Business Continuity Testing Exercise - RFI

The NHSBSA is a Special Health Authority and an Arm's Length Body of the Department of Health and Social Care. We provide a range of critical central services to NHS organisations (our 'clients'), NHS contractors, health bodies, patients and the public (our 'customers'). The NHSBSA requires a service to design, deliver, and facilitate an independent business continuity exercise to test incident response in a realistic, catastrophic scenario. The incident scenario should reflect the complexity and diversity of the NHS sector and be relevant to the threat landscape across the NHS i.e. a ransomware attack or a data integrity breach. It should ideally have a business wide impact, covering a range of the NHSBSA’s services and directorates. Prior to the design of the business continuity exercise, the Supplier will engage with the NHSBSA and be provided with information and/or documents as required to design an appropriate exercise. Delivery of the exercise should take place over half a day and be followed by a debrief session on the same day. Following this, two reports should be submitted by the Supplier; one high level and the other more detailed. Both reports should include, but not be limited to, key observations, analysis of strengths and weaknesses, and prioritised recommendations. Further details of the NHSBSA's requirements can be found within the Request for Information (RFI) documents within the supplier documents section of the individual opportunity. At this stage we are seeking high-level input to enable us to assess the market and to inform any future procurement strategy to ensure compliance with The Procurement Act 2023 and/or the Public Contracts Regulations 2015 as the case maybe. Interested parties must register an interest in this RFI via https://health-family.force.com/s/Welcome (search opportunities using system reference C483294). Suppliers can register from Wednesday 21st October 2026 and the RFI documents will be made available on Wednesday 21st O