Penetration Testing Tenders and Contracts

Penetration testing procurement covers network, application and cloud testing, red teaming and ethical hacking, and IT Health Checks (ITHCs), the public sector name for an annual scope-defined test often needed for Public Services Network compliance. Buyers often ask for testers accredited under the NCSC CHECK scheme, and testing also comes up inside wider cyber assurance and Cyber Essentials work.

Stotles brings together penetration testing tenders and contracts from 100+ portals into one search, so you do not have to check each portal separately, and you can set alerts for new opportunities across the UK and Ireland.

If you want to search the government portals directly, Find a Tender carries higher-value contracts across the UK and Contracts Finder carries lower-value contracts in England. Public Contracts Scotland, Sell2Wales and eTendersNI cover Scotland, Wales and Northern Ireland, Ireland's eTenders covers Irish public bodies, and many councils, NHS bodies and housing associations publish on their own e-tendering portals such as ProContract. Penetration testing mostly runs as call-offs from Crown Commercial Service cyber security frameworks, the Cyber Security Services dynamic purchasing system and G-Cloud.

Penetration testing tenders are scored on accreditation, tester qualifications, methodology, reporting quality and day rates. Testing recurs every year, so a strong first engagement often leads to repeat work.

Buyers often require NCSC CHECK or CREST accredited testers, and testers working on government systems may need security clearance. Tenders usually set minimum insurance cover, check financial standing and ask for evidence of similar contracts at selection stage. Under the Procurement Act 2023, suppliers can be excluded for certain criminal convictions, insolvency or failure to pay tax.

Penetration testing buying mostly runs as call-offs from CCS cyber security frameworks and G-Cloud, or from multi-supplier frameworks that buyers set up themselves. Councils, police and fire services, NHS bodies, central government departments and regulators all commission penetration testing.

In practice, yes. An IT Health Check, written ITHC, is the UK public sector name for a scope-defined penetration test run once a year, usually to keep a Public Services Network connection or to meet the NHS Data Security and Protection Toolkit. Buyers ask for testers accredited under the NCSC CHECK scheme. Notice titles use the two terms interchangeably, so searching for one and not the other misses a large part of the market.

Accreditation first. Many notices restrict bidders to NCSC CHECK or equivalent accredited testers, and a lot of the work is called off a cyber security framework or a dynamic purchasing system rather than run as an open competition. Then read the scope, because an external infrastructure and web application test is a different job from a full estate review or a red team exercise. Recent awards are the quickest way to see how buyers word the requirement.

Read digital and technology strategies, licence and contract renewal dates, architecture reviews and early market engagement notices, which show penetration testing work coming due ahead of a notice. On Stotles you can track those signals and the buyers behind them, then follow a notice from pre-tender through to award.

Penetration testing notices carry 72800000 (Computer audit and testing services) and 72254100 (Systems testing services). Plenty of notices are filed under the much broader parent IT services heading instead, and some carry no code at all.