SprosRadar
Find tenders
SprosRadar
Find tenders
Find a Tender · 104717-2026

Penetration Testing

This notice is no longer open for submissions. The original remains available for reference.

Status
Awarded
Estimated value
Value not published
Submission deadline
Deadline not published
Published
Nov 4, 2026
Buyer
Planning Inspectorate
Country
United Kingdom
CPV code
72820000
Source
Find a Tender
Open official notice

Checked:

The original notice takes precedence. Its status and conditions can change after collection.

Description

The Planning Inspectorate is seeking proposals from qualified and experienced suppliers for the provision of penetration testing services. As a Public Sector organisation, we recognise the importance of safeguarding our information assets, protecting our infrastructure, and ensuring the confidentiality, integrity, and availability of our systems and data.
In response to the evolving cyber threat landscape and the need to maintain robust security assurance, the Planning Inspectorate's requires the delivery of penetration testing services to proactively identify vulnerabilities, assess the effectiveness of existing security controls, improve resilience across services, and mitigate risks posed by potential cyber threats.
Through the identification and remediation of vulnerabilities, the services will assist in reducing the likelihood of a costly data breach or disruption to business operations, and in turn enable the appropriate identification, assessment, and management of cyber risk across the organisation.
This requirement is also informed by applicable security and regulatory expectations, including alignment with recognised government guidance and assurance schemes for penetration testing, ensuring that Planning Inspectorate continues to meet expected standards for secure system operation and risk management.

Lots

  1. 1

    Web Application, Application Programming Interface (API), Infrastructure, Large Language Model (LLM), and Cloud Testing (including Microsoft 365 and Microsoft Azure environments)
    The supplier shall conduct thorough and methodical penetration testing across Web Applications, Application Programming Interfaces, internal and external infrastructure, Large Language Model implementations, and cloud platforms (including Microsoft 365 and Microsoft Azure). This shall include both authenticated and unauthenticated testing, as well as internal and external perspectives, to ensure a comprehensive assessment of the organisation's attack surface.
    Internal and external testing coverage
    Testing shall encompass both external threat scenarios (simulating attacks from outside the organisation) and internal threat scenarios (simulating insider threats or compromised credentials), ensuring a holistic evaluation of security posture across all layers of the environment.
    Vulnerability validation and re-testing
    The supplier shall validate identified vulnerabilities through controlled exploitation techniques to confirm their existence and potential impact. Following remediation, the supplier shall perform re-testing activities to verify that vulnerabilities have been effectively addressed and that no residual risk remains.
    Authorisation and non-disruptive testing
    All testing activities must be formally authorised in advance and conducted in a controlled and non-disruptive manner, ensuring no adverse impact on live services, business operations, or data integrity. The supplier shall adhere to agreed rules of engagement, change control processes, and escalation procedures throughout the engagement. Additional information: This is a Call-off contract from GCA Framework RM3764.3 Cyber Security Services 3, Dynamic Purchasing System under PCR 2015.

Public business contacts

procurement@planninginspectorate.gov.uk

www.gov.uk

Checked:

Related notices