Page 1 of 22

Macmillan Cancer Support

Invitation to Tender for the evaluation of the Advanced Specialist Practitioner – Care Homes Project

Page 2 of 22

MACMILLAN CANCER SUPPORT WISHES TO INVITE PROPOSALS FOR THE QUALITATIVE EVALUATION OF THE ADVANCED SPECIALIST PRACTITIONER – CARE HOMES PROJECT WITHIN BARNSLEY.

1. The brief

Introduction

This tender is for a formative and summative evaluation of Macmillan’s Advanced Specialist Practitioner (ASP) role, an end of life care project in Barnsley.

The evaluation focus is on the development of whole-system working rather than the expected outcomes

of the individual role.

The aims of this evaluation are to increase our understanding of:

• the impacts of the ASP on high quality clinical and personalised holistic care and personalised choice in the last year of life

• what an appropriately skilled and integrated system working looks like

• the sustainability of personalised holistic care planning within the system.

Background and context

Macmillan Cancer Support is seeking a suitably qualified contractor to deliver a formative and summative evaluation of the Advanced Specialist Practitioner (ASP) role, which is being piloted for three years in Barnsley, South Yorkshire.

Macmillan Cancer Support is a team of supporters, volunteers, staff, campaigners, health and social care professionals and fundraisers. We are cancer experts, an independent voice for change and the name everyone thinks of first when cancer support issues are raised. But the most important things that bind us are our care and support for people living with cancer. With over 100 years’ experience of supporting people living with cancer, we have a huge amount of experience, knowledge and expertise. Supporting people living with cancer means we support people throughout the whole cancer journey, including the end. We have extensive experience in partnering to deliver Specialist Level Palliative Care (SLPC) services across the UK and have tested and evaluated the provision of SLPC in community settings. We have the authority and relationships to influence people at all levels, from individual campaigners to government ministers. Which means we can shape cancer and end of life care policy now and for the future.

Our evidence tells us that people, with and without cancer, at the end of their lives often have a less than optimal experience, and a poor experience at end of life can undermine years of good experience of care. We also know end of life care and support varies in quality across the UK and there is a need to improve quality so that it is equitable and consistent for all.

Our project

In recent years, Barnsley has experienced a dramatic increase in its elderly population and a subsequent increase in the number of elderly people living with cancer and with palliative care needs.

Along with an increase in the elderly population, Barnsley has seen a decline in the number of nursing homes and beds and appropriately skilled staff. This has led to an increasing reliance on residential care homes where the required skills needed to support palliative care for cancer patients is currently lacking. Moreover, almost a third of the residential care homes in Barnsley are rated by the Care Quality Commission (CQC) as ‘Requires Improvement’ or below. These are just a few of the reasons linked with increased A&E attendances for older adults from care homes in Barnsley, which is often significantly worse when compared to the rest of England and similar comparator locations. (For more information about this and other health inequalities in this population in Barnsley, see the CQC local authority area data profile: Older people's pathway for Barnsley Local Authority)

Due to competition for care home places, many people are not able to access suitable and affordable

Page 3 of 22

end of life care near to their previous place of residence and are forced to move. This move often results in patients having to change their GPs, making it difficult for primary care professionals to provide future planning for individuals in their preferred place of care. Service audits have shown this to be problematic as there can be a lack of clinical leadership in this scenario, resulting in an inappropriate hospital conveyance and/or admission, leading to poorer quality and less personalised care for those at end of life.

To address these issues, Macmillan funded a three-year pilot with the local Palliative Care and End of Life Service in Barnsley, part of the South West Yorkshire Partnership NHS Foundation Trust (SWYPFT). The pilot aims to provide enhanced care planning to care home residents in the last year of life through improved collaborative, enhanced care planning. This work will be facilitated by an Advanced Specialist Practitioner (ASP) who, working alongside the existing Clinical Nurse Specialists, will work approximately 50 residential care homes (targeting around 250 patients) within Barnsley. This support will be rolled out across six ‘neighbourhoods’ using a staggered approach across the three years. During the life span of this evaluation, four neighbourhoods will have received support from the ASP.

