DORS+ Managed Services and Hosting Procurement

UKROEd Ltd is a private, not-for-profit company responsible for the delivery, management and administration of the National Driver Offender Retraining Scheme (NDORS) on behalf of the Police service. It is the operating company of the Road Safety Trust and is committed to the education and training of drivers who commit low level traffic offences. NDORS training courses are delivered by course providers licensed by UKROEd (22 in total). Over 2 million people attend NDORS courses every year. The Scheme currently operates across England, Scotland, Wales and Northern Ireland. DORS+, a bespoke and Police Digital Services (PDS) assured system, is the national data and integration hub for the NDORS, connecting Police Forces, licensed course providers and members of the public who have been offered NDORS courses. It supports end-to-end processes from initial eligibility checks through to course booking, attendance recording and case closure, and provides UKROEd and its partners with the information needed to manage, govern and continually improve the scheme. UKROEd’s role as the governance lead for NDORS is enshrined in the Police, Crime, Sentencing and Courts Act 2022. UKROEd is responsible for NDORS course specifications, trainer and provider licensing, and for the collection and distribution of administration and enforcement cost recovery charges. The DORS+ system is central to this role, acting as the single online route for offenders to explore course availability, register their intent, book or reschedule courses, view their course attendance history and maintain their personal details (data is retained for 3.5 years from the date of the offence). The managed service partner will therefore be taking responsibility for a mission-critical platform with a high level of public, policing and provider dependency. The current managed services agreement for DORS+ ends on 31st May 2028 and UKROEd is tendering for a partner capable of operating, supporting and enhancing the service in line with future ambitions for NDORS and wider digital transformation. The supplier will be required to provide a managed service for the existing DORS+ solution and supporting Microsoft Azure environment, including platform and application support, maintenance and approved improvements. The priority is to ensure the availability, security, performance and ongoing operation of the current service, with innovation and improvements delivered through the appropriate UKROEd governance processes. Required capabilities are likely to include monitoring, incident and problem management, change and release management, backup and disaster recovery, and technical support for existing integrations. Suppliers should provide appropriately skilled resources with experience of supporting Microsoft Azure, Azure App Services, Azure Application Gateway and Web Application Firewall, Microsoft SQL Server, C#/.NET Web API applications, SOAP and REST APIs, web portals, Hangfire scheduling and associated integrations. Bidders will be expected to have experience of managing a PDS assured national system and providing a full end user support service to a range of stakeholders. At this stage, bidders should note that the Authority expects the DORS+ solution, all associated data, and any supporting hosting or managed service arrangements to be based within the United Kingdom. In addition, personnel requiring access to the service, systems, data, or operational environments are expected to hold, or be capable of obtaining and maintaining, Non-Police Personnel Vetting (NPPV) Level 3 clearance where required. Bidders should also demonstrate their ability to maintain appropriate security controls and ongoing compliance with relevant security, information assurance, and data protection requirements, together with a robust cyber security posture that protects the confidentiality, integrity, and availability of the service and its data throughout the contract term. This should include compliance with applicable legislation and standards, including UK GDPR, ISO 27001, Cyber Essentials plus (or equivalent), relevant police information assurance requirements, and alignment with National Cyber Security Centre (NCSC) guidance and hosting best practices for cloud-hosted services. Bidders will be required to provide effective security governance, vulnerability management, security monitoring, incident response, and continual security improvement throughout the lifetime of the contract.