UHB Infrastructure & Software Pen Testing - Market Engagement

University Hospitals Birmingham NHS Foundation Trust (UHB) is one of the largest teaching hospital Trusts in England and the West Midlands, serving a regional, national and international population. It includes Birmingham Heartlands Hospital, Birmingham Chest Clinic, Good Hope Hospital, the Queen Elizabeth Hospital Birmingham, Solihull Hospital and various Community Services. We also run a number of smaller satellite units, allowing people to be treated as close to home as possible.

As an NHS organisation, UHB will see and treat more than 2.2 million people every year across our sites UHB currently employs over 20,000 members of staff and we are committed to investing in their development and their health and wellbeing.

The Trust intends to engage a service provider for conducting a "call-off" contract penetration testing services on the Trusts infrastructure and systems (internal/external) to identify potential vulnerabilities and weaknesses that could be exploited by attackers. The primary objective of the penetration testing is to enhance the security posture of the Trusts infrastructure/systems and reduce the risk of cyber-attacks.

As stated above the penetration testing will be conducted on our internal/external infrastructure which is a requirement as part of the Data Security Protection Toolkit. Penetration testing on our in-house developed systems and or commercial solution will be required which may be internally used or externally facing.

As part of the on-going Cyber security programme and addressing the complex threat landscape facing the National Health Service (NHS), UHB wishes to enhance the capabilities of its Cyber Security.

The scope of work for the penetration testing service provider will include but not limited to the following: (See Briefing Note document)

Potential bidders are asked to note that the route to market has not yet been decided and therefore the procurement timetable has not been finalised. The Authority will make a final decision on the most appropriate route market following this engagement exercise. This may be a direct award via an existing public sector framework agreement or alternatively, the Authority may decide to run a competitive process via a mini-competition under a framework or an openly advertised procedure. If the latter, the publication of the ITT will include the publication of a Contract Notice, a Contracts Finder notice, and the ITT documents will be published on the Authority' Atamis e-tendering system.

Suppliers wishing to participate in this market engagement exercise and express an interest in this requirement should respond to the questionnaire via the online form on the Health Family Single eCommercial System Portal (Atamis) by 13:00 on Tuesday 25th April 2023.

https://health-family.force.com/s/Welcome