Working alongside both primary and secondary care colleagues, the ASP will utilise their advanced clinical assessment skills / palliative care knowledge to ensure a robust individualised care plan is in place for each patient. The long-term case management of these patients will be led by community nursing services, specialist palliative care or primary care as appropriate. This will ensure a proactive and meaningful care plan is developed and is led by the person’s needs and ensures liaison with all involved, avoiding unnecessary hospital admissions and safeguarding quality of care. The figure below further outlines how, over the next three years, we expect the ASP to support this aim by enhancing the provision of palliative care for residents of care home.

Page 4 of 22

Evaluation aims

The aims of this evaluation are to increase our understanding of:

• the impacts of the ASP on high quality clinical and personalised holistic care and personalised choice in the last year of life

• what an appropriately skilled and integrated system working looks like

• the sustainability of personalised holistic care planning within the system.

Key questions The impacts of the ASP on high quality clinical and personalised holistic care and personalised choice

• Has there been a decrease in the number of unplanned and avoidable emergency admissions to hospital?

• Have more patients been provided with appropriate care (and ultimately death) in their preferred place?

• What, if any, changes have there been to the way palliative care home residents are recognised and identified?

6. Support care home staff to effectively

manage palliative care patients within their

preferred place of care, avoiding unnecessary hospital admissions.

3. Devise and implement robust individualised care plans providing

emphasis on advanced care planning and

anticipatory medical care planning.

1. Build effective working relationships

and care pathways with primary care,

secondary care, care home staff and existing

community teams.

Enhance the provision of

palliative care for patients

within a care home setting

2. Pro-actively identify patients within care

home settings who are living with palliative care

needs.

7. Work co-operatively with all health and social

care professionals supporting recognition of

palliative care needs and the creation of care

pathways to support the transfer of care.

4. Use advanced clinical assessment skills /

palliative care knowledge to undertake responsive assessments to support

care home residents’ best interests and effective

decision making.

5. Provide and deliver education to care homes

through coaching and being a role model.

Review and challenge practice to support the maintenance of quality

palliative care.

Page 5 of 22

• What difference has this made to the number of care home residents being able to access enhanced quality palliative care, e.g. increased number of advanced care plans in place/followed?

• What evidence is there to suggest there has been an increase in best interest decision making and clear, good quality future holistic care planning taking place for palliative care home residents that has enabled a proactive rather than reactive approach?

• Is there evidence to suggest that palliative care home residents and their family have had their individual choices and preferences considered and that care was provided in their preferred place?

• Have care home resident and relative satisfaction levels changed in relation to the type of palliative care now being received?

Appropriately skilled and integrated system working

• What are the key elements and enablers of an integrated system, and to what extent has the ASP been able to influence this?

• Who are the key players and what are their roles within the system?

• What skills are needed within the system, particularly the care homes, to provide palliative care home residents with appropriate and timely care?

• How might input from the ASP supported learning and upskilling workers within the care home setting? (e.g. Do care home staff feel equipped with the appropriate skills to support patients living with cancer and palliative needs?)

Sustainability of personalised holistic care planning within the system

• Following the intervention of the ASP within a care home, how has the system continued to support palliative care residents in their preferred place of care? (e.g. what has been the sustainability of the enhanced care plan?)

Audience

It’s our hope that the learning we gain through this evaluation will support continuous improvement and innovation in the end of life sector, a key area of Macmillan’s current strategy. Findings from this evaluation will also be used by the project steering group to help build the business case for SWYPFT to adopt the role from December 2021 onwards. Key stakeholders interested in findings from this evaluation include:

• Macmillan Advanced Specialist Practitioner – Care Home Steering Group

• South West Yorkshire Partnership NHS Foundation Trust (SWYPFT)

• Barnsley CCG and wider stakeholders

• Macmillan Cancer Support, specifically the End of Life Care programme

• Primary Care Network

• Barnsley Healthcare Federation

Approach and methodology

For the most part we expect this evaluation to take a formative approach, capturing and sharing learning throughout the project to help us understand what works well, for whom, in what circumstances.

Key stakeholders which the evaluation might want to engage with though interviews or focus groups include:

• Care home centre management

• Advanced Specialist Practitioner

• SWYPFT Palliative Care / EoL Service staff members

• Primary care representatives

• Emergency services (Ambulance Service)

Page 6 of 22

• Community nursing service staff (Neighbourhood Nursing Service in Barnsley)

• Community Matrons

• Barnsley Hospital Foundation Trust Secondary Care

If helpful to answering evaluation question, SWYPFT can put in place mechanisms to gather data of patient and family experiences, including collating stories/case studies. These can be shared with evaluators on request.

