Penetration Testing · UK public procurement notice

Web Application, Application Programming Interface (API), Infrastructure, Large Language Model (LLM), and Cloud Testing (including Microsoft 365 and Microsoft Azure environments)

The supplier shall conduct thorough and methodical penetration testing across Web Applications, Application Programming Interfaces, internal and external infrastructure, Large Language Model implementations, and cloud platforms (including Microsoft 365 and Microsoft Azure). This shall include both authenticated and unauthenticated testing, as well as internal and external perspectives, to ensure a comprehensive assessment of the organisation's attack surface.

Internal and external testing coverage

Testing shall encompass both external threat scenarios (simulating attacks from outside the organisation) and internal threat scenarios (simulating insider threats or compromised credentials), ensuring a holistic evaluation of security posture across all layers of the environment.

Vulnerability validation and re-testing

The supplier shall validate identified vulnerabilities through controlled exploitation techniques to confirm their existence and potential impact. Following remediation, the supplier shall perform re-testing activities to verify that vulnerabilities have been effectively addressed and that no residual risk remains.

Authorisation and non-disruptive testing

All testing activities must be formally authorised in advance and conducted in a controlled and non-disruptive manner, ensuring no adverse impact on live services, business operations, or data integrity. The supplier shall adhere to agreed rules of engagement, change control processes, and escalation procedures throughout the engagement. Additional information: This is a Call-off contract from GCA Framework RM3764.3 Cyber Security Services 3, Dynamic Purchasing System under PCR 2015.