Integrated Data Platform Security, Governance and Assurance Review

⁠⁠⁠Overview

The Digital Transformation Agency (DTA) is seeking a supplier with demonstrated expertise in IRAP-aligned security reviews, Microsoft Fabric, Dynamics 365, Microsoft Power Platform, Azure, Microsoft Purview, identity and access management, cloud governance and security architecture to undertake an independent assurance review of the Integrated Data Platform (IDP).

This engagement will focus on assessing the security, governance and operational maturity of the IDP ecosystem, including Microsoft Fabric, Dynamics 365, Power Pages, Azure services and supporting data management capabilities. The review will identify configuration drift, control gaps and operational risks, provide assurance against established security and architectural baselines, and recommend measures to strengthen compliance, resilience and ongoing governance.

The DTA will retain ownership and control of all hosting environments, infrastructure, platforms and licensing throughout the engagement.

Scope

The scope includes:

• An independent assessment of the IDP security, governance and operational maturity
• A configuration drift and security findings register, including evidence, risk ratings and recommended remediation actions
• A security assurance report outlining key findings, control impacts and areas for improvement
• Recommendations for enabling emerging AI capabilities, including Copilot and Fabric Data Agents, within the existing accredited environment while maintaining appropriate security and governance controls
• A prioritised remediation roadmap and executive briefing pack to support future investment and governance decisions

Contractor Requirements

• Demonstrated expertise in IRAP-aligned security reviews
• Demonstrated expertise in Microsoft Fabric, Dynamics 365, Microsoft Power Platform, Azure and Microsoft Purview
• Demonstrated expertise in identity and access management, cloud governance and security architecture
• All personnel engaged under this arrangement must hold, at a minimum, a Baseline Security Clearance