Scope
Title
ITHC, Penetration Testing and Associated Services Contract 2
Reference
P-35707
Description
Defra Group has an extremely diverse and complex IT estate which presents significant cyber security risks. Security testing is a pre-requisite to internal approval for projects and programmes within the organisation.
Defra Group is looking to award the ITHC, Penetration Testing and Associated Services Contract (2) to three CHECK qualified, Security Cleared (SC) suppliers that can offer security testing and exercising services for new, operational and legacy systems within Defra Group. Services include ITHCs, Penetration Testing and Red/Blue and Purple Teaming. Testers are required to produce CHECK certified reports and communicate any vulnerabilities to the project and risk owner for mitigations/fixes.
Defra is looking to contract for a three-year term, with an optional twelve-month extension (3+1). The total value of the contract is estimated to be £4.5m but actual spend depends on the number of Security Tests required by the organisation which will be issued to Suppliers via Work Orders. Work Orders will be issued by individual business units across Core Defra and its arm's length bodies that are in-scope of this agreement (Natural England, Rural Payments Agency, Marine Management Organisation and the Environment Agency). Defra proposes to issue Work Orders to Suppliers on rotation, through a taxi system to ensure an even distribution of orders where possible.
The Crown Commercial Services' Cyber Security Services 3 DPS is the chosen route to market for this opportunity, using a 2-stage process.
1. Suppliers on the DPS who meet the Authority's mandatory requirements will be longlisted and invited to submit a Capability Assessment (Stage 1).
2. Suppliers that answer 'yes' to all questions in the Capability Assessment, will pre-qualify for this opportunity and be shortlisted to bid. Shortlisted suppliers will be invited to submit a tender response (Stage 2).
Timelines: Please note that these are not guaranteed and could be subject to change.
23/10/2024 - A Capability Assessment will be shared with Suppliers longlisted on the DPS. A market briefing pack will also be shared to provide suppliers with further information about this opportunity.
05/11/2024 - Deadline for return of completed Capability Assessment
18/11/2024 - Publication of ITT
22/11/2024 - Tender Clarification Deadline
28/11/2024 - Responses to clarification questions
11/12/2024 - Tender Submission Deadline
22/01/2025 - Evaluation deadline
28/01/2025 - Contract Award
07/02/2025 - 10-day optional standstill period ends
07/03/2025 - Expected contract Start Date
Contract type
Services
Main category (CPV code)
- 72222300 - Information technology services
Additional categories (CPV codes)
- 72254000 - Software testing
- 72000000 - IT services: consulting, software development, Internet and support
Contract location
- UKI32 - Westminster
Contract start date (estimated)
7 March 2025
Contract end date (estimated)
6 March 2028
Maximum value (estimated, excluding VAT)
£4,500,000
Renewal
No
OptionsThe right to additional purchases while the contract is valid.
It is anticipated that the contract will be awarded for an initial 3 year term, with the option to extend for 1 additional period of 12 months.
Contract is suitable for
- Small and medium-sized enterprises (SME)
Contract is not suitable for
- Voluntary, community and social enterprises (VCSE)
Buyer
Defra Group Commercial
Defra Group (Core Defra, Rural Payments Agency, Environment Agency, Natural England and Marine Management Organisation)
Horizon House, Deanery Road, Bristol
Bristol
BS1 5AH
United Kingdom
Website: https://www.gov.uk/government/organisations/department-for-environment-food-rural-affairs
Other: Other
NUTS code: UKI32 - Westminster
Contact name: Sara Bevan - DgC
Email: sara.bevan@defra.gov.uk
Telephone: 07468766045
Procedure
Procurement start date (estimated)When the contract notice or equivalent will be published.
23 October 2024
Commercial approachWhether the procurement is for a new requirement or a reprocurement.
New requirement