There are also a few summative elements we’d like evaluators to consider, for example: impact on unplanned hospital admissions, changes to the number of palliative patients receiving enhanced care planning, etc.

Using EPaCCs, SWYPFT is collecting data on/supporting collection of:

• Preferred place of death

• Actual place of death – with reason for difference

• Existence and use of Advanced Care Plan

Lastly, SWYPFT is currently working with partners to understand the availability of data such as:

• Ambulance conveyance rates by care home

• Unplanned hospital admission.

We recognised the constraints caused by both time and resources to do this work for all care homes and are open to suggestions of how the evaluation might deliver against our key questions within these constraints. For this reason, we are suggesting that the external evaluator will work with analyst from SWYPFT to analyse and write-up of the above summative data, rather than conducting primary data collection on these elements.

Timescales and outputs

The ASP role will be in place between Jan 2019 and December 2021; however, we envision this evaluation will only run between September 2019 and August 2020, with a final report prepared in time to support decision making on continued funding of the ASP role.

We are open to suggestions as what the reporting might look like given the timescales and budgets available. However, as part of the final report, we’d like included:

• a short executive summary which can be shared as a standalone document

• analysis and findings from all elements of data collection, including analysis and write up of patient and staff experience data presented in a suitable format

• a one page visual of the palliative care system in the key players within Barnsley

Deliverables Date

Presentation to project steering group introducing

evaluation plan

Oct 2020

Interim working note – focused on the learning and

integration from the first two neighbourhoods

Early March 2020

Final report including learning from all two

neighbourhoods

July 2020

Discussion at project steering group August 2020

Management arrangements

The Macmillan manager for this work will be Sue Clarke, Macmillan Partnership Manager - South Yorkshire, with support from Mary Winter, Evidence Adviser – North. There will also be input and guidance from other key members of Macmillan.

Page 7 of 22

Resources available to support the evaluation

Resources that will be available for utility throughout the evaluation will include:

• the support of the Macmillan evaluation team member throughout the evaluation

• guidance and input from the evaluation steering group

• access to a wide range of expertise and resource from Macmillan’s departments.

Budget

The expected range for this evaluation is £12,000- £15,000 including VAT.

Please note that any methods that exceed this budget range should be presented as a separate costed option within your proposal, and include a clear rationale for the value that any additional work would bring.

We expect bidders to provide a detailed breakdown of costs on a day-rate/number of days by output format, including details of tasks allocated to each staff member. The process to decide which proposal to support will include discussion on proposed costs and value for money.

Payments will be made on successful completion of the stages of the work, and quality deliverables provided, which meet our Macmillan quality standards (Appendix 3).

2. The bidding process

Proposal requirements

Maximum length for proposals is 10 A4 pages. CVs can be included as an appendix, along with any additional company information you think is relevant (please limit this). The proposal should include the following:

• a succinct summary of the proposal

• details of the approach and methods to be used, including your rationale for choosing this approach and methodology

• your organisation’s experience of research/ evaluation, particularly within the Health and Social Care and Cancer sectors, and End of Life Care.

• details of the personnel to be involved including their role for this work and their previous experience (CVs to be included as an appendix)

• arrangements for managing this work and quality assuring processes, including how you would like to work with Macmillan and other stakeholders during the project

• a detailed budget, including a breakdown of time and costs per activity and per team member – the budget should also include expenses and specify if it includes VAT

• consideration of any ethical and other research governance risks

• details of how stakeholders will be involved in the planning, design, conduct and dissemination of the project.

Criteria for selection

The proposals will be reviewed against the following key criteria. Appropriateness of proposal, approach and methods

• A clear and well-presented proposal

• A strong appreciation of what the programme is looking to achieve and what we want to get from the evaluation while also offering flexibility in approach to accommodate programme evolution

• Adopting a method which is flexible, collaborative and provides value for money

• A commitment to proactively sharing learning and applying findings in practice

• An appreciation that it’s vulnerable adults who are taking up the services, so the evaluation should not be a burden but something that is useful for all

Page 8 of 22

A suitably qualified and experienced team

• Previous experience of research or evaluation with experience in evaluating similar projects

• Experienced in qualitative and quantitative data collection, analysis and synthesis

• Previous work in the health/ charity sector, Health and Social Care services, preferably with experience working in End of Life Care

