Skip to content
SLETOR
OpenIT services

Penetration Testing[E16]

Cardiff, United KingdomSenedd Cymru / Welsh Parliament[E1]

Sign in to track this bidAdd deadline to calendar

In plain English

What they want
The Senedd is looking to procure a penetration testing service to provide independent assurance over the security of its technology estate and to identify vulnerabilities that may expose the organisation to cyber security risk. The contract will include the planning, execution and reporting of penetration testing activities against Commission systems and services.
Who can bid
No restrictions are stated in the notice data. The tender documents may set more.
Deadline
Buyer's deadline: 24 Nov 2026, 10:00 UTC. UTC: 24 Nov 2026, 10:00 UTC.
Published 21 Oct 2026.
Value
GBP 80,000
Buyer
Senedd Cymru / Welsh ParliamentSee what else this buyer buys and when.
How to apply
Through the buyer's official process. Open the original notice on UK Find a Tender (OCDS) (opens in a new tab) ↗
Tender documents

The tender documents for this notice are on the buyer's own portal, usually behind a free supplier registration. We link to them and do not fetch them, so the report is based on the notice only.

Your tender documents

Download the tender pack from the buyer's portal (the invitation to tender, specification, selection questionnaire, scoring and draft contract) and add it here. We read every page and check it against your company for the bid assessment.

Sign in to upload documents.

Deadline[E5]
24 Nov 2026, 10:00 UTC
Value[E17]
GBP 80,000
Published[E13]
21 Oct 2026
Procedure[E12]
Below threshold - open competition
Source
UK Find a Tender (OCDS) (opens in a new tab)
Last checked
22 hours ago

About the requirement

From the notice

The Senedd is looking to procure a penetration testing service to provide independent assurance over the security of its technology estate and to identify vulnerabilities that may expose the organisation to cyber security risk. The contract will include the planning, execution and reporting of penetration testing activities against Commission systems and services. Testing may include external infrastructure, internal infrastructure, web applications, remote access services, wireless technologies and physical locations as required. These tests may be performed in white, grey, or black box scenarios. The Senedd Commission is seeking to procure an independent penetration testing service capable of identifying vulnerabilities, validating the effectiveness of security controls and providing assurance over the resilience of the Commission's technology estate. The service should provide realistic security assessments that reflect the techniques and methodologies employed by malicious actors, whilst ensuring testing is undertaken in a controlled manner that minimises risk to operational services. The service should support the Commission's cyber security strategy by identifying weaknesses before they can be exploited, providing prioritised remediation recommendations and supporting continuous improvement of the organisation's overall security posture.[E6]

Eligibility and requirements

  • ConditionDelivery location: UKL, United Kingdom.[E7]
  • ConditionThe legal basis is UKPGA 2023/54 (Procurement Act 2023).[E8]
  • ConditionThe buyer marks lot 1 as suitable for small and medium-sized businesses.[E9]
  • DetailLot 1 runs from 11 Dec 2026 to 10 Dec 2030.[E3]
  • DetailClarification questions close at 17 Nov 2026, 10:00 UTC.[E10]
  • DetailThe notice explains how to submit a tender.[E15]
  • The notice data states no restriction on who may bid. Exclusion grounds and selection criteria in the tender documents still apply.

Risks and unknowns

  • UnknownWe read the published notice, not the full tender documents.

Updates

  1. First seen · 28 Oct 2026, 09:21 UTC

    The source published a call for competition with a future deadline.

    Source document 099362-2026

Evidence

17 facts

Every fact on this page comes from the published notice. Each entry shows the document and the field it was read from.

  1. E1

    The buyer is Senedd Cymru / Welsh Parliament.

    Document 099362-2026, field /buyer/name, read 28 Oct 2026, 09:21 UTC · source (opens in a new tab)

  2. E2

    The notice is classified under CPV 72000000 (IT services: consulting, software development, Internet and support).

