Opportunity: Small Business Research Initiative (SBRI) : Reducing Public Sector Risk through Culture Change (Phase One)

Deadline: 8 November

The Government Security Group is mobilising a multi-phase approach to reducing public sector risk through culture change.

The overall programme will be delivered over two phases; and Phase One (November to March) delivers a “bake off” between up to six small business innovative suppliers to reduce public sector risk through cultural change.

Up to £400,000 (including VAT) is allocated to this phase of the competition, with potentially a number of simultaneous technical feasibility study contracts awarded of up to £60,000k (including VAT) per project for up to 12 weeks.

Phase Two will award research and development contracts to Phase One project partners to deliver a “private beta” or field testing of the prototype developed in Phase One with a small group of controlled users.

The intended outcomes of this work are delivery of a standard for best practice security culture, the validation or disproving of our nine hypotheses, development of a prototype product or service for reducing risk through culture change and delivery of metrics or performance indicators for measuring the effectiveness of the intervention(s).

The deadline for applications is 8 November 2021

Contract details

Security is seen as complicated or confusing by many people, or even as a blocker or impediment to working. Security is rarely promoted as an enabler or core business outside the security practitioner community.

The public sector needs to better enable its people to reduce and manage risk, where ‘people’ are defined as users (anyone who uses Government official IT) and practitioners (those responsible for managing and delivering security in an organisation), and where ‘risk’ is defined as ‘the harm arising from potential loss, damage or compromise of government assets’.

Government knows that organisational cultures can be a powerful influence on how people act in the workplace, where ‘culture’ is defined as “shared values (what is important) and beliefs (how things work) that interact with an organisation’s structures and control systems to produce behavioural norms (the way we do things around here)“.

It would like to validate or disprove the following hypotheses:

A) Promoting appropriate culture(s) is an effective lever in reducing and managing risk;

B) Human Factors - including organisational climate and culture - play a critical role in our cross government risk posture today;

C) It is feasible to develop a holistic methodology or capability that can assess and monitor the health of the Human Factors landscape - including organisational climate and culture - across a public sector organisation in near real time;

D) It is feasible to develop a single methodology or capability to assess and monitor the health of the Human Factors landscape - including organisational climate and culture - across government in near real time;

E) Although several aspects of culture are interrelated, it adds value to target ‘cyber culture’ separately from ‘organisational culture’ or ‘security culture’ (where “security culture” is defined as ‘The set of values, beliefs and assumptions, shared by everyone in an organisation, which determine how people are expected to think about and approach physical, personnel, technical and cyber security’);

F) Leadership (senior leaders as well as local line managers) attitudes and behaviours are the single greatest factor which drive an organisation’s risk posture, and therefore represents the greatest value for risk interventions;

G) Risk interventions applicable to government departments are also applicable to other public sector organisations such as local authorities, education and healthcare arm lengths bodies;

H) Appropriate security cultures require the organisation to improve people’s capability and opportunity to work securely, as well as their attitudes and motivation.

I) Interventions which reduce high risk behaviours (e.g. reduced IT security violations) can be measured in near real-time, quantitatively and qualitatively.

Over 12 weeks, Phase One invites potentially multiple suppliers to:

1) validate or disprove as many of our nine hypotheses as possible;
2) develop, prototype and test systematic interventions or groups of interventions to reduce risk, and;
3) propose implementation measures and outcome measures of the effectiveness for these intervention(s).

Phase two - the intended outcome of Phase Two is that we have field tested what will turn into a centrally delivered service that improves delivery in departments/ public sector organisations. Government targets awarding up to three Phase Two contracts of up to £200,000 each (including VAT) for up to 12 months of research, development and prototyping.

The contract will terminate at the end of Phase Two, and the chosen business will be expected to pursue commercialisation of their solution.