• Experience of working collaboratively with stakeholders including senior stakeholders and frontline staff and helping them to collect data

• An appreciation and knowledge of the challenges and drivers to delivering integrated health and social care and the ability to work within differing contexts and systems

Selection process

We would appreciate if you would confirm by email your interesting in bidding by sending a completed expression of interest form (Appendix 1 of the ITT) to EvaluationClinic@macmillan.org.uk by the 2nd August 2019. We are happy to receive EOIs before this deadline and will endeavour to respond to confirm an invitation to bid within 3 working days. We will be conducting a two stage selection process:

• Stage one – reviewing bids and shortlisting of organisations for interview

• Stage two – interviews with potential suppliers for final selection

Activity Date

Close of Expression of Interest 5pm, Friday, 2nd August 2019

Close for all questions 5pm, Friday, 2nd August 2019

Submission deadline for proposals 5pm, Friday, 16th August 2019

Notification of shortlisted organisations to interview On Friday, 23rd August 2019

Interviews at Kendray Hospital, Barnsley 2nd Sept 2019 12.30-3.30 Kendray Hospital, Barnsley

Notification of successful bidder following interview By Friday, 6th September 2019

Inception meeting Late September/ Early October 2019

Submission details

Send an electronic version of your proposal, plus any appendices to: Mary Winter at EvaluationClinic@macmillan.org.uk All submissions should include a signed form of tender (Appendix 2). Please complete and return the attached form of tender (Appendix 2) as part of your submission, as well as completing our Third Party Security Assessment form (Appendix 4). Tenders will be accepted until 5pm on 16th August 2019.

Queries

We are happy to answer questions you may have relating to this ITT until 5pm on Friday, 2nd August 2019. Any queries should be sent to Mary Winter at EvaluationClinic@macmillan.org.uk. Please note, questions and responses will be shared with all bidders.

Page 9 of 22

3. Conditions of tendering All the documents and information supplied with this tender ("the tender documents") are private and confidential and remain the property of Macmillan Cancer Support and must be returned upon demand. Macmillan’s tender documents are personal to you as the individual or the organisation that is invited to submit a tender. You must not assign or pass them to any other person or legal entity (including subsidiary or associated companies) without our prior written consent. For your tender to be valid you must complete all the details requested in the Form of Tender:

• Where the tenderer is an individual, by that individual

• Where the tenderer is a partnership, by at least two duly authorised partners

• Where the tenderer is a company, within the meaning of the Companies Act, either by two directors or by a director and secretary of the company, such persons being duly authorised for that purpose

You must satisfy yourself, through your own efforts, of the accuracy of any information you rely on to complete your tender return. You must also satisfy yourself as to the accuracy and sufficiency of the prices and rates you tender. The information that we have supplied is given in good faith for you to use as general guidance in the preparation of your tender. You must satisfy yourself through your own investigations of the accuracy of this information. We shall not be held responsible or liable for the accuracy of any information you use. We cannot guarantee the total volume or value of goods and / or services that we will purchase from those organisations and individuals to whom we award a contract. If we need to make any changes and / or additions to any of the tender documents you will receive an e-mail to let you know this has happened. These changes and alterations will be deemed to form part of the tender documents. Macmillan expects each tender to be valid, for it to accept, for a period of at least 90 days from the return date. Macmillan does not bind itself to accept the lowest priced tender or any tender and it will not be liable for or pay any expenses or losses which you might incur in preparing your tender. The issue of tender documents to you is merely an invitation to treat and it does not amount to any form of offer for any purpose whatsoever. Macmillan is not contractually bound to consider any tender. Any acceptance of a tender by Macmillan will be by letter. No other method of acceptance shall be binding on us.

Page 10 of 22

Appendix 1

EVALUATION OF ADVANCED SPECIALIST PRACTITIONER

CARE HOMES PROJECT, BARNSLEY

July 2019

EXPRESSION OF INTEREST FORM

Project title Formative and summative evaluation of Macmillan’s Advanced Specialist Palliative Care Practitioner project in Barnsley

Agency/Organisation name

Agency/Organisation address

Contact name

Email address

Telephone number

Briefly indicate who you are proposing will carry out the evaluation and their relevant skills and experience (max 300 words).

Briefly indicate the relevant previous evaluations undertaken by proposed team members. Projects cited should include dates and contract value (max 300 words).