    Document 099362-2026, field /tender/items/0/additionalClassifications/0/id, read 28 Oct 2026, 09:21 UTC · source (opens in a new tab)

  3. E3

    Lot 1 runs from 11 Dec 2026 to 10 Dec 2030.

    “2026-12-11T00:00:00+00:00 to 2030-12-10T23:59:59+00:00”

    Document 099362-2026, field /tender/lots/0/contractPeriod, read 28 Oct 2026, 09:21 UTC · source (opens in a new tab)

  4. E4

    The buyer's address is in United Kingdom.

    Document 099362-2026, field /parties/0/address/country, read 28 Oct 2026, 09:21 UTC · source (opens in a new tab)

  5. E5

    Tenders must be submitted by 24 Nov 2026, 10:00 UTC.

    “2026-11-24T10:00:00+00:00”

    Document 099362-2026, field /tender/tenderPeriod/endDate, read 28 Oct 2026, 09:21 UTC · source (opens in a new tab)

  6. E6

    The buyer describes the requirement in the notice.

    “The Senedd is looking to procure a penetration testing service to provide independent assurance over the security of its technology estate and to identify vulnerabilities that may expose the organisation to cyber security risk. The contract will include the planning, execution a…”

    Document 099362-2026, field /tender/description, read 28 Oct 2026, 09:21 UTC · source (opens in a new tab)

  7. E7

    Delivery location: UKL, United Kingdom.

    Document 099362-2026, field /tender/items/0/deliveryAddresses/0, read 28 Oct 2026, 09:21 UTC · source (opens in a new tab)

  8. E8

    The legal basis is UKPGA 2023/54 (Procurement Act 2023).

    Document 099362-2026, field /tender/legalBasis/id, read 28 Oct 2026, 09:21 UTC · source (opens in a new tab)

  9. E9

    The buyer marks lot 1 as suitable for small and medium-sized businesses.

    “sme: true”

    Document 099362-2026, field /tender/lots/0/suitability/sme, read 28 Oct 2026, 09:21 UTC · source (opens in a new tab)

  10. E10

    Clarification questions close at 17 Nov 2026, 10:00 UTC.

    “2026-11-17T10:00:00+00:00”

    Document 099362-2026, field /tender/enquiryPeriod/endDate, read 28 Oct 2026, 09:21 UTC · source (opens in a new tab)

  11. E11

    This is a call for competition. Suppliers can respond.

    “tender”

    Document 099362-2026, field /tag, read 28 Oct 2026, 09:21 UTC · source (opens in a new tab)

  12. E12

    The procedure is: Below threshold - open competition.

    Document 099362-2026, field /tender/procurementMethodDetails, read 28 Oct 2026, 09:21 UTC · source (opens in a new tab)

  13. E13

    The notice was published on 21 Oct 2026.

    “2026-10-21T11:21:29+01:00”

    Document 099362-2026, field /tender/documents/1/datePublished, read 28 Oct 2026, 09:21 UTC · source (opens in a new tab)

  14. E14

    Find a Tender gives the tender status as active.

    Document 099362-2026, field /tender/status, read 28 Oct 2026, 09:21 UTC · source (opens in a new tab)

  15. E15

    The notice explains how to submit a tender.

    “Bravo Solutions e-tendering portal at https://etenderwales.ukp.app.jaggaer.com/web/login.shtml Search for itt_127977 - Penetration Testing”

    Document 099362-2026, field /tender/submissionMethodDetails, read 28 Oct 2026, 09:21 UTC · source (opens in a new tab)

  16. E16

    The notice is titled "Penetration Testing".

    Document 099362-2026, field /tender/title, read 28 Oct 2026, 09:21 UTC · source (opens in a new tab)

  17. E17

    The stated value is GBP 80,000 excluding VAT.

    “80000 GBP”

    Document 099362-2026, field /tender/value/amount, read 28 Oct 2026, 09:21 UTC · source (opens in a new tab)

Contains public sector information from Find a Tender, licensed under the Open Government Licence v3.0. Data licence: Open Government Licence v3.0 (opens in a new tab). Personal contact details in notices are not stored or shown.