---
title: "Continuous Testing (PTaaS) Service Agreement"
ocid: "ocds-h6vhtk-078297"
canonical_url: "https://d3tenders.com/contract/?ocid=ocds-h6vhtk-078297"
markdown_url: "https://d3tenders.com/contract/ocds-h6vhtk-078297.md"
json_url: "https://d3tenders.com/contract/ocds-h6vhtk-078297.json"
source: "Find A Tender Service"
current_stage: "Tender"
buyer: "THAMES WATER UTILITIES LIMITED"
published: "2026-10-07"
---

# Continuous Testing (PTaaS) Service Agreement

Buyer: THAMES WATER UTILITIES LIMITED  
Current stage: Tender  
OCID: ocds-h6vhtk-078297

[View canonical contract page](https://d3tenders.com/contract/?ocid=ocds-h6vhtk-078297)  
[Download OCDS JSON](https://d3tenders.com/contract/ocds-h6vhtk-078297.json)

## Summary

Thames Water Utilities Limited is seeking a supplier for a continuous penetration testing as a service (PTaaS) programme for its IT environment. The service covers penetration testing, red- and purple-team exercises, cyber stress testing, vulnerability discovery and remediation retesting. Testing is intended to run in phases, with red-team activity shifting into purple-team collaboration when issues are detected; findings are shared while testing continues. The supplier will work with Thames Water teams to validate security controls, detection and response, and support remediation, retesting and tracking findings through to closure. Automation can support workflow, reporting and prioritisation, while testing, validation and assurance remain under human oversight. Delivery is across Thames Water’s service areas in London and the South East.

Thames Water invited offers through a competitive flexible, multi-stage procedure. The process begins with a pre-qualification questionnaire (PSQ), from which up to six suppliers may proceed to the invitation-to-negotiate stages: technical and commercial responses first, then negotiation and presentations for selected suppliers. The deadline to request access to and submit the PSQ was 3 November 2026 at 12 noon; enquiries were due by 20 October 2026 at 5 pm. The stated evaluation weighting is 70% technical and 30% commercial, alongside pass/fail and technical selection questions. The estimated value is £2 million excluding VAT (£2.4 million including VAT). The initial contract term is three years from 1 April 2027 to 31 March 2030, with extension options up to a maximum overall term of eight years, ending by 31 March 2035.

This opportunity suits specialist cyber security providers able to deliver a fully governed, continuous testing service for a large utility’s IT environment. Suppliers need to provide at least an annual penetration test and support testing at the required service cadence, including phased red- and purple-team exercises, cyber stress testing, vulnerability discovery and repeat testing after remediation. A qualified, accredited and suitably vetted team is required. Strong candidates will be able to collaborate closely with Thames Water’s security teams, validate controls and incident detection and response, and provide clear human oversight from testing through assurance. The work also calls for disciplined handover and end-to-end traceability of findings to closure, with automation used to assist tracking, reporting and prioritisation rather than replace expert testing or validation. SMEs are considered suitable to compete.

## Notice

IMPORTANT: Please read this section before deciding whether you wish to register for this event. This section provides you with information regarding the scope of this procurement and details some of the key requirements that a successful applicant MUST be able to deliver. This tender is for a new direct contract for a Continuous Testing supplier to implement and provide a fully governed continuous testing framework for IT covering penetration testing, red/purple team exercises, cyber stress testing, vulnerability discovery and remediation re-testing. The preferred supplier must support red and purple team testing that will include a multi phase continuous testing model (e.g. tag and release), where red team activity transitions into purple teaming upon detection, and findings are shared in cycle while testing continues across subsequent phases. The service must include active collaboration with Thames Water teams during purple team activities, including validation of controls, detection capability, and response processes. The solution must demonstrate clear human oversight across testing, validation, and remediation activities, with automation used to support workflows (e.g. tracking, reporting, prioritisation) but not to replace core testing, validation, or assurance activities. The supplier must support collaborative remediation and retesting, ensuring findings are handed over, validated, and retested with Thames Water teams, with end to end traceability through to closure. The following conditions would be considered as some of key requirements for a supplier to meet to be considered for this opportunity: * Availability of a yearly penetration test as a minimum * A fully functional PTaaS service that can deliver service in line with applicable cadences * A qualified, accredited and suitably vetted PTaaS support team Thames Water reserves the right to refine the award criteria. Please note that that deadline for asking for access to the PSQ & submitting of the PSQ is Tuesday, 3 November 2026, at 12 p.m.

### Lot Information

Lot 1

Renewal: Thames Water envisages that the contract will be awarded for an initial term of 3 years with options to extend by 1 year or longer, up to a maximum overall term of 8 years.

## Key Details

| Field | Value |
| --- | --- |
| Publication source | Find A Tender Service |
| Latest notice | https://www.find-tender.service.gov.uk/Notice/094688-2026 |
| Notice type | UK4 - Tender Notice |
| Procurement type | Standard |
| Procurement category | Services |
| Procurement method | Selective |
| Procurement method details | Competitive flexible procedure |
| Tender suitability | SME |
| Awardee scale | Not specified |
| All stages | Tender |

## Dates

| Field | Value |
| --- | --- |
| Publication date | 7 Oct 2026 |
| Submission deadline | Not specified |
| Future notice date | Not specified |
| Award date | Not specified |
| Contract period | 1 Apr 2027 - 31 Mar 2030 |
| Recurrence | Not specified |

## Values

| Field | Value |
| --- | --- |
| Tender value | £2,000,000 |
| Lots value | £2,000,000 |
| Awards value | Not specified |
| Contracts value | Not specified |

## Status

| Field | Value |
| --- | --- |
| Tender status | Active |
| Lots status | Active |
| Awards status | Not specified |
| Contracts status | Not specified |

## Buyer

| Field | Value |
| --- | --- |
| Main buyer | THAMES WATER UTILITIES LIMITED |
| Locality | READING |
| Postcode area | Reading |
| Postcode | RG1 8DB |
| Country | England |
| ITL 1 | TLJ South East (England) |
| ITL 2 | TLJ1 Berkshire, Buckinghamshire and Oxfordshire |
| ITL 3 | TLJ16 Berkshire West |
| Local authority | Reading |
| Electoral ward | Thames |
| Westminster constituency | Reading Central |
| Delivery location | TLI London, TLJ South East (England) |

## CPV Codes

### Divisions

- 72 - IT services: consulting, software development, Internet and support

### Codes

- 72000000 - IT services: consulting, software development, Internet and support

## Release History

- 7 Oct 2026 at 12:22 - Tender - UK4 - Tender Notice - https://www.find-tender.service.gov.uk/Notice/094688-2026

## Documents

- https://www.find-tender.service.gov.uk/Notice/094688-2026
  7th October 2026 - Tender notice on Find a Tender

## Notice URLs

- https://forms.cloud.microsoft/e/xBDaHtLPD7
- https://www.legislation.gov.uk/ukpga/2023/54/contents

## Provenance

This Markdown file is an alternate public rendering of the D3 Tenders contract record. The canonical page is https://d3tenders.com/contract/?ocid=ocds-h6vhtk-078297. The underlying structured data is available as OCDS JSON at https://d3tenders.com/contract/ocds-h6vhtk-078297.json.