Penetration testing - ORR Network (Dec 22)

Tender description

Summary of the work Comprehensive penetration and vulnerability testing required on all areas of the ORR network and devices. The work will involve all areas of ORR's network minimal on premise presence and including all cloud applications. Specialist role Cyber security consultant Expected Contract Length 3 full checks over 6 months (estimated). Latest start date Monday 23 January 2023 Who Speclialist Work With Working for the Security manager and with the Service delivery manager and the third line support. What Specialists Work On Carry out Penetration testing across ORR's network in preparation for