---
title: "Penetration Testing"
ocid: "ocds-h6vhtk-078c98"
canonical_url: "https://d3tenders.com/contract/?ocid=ocds-h6vhtk-078c98"
markdown_url: "https://d3tenders.com/contract/ocds-h6vhtk-078c98.md"
json_url: "https://d3tenders.com/contract/ocds-h6vhtk-078c98.json"
source: "Find A Tender Service"
current_stage: "Tender"
buyer: "Senedd Cymru / Welsh Parliament"
published: "2026-10-21"
---

# Penetration Testing

Buyer: Senedd Cymru / Welsh Parliament  
Current stage: Tender  
OCID: ocds-h6vhtk-078c98

[View canonical contract page](https://d3tenders.com/contract/?ocid=ocds-h6vhtk-078c98)  
[Download OCDS JSON](https://d3tenders.com/contract/ocds-h6vhtk-078c98.json)

## Summary

Senedd Cymru / Welsh Parliament is buying independent penetration testing to assess the security of its technology estate and identify vulnerabilities that could expose it to cyber risk. The work covers planning, carrying out and reporting tests on Commission systems and services. Depending on need, targets may include external and internal infrastructure, web applications, remote access services, wireless technologies and physical locations. Testing may use white-, grey- or black-box approaches. The service is intended to validate security controls, assess resilience and provide prioritised recommendations to address weaknesses. Delivery is for the Senedd Commission in Wales.

The buyer invited offers through an open competition for one lot. The procurement was at tender stage, with bids submitted electronically through the Bravo Solutions e-tendering portal. The enquiry deadline set was 17 November 2026 at 10:00 UTC, and the bid deadline was 24 November 2026 at 10:00 UTC. The contract period is 11 December 2026 to 10 December 2030. The estimated value is £80,000 excluding VAT (£100,000 including VAT). Evaluation gives quality a 60% weighting and contract cost 40%; further details are in the procurement documents.

This opportunity suits penetration-testing and cyber-security firms able to deliver independent, realistic assessments across varied technology environments. Suppliers should be capable of testing infrastructure, applications, remote access, wireless systems and, where required, physical locations, using white-, grey- or black-box methods. The work calls for robust planning and controlled testing that minimises risk to operational services, as well as clear reporting. Strong competitors will be able to identify and validate vulnerabilities, assess whether security controls work effectively, judge resilience against techniques used by malicious actors, and provide prioritised remediation advice that supports continuous improvement. The lot is marked as suitable for small and medium-sized enterprises.

## Notice

The Senedd is looking to procure a penetration testing service to provide independent assurance over the security of its technology estate and to identify vulnerabilities that may expose the organisation to cyber security risk. The contract will include the planning, execution and reporting of penetration testing activities against Commission systems and services. Testing may include external infrastructure, internal infrastructure, web applications, remote access services, wireless technologies and physical locations as required. These tests may be performed in white, grey, or black box scenarios. The Senedd Commission is seeking to procure an independent penetration testing service capable of identifying vulnerabilities, validating the effectiveness of security controls and providing assurance over the resilience of the Commission's technology estate. The service should provide realistic security assessments that reflect the techniques and methodologies employed by malicious actors, whilst ensuring testing is undertaken in a controlled manner that minimises risk to operational services. The service should support the Commission's cyber security strategy by identifying weaknesses before they can be exploited, providing prioritised remediation recommendations and supporting continuous improvement of the organisation's overall security posture.

## Key Details

| Field | Value |
| --- | --- |
| Publication source | Find A Tender Service |
| Latest notice | https://www.find-tender.service.gov.uk/Notice/099362-2026 |
| Notice type | UK4 - Tender Notice |
| Procurement type | Standard |
| Procurement category | Services |
| Procurement method | Open |
| Procurement method details | Below threshold - open competition |
| Tender suitability | SME |
| Awardee scale | Not specified |
| All stages | Tender |

## Dates

| Field | Value |
| --- | --- |
| Publication date | 21 Oct 2026 |
| Submission deadline | 24 Nov 2026 |
| Future notice date | Not specified |
| Award date | Not specified |
| Contract period | 11 Dec 2026 - 10 Dec 2030 |
| Recurrence | Not specified |

## Values

| Field | Value |
| --- | --- |
| Tender value | £80,000 |
| Lots value | £80,000 |
| Awards value | Not specified |
| Contracts value | Not specified |

## Status

| Field | Value |
| --- | --- |
| Tender status | Active |
| Lots status | Active |
| Awards status | Not specified |
| Contracts status | Not specified |

## Buyer

| Field | Value |
| --- | --- |
| Main buyer | Senedd Cymru / Welsh Parliament |
| Locality | CARDIFF |
| Postcode area | Cardiff |
| Postcode | CF99 1SN |
| Country | Wales |
| ITL 1 | TLL Wales |
| ITL 2 | TLL5 South East Wales |
| ITL 3 | TLL52 Cardiff and Vale of Glamorgan |
| Local authority | Cardiff |
| Electoral ward | Butetown |
| Westminster constituency | Cardiff South and Penarth |
| Delivery location | TLL Wales |

## CPV Codes

### Divisions

- 72 - IT services: consulting, software development, Internet and support

### Codes

- 72000000 - IT services: consulting, software development, Internet and support

## Release History

- 21 Oct 2026 at 11:21 - Tender - UK4 - Tender Notice - https://www.find-tender.service.gov.uk/Notice/099362-2026

## Documents

- https://www.find-tender.service.gov.uk/Notice/099362-2026
  21st October 2026 - Tender notice on Find a Tender
- https://etenderwales.ukp.app.jaggaer.com/web/login.shtml
  The Procurement documents will be available to access and view on the Bravo Solutions portal. Those suppliers who are not already registered on the portal will need to register. Registration is free and you can do this by going to the following link: https://etenderwales.ukp.app.jaggaer.com/web/login.shtml. The Procurement documents can be found by searching for reference itt_127977 - Penetration Testing.

## Notice URLs

- https://senedd.wales/commission/our-procurement-values/how-to-bid-for-a-welsh-parliament-contract/
- https://www.legislation.gov.uk/ukpga/2023/54/contents

## Provenance

This Markdown file is an alternate public rendering of the D3 Tenders contract record. The canonical page is https://d3tenders.com/contract/?ocid=ocds-h6vhtk-078c98. The underlying structured data is available as OCDS JSON at https://d3tenders.com/contract/ocds-h6vhtk-078c98.json.