONR in confidence for the purpose of the SQ in this particular tender, disclosure of that information is likely to result in a breach of confidence that is actionable against the supplier.

This is an absolute exemption and so does not require the public interest test.

Section 43(1) FOIA – Trade secrets

We have considered under Section 43(1) of the FOIA whether information relating to trade secrets in the attached documents are exempt from disclosure. As this is a qualified exemption, we are required to balance the public interest between disclosure and non-disclosure. We have therefore applied the Public Interest Test, as set out below:

Factors for release:

Use of the exemption provides no further information to the public and represents a frustration of ONR’s policy of openness and transparency;

  • The public have a vested interest in issues related to the nuclear industry, and in facilitating accountability and transparency in how ONR as an independent nuclear regulator awards its public procurement contracts on support services.
  • Greater transparency about the tendering process and the negotiation of public sector contracts may encourage more companies to take part in the process and help them improve their bids. This will increase competition and help other public authorities get better value for money.

Factors against release:

  • Disclosing trade secrets about the supplier’s development of proprietary cyber security projects, programmes and capabilities would be liable to cause significant financial and reputational harm to the supplier ;
  • Management of cyber security risks and threats to businesses is a specialist support service. Disclosing information about the supplier’s intellectual property on cyber security support, which is not otherwise readily accessible, would be advantageous to the supplier’s rivals in this field, and should therefore be afforded a high level of secrecy.

Conclusion

After careful consideration of the factors set out above, ONR has concluded that the information should be withheld. Disclosure of the information would likely to lead to misappropriation of the supplier’s trade secrets by competitors and distort the market in this specialist field. Consequently, releasing the information would not be in the public interest.

Section 43(2) FOIA – Prejudice to commercial interests

We have considered under Section 43(2) of the FOIA on whether there is prejudice to the commercial interests of the suppliers in relation to information in the attached documents. As this is a qualified exemption, we are required to balance the public interest between disclosure and non-disclosure. We have therefore applied the Public Interest Test, as set out below:

Factors for release:

• Use of the exemption provides no further information to the public and represents a frustration of ONR’s policy of openness and transparency;
• The public have a vested interest in issues related to the nuclear industry, and in facilitating accountability and transparency in how ONR as an independent nuclear regulator awards its public procurement contracts on support services.
• Greater transparency about the tendering process and the negotiation of public sector contracts may encourage more companies to take part in the process and help them improve their bids. This will increase competition and help other public authorities get better value for money.

Factors against release:

  • Disclosing the information provided by the supplier in relation to third parties would result in reputational damage to and loss of customer confidence in the supplier. This could potentially result in loss of trading relationships and thus prejudice the supplier’s commercial interests by distorting the competitive market.
  • Disclosing information about the supplier’s contracts with third party organisations, business contacts, and responses to specific bid related questions would prejudice the supplier’s commercial interests as this information could be used by competitors to obtain an advantage in any future bids. This would in turn have the effect of distorting competition in this specialist market which would not be in the public interest.
  • Sharing information on subjective cyber security capabilities, assessments, and research projects would prejudice the supplier’s commercial interests as this could inform any potential competitors and lessen the supplier’s competitive advantage in future procurement exercises. This would in turn have the effect of distorting competition in this specialist market which would not be in the public interest.
  • Publication of the information may prejudice the ONR’s future procurement tenders by discouraging potential suppliers from submitting SQs and bids, or reducing the quality of the details submitted in future bids.

Conclusion

There is a strong public interest in protecting the commercial interests of individual companies and organisations, and ensuring they are able to compete in the market fairly. Publication of the information may prejudice the supplier’s existing and possible future commercial arrangements. In addition, releasing the information could inhibit ONR’s own commercial interests in future public procurement tenders. As a result, it is in the public interest to withhold the information.

Finally, we have been asked to note that from the disclaimer included within the SQs, the SQ is addressed to and prepared solely for the ONR and were not prepared with the interests of anyone other than the ONR in mind. On that basis, the suppliers do not accept any duty or responsibility to anyone else in their release under the FOIA.

Exemptions applied

Section 40(2), 41, 43(1) and 43(2)

PIT (Public Interest Test) if applicable

Yes, please see above.