3 ms·

I’m reading the original tender and there is zero mention of ISO 9000. In fact, the tendering authority even specifically stated this opportunity was a good fit

by hluska 9mo ago

I’m reading the original tender and there is zero mention of ISO 9000. In fact, the tendering authority even specifically stated this opportunity was a good fit for SMEs. Where does all this talk of standards come from?

Aeolun 9mo ago
If this was a good fit for SME, and the price paid for the whole thing was 4M pounds, why didn’t any SME win the tender? Seriously, that’s the whole yearly turnover for most SME shops I ever worked at. And all of them could do a better job than this.
- hkt 9mo ago
  That's possibly why: small businesses reliant on contracts that are, to them, disproportionately huge.. well, they die at the end of the contract. HMRC killed off an OpenStack based AWS competitor by replacing them, about ten years ago. Anchor clients can be a real hazard if an SME can't live without them. Sometimes it just isn't worth it.
lwhi 9mo ago
For government tenders, I do know that agencies need certification. Maybe not ISO2001 (which is a security standard that many corporate procurement processes require the supplier to have obtained when purchasing software), but Cyber Essentials / Cyber Essentials Plus is common.
- rcxdude 9mo ago
  Cyber Essentials is a lot more of a PITA than 9001, it's very prescriptive in ways that cause all kinds of headaches without helping security.
  - henryaj 9mo ago
    I absolutely hated doing Cyber Essentials (Plus). Huge waste of time
marcus_holmes 9mo ago
In the tender there's one line: > IV.1.8) Information about the Government Procurement Agreement (GPA) The procurement is covered by the Government Procurement Agreement: Yes Googling the UK Government Procurement Agreement got me to: > https://www.gov.uk/government/collections/government-standard-contracts-for-procurement https://www.gov.uk/government/collections/government-standar... which was when I realised this was a rabbit hole and while I am positive that somewhere deep in that rabbit hole would be a requirement for all procurement suppliers to meet ISO9000 or similar, I was going to have to spend hours finding it. Hours I don't have. You can cheerfully dismiss this opinion if you like, I don't have the data to provide you evidence. But I also think this proves my point; if you have to spend hours just finding out what the requirements are, you probably don't meet them.
- duckmysick 9mo ago
  It's there in the The Model Services Contract, under Core Terms: > Quality Plans > 6.1 The Supplier shall develop, within [insert number] Working Days of the Effective Date, quality plans that ensure that all aspects of the Services are the subject of quality management systems and are consistent with BS EN ISO 9001 or any equivalent standard which is generally recognised as having replaced it ("Quality Plans"). The Short Form Contract also have optional ISO 27001 or Cyber Essentials (which is, uh, an adventure on its own). But there's also an option for no certification required. It depends on the contract. But yes, you're right. Dealing with requirements takes time and experience and you likely need a dedicated person (or team) to deal with it.
  - marcus_holmes 9mo ago
    Thanks for going down the rabbit hole :)

by hluska 9mo ago

Aeolun 9mo ago

If this was a good fit for SME, and the price paid for the whole thing was 4M pounds, why didn’t any SME win the tender? Seriously, that’s the whole yearly turnover for most SME shops I ever worked at. And all of them could do a better job than this.

hkt 9mo ago
That's possibly why: small businesses reliant on contracts that are, to them, disproportionately huge.. well, they die at the end of the contract. HMRC killed off an OpenStack based AWS competitor by replacing them, about ten years ago. Anchor clients can be a real hazard if an SME can't live without them. Sometimes it just isn't worth it.

lwhi 9mo ago

For government tenders, I do know that agencies need certification. Maybe not ISO2001 (which is a security standard that many corporate procurement processes require the supplier to have obtained when purchasing software), but Cyber Essentials / Cyber Essentials Plus is common.

rcxdude 9mo ago
Cyber Essentials is a lot more of a PITA than 9001, it's very prescriptive in ways that cause all kinds of headaches without helping security.
- henryaj 9mo ago
  I absolutely hated doing Cyber Essentials (Plus). Huge waste of time

marcus_holmes 9mo ago

In the tender there's one line: > IV.1.8) Information about the Government Procurement Agreement (GPA) The procurement is covered by the Government Procurement Agreement: Yes Googling the UK Government Procurement Agreement got me to: > https://www.gov.uk/government/collections/government-standard-contracts-for-procurement https://www.gov.uk/government/collections/government-standar... which was when I realised this was a rabbit hole and while I am positive that somewhere deep in that rabbit hole would be a requirement for all procurement suppliers to meet ISO9000 or similar, I was going to have to spend hours finding it. Hours I don't have. You can cheerfully dismiss this opinion if you like, I don't have the data to provide you evidence. But I also think this proves my point; if you have to spend hours just finding out what the requirements are, you probably don't meet them.

duckmysick 9mo ago
It's there in the The Model Services Contract, under Core Terms: > Quality Plans > 6.1 The Supplier shall develop, within [insert number] Working Days of the Effective Date, quality plans that ensure that all aspects of the Services are the subject of quality management systems and are consistent with BS EN ISO 9001 or any equivalent standard which is generally recognised as having replaced it ("Quality Plans"). The Short Form Contract also have optional ISO 27001 or Cyber Essentials (which is, uh, an adventure on its own). But there's also an option for no certification required. It depends on the contract. But yes, you're right. Dealing with requirements takes time and experience and you likely need a dedicated person (or team) to deal with it.
- marcus_holmes 9mo ago
  Thanks for going down the rabbit hole :)