Security Testing Engagement Partner

Tender description

Why the Work is Being Done As an organisation, we need to regularly carry out IT health checks/penetration testing and accreditation of new projects and also our existing systems and services. Rather than procure these on an ad-hoc basis, we are seeking to partner with an established provider of these services over a longer-term period. Problem to Be Solved Agile and consistent IT health checks and penetration testing of our newly developed and existing products and services. Who Are the Users As the Met Office Security Testing Team and Accreditation team, we need to identify and work with an established IT Security testing partner, so that we can assure and test our products and services. Early Market Engagement Work Already Done The Met Office has a standard, established process for engaging external security testing (see also Working Arrangements below). Existing Team The Met Office has an internal Security Testing team who will be co-ordinating all partner engagements. Current Phase Live Work Location The Met Office has its headquarters in Exeter, where the majority of engagements will take place if an on-site visit is required. Remote working is an option where this is appropriate and possible. The Met Office has a number of outstations around the UK, where some engagements may be required to take place, although this will be a minority, if any. Working Arrangments In general, for each engagement, a Target of Evaluation (ToE) will be provided and should be mutually agreed with a proposal/test plan. Once agreed, this engagement will be arranged and scheduled with initiation and conclusion meetings taking place. A detailed test exit report with recommendations must be provided as per CHECK practices. Security Clearance SC clearance is required for this engagement. Some limited engagements may require DV clearance. Please consider when responding, the necessity for some individuals to be willing and able to pass DV clearance. This is expected to be a low number of engagements. Additional T&Cs Skills & Experience An established and recognised provider of penetration testing services Web Application testing (CHECK and CREST Accredited) Infrastructure testing (CHECK and CREST Accredited) Build reviews (CHECK and CREST Accredited) Code reviews (CHECK and CREST Accredited) Firewall and networking audits (CHECK and CREST Accredited) Wireless and networking audits (CHECK and CREST Accredited) Security Training Knowledge Transfer Nice to Haves Mobile device and application testing Incident response Social engineering Physical security No. of Suppliers to Evaluate 5 Proposal Criteria The experience and professionalism of the provider The thoroughness and efficiency of the test plan/proposal The lead time to complete an engagement The value for money of the proposal Cultural Fit Criteria Timeliness and effectiveness of communication Willingness to engage as a partner Openness and approach to knowledge transfer/training Payment Approach Time and materials Assessment Method Written proposal Case study Work history Presentation Evaluation Weighting Technical competence 60% Cultural fit 20% Price 20% Questions from Suppliers Budget range £60,000 to £100,000 per annum.