Penetration Testing
The contract covers an independent penetration testing service for Senedd Cymru / Welsh Parliament, the legislative body and public-sector organisation responsible for the Senedd Commission’s technology estate. The supplier will plan, conduct and report controlled security assessments across Commission systems and services, potentially including external and internal infrastructure, web applications, remote access services, wireless technologies and physical locations, using white-, grey- or black-box testing as required. Testing must realistically reflect malicious-actor techniques while minimising disruption to operational services, validate the effectiveness of security controls, identify vulnerabilities and provide prioritised remediation recommendations to support ongoing cyber security improvement. The estimated contract value is £80,000, although the available information does not state the contract duration or delivery timeframe. Work will be delivered across the United Kingdom, including the Commission’s relevant technology systems and physical sites. The critical requirement is demonstrable capability to provide independent, controlled penetration testing and assurance over the resilience of the technology estate.
Buyer: Senedd Cymru / Welsh Parliament. Source: Find a Tender. Updated 21 Oct 2026.
Key facts
- Estimated value: £80k
- Bids close: 24 Nov 2026
- Location: Wales, Cardiff and Vale of Glamorgan
- Procedure: Below threshold - open competition
- Contract period: 11 Dec 2026 to 10 Dec 2030
- Category: IT services: consulting, software development, Internet and support (72000000)
From the official notice
The Senedd is looking to procure a penetration testing service to provide independent assurance over the security of its technology estate and to identify vulnerabilities that may expose the organisation to cyber security risk. The contract will include the planning, execution and reporting of penetration testing activities against Commission systems and services. Testing may include external infrastructure, internal infrastructure, web applications, remote access services, wireless technologies and physical locations as required. These tests may be performed in white, grey, or black box scenarios. The Senedd Commission is seeking to procure an independent penetration testing service capable of identifying vulnerabilities, validating the effectiveness of security controls and providing assurance over the resilience of the Commission's technology estate. The service should provide realistic security assessments that reflect the techniques and methodologies employed by malicious actors, whilst ensuring testing is undertaken in a controlled manner that minimises risk to operational services. The service should support the Commission's cyber security strategy by identifying weaknesses before they can be exploited, providing prioritised remediation recommendations and supporting continuous improvement of the organisation's overall security posture.
View the official notice
Questions about this tender
When is the deadline?
Bids close on 24 Nov 2026.
What is it worth?
The estimated value is £80k.
Who can apply?
The buyer has marked it as suitable for small and medium-sized businesses.
How do I bid?
Open the official notice, register on the buyer's portal and submit your bid before the deadline.
Similar tenders
Contains public sector information licensed under the Open Government Licence v3.0.
See all live tenders