AGILE DESIGN AND DELIVERY SERVICES. G-CLOUD SERVICE DEFINITION.

AGILE DESIGN AND DELIVERY SERVICES. G-CLOUD SERVICE DEFINITION.

Table of contents 1 Introduction...3 1.1 Agile Lifecycle Services...3 1.2 Secure by Design (SbD)...4 2 Services Overview...5 2.1 Agile Delivery Strategy...5 2.2 Agile Business Analysis Services...6 2.3 Agile Development Services...7 2.4 Agile Application Support Services...9 2.5 Agile Project Management Services...9 3 Technical Requirements... 11 4 Service Delivery... 11 4.1 Service Management... 11 4.2 Service Constraints... 11 4.3 Service Levels... 11 4.4 Information Assurance... 11 4.5 Backup/Restore & Disaster Recovery... 11 4.6 Data Restoration / Service Migration... 11 4.7 Trial Services... 11 4.8 On/Off-boarding... 11 4.9 Training... 12 5 Commercial Arrangements... 13 5.1 Pricing... 13 5.2 Agile Design & Delivery Services Terms and Conditions... 13 5.3 Ordering and Invoicing Process... 13 5.4 Customer Responsibilities... 13 5.5 Termination Terms... 13 5.6 Financial Recompense Model for Not Meeting Service Levels... 13 6 Detica: Information Intelligence... 14 Agile Design & Delivery Services Page 2 of 15

1 Introduction 1.1 Agile Lifecycle Services An Agile application development approach helps you fully realise the benefits of Cloud based services by providing a flexible and responsive approach to developing new services. The Agile Lifecycle enables development to be conducted as iterations against a set of prioritised customer requirements. The approach brings the customer closer to development activity so that a focus is maintained on benefits and user requirements. The key to successful Agile development is acceptance by both the customer and the supplier of agile principles including adaptive planning, elaboration and prioritisation of requirements, time-boxed delivery sprints whilst providing flexibility to change. Results are seen early and often with feedback being incorporated into subsequent iterations. Completed iterations are often fully deployable into the Cloud, thus gaining the benefit of early end user feedback which can also inform future iterative developments. Agile lifecycles are often seen as a solution to the challenges experienced with traditional waterfall development techniques: full up-front definition of requirements are required; commercially there is a desire to have a complete prescriptive solution design agreed before any code is developed; the resultant software is often considered rigid and inflexible; there are long periods before the customer sees outputs, which are then difficult or expensive to change in response to clarified needs or a shifting benefits realisation landscape. BAE Systems Detica s Agile approach addresses these factors in order to maximise the advantages of Agile, but also recognise the reality of delivering into a complex and demanding domain. It has the following key features and services: Agile Delivery Strategy:- a packaged service that assesses the customer s project needs, starting with benefits realisation and outcomes definition, and then proposes a development roadmap identifying development stages and assesses what aspects can be agile, and where alternative approaches may be more suitable. This is accompanied by a commercial strategy which enables the agile aspects to flourish but achieves the desired outcomes, and recognises a fair and manageable risk profile Agile Business Analysis:- as a follow-on from the Agile Delivery Strategy, or as a stand-alone service, this service assists the customer with business process and requirements elaboration from the benefits realisation strategy, shaped to support a fully agile or hybrid delivery model Agile System Development:- a fully agile or hybrid systems development service encompassing design, development, systems integration, test, and transition to operation. The hybrid model supports system requirements that are not amenable to the agile approach for whatever reason, and deployments into complex systems integration and/or secure environments. Legacy system data migrations and end user training are also offered. Agile Application Support:- a complete third line application support managed service for systems that have been developed and need to be enhanced throughlife using agile development techniques. Agile Project Management:- project management services to manage the delivery of systems in collaboration with the customer using an Agile development approach. Agile Project Management is also offered as an advisory service that customers can use to manage agile or hybrid deliveries from other suppliers. Agile Design & Delivery Services Page 3 of 15