Page 11 of 22

Appendix 2

FORM OF TENDER

DECLARATION

We do hereby offer to enter into a contract with the Macmillan Cancer Support on the terms and conditions of the Invitation to Tender, subject only to Tenderer Qualifications as may be agreed by the Macmillan Cancer Support. We undertake to keep the tender open for acceptance by the Macmillan Cancer Support for a period of ninety (90) days from the return date. We declare that this is a bona fide tender, intended to be competitive, and that we have not fixed or adjusted the amount of the tender by, or under, or in accordance with, any agreement or arrangement with any other person. We further declare that we have not done, and we undertake that we will not do, any of the following acts prior to award of this Contract:

(a) Collude with any third party to fix the price of any number of tenders for this Contract;

(b) Offer, pay, or agree to pay any sum of money or consideration directly or indirectly to any

person for doing, having done, or promising to be done, any act or thing of the sort described herein and above.

We understand that you are not bound to accept the lowest price, or any, tender. Signed: Date: Name: in the capacity of: duly authorised to sign tenders for and on behalf of:

Page 12 of 22

Appendix 3

MACMILLAN QUALITY STANDARDS FOR EVALUATIONS

Theory of Change: Expectations of Development and Quality Table 1 outlines a rubric with basic quality standards the Evaluation team uses when reviewing six elements of the Theory of Change process; analysis, participation/facilitation with programme stakeholders, causality, assumptions and the output. In addition to the below, Macmillan encourages all bidders to refer to the Treasury’s Green Book, Magenta Book and Aqua Book which provide useful guidance based on best practice in the field. Table 1: Theory of Change Quality Standards Rubric

PRINCIPLES WEAK HAS

POTENTIAL REASONABLE ROBUST

Comprehensive analysis

Superficial, uncritical, business as usual

Some new thinking, with big gaps in critical thinking

Critical thought on most areas, unclear in some areas, mainly based on known strategies

Critical, clear, focused, considers wide range of perspectives, information and strategies

Participation/Facilitation

Very few people involved ad hoc in formulation or review

Intentional inclusion of some players in formulation or review

Clear process for diverse input planned with wide participation in some aspects but not fully realised

Clear process implemented with critical input from diverse relevant players

Evidence-based/contextualised locally

Little to no elements of the theory of change (narrative, causal pathways, assumptions) supported by contextual evidence

Sporadic contextual evidence of elements of the theory of change

Critical elements of the theory of change with contextual evidence

All possible elements of theory of change comprehensively and systematically outline evidence in local context

Causality No causal pathways made between individual components outlined in the theory

Some causal pathways between components made but not systematic or clear

Causal links of critical components of the theory of change have been made

Clear, comprehensive causal pathways for all components outlined in the theory of change

Page 13 of 22

Articulated assumptions

None except most basic/obvious

Some but not systematic, clear or critical

Fairly complete but not all well formulated

Clear, comprehensive, critical ones identified

Output: Map and Narrative

Incoherent theory of change map with no accompanying narrative

A clear Theory of Change map but with little to no narrative

A clear Theory of Change map with critical pathways explained using change statements in accompanying narrative

Clear, comprehensive Theory of Change map with all causal pathways explained with change statements in accompanying narrative

Monitoring, Evaluation and Learning Framework: Expectations of Development and Quality Table 2 outlines a Monitoring, Evaluation and Learning Framework template showing how the Evaluation team expects information included in a framework to be outlined. This does not represent the minimum information expected as part of a framework and should complement other information included as part of a framework. Table 2: MEL Framework Template

Key Evaluation Question

Sub Question

Indicator Target Data

Collection Method

Frequency Responsible

for Collection

Reporting

1.

2.

Table 3 provides a description of each framework element outlined with an expectation of standards of each element and example. Table 3: Monitoring, Evaluation and Learning (MEL) Framework Element Standards

Framework Element

Description Standard Example

Key Evaluation Question

Key evaluation questions (KEQs) are the high-level questions that an evaluation is designed to answer and which determine what data to collect, how to analyse it, and how to report it.

The KEQs should be ideally defined in scoping the evaluation and should be developed with as many relevant stakeholders as possible who have an interest in the evaluation output.

Does the Macmillan Physical Activity Behaviour Change Care Pathway improve health and wellbeing for people with cancer?

