Security Assessment and Penetration Testing Services

The SSRO is seeking a supplier to deliver annual security assessment and penetration testing services across a multi-phase programme. The work comprises three phases: Phase 1 involves conducting comprehensive security assessments and penetration tests with results delivered by 17 July 2026; Phase 2 includes liaison and support with the SSRO and their IT Managed Service partner to resolve critical vulnerabilities and up to five additional non-critical vulnerabilities by 25 September 2026; Phase 3 involves retesting all remediated critical and selected non-critical vulnerabilities across external, Microsoft cloud, and web application environments by 16 October 2026. The supplier must complete this core programme annually throughout the contract term. Testing will be conducted between 6-17 July in the first contract year, with detailed reporting and vulnerability remediation support required.