✓Tender information last checkedLast checked 21 Oct 2026, 12:52.
Opportunity overview
The Senedd is looking to procure a penetration testing service to provide independent assurance over the security of its technology estate and to identify vulnerabilities that may expose the organisation to cyber security risk.
The contract will include the planning, execution and reporting of penetration testing activities against Commission systems and services. Testing may include external infrastructure, internal infrastructure, web applications, remote access services, wireless technologies and physical locations as required. These tests may be performed in white, grey, or black box scenarios.
The Senedd Commission is seeking to procure an independent penetration testing service capable of identifying vulnerabilities, validating the effectiveness of security controls and providing assurance over the resilience of the Commission's technology estate.
The service should provide realistic security assessments that reflect the techniques and methodologies employed by malicious actors, whilst ensuring testing is undertaken in a controlled manner that minimises risk to operational services.
The service should support the Commission's cyber security strategy by identifying weaknesses before they can be exploited, providing prioritised remediation recommendations and supporting continuous improvement of the organisation's overall security posture.
Classification
CPV72000000 — IT services: consulting, software development, Internet and support
The Procurement documents will be available to access and view on the Bravo Solutions portal. Those suppliers who are not already registered on the portal will need to register.
Registration is free and you can do this by going to the following link: https://etenderwales.ukp.app.jaggaer.com/web/login.shtml.
The Procurement documents can be found by searching for reference itt_127977 - Penetration Testing.Open source ↗
Published notice details
Additional information from the published procurement release. Fields appear only when supplied by the source; check the original notice and tender documents before acting.
Scope, procedure and submissions
Id
1284
Status
active
Procurement Method
open
Procurement Method Details
Below threshold - open competition
Main Procurement Category
services
Above Threshold
No
How to submit
Bravo Solutions e-tendering portal at https://etenderwales.ukp.app.jaggaer.com/web/login.shtml
Search for itt_127977 - Penetration Testing
IT services: consulting, software development, Internet and support
Delivery locations
Entry 1
Region
UKL
Country
GB
Country Name
United Kingdom
Published documents
Entry 1
Id
L-4
Document Type
biddingDocuments
Description
The Procurement documents will be available to access and view on the Bravo Solutions portal. Those suppliers who are not already registered on the portal will need to register.
Registration is free and you can do this by going to the following link: https://etenderwales.ukp.app.jaggaer.com/web/login.shtml.
The Procurement documents can be found by searching for reference itt_127977 - Penetration Testing.
1 published notice version reviewed by ProcuraAxis.
1 VERSION
1
099362-2026Tender notice on Find a Tender ·
PROCURAAXIS ANALYSIS
ProcuraAxis Analysis
Our approved analysis of the opportunity appears below the official tender information.
ANALYSIS PREVIEW
Opportunity intelligence at a glance
Senedd Cymru / Welsh Parliament is seeking an independent penetration-testing service for its technology estate. The service covers planning, execution and reporting, with possible testing of infrastructure, web applications, remote access, wireless technologies and physical locations, using white-, grey- and black-box scenarios as required.
Who this may suit
Suitable for suppliers that provide independent, controlled penetration-testing assessments and remediation reporting across the stated technology areas.
Key points identified
Independent serviceIndependent penetration testing serviceEvidence: "The Senedd is looking to procure a penetration testing service to provide independent assurance" and "seeking to procure an independent penetration testing service"
Testing lifecyclePlanning, execution and reporting of penetration-testing activitiesEvidence: "The contract will include the planning, execution and reporting of penetration testing activities"
Assessment approachRealistic assessments reflecting malicious-actor techniques and methodologiesEvidence: "The service should provide realistic security assessments that reflect the techniques and methodologies employed by malicious actors"
96% approved-analysis confidence6 supplier criteria identified3 risks or unknowns
ProcuraAxis structures information found in published procurement records, checks the result for consistency and publishes only approved analysis. Confidence describes the completeness and consistency of the available source information; it is not a guarantee of eligibility or contract award.
Senedd Cymru / Welsh Parliament is seeking an independent penetration-testing service for its technology estate. The service covers planning, execution and reporting, with possible testing of infrastructure, web applications, remote access, wireless technologies and physical locations, using white-, grey- and black-box scenarios as required.
Who this may suit
Suitable for suppliers that provide independent, controlled penetration-testing assessments and remediation reporting across the stated technology areas.
Key deliverables
Plan, execute and report penetration-testing activities.
Identify vulnerabilities and assess security-control effectiveness.
Provide prioritised remediation recommendations.
Undertake controlled testing that minimises risk to operational services.
SUPPLIER REQUIREMENTS
6 criteria identified
Independent service
98% confidence
Independent penetration testing service
View supporting evidence
"The Senedd is looking to procure a penetration testing service to provide independent assurance" and "seeking to procure an independent penetration testing service"
Testing lifecycle
98% confidence
Planning, execution and reporting of penetration-testing activities
View supporting evidence
"The contract will include the planning, execution and reporting of penetration testing activities"
Assessment approach
95% confidence
Realistic assessments reflecting malicious-actor techniques and methodologies
View supporting evidence
"The service should provide realistic security assessments that reflect the techniques and methodologies employed by malicious actors"
Controlled delivery
98% confidence
Testing must minimise risk to operational services
View supporting evidence
"ensuring testing is undertaken in a controlled manner that minimises risk to operational services"
Registration on the Bravo Solutions portal is needed for suppliers not already registered to access and view procurement documents; registration is stated to be free.
View supporting evidence
Bidding-document title: "Those suppliers who are not already registered on the portal will need to register. Registration is free"
COMMERCIAL AND DELIVERY
Contract intelligence
Commercial
Maximum value
98% confidence
Up to GBP 80,000
View supporting evidence
process.value_max: 80000 GBP; lot 1 value_amount: 80000 GBP
Contract term
99% confidence
Unknown
View supporting evidence
contract_start_at and contract_end_at are null
Delivery
Delivery region
94% confidence
UKL, United Kingdom
View supporting evidence
Delivery location: region "UKL", country "United Kingdom"
Potential test targets
98% confidence
External and internal infrastructure, web applications, remote access services, wireless technologies and physical locations, as required
View supporting evidence
"Testing may include external infrastructure, internal infrastructure, web applications, remote access services, wireless technologies and physical locations as required."
Test scenarios
98% confidence
White-box, grey-box or black-box scenarios
View supporting evidence
"These tests may be performed in white, grey, or black box scenarios."
Bidding-document title: "The Procurement documents can be found by searching for reference itt_127977 - Penetration Testing."
RISKS AND UNKNOWNS
Points requiring attention
Operational-service risk
98% confidence
Testing must be controlled to minimise risk to operational services.
View supporting evidence
"ensuring testing is undertaken in a controlled manner that minimises risk to operational services"
Scope variability
96% confidence
The stated test targets and white-, grey- or black-box scenarios are expressed as potential or as-required elements; final testing scope may vary.
View supporting evidence
"Testing may include... as required" and "may be performed in white, grey, or black box scenarios."
Contract timetable
99% confidence
Contract start and end dates are unknown.
View supporting evidence
contract_start_at and contract_end_at are null
ProcuraAxis analysis supplements, but does not replace, the original notice and tender documents. Always verify eligibility, deadlines and commercial terms with the issuing authority.
Continue in your ProcuraAxis workspaceFree account · Full approved analysis