The Ministry of Defence has signalled its intention to implement a new highly secure IT and physical infrastructure for storing some of the UK’s most highly classified and sensitive information.
The department has published an early-stage procurement notice outlining a potential “requirement for the provision of secure infrastructure on a civilian site in the southeast of England”.
Although the ministry claimed that the details provided are, necessarily, limited by the sensitivity of the project, the notice indicated that the facility will likely include a private cloud system and physical document storage provided as a fully managed service. Data stored at the site will include that which is classified by government as Top Secret – which sits above Secret and Official as the highest level of security classification.
“The requirement would be for the full-service provision of physical and IT infrastructure classified above-secret,” the MoD notice said. “The service required would include: site leasing; facility design, build, accreditation, and management; and cloud IT system design, build, accreditation and support.”
Official guidelines define Top Secret-classified data as “HM Government’s most sensitive information requiring the highest levels of protection from the most serious threats… where compromise could cause widespread loss of life or else threaten the security or economic wellbeing of the country”.
The ministry said that it expects to appoint a supplier of the new secure infrastructure to five-year contract likely to come into effect in the second quarter of 2023 – although prospective providers are advised that this is “subject to change”.
Suppliers wishing to express an interest in the contract must email the MoD, after which they will be asked to complete a pre-qualification questionnaire “to determine suitability-for and advancement-to a competitive” tender process. The appointed firm will need to possess the List X clearance given to contractors retained by government to process or store sensitive information.
“The project is classified up to Top Secret – UK Eyes Only,” the notice said. “For this reason, the ministry cannot share further information without first satisfying security protocols.”
The MoD did not provide an estimate of how much money will likely be spent via the contract.
In a separate procurement, the MoD is also looking to award a deal for the provision of IT services required to process data classified at the lower level of Secret. The contract will replace an engagement with an incumbent supplier. The ministry indicated that it wishes to complete the switchover by March 2025.
The new provider will be expected to sustain existing services but also “enable change that would improve the user experience, increase user numbers and keep pace with the ever-changing cyber landscape”, the MoD indicated in another recently published early-engagement procurement notice.
“The [ministry] is looking to contract for Secret IT services that would deliver secure, robust, responsive and reliable services to ensure that [it] is able to work and operate effectively and efficiently, both internally and externally, collaborating with industry, allies and coalition partners,” it added.
“The current intention is for the contract to include the delivery of workplace services, end user support services, productivity and collaboration services, application services, business user services and records management services.”
Secret is the middle tier of government’s three levels of security classification – sitting between Official and Top Secret. The definition is applied to “very sensitive information that justifies heightened protective measures to defend against determined and highly capable threat actors… for example, where compromise could seriously damage military capabilities, international relations or the investigation of serious organised crime”.
Sam Trendall is editor of CSW's sister title PublicTechnology, where this story first appeared