Official UK procurement notice
Cyber Security Assurance Services Framework
Authority: The City of Edinburgh Council (Local council)
What is being bought6 lots · detail below
Published requirement descriptionThe City of Edinburgh Council is awarding a robust Framework for the procurement of secure digital services. It aims to enhance the Councils ability to assess and select IT service providers that meet stringent security requirements, ensuring the delivery of secure and reliable digital services.
CPV: IT services: consulting, software development, Internet and support
How this framework works
From the published notice- Places
- up to 6 suppliers · 4 bids on the busiest of 6 lots (0.7 per place) · 4 appointed
Lots and requirements (6)Procurement structure
6 lots · all with a published value · evaluation weights differ by lotEvery one of these 5 lots carries the same published figure, £15,000: it is the framework's maximum for the whole notice, not each lot's own budget, and no share per lot is published. The cards below say ceiling above rather than repeat it.
Lot #1Essential Services: Penetration Testing, Security Assurance & Reporting, Advice & ConsultationAwardedRenewalPublished value£675,000
The City of Edinburgh Council intends to establish a Framework Agreement that will provide the Council with a range of ICT information and system security assessments.
These include:
- Penetration testing and vulnerability assessments against industry standards at application, component, and full stack levels, and
- Security assurance and reporting of proposed new technologies and services.
Suppliers must also provide:
- Advice and consultation on proposed and existing cloud developments,
- Advice and consultation on proposed and existing cloud infrastructure configurations, and
- Advice and consultation on cloud technologies to support ongoing management of our cloud operations.
Lot #2Incident Response, Digital Forensics, Data Breach Assessment & RecoveryAwardedRenewalceiling above
The City of Edinburgh Council intends to establish a Framework Agreement that will provide the Council with a range of ICT information and system security assessments.
These include:
- Incident Response,
- Digital Forensics,
- Data Breach Assessment and Recovery.
Lot #3Security Audit – PCI, Security Architecture/Design Review, Compliance & Regulatory Services.AwardedRenewalceiling above
The City of Edinburgh Council intends to establish a Framework Agreement that will provide the Council with a range of ICT information and system security assessments.
These include:
- Security Audit – PCI,
- Security Architecture/Design Review,
- Compliance and Regulatory Services.
Lot #4Threat IntelligenceAwardedRenewalceiling above
The City of Edinburgh Council intends to establish a Framework Agreement that will provide the Council with a range of ICT information and system security assessments.
These include:
- Threat Intelligence
Lot #5Vulnerability AssessmentsAwardedRenewalceiling above
The City of Edinburgh Council intends to establish a Framework Agreement that will provide the Council with a range of ICT information and system security assessments.
These include:
- Vulnerability Assessments
Lot #6Data & Hardware SanitisationAwardedRenewalceiling above
The City of Edinburgh Council intends to establish a Framework Agreement that will provide the Council with a range of ICT information and system security assessments.
These include:
- Data and Hardware Sanitisation
What it takes to wini
How this buyer will score bids.
The evaluation criteria and weights exactly as published on the notice, grouped by family (price, quality, social value and so on).
Evaluation split and conditions of participation as published; the tender pack may add morei
How this buyer will score bids.
The evaluation criteria and weights exactly as published on the notice, grouped by family (price, quality, social value and so on).
Lots publish different evaluation splits; there is no single procedure weighting.
- Suitability
Suppliers are required to comply with the following qualification and accreditation requirements:
- CREST or CHECK accredited, evidence of accreditation will be required.
- Assessments carried out by your organisation are conducted by appropriately qualified individuals, for example (CISSP, CISM, CEH, CCSP, OSCP, CCT INF) or equivalent.
- Accredited Microsoft, AWS Partner or equivalent.
- Economic & financial standing
Tenderers are required to have a minimum “general” annual turnover as detailed below for the last two financial years. Where a Tenderer does not have an annual turnover of this value, the Council may exclude the Tenderer from the competition or may apply discretion, seeking supporting evidence to determine the Tenderer’s suitability to proceed in the competition.
The formula for calculating a Tenderer’s current ratio is current assets divided by current liabilities. The acceptable range for each financial ratio is greater than the ratio as detailed below. Where a Tenderer’s current ratio is less than the acceptable value, the Council may exclude the Tenderer from the competition or may apply discretion, seeking supporting evidence to determine the Tenderer’s suitability to proceed in the competition.
Minimum: Estimated Value pa Minimum “General” Annual Turnover Ratio Cyber Assurance Framework 250,000 GBP 1.10 It is a mandatory requirement that service providers appointed to this Framework Agreement have the following insurance in place: - Professional Indemnity Insurance (minimum of 5…
- Price carries 50 points on every lot: a 10% discount moves about 5 points.
- “Cyber Security Assurance Services Framework” is a framework: the contest is a place on its panel, up to 6 suppliers, not a single contract.
