Pipeline

ITHC, Penetration Testing and Associated Services Contract 2

  • Defra Group Commercial

UK1: Pipeline notice

Notice identifier: 2024/S 000-034110

Procurement identifier (OCID): ocds-h6vhtk-04b008

Published 22 October 2024, 11:43am



Scope

Title

ITHC, Penetration Testing and Associated Services Contract 2

Reference

P-35707

Description

Defra Group has an extremely diverse and complex IT estate which presents significant cyber security risks. Security testing is a pre-requisite to internal approval for projects and programmes within the organisation.

Defra Group is looking to award the ITHC, Penetration Testing and Associated Services Contract (2) to three CHECK qualified, Security Cleared (SC) suppliers that can offer security testing and exercising services for new, operational and legacy systems within Defra Group. Services include ITHCs, Penetration Testing and Red/Blue and Purple Teaming. Testers are required to produce CHECK certified reports and communicate any vulnerabilities to the project and risk owner for mitigations/fixes.

Defra is looking to contract for a three-year term, with an optional twelve-month extension (3+1). The total value of the contract is estimated to be £4.5m but actual spend depends on the number of Security Tests required by the organisation which will be issued to Suppliers via Work Orders. Work Orders will be issued by individual business units across Core Defra and its arm's length bodies that are in-scope of this agreement (Natural England, Rural Payments Agency, Marine Management Organisation and the Environment Agency). Defra proposes to issue Work Orders to Suppliers on rotation, through a taxi system to ensure an even distribution of orders where possible.

The Crown Commercial Services' Cyber Security Services 3 DPS is the chosen route to market for this opportunity, using a 2-stage process.

1. Suppliers on the DPS who meet the Authority's mandatory requirements will be longlisted and invited to submit a Capability Assessment (Stage 1).

2. Suppliers that answer 'yes' to all questions in the Capability Assessment, will pre-qualify for this opportunity and be shortlisted to bid. Shortlisted suppliers will be invited to submit a tender response (Stage 2).

Timelines: Please note that these are not guaranteed and could be subject to change.

23/10/2024 - A Capability Assessment will be shared with Suppliers longlisted on the DPS. A market briefing pack will also be shared to provide suppliers with further information about this opportunity.

05/11/2024 - Deadline for return of completed Capability Assessment

18/11/2024 - Publication of ITT

22/11/2024 - Tender Clarification Deadline

28/11/2024 - Responses to clarification questions

11/12/2024 - Tender Submission Deadline

22/01/2025 - Evaluation deadline

28/01/2025 - Contract Award

07/02/2025 - 10-day optional standstill period ends

07/03/2025 - Expected contract Start Date

Contract type

Services

Main category (CPV code)

  • 72222300 - Information technology services

Additional categories (CPV codes)

  • 72254000 - Software testing
  • 72000000 - IT services: consulting, software development, Internet and support

Contract location

  • UKI32 - Westminster

Contract start date (estimated)

7 March 2025

Contract end date (estimated)

6 March 2028

Maximum value (estimated, excluding VAT)

£4,500,000

Renewal

No

OptionsThe right to additional purchases while the contract is valid.

It is anticipated that the contract will be awarded for an initial 3 year term, with the option to extend for 1 additional period of 12 months.

Contract is suitable for

  • Small and medium-sized enterprises (SME)

Contract is not suitable for

  • Voluntary, community and social enterprises (VCSE)

Buyer

Defra Group Commercial

Defra Group (Core Defra, Rural Payments Agency, Environment Agency, Natural England and Marine Management Organisation)

Horizon House, Deanery Road, Bristol

Bristol

BS1 5AH

United Kingdom

Website: https://www.gov.uk/government/organisations/department-for-environment-food-rural-affairs

Other: Other

NUTS code: UKI32 - Westminster

Contact name: Sara Bevan - DgC

Email: sara.bevan@defra.gov.uk

Telephone: 07468766045


Procedure

Procurement start date (estimated)When the contract notice or equivalent will be published.

23 October 2024

Commercial approachWhether the procurement is for a new requirement or a reprocurement.

New requirement