--- title: "Penetration Testing and Cybersecurity Assessment" ocid: "ocds-r6ebe6-0000843381" canonical_url: "https://d3tenders.com/contract/?ocid=ocds-r6ebe6-0000843381" markdown_url: "https://d3tenders.com/contract/ocds-r6ebe6-0000843381.md" json_url: "https://d3tenders.com/contract/ocds-r6ebe6-0000843381.json" source: "Public Contracts Scotland" current_stage: "Tender" buyer: "Cairn Housing Association" published: "2026-09-18" --- # Penetration Testing and Cybersecurity Assessment Buyer: Cairn Housing Association Current stage: Tender OCID: ocds-r6ebe6-0000843381 [View canonical contract page](https://d3tenders.com/contract/?ocid=ocds-r6ebe6-0000843381) [Download OCDS JSON](https://d3tenders.com/contract/ocds-r6ebe6-0000843381.json) ## Summary Cairn Housing Association is seeking a cybersecurity partner to deliver comprehensive penetration testing and security assessment services. The work covers the association’s digital infrastructure, applications and operational processes, supporting its information security programme and regulatory obligations. The scope includes testing and assessment against requirements associated with GDPR, ISO 27001, PCI DSS, the Network and Information Systems Regulations (NIS) and Cyber Essentials Plus. This is a specialist cybersecurity services requirement, classified under CPV 72267100. Cairn Housing Association is based in Edinburgh and is the organisation procuring and using the services. The requirement is presented as a single package, with delivery arrangements and detailed activities set out in the tender documents. The procurement has reached tender: Cairn Housing Association invited offers through an open procedure, with responses submitted electronically in English. The tender deadline is 16 October 2026 at 12:00 UTC, with bid opening scheduled for 12:30 UTC the same day. The contract is planned to run for 1,080 days, and bids must remain valid for 90 days after submission. The procurement is covered by the Government Procurement Agreement. One package is offered, variants are not allowed and there is no stated renewal or extension option. Evaluation and suitability requirements are set out in the tender documents. Bidders must provide the names and qualifications of staff proposed for the work. Electronic payment and ordering will be used, and electronic invoicing is allowed. This opportunity suits established penetration-testing and cybersecurity consultancies able to assess infrastructure, applications and operational processes as one engagement. Strong candidates will need demonstrable experience of security testing, structured risk assessment and producing evidence suitable for an organisation operating under data-protection, payment-security, network-security and information-security standards. The requirement is well suited to suppliers with qualified, appropriately experienced consultants whose names and qualifications can be provided at tender stage, and with the capacity to maintain delivery over a substantial multi-year service period. Firms should be comfortable working within formal public-sector tender requirements, submitting a complete electronic response in English and explaining how their technical approach meets the detailed specification and quality requirements. ## Notice Services of a cybersecurity partner to conduct comprehensive penetration testing and security assessment engagement across Cairn Housing Association's digital infrastructure, applications and operational processes, in support of our information security programme and its obligations under regulatory frameworks including GDPR, ISO27001, PCI DSS, NIS and Cyber Essentials Plus ## Key Details | Field | Value | | --- | --- | | Publication source | Public Contracts Scotland | | Latest notice | https://www.publiccontractsscotland.gov.uk/search/show/search_view.aspx?ID=SEP564781 | | Notice type | PCS Notice - Website Contract Notice | | Procurement type | Standard | | Procurement category | Services | | Procurement method | Open | | Procurement method details | Open procedure | | Tender suitability | Not specified | | Awardee scale | Not specified | | All stages | Tender | ## Dates | Field | Value | | --- | --- | | Publication date | 18 Sep 2026 | | Submission deadline | 16 Oct 2026 | | Future notice date | Not specified | | Award date | Not specified | | Contract period | Not specified | | Recurrence | Not specified | ## Values | Field | Value | | --- | --- | | Tender value | Not specified | | Lots value | Not specified | | Awards value | Not specified | | Contracts value | Not specified | ## Status | Field | Value | | --- | --- | | Tender status | Active | | Lots status | Active | | Awards status | Not specified | | Contracts status | Not specified | ## Buyer | Field | Value | | --- | --- | | Main buyer | Cairn Housing Association | | Locality | EDINBURGH | | Postcode area | Edinburgh | | Postcode | EH7 4GH | | Country | Scotland | | ITL 1 | TLM Scotland | | ITL 2 | TLM1 East Central Scotland | | ITL 3 | TLM13 City of Edinburgh | | Local authority | City of Edinburgh | | Electoral ward | Leith Walk | | Westminster constituency | Edinburgh North and Leith | | Delivery location | TLM75 City of Edinburgh | ## CPV Codes ### Divisions - 72 - IT services: consulting, software development, Internet and support ### Codes - 72267100 - Maintenance of information technology software ## Release History - 18 Sep 2026 at 01:00 - Tender - PCS Notice - Website Contract Notice - https://www.publiccontractsscotland.gov.uk/search/show/search_view.aspx?ID=SEP564781 ## Documents - https://www.publiccontractsscotland.gov.uk/NoticeDownload/DownloadDocument.aspx?id=SEP564781&idx=6 18th September 2026 - Freedom of Information Statement - https://www.publiccontractsscotland.gov.uk/NoticeDownload/DownloadDocument.aspx?id=SEP564781&idx=7 18th September 2026 - Form of Tender - https://www.publiccontractsscotland.gov.uk/NoticeDownload/DownloadDocument.aspx?id=SEP564781&idx=8 18th September 2026 - Declaration of Subcontractors - https://www.publiccontractsscotland.gov.uk/NoticeDownload/DownloadDocument.aspx?id=SEP564781&idx=2 18th September 2026 - Specification - https://www.publiccontractsscotland.gov.uk/NoticeDownload/DownloadDocument.aspx?id=SEP564781&idx=3 18th September 2026 - Pricing Schedule - https://www.publiccontractsscotland.gov.uk/NoticeDownload/DownloadDocument.aspx?id=SEP564781&idx=4 18th September 2026 - Quality Questionnaire - https://www.publiccontractsscotland.gov.uk/NoticeDownload/DownloadDocument.aspx?id=SEP564781&idx=5 18th September 2026 - Data Sharing Agreement (info only) - https://www.publiccontractsscotland.gov.uk/NoticeDownload/DownloadDocument.aspx?id=SEP564781&idx=1 18th September 2026 - Invitation to Tender - https://www.publiccontractsscotland.gov.uk/search/show/search_view.aspx?ID=SEP564781 Penetration Testing and Cybersecurity Assessment - Services of a cybersecurity partner to conduct comprehensive penetration testing and security assessment engagement across Cairn Housing Association's digital infrastructure, applications and operational processes, in support of our information security programme and its obligations under regulatory frameworks including GDPR, ISO27001, PCI DSS, NIS and Cyber Essentials Plus ## Notice URLs - http:// - http://www.cairnha.com - https://api.publiccontractsscotland.gov.uk/v1/Notice?id=ocds-r6ebe6-0000843381 - https://www.publiccontractsscotland.gov.uk/ - https://www.publiccontractsscotland.gov.uk/ESPD/ESPD_Download.aspx?id=843381 - https://www.publiccontractsscotland.gov.uk/Search/Search_Switch.aspx?ID=843381 - https://www.publiccontractsscotland.gov.uk/sitehelp/help_guides.aspx ## Provenance This Markdown file is an alternate public rendering of the D3 Tenders contract record. The canonical page is https://d3tenders.com/contract/?ocid=ocds-r6ebe6-0000843381. The underlying structured data is available as OCDS JSON at https://d3tenders.com/contract/ocds-r6ebe6-0000843381.json.