Price arithmetic assumes straight proportional scoring; the tender pack may use another formula.
Procedure terms & legal framework
From the official record · publisher note attached- Procedure method
- Restricted procedure
- Legal basis
- CELEX · 32014L0024 Public Contracts Regulations 2015 (Directive 2014/24/EU)
- Procurement category
- Services
- Notice status
- Awarded
- Procurement threshold
- Unspecified in notice
- Regulatory regime
- Standard
- Commercial structure
- Framework agreement
- Who may use this agreement
- Not stated in the notice; call-off rights may be limited to the establishing authority
- Competition type
- Competitive procedure
- GPA / WTO covered
- Yes (GPA)
- Recurring procurement
- No (one-off requirement)
- First published
- 2 Jul 2024, 08:47 BST
- Last source update
- 6 Aug 2025, 15:29 BST
- Authority reference
CT1218- FTS notice number
2025/S 000-046608- Classification (CPV)
- Delivery area
- Official registry OCID
ocds-h6vhtk-0478f3Find a Tender
- Review procedure
An economic operator that suffers or risks suffering loss or damage attributable to a breach of duty under Public Contracts (Scotland) Regulations 2015 may bring proceedings in the Sheriff Court or Court of Session. A claim for an ineffectiveness order must be made within 30 days of the Contract Award Notice being published in the Find a Tender Service within 30 days of the date those who expressed an interest in or otherwise bid for the contract were informed of the conclusion of the contract or in any other case within 6 months from the date on which the contract was entered into.
Publisher note: Contained in tender documentation (SC Ref:806607)
How it was run
Official notice- Appointment period ends
- 31 Jul 2024, 12:00 BST
- Submission channel
- {"electronicSubmission"}
- Accepted languages
- en
- Bid validity
- 180 days from the deadline
Timeline
31 Jul 2024 → 6 Aug 2025 · 3 dates- Admission / appointment period endsperiod end, not a bid countdown31 Jul 2024, 12:00 BST
- Invitations to tender expected2 Sept 2024, 00:00 BST
- Notice published6 Aug 2025, 15:29 BST
Notice history
1 event · 2 releases on Find a Tender- Status changed to complete6 Aug 2025, 15:29 BST
Commercial outcome & contract awards
Published awards, contracts and bid statistics, not a forecast6 suppliers are admitted to this framework without individual award values or dates, see the supplier list below.
Contracts
All 6 of these contracts carry the same published figure, £750,000, the framework's maximum for the whole notice, not each contract's own value. They are not eleven separate sums.
Essential Services: Penetration Testing, Security Assurance & Reporting, Advice & Consultation
- Signed
- 6 Aug 2025
- Value
- ceiling above
- Status
- active
Security Audit – PCI, Security Architecture/Design Review, Compliance & Regulatory Services.
- Signed
- 6 Aug 2025
- Value
- ceiling above
- Status
- active
Threat Intelligence
- Signed
- 6 Aug 2025
- Value
- ceiling above
- Status
- active
Vulnerability Assessments
- Signed
- 6 Aug 2025
- Value
- ceiling above
- Status
- active
Data & Hardware Sanitisation
- Signed
- 6 Aug 2025
- Value
- ceiling above
- Status
- active
Incident Response, Digital Forensics, Data Breach Assessment & Recovery
- Signed
- 6 Aug 2025
- Value
- ceiling above
- Status
- active
Bid statistics published by the authority
| Lot | Bids | SME | VCSE | Valid bid range |
|---|---|---|---|---|
| 1 · Essential Services: Penetration Testing, Security Assurance & Reporting, Advice & Consultation | 4bids · 4 electronic · 4 from abroad | 4 | — | — |
| 2 · Incident Response, Digital Forensics, Data Breach Assessment & Recovery | 3bids · 3 electronic · 3 from abroad | 3 | — | — |
| 3 · Security Audit – PCI, Security Architecture/Design Review, Compliance & Regulatory Services. | 4bids · 4 electronic · 4 from abroad | 4 | — | — |
| 4 · Threat Intelligence | 4bids · 4 electronic · 4 from abroad | 4 | — | — |
| 5 · Vulnerability Assessments | 4bids · 4 electronic · 4 from abroad | 4 | — | — |
| 6 · Data & Hardware Sanitisation | 4bids · 4 electronic · 4 from abroad | 4 | — | — |
Contracting authority & participating public bodies
Dispute resolution & review bodies
- Sheriff CourtReview body
Framework contractors & participating bidders
4 commercial parties on the notice- Entserv UK LtdFramework contractor
- NCC Group Security Services LimitedFramework contractor
- Redcentric Solutions LimitedFramework contractor
- Trustmarque Solutions LtdFramework contractor
Official documents & specifications (1)
Official links; attachments are not copiedTender pack and attachments
- Technical selection criteria