Agile Delivery Strategy Benefits Realisation / Evolution Business Analysis & Elaboration UAT OAT TTO Architectural & Functional Design Detailed Design SAT / Penetration Testing Alternative route for simple systems Waterfall Dev & Test Waterfall FAT Iteration 1 Development & Test Iteration n Development & Test 1.2 Secure by Design (SbD) Figure 1: BAE Systems Detica s standard Agile development lifecycle The protection of information and IT systems, including Critical National Infrastructure, is a vital concern. It is essential therefore that any system design and deployment has appropriate levels of security protection built in; furthermore this should occur intrinsically as part of the full development life cycle, not an add on hygiene factor at the end. Deploying systems in a cloud environment compounds the risk: the infrastructure (IaaS) and platforms (PaaS) (including databases) are removed from the more traditional privately hosted environments. Operationally they achieve their flexibility by a variety of techniques such as sharing of computing resources and multi-tenancy of databases. Although the G-Cloud has broad security protection built in, there may nevertheless still be concerns over sensitive data access, data segregation and privacy, and network component sharing, amongst others. BAE Systems Detica s response to this is our Secure by Design (SbD) methodology, and is the hallmark to our approach to systems design. This is a through-life specification, design, integration and management of controls to ensure information confidentiality, integrity and availability, where the controls are proportionate to the potential business materiality they mitigate. This approach provides effective and efficient risk mitigation by promoting a whole-system, through-life approach using the most appropriate controls to manage the risk and minimise adverse impacts on users. We have extensive experience in developing such systems up to IL6 and beyond, and even at impact levels below IL3 our design approach naturally embeds good security practice. Agile Design & Delivery Services Page 4 of 15

2 Services Overview 2.1 Agile Delivery Strategy Agile Delivery Strategy is a packaged service where BAE Systems Detica works with the customer for a short, focused period to develop a delivery strategy that will best match their needs. The strategy takes account of target benefits and business requirements, technical and service management strategy and commercial and security constraints. The purpose of the strategy is to ensure that Agile methods will be used to best effect taking account of both opportunities and risks, and that where appropriate they are combined with formal systems development and integration as a hybrid delivery model. The following outputs are produced: Development Plan: a high level description of the development approach using the most appropriate agile techniques. This may include holding a high level scoping work-shop to define the medium to longer term priorities or stages for any solution. This is helpful as these can inform the logical evolutionary blocks or steps that a future project should look to follow. Commercial Plan: a description of the optimal commercial model that achieves the Development Plan whilst supporting the customer s desired outcomes and cost envelope; a basis of acceptance is defined; and risk is fairly shared and managed; within a time-boxed delivery schedule. Relationship Management Plan: the plan that defines how Detica and the customer will collaborate to ensure that the more flexible Commercial Plan achieves its objectives. Detica encourages the adoption of BS11000 ( Collaborative business relationships Part 1: A framework specification ) by key parties. The service is time boxed in order to focus on producing the outputs in a timely manner to provide the customer a quick basis for determining the future direction of the project or group of projects. Where the customer is looking to define a clearer set of requirements for a project, the BAE Systems Detica Business Analysis Services can be used to define these. We offer Agile Delivery Strategy development as a standalone fixed price work package. The price can be found in section 5.1 below. This is typically a 2 week exercise undertaken by an Agile development expert and is based on a typical agile development involving a single application supporting up to five primary business processes, with moderate integration requirements and operating within an established hosting and service management environment. The pricing will be validated with you during the ordering process against the scale and complexity of the requirements and required output. Agile Design & Delivery Services Page 5 of 15

