Tender

Ask AI about this notice

Summarise, research or assess it with AI

View Markdown

Share this notice

Send this contract to a colleague

Continuous Testing (PTaaS) Service Agreement

THAMES WATER UTILITIES LIMITED

This public procurement record has 1 release in its history.

Tender

07 Oct 2026 at 12:22

UK4 - Tender Notice
Summary of the contracting process

Thames Water Utilities Limited is seeking a supplier for a continuous penetration testing as a service (PTaaS) programme for its IT environment. The service covers penetration testing, red- and purple-team exercises, cyber stress testing, vulnerability discovery and remediation retesting. Testing is intended to run in phases, with red-team activity shifting into purple-team collaboration when issues are detected; findings are shared while testing continues. The supplier will work with Thames Water teams to validate security controls, detection and response, and support remediation, retesting and tracking findings through to closure. Automation can support workflow, reporting and prioritisation, while testing, validation and assurance remain under human oversight. Delivery is across Thames Water’s service areas in London and the South East.

Thames Water invited offers through a competitive flexible, multi-stage procedure. The process begins with a pre-qualification questionnaire (PSQ), from which up to six suppliers may proceed to the invitation-to-negotiate stages: technical and commercial responses first, then negotiation and presentations for selected suppliers. The deadline to request access to and submit the PSQ was 3 November 2026 at 12 noon; enquiries were due by 20 October 2026 at 5 pm. The stated evaluation weighting is 70% technical and 30% commercial, alongside pass/fail and technical selection questions. The estimated value is £2 million excluding VAT (£2.4 million including VAT). The initial contract term is three years from 1 April 2027 to 31 March 2030, with extension options up to a maximum overall term of eight years, ending by 31 March 2035.

This opportunity suits specialist cyber security providers able to deliver a fully governed, continuous testing service for a large utility’s IT environment. Suppliers need to provide at least an annual penetration test and support testing at the required service cadence, including phased red- and purple-team exercises, cyber stress testing, vulnerability discovery and repeat testing after remediation. A qualified, accredited and suitably vetted team is required. Strong candidates will be able to collaborate closely with Thames Water’s security teams, validate controls and incident detection and response, and provide clear human oversight from testing through assurance. The work also calls for disciplined handover and end-to-end traceability of findings to closure, with automation used to assist tracking, reporting and prioritisation rather than replace expert testing or validation. SMEs are considered suitable to compete.

How relevant is this notice?

Notice Information

Notice Title

Continuous Testing (PTaaS) Service Agreement

Notice Description

IMPORTANT: Please read this section before deciding whether you wish to register for this event. This section provides you with information regarding the scope of this procurement and details some of the key requirements that a successful applicant MUST be able to deliver. This tender is for a new direct contract for a Continuous Testing supplier to implement and provide a fully governed continuous testing framework for IT covering penetration testing, red/purple team exercises, cyber stress testing, vulnerability discovery and remediation re-testing. The preferred supplier must support red and purple team testing that will include a multi phase continuous testing model (e.g. tag and release), where red team activity transitions into purple teaming upon detection, and findings are shared in cycle while testing continues across subsequent phases. The service must include active collaboration with Thames Water teams during purple team activities, including validation of controls, detection capability, and response processes. The solution must demonstrate clear human oversight across testing, validation, and remediation activities, with automation used to support workflows (e.g. tracking, reporting, prioritisation) but not to replace core testing, validation, or assurance activities. The supplier must support collaborative remediation and retesting, ensuring findings are handed over, validated, and retested with Thames Water teams, with end to end traceability through to closure. The following conditions would be considered as some of key requirements for a supplier to meet to be considered for this opportunity: * Availability of a yearly penetration test as a minimum * A fully functional PTaaS service that can deliver service in line with applicable cadences * A qualified, accredited and suitably vetted PTaaS support team Thames Water reserves the right to refine the award criteria. Please note that that deadline for asking for access to the PSQ & submitting of the PSQ is Tuesday, 3 November 2026, at 12 p.m.

Lot Information

Lot 1

Renewal: Thames Water envisages that the contract will be awarded for an initial term of 3 years with options to extend by 1 year or longer, up to a maximum overall term of 8 years.

Notice Details

Publication & Lifecycle

Open Contracting ID
ocds-h6vhtk-078297
Publication Source
Find A Tender Service
Latest Notice
https://www.find-tender.service.gov.uk/Notice/094688-2026
Current Stage
Tender
All Stages
Tender

Procurement Classification

Notice Type
UK4 - Tender Notice
Procurement Type
Standard
Procurement Category
Services
Procurement Method
Selective
Procurement Method Details
Competitive flexible procedure
Tender Suitability
SME
Awardee Scale
Not specified

Common Procurement Vocabulary (CPV)

CPV Divisions

72 - IT services: consulting, software development, Internet and support

CPV Codes

72000000 - IT services: consulting, software development, Internet and support

Notice Value(s)

Tender Value
£2,000,000 £1M-£10M
Lots Value
£2,000,000 £1M-£10M
Awards Value
Not specified
Contracts Value
Not specified

Notice Dates

Publication Date
7 Oct 20266 days ago
Submission Deadline
Not specified
Future Notice Date
Not specified
Award Date
Not specified
Contract Period
1 Apr 2027 - 31 Mar 2030 3-4 years
Recurrence
Not specified

Notice Status

Tender Status
Active
Lots Status
Active
Awards Status
Not Specified
Contracts Status
Not Specified

Buyer & Supplier

Contracting Authority (Buyer)

Main Buyer
THAMES WATER UTILITIES LIMITED
Contact Name
Available with D3 Tenders Premium →
Contact Email
Available with D3 Tenders Premium →
Contact Phone
Available with D3 Tenders Premium →

Buyer Location

Locality
READING
Postcode
RG1 8DB
Postcode Area
Reading
Country
England
Major Region (ITL 1)
TLJ South East (England)
Basic Region (ITL 2)
TLJ1 Berkshire, Buckinghamshire and Oxfordshire
Small Region (ITL 3)
TLJ16 Berkshire West
Delivery Location
TLI London, TLJ South East (England)
Local Authority
Reading
Electoral Ward
Thames
Westminster Constituency
Reading Central

Further Information

Notice Documents

Open Contracting Data Standard (OCDS)

View full OCDS Record for this contracting process

JSON Markdown

The Open Contracting Data Standard (OCDS) is a framework designed to increase transparency and access to public procurement data in the public sector. It is widely used by governments and organisations worldwide to report on procurement processes and contracts.

Loading OCDS record...