Sub question More specific questions which disaggregate a KEQ into constituent elements with clear reference to the variables whose measurement can help answer the KEQ – often between 1-5 evaluation sub-questions per KEQ.

These specific sub questions should be directly linked to the data collection tools.

Do people with cancer engage in more physical activity as a result of engaging with the programme?

Page 14 of 22

Indicator An outcome indicator provides a marker of whether a certain change has happened or whether certain conditions exist.

Each indicator should relate directly to one of the evaluation sub-questions – one or more indicator per sub-question. There should be a mix of quantitative and qualitative indicators, depending on the evaluation sub-questions and measures to which individual outcome indicators relate. An indicator should be; relevant and specific, consistent, credible, sensitive, unambiguous and feasible to collect.

Increase in time spent doing physical activity

Target A target provides a standard or benchmark from which to judge the performance of the change that has been made. This allows the changes that have taken place to be judged in a systematic and transparent way and enables those analysing the data to determine whether, and in what ways, it has been a success or a failure.

When setting a target, these should be realistic and timebound. This should be agreed by those responsible for the performance of the programme and with understanding of the programme’s capability and capacity. Targets should be informed using evidence-based benchmarks where possible.

5% increase in time spent doing physical activity from baseline

Data Collection Method

The data collection method is the mode/tool being used to gather the information required. Data collection methods can include a range of qualitative and quantitative methods such as; survey questionnaires, interviews, focus groups, observation, learning log, document review etc.

These methods should be selected based on how well they answer the key evaluation questions and with consideration of the programme resource available.

Survey Questionnaire (Scottish Physical Activity Questionnaire)

Frequency Frequency should show the number of times or intervals the data outlined in the framework is to be collected.

This should be determined based upon how well this answers the key evaluation questions and with consideration of the programme resource available but should happen at a minimum before and after the intervention.

Baseline, and at 3, 6, 12 months.

Responsible for Data Collection

The individual/s gathering the data required for the evaluation as outlined in the

The person/s responsible for collecting the data should clear stated and identifiable

John Smith, Jane Smyth – Physical Activity

Page 15 of 22

framework.

with their name and roles stated.

Coordinators

Reporting This shows when the data being collected is being used/shown in an output. This could include major evaluation outputs including interim and final reports as well as regular reports including monthly manager’s update.

The outlined report outputs should be able to be recognised by all individuals involved in the evaluation.

Quarterly Performance Report Final Report

Page 16 of 22

Appendix 4

Information Security Assessment of 3rd Party Supplier

Introduction

This document is to assess the security credentials of a 3rd party supplier (“Supplier”) before Macmillan enters into a data processor agreement. The document should be completed by Macmillan information asset owner, the Supplier and Macmillan Security manager. Macmillan may choose to audit the Supplier’s response to this document.

Macmillan Asset Owner - Macmillan to Complete This section should be completed by Macmillan information asset owner or delegate who plans to exchange information with a Supplier.

The name of Macmillan asset owner or delegate.

The asset owner’s Division or Function.

A description of the information that will be exchanged with the Supplier.

The classification given to the information. i.e. Restricted, Internal, Confidential or Public. (Should consider GDPR Sensitive Data)

The date when the information will be exchanged.

The period of time the information will exchanged.

Mention why this Supplier was selected.

Page 17 of 22

Supplier Details- Supplier to Complete This section should be completed by the Supplier.

The name and the role of the person completing this assessment.

The company name of the Supplier.

The service the Supplier intends to provide.

Contact details for the Supplier.

The date the Supplier completed this assessment.

Page 18 of 22

Supplier Security Assessment- Supplier to Complete

This section needs to be completed by the Supplier so that Macmillan is able gauge the Supplier’s security position. Where the Supplier does not have a security measure in place then a comment is required. If a measure is not applicable then just put in NA.

Item Security Measures Yes No Comments/Target Date

1 Compliance

1.1 Is the Supplier registered with the Information Commissioner’s Office under the Data Protection Act? If so provide registration number.

1.2 Is the Supplier accredited to the ISO 27001 Security standard?

1.3 Does the Supplier run yearly compulsory security awareness training to all staff including data protection and PCI DSS if applicable?

1.4 Will the Supplier or its sub-contractors host Macmillan information outside the EEA?

1.5 If the Supplier or it sub-contractors plan to take credit card payments on Macmillan’s behalf are they PCI compliant? To what level?