2.2 Agile Business Analysis Services Business analysis and requirements management provides an essential link between the outcomes and benefits required from a system development, the business use of that system, and the requirements for the system itself. For a broader programme management engagement, please refer to our Programme Management services. 2.2.1 Business Analysis BAE Systems Detica offers a range of business analysis services including business and IT strategy, business process analysis and improvement, organisation design and data modelling, linked to the programme blueprint and benefits realisation strategy. This service can also be used to extend the Agile Delivery Strategy service for large or complex engagements. We work with the major business analysis and enterprise architecture methods including UML, BPMN, Zachman, and TOGAF/MODAF. Our Secure by Design methodology is applied during this stage to consider security related use patterns and embed mitigations within the business design. This can be complemented by BAE Systems Detica s specialist Cyber services which include security policy, architecture and accreditation related services. 2.2.2 Requirements Elaboration and Capture During this phase we will provide capture and management of functional and nonfunctional requirements in a form that can be understood by system architects, designers and implementation teams (including data architects), and validated by users and other stakeholders. In an agile context, the key feature is to recognise what requirements cannot be fully defined at project outset, and should be added to the product backlog for agile development. In these cases high level business requirements and their benefits can be articulated, leaving elaboration to the agile development phase. Depending on the nature of the application or service involved (e.g. data solutions, COTS applications and integration, bespoke applications, and web / digital media) we will apply a range of techniques for developing and defining functional requirements. Requirements are written in such a way as to be correct, atomic, complete, achievable, and testable, and are categorised according to the FURPS model (Functionality, Usability, Reliability, Performance, and Supportability). Requirements are accompanied by acceptance criteria, which determine how the requirement is to be verified during acceptance testing. Typically non-functional requirements (NFRs) describe aspects of the system including (but not limited to): Availability, Reliability, Maintainability, Performance, Scalability, Backup and Recovery, and Operational Support. The NFRs are also tailored to meet the particular characteristics of a cloud-based deployment. Where appropriate, our Secure by Design method ensures that security requirements are also elaborated and made traceable at this stage. 2.2.3 Requirements Management Requirements are typically defined via a level of decomposition (i.e. from business, to system, etc); traceability is maintained between levels, and through into design, code, and test. In this way the impact of any requirement change can be readily assessed. Agile Design & Delivery Services Page 6 of 15

The use of tooling provides the required traceability to these steps and we can adapt to use customer-selected tooling if desired. Typical tools used for this purpose include but are not limited to Enterprise Architect and Rational Pro. 2.3 Agile Development Services Following business and requirements analysis, the solution enters the development phase modelled in the Development Plan produced during the Agile Delivery Strategy. BAE Systems Detica offers a full range of Agile development services capable of supporting development of application services operating at a range of security levels from IL1 and 2 for standard Cloud deployment, through to IL6 for specialist deployments. Our services include: 2.3.1 Solution Design Independent of the delivery methodology and life cycle, a preliminary architectural and functional design is typically required for a solution and needs to be considered at this stage. The solution architecture addresses infrastructure and operating environments, package deployment, third party systems integration points, non-functional system aspects, and security. Where the customer intends to purchase IaaS or PaaS from the G-Cloud the architecture design may need to identify how this is to be scoped and managed. For any non-agile aspects of the solution, the architecture is followed by a formal detailed design. Design and development activities should then follow documented techniques such as Use Cases and UML. Within Detica, we maintain an in-house variant of the RUP, known as DSUP (the Detica Software Unified Process) which encapsulates lean principles and continual improvement. Our Secure by Design methodology ensures that any coding counter-measures, lockdown techniques, and policy definition and design are considered and designed in as appropriate. Protective Monitoring requirements are agreed with the customer s security consultant, and appropriate controls (typically GPG13 compliant) and tooling deployed. For solutions where user experience is key, Detica uses a User Centric Design (UCD) approach and may involve our Creative Team. This process takes the user design from user profile analysis and user journeys, through wireframe and style guide development, to detailed screen designs. The entire process involves the customer in a Joint Application Design approach. In the agile case, this process is adapted to ensure that iterated development follows a set of design principles and consistent look and feel. 2.3.2 Solution Development Software is typically developed at our onshore development facility in Leeds, although we can establish this team on customer site if required. Our development teams are skilled in major programming languages including Java,.Net, Perl and Python; and a wide range of COTS packages covering covering workflow, case management, middleware integration, MS Sharepoint, MS Dynamics CRM, Oracle, Tibco, and Software AG. They operate using peer code reviews; unit testing; and the production of appropriate detailed design documentation. Agile development is conducted in sprints, durations to be determined in the Development Plan devised in the Agile Delivery Strategy; customer presence is essential for ongoing review and consultation, but this can be flexible dependent on customer location. Agile Design & Delivery Services Page 7 of 15

