ITHC, Penetration Testing and Associated Services Contract 2

Defra Group has an extremely diverse and complex IT estate which presents significant cyber security risks. Security testing is a pre-requisite to internal approval for projects and programmes within the organisation. Defra Group is looking to award the ITHC, Penetration Testing and Associated Services Contract (2) to three CHECK qualified, Security Cleared (SC) suppliers that can offer security testing and exercising services for new, operational and legacy systems within Defra Group. Services include ITHCs, Penetration Testing and Red/Blue and Purple Teaming. Testers are required to produce CHECK certified reports and communicate any vulnerabilities to the project and risk owner for mitigations/fixes.

Defra is looking to contract for a three-year term, with an optional twelve-month extension (3+1). The total value of the contract is estimated to be £4.5m but actual spend depends on the number of Security Tests required by the organisation which will be issued to Suppliers via Work Orders. Work Orders will be issued by individual business units across Core Defra and its arm’s length bodies that are in-scope of this agreement (Natural England, Rural Payments Agency, Marine Management Organisation and the Environment Agency). Defra proposes to issue Work Orders to Suppliers on rotation, through a taxi system to ensure an even distribution of orders where possible.

The Crown Commercial Services’ Cyber Security Services 3 DPS is the chosen route to market for this opportunity, using a 2-stage process. 1. Suppliers on the DPS who meet the Authority’s mandatory requirements will be longlisted and invited to submit a Capability Assessment (Stage 1). 2. Suppliers that answer ‘yes’ to all questions in the Capability Assessment, will pre-qualify for this opportunity and be shortlisted to bid. Shortlisted suppliers will be invited to submit a tender response (Stage 2).

Timelines: Please note that these are not guaranteed and could be subject to change. 23/10/2024 – A Capability Assessment will be shared with Suppliers longlisted on the DPS. A market briefing pack will also be shared to provide suppliers with further information about this opportunity. 05/11/2024 – Deadline for return of completed Capability Assessment 18/11/2024 – Publication of ITT 22/11/2024 – Tender Clarification Deadline 28/11/2024 – Responses to clarification questions 11/12/2024 – Tender Submission Deadline 22/01/2025 – Evaluation deadline 28/01/2025 – Contract Award 07/02/2025 – 10-day optional standstill period ends 07/03/2025 – Expected contract Start Date