1.6 Does the Supplier have a responsible attitude to the Copyright, Designs and Patents Act (1988)?

1.7 Will the Supplier remove all Macmillan data from their systems once the engagement is completed? Please explain how.

2 Security Policy

2.1 Does the Supplier have an information security policy which has been communicated to all their staff? Please send a copy.

2.2 Does the Supplier review its security policy on yearly basis? Please state the date of the last review.

2.3 Does the Supplier have a high-level infrastructure diagram and process flows for the service being provided? Please provide

3 Organization and Information Security

3.1 Does the Supplier have someone appointed in the role of Security Manager? Are staff aware of their information security responsibilities?

Page 19 of 22

3.2 Does the Supplier use a 3rd party supplier to host their information processing facilities and have they verified that the 3rd party has adequate information security measures in place? Are Macmillan’s DP/ data security terms passed on to suppliers?

4 Asset Management

4.1 Does the Supplier clearly define information assets and assigned these to owners who are responsible for maintaining their protection?

4.2 Does the Supplier have an information classification system to ensure that information receives the appropriate level of protection?

5 Human Resource Security

5.1 Does the Supplier put employees, contractors and sub-contractors through strict pre-employment vetting, including reference and security checks?

5.2 Does the Supplier cover data protection and security in employment contracts?

5.3 Does the Supplier ensure that employees, contractors and third parties exit the Supplier or change employment in an orderly manner?

6 Physical and Environmental Security

6.1 Does the Supplier implement security measures to prevent the unauthorised access to their premises, as well as, secure areas within their offices?

6.2 Does the Supplier have measures to prevent the loss, damage or theft of equipment which may result in an interruption to the Supplier’s activities?

7 Communications and Operations Management

7.1 Does the Supplier follow a formal IT service management process such as the IT Infrastructure Library (ITIL) to run its IT operations?

7.2 Does the Supplier follow a formal change process to assess the impact of planned changes to its business?

7.3 Does the Supplier employ network controls such firewalls and intrusion detection systems to protect their systems?

Page 20 of 22

7.4 Does the Supplier employ anti-virus software to protect computers and network gateways?

7.5 Does the Supplier regularly patch computers on its estate to protect them against threats?

7.6 Does the Supplier ensure that they use legitimate and correctly licensed software?

7.7 Does the Supplier run a formal backup procedure to maintain the integrity and availability of their information processing facilities?

7.8 Does the Supplier employ tools to exchange information with 3rd parties in a secure manner?

7.9 Does the Supplier regularly perform Internet penetration tests on their network? How often? Please state when the last test was performed.

8 Access Control

8.1 Does the Supplier employ complex passwords for user accounts and require users to regularly change their passwords?

8.2 Does the Supplier ensure that users only have access to the information they are authorised?

8.3 Does the Supplier ensure that users cannot make unauthorized changes to computers or applications?

8.4 Does the Supplier have a process to ensure that when people leave the organization their access to systems is disabled or removed?

9 Information Systems Acquisitions, Development and Maintenance

9.1 When the Supplier collects information on our behalf over the Internet are cryptographic controls employed to protect the collection of this information?

9.2 Does the Supplier ensure that applications used to process Macmillan information do not introduce any errors or allow information to be misused, and the technology kept up to date?

Page 21 of 22

9.3 Does the Supplier develop their own web applications to collect and process Macmillan data and therefore make sure those applications are developed with information security in mind? eg. OWASP guidelines, ICO Privacy Impact Assessment guidance.

10 Information Security Incident Management

10.1 Does the Supplier have a defined process for managing information security incidents?

10.2 Does the Supplier intend to report any information security incidents impacting Macmillan information immediately to Macmillan? How?

11 Business Continuity Management

11.1 Does the Supplier have a business continuity plan to protect the business from major failures and to ensure timely resumption? Disaster recovery? High availability?

12 Cloud

12.1 Does the Supplier maintain an active inventory of all cloud service connections in its environment?

12.2 Are all cloud services connections tested and assessed?

12.3 Does the Supplier control and monitor the use of cloud services by its staff?

12.4 Are all cloud services connections secure?

Page 22 of 22

Macmillan Security Recommendation – Macmillan to Complete

This section is to be completed by Macmillan Security Manager once the sections above have been completed.

The name of the Security Manager

The details of the security recommendation.

The date the recommendation was completed.

Should we proceed with this Supplier?