2.3.3 Solution Test The test approach is agreed early-on with the customer and documented in a Test Strategy, which covers the all necessary stages of testing and identifies the roles and responsibilities of the parties involved. The Test Strategy typically includes test phasing, documentation (plans, scripts, readiness reviews, and reports), test tools and environment requirements, test coverage, management information and test reporting, and defect management and triage processes. A Test Manager will be appointed to coordinate and manage test activities. The Test Manager works closely with the customer to provide visibility of progress and the results of testing. Testing commences with the developers unit testing their software; in the agile case the software is continually integrated and functionally tested, with customer collaboration and sign-off. This enables completed iterations to be deployed to users where desired. With sufficient code maturity, tests are built into test automation systems, and continual build and test runs performed. In some cases, it may be appropriate to complete a formal Factory Acceptance Testing (FAT) as the key checkpoint for customer acceptance and sign-off. This can be used as a handover point if Detica is developing just a sub-system and the customer is completing the integration. In many cases, there can be a requirement to validate the system integration and performance aspects before handover, which typically cannot be performed in the development environment. This requires System Integration Testing (SIT), including specialist performance testing expertise and tooling, followed by a formal witness Site Acceptance Test (SAT), to be performed in the target hosted environment. In secure environments, penetration testing would typically occur following SAT. The typical point for handover is the completion of a User Acceptance Testing (UAT) phase. This is performed against each batch of developed requirements to ensure that they have been satisfactorily delivered and the system can enter operational service. 2.3.4 Solution Transition to Operation (TTO) Following system acceptance, there may still be a process of transitioning to operational service. The exact requirements for this stage will depend on the specific customer needs and their existing hosting arrangements (i.e. outsource provision vs. in-house team). As a result, Transition to Operation may include the following: User training (see the Training service description). Legacy data may need migrating; this typically involves its own Extract Transform and Load (ETL) process to be developed, tested, and managed prior to go-live Support services are tested, including service liaison with the customer s, or the customer s third party service partners, in an Operational Acceptance Test (OAT) There may be aspects of end user environment roll-out to be managed (although this is increasingly rare with the predominance of web-based solutions) Any system or network monitoring solution is activated. The customer may wish to have an optional period of Operational Evaluation, where user feedback can be received, further action plans established and confidence to be gained in the support services prior to the move to a business as usual support state. Agile Design & Delivery Services Page 8 of 15

2.4 Agile Application Support Services Detica can provide third-line application support based on ITIL v3 to systems developed using our Agile Application Development Services. The typical services that we offer to our customers include but are not limited to the following: Telephone and e-mail support contact points; Provision of business hours support (9am to 6pm GMT, Monday to Friday, normal working days) with on-call Priority 1 and 2 incident support available during out-ofhours; Incident and problem management; Knowledge transfer to the customer s IT teams to help maintain and improve inhouse support capability; Provision of a Detica Service Delivery Manager with responsibility for service delivery, to consolidate requests for change, and act as a point of escalation; Provision of monthly service reports and service reviews; Change impact assessments for your proposed changes to the solution or its ecosystem; Enhancements through change control if required. Our Agile Application Support services typically provide a lower level handling of change requests and system development enhancements than for traditional support services. By agreement with the customer, a set of change requests will be prioritised alongside the residual requirements backlog from earlier project and service deliveries, into a timeboxed release target. Detica applies Agile techniques through these time-boxed sprints to develop and test the most appropriate solution with the customer to develop an actual release candidate. It is important to note however that frequent system changes should be avoided as this impacts user familiarity and possibly training needs. Depending on customer-defined need, this process can in effect be a continuation of the agile delivery project, encompassing all aspects of development, deployment, on-boarding, and user training. Should a customer wish, we can offer Agile Application Support Services for an annual fixed price following agreement of the service scope. 2.5 Agile Project Management Services Where Detica is engaged to perform the solution delivery, Project Management is normally included in this service. The Project Manager is appointed at the outset of the engagement, and is usually a consistent point of contact through the delivery lifecycle. For large or portfolio projects, a Project Director may also be appointed to supplement this role. The Project Manager is not only responsible for delivery within the agreed customer budget, schedule, and quality (including adherence to Detica s ISO9001 Quality Management System through the application and tailoring of our Assurance Framework), but is also responsible for ensuring the collaborative nature of the relationship works, as defined during the Agile Delivery Strategy. This is particularly important for agile Agile Design & Delivery Services Page 9 of 15

developments, where a high degree of trust and transparency is essential to success in a contractual customer/supplier context. Our Project Managers understand that most IT projects involve more than just software development and will take and end-to-end view of the project in order to promote a successful outcomes considering aspects such as information assurance and business impact. Detica Project Managers use the BAE Systems Lifecycle Management (LCM) framework for Project Management. This incorporates industry good practice elements from PRINCE2, the Association of Project Management (APM) Book of Knowledge (BoK) and our own BAE Systems Engineering Lifecycle (ELC) methods. Additionally, Detica can offer client-side Project Management services to assist the customer in managing the deliveries of other suppliers. Agile Design & Delivery Services Page 10 of 15

3 Technical Requirements No specific services have been offered within these definitions for the provision of a technical environment that will enable the delivery of Agile solutions. These details and any additional costs will need to be defined on a case by case basis with each customer as the requirements for networking, tools, licencing, connectivity, infrastructure and facilities will vary for different projects. 4 Service Delivery 4.1 Service Management This will only apply to Agile Application Support Services listed in section 2.4. These are defined on a case by case basis depending on customers needs. 4.2 Service Constraints Not anticipated, however this will be subject to discussion with customers during the ordering process. 4.3 Service Levels These are defined on a case by case basis depending on customers needs. 4.4 Information Assurance All of our staff working for Government customers hold appropriate levels of security clearance. At a minimum this is SC and a significant number hold DV. We have extensive experience in scoping, designing, delivering and supporting systems at all Impact Levels from IL0 to IL6+. We are also highly experienced in gaining appropriate accreditation for such systems. At the heart of our capability is our team of CLAS consultants, one of the largest such pools of CLAS consultants in the UK. Our Information Assurance capabilities support both our internal requirements for appropriate security controls and those of our customers. 4.5 Backup/Restore & Disaster Recovery Not applicable. 4.6 Data Restoration / Service Migration Not applicable. 4.7 Trial Services Not applicable. 4.8 On/Off-boarding Not applicable. Agile Design & Delivery Services Page 11 of 15

4.9 Training Where appropriate, Detica can provide training in the developed solution for both end users and system administrators. Training delivery can include, but is not limited to: Training Needs Analysis (TNA) Training Delivery Planning User Guides Classroom training, including system-based exercises Train-the-trainer Computer Based Training (CBT) Instructional videos The user-facing aspects of the solution may also have comprehensive contextual on-line help. Agile Design & Delivery Services Page 12 of 15

5 Commercial Arrangements 5.1 Pricing 5.1.1 Please refer to the BAE Systems Detica Government Cloud Services SFIA Rate Card to develop pricing for the services offered in this Service Definition Document. 5.1.2 The fixed price for our Agile Delivery Strategy service for the scope set out in section 2.1 of this document is 19,950 exclusive of VAT, including expenses (within the M25) subject to our terms and conditions. 5.1.3 The work package above is priced based on our assumptions of scale and complexity for work of this type, and will be validated with you as part of the call-off process. 5.1.4 Price discounts may be available dependent upon volume and specific requirements. 5.1.5 Pricing is subject to contract and delivery in the UK geography (alternative pricing will apply for other geographies). 5.2 Agile Design & Delivery Services Terms and Conditions 5.2.1 The full terms and conditions for this service can be found in BAE Systems Detica Terms & Conditions v1.pdf. 5.3 Ordering and Invoicing Process 5.3.1 Please refer to the separate terms and conditions document for this service. 5.4 Customer Responsibilities 5.4.1 Please refer to the separate terms and conditions document for this service. 5.4.2 For Agile Development Strategy fixed price packages, specific customer responsibilities include: 5.4.2.1 Timely access to key documentation including e.g. business case, high level requirements, relevant information about existing ICT services. 5.4.2.2 Timely access to key stakeholders. 5.4.2.3 Building access and office accommodation for two consultants. 5.4.2.4 Timely review and feedback of documents produced. 5.5 Termination Terms 5.5.1 Please refer to the separate terms and conditions document for this service. 5.6 Financial Recompense Model for Not Meeting Service Levels Service levels and credits relating to a scoped deployment of our Agile Application Support Services can be agreed with the customer during commercial discussion. Agile Design & Delivery Services Page 13 of 15

6 Detica: Information Intelligence BAE Systems Detica is an information intelligence specialist. We help government and commercial organisations exploit information to deliver critical business services more effectively and economically. We also develop solutions to strengthen national security and resilience, enabling citizens to go about their lives freely and with confidence. By combining technical innovation and domain knowledge, we integrate and deliver world-class solutions often based on our own unique intellectual property to our customers most complex operational problems. We recognise the importance of Cloud services to the realisation of HMG s IT Strategy and have optimised many of our most compelling IT service offerings for Government on G-Cloud. Through these offerings we are at the forefront of realising the full benefits of Information Technology for our customers. Below is a summary of our G-Cloud services. G-Cloud Service Advisory Service Integration and Management (SIAM) Information Security Agile Design and Delivery Architecture Data Services Programme Management Digital Media Secure Mobility & Mobile Protection NetReveal OnDemand Service Description Providing Business and IT strategy and transformation advisory services, including requirements management, organisational change, and business case & benefits management. Covering all aspects of SIAM services, from target operating model design, to service integration, enterprise architecture and programme management. Cyber security assessments, architecture and testing services; Threat detection and protective monitoring services. Services delivered using the Agile method for design and development, including Secure-by-Design services. The design of end to end architecture solutions, including infrastructure, operations, applications and service, as well as enterprise architecture. Information management, data architecture design and monitoring, and training and end user development services for data management; Provision of data discovery and analysis/assessment services.. Provision of programme management and support experts to provide delivery and/or assurance of internal and external programmes. Digital transformation, media development, including user experience, social business and mobile media. From mobile strategy, through to development of your secure mobile proposition for your user base; Cloud based protection for your user base portfolio of mobile devices. Cloud based delivery of the global leader in counter fraud software. For more details on our services for G-Cloud, visit www.baesystemsdetica.com/g-cloud or send us an email at gcloud@baesystemsdetica.com. Detica is part of BAE Systems, the premier global defence, security and aerospace company. BAE Systems delivers a full range of products and services for air, land and naval forces, as well as advanced electronics, security, information technology solutions and customer support services. Agile Design & Delivery Services Page 14 of 15

Detica Limited is a BAE Systems company, trading as BAE Systems Detica. Detica Limited is registered in England (No.1337451) with its registered office at Surrey Research Park, Guildford, England, GU2 7YP. Copyright BAE Systems plc 2013. All Rights Reserved. BAE SYSTEMS, DETICA and the names of the BAE Systems Detica products referenced herein are trademarks of BAE Systems plc and are registered in certain jurisdictions. Agile Design & Delivery Services Page 15 of 15