Tender: SSRO Security Assessment and Penetration Testing Services – Annual Phased Programme (Jul–Oct 2026)

About

The SSRO is seeking a supplier for a core annual programme of Security Assessment and Penetration Test services to carry out testing, liaise on remediation and perform retesting as set out in the Service Specification. The requirement is delivered in three phases each year: Phase 1 – Security Assessment and Penetration Testing and reporting the results (one combined report or separate documents at Supplier discretion); Phase 2 – liaising with the SSRO and the SSRO's IT Managed Service partner while they resolve all critical vulnerabilities and up to five additional non-critical vulnerabilities per assessment; and Phase 3 – retesting on all "critical" vulnerabilities and the additional vulnerabilities per assessment (external, MS cloud, web application) following completion of remedial work by the SSRO's IT Managed Service partner. For the first contract year, Phase 1 is to be carried out between 6 July and 17 July with final report(s) received by the SSRO no later than 17 July 2026; Phase 2 is expected to be completed by 25 September 2026; and Phase 3 is expected to be completed by 16 October 2026.