BM03 — Version Control SOP

Bid: NHS SBS SBS10523 (Ariba RFx 1110014540) Effective: 15 Jun 2026 | Owner: Bid Manager | Mandatory for all contributors

A 3-week bid lives or dies on version discipline. This SOP is non-negotiable from G0 onward. Breaches at G2 or later are an escalation to the CEO.

1. Single Source of Truth

The only authoritative location for bid material is:

/Users/<bidteam>/.../NHS 2026/NHS_SBS_Bid/

mirrored nightly at 23:00 BST to:

/backup/NHS_SBS_Bid_<YYYY-MM-DD>.zip   (encrypted, AES-256, 30-day retention)

No bid material lives anywhere else. Not in personal Drives, not in email attachments, not on local desktops. If a contributor needs to work offline, they branch a copy with _LOCAL_<initials> suffix and reconcile within 24h.

2. Folder Layout (frozen at G0)

NHS_SBS_Bid/
├── 00_Tracker/                 submission_tracker.md (live)
├── 01_Strategic_Plan.md
├── 02_Execution_Plan_RAID.md
├── 03_Proposal_Narrative_Draft.md
├── 04_Team_Briefing_Deck.md
├── 09_BritiAI_ITT_Mapping.md
├── deliverables/
│   ├── 01_BidMgr/              this folder (BM01–BM05)
│   ├── 02_BidWriter/           narratives by lot
│   ├── 03_CSO/                 clinical safety
│   ├── 04_CEPlus/              Cyber Essentials Plus
│   ├── 05_ISO27001/            ISO evidence
│   ├── 07_RedTeam/             review pack
│   └── 09_TrustOutreach/       reference & support letters
├── evidence/                   all attachments (see BM04)
├── ariba_submission/           final PDFs and uploads (frozen at G4)
└── archive/                    superseded versions, never deleted

After G0, no new top-level folders without BM approval.

3. File Naming Convention

<area>_<artefact-shortname>_<STATE>_v<MAJOR>.<MINOR>.<ext>

Examples:

BM01_BidMgmtPlan_DRAFT_v0.3.md
L6_Q1_OperEfficiency_REVIEW_v1.2.md
L7_RateCard_APPROVED_v2.0.xlsx
Evidence_InsurancePI_APPROVED_v1.0.pdf

Rules:

Lowercase only for extensions; everything else as shown.
No spaces. Underscores for word breaks. Hyphens inside short-names.
No personal initials in filenames (they go in the change log).
MAJOR increments on state promotion or material content change. MINOR increments on edits within a state.
v0.x = pre-review. v1.x = in review. v2.x = approved. v3.x = submitted.

4. File States

State	Meaning	Who can edit	Who promotes
DRAFT	Initial authoring	Named owner only	Owner → REVIEW
REVIEW	In review by named reviewer(s)	Owner + reviewer (tracked changes)	Reviewer → APPROVED via BM
APPROVED	Signed off by approver in §2 of BM01	BM only (typos / format)	BM → SUBMITTED at G5
SUBMITTED	Filed in Ariba; immutable	Nobody	—

Pre-G2 (29 Jun): Owners may move DRAFT ↔ REVIEW freely. Post-G2: Only the BM moves state. Owners propose; BM disposes. Post-G4 (2 Jul): Only typo-level edits in APPROVED state, with CEO co-sign in change log.

5. Change Log Discipline

Every file has a change log at the bottom. Every state change or material edit gets a line:

| Date       | Time  | Who | From → To             | Change summary                          |
|------------|-------|-----|-----------------------|-----------------------------------------|
| 2026-06-20 | 11:42 | DT  | DRAFT v0.2 → DRAFT v0.3 | Added DCB0129 paragraph; word count 1,420 |
| 2026-06-25 | 15:10 | JC  | DRAFT v0.3 → REVIEW v1.0 | Sent to CTO for technical review        |
| 2026-06-28 | 09:30 | BM  | REVIEW v1.2 → APPROVED v2.0 | CTO sign-off recorded                |

No change log entry = the change didn’t happen. BM audits at every standup.

6. Who Can Edit What

Artefact class	Primary editor	Reviewer(s)	Approver
Strategy & plans (01, 02, BM01–BM05)	BM	CEO	CEO
Quality narratives (per lot)	Bid Writer	Technical Lead, BM	CEO at G4
Technical / architecture	CTO	BM	CEO
Clinical safety pack	CSO	CTO, CEO	CEO countersigns
IG / DSPT / DPIA	CTO (DPO)	Legal	CEO
Commercial / pricing	CFO	CEO	CEO
Subcontractor MoUs	BM	Legal	CEO + counterparty
Social value	Bid Writer	BM	CEO
Evidence attachments	BM (curates)	Owner of underlying doc	BM at G3

Anyone editing outside their lane without BM approval gets reverted. No drama, just reverted.

7. Concurrent Edit Protocol

Markdown files are edited in plain text via the agreed editor. Only one person edits a file at a time. Coordination is via the standup or a quick Slack [EDIT-LOCK] <file> post. Locks auto-expire after 4 hours; the BM clears stale locks at end of day.

Office files (xlsx, docx) follow the same lock protocol — no co-editing during the bid run. Co-editing creates conflicting authoritative copies; we avoid it.

8. Daily Backup Protocol

Time	Action	Owner
09:30	Standup confirms previous day’s backup integrity	BM
17:00	BM commits day’s work to backup zip (`NHS_SBS_Bid_<YYYY-MM-DD>.zip`)	BM
23:00	Automated mirror to encrypted backup location	Cron / CTO
Weekly (Fri 18:00)	Off-site copy to second physical location	BM

Backups retain 30 days. From G3 onward, backups are hourly during working hours.

9. Ariba Drafts

Ariba allows in-portal drafting. We do not rely on it as a source of truth. Workflow:

Author the answer in markdown locally to its APPROVED state.
Paste into Ariba.
Save in Ariba and export a PDF snapshot to /ariba_submission/snapshots/<YYYY-MM-DD-HHMM>/.
Three snapshots minimum: post-paste, pre-submit (G5-2h), post-submit (G5).

10. Submitted State

Once the BM clicks Submit in Ariba at G5:

All APPROVED files are copied to /ariba_submission/final/ and renamed to SUBMITTED_vN.0.
The directory is set read-only.
A submission manifest (BM05 §7) is generated and signed by BM + CEO.
The archive copy goes to /archive/SUBMITTED_<YYYY-MM-DD>/.

After submission, the only legitimate edits are clarification responses requested by NHS SBS, which start a new clarification log.

11. Enforcement and Violations

First violation (missing change log, wrong filename): BM corrects, private nudge to owner.
Second violation by same owner: raised at standup, owner reads this SOP aloud (mostly to make the point stick).
Third violation or any violation post-G3: CEO escalation.
Any violation that risks the submission integrity (overwrite of APPROVED file, missing backup, lost evidence): immediate CEO escalation regardless of count.

12. Acceptance

Every named owner in BM01 §2 confirms they have read this SOP by Tue 16 Jun, end of day. Confirmation is logged in the standup notes.

BritiAI · NHS SBS Bid Vault

Explorer

NHS SBS Bid Vault SBS10523 · Healthcare AI Solutions

43 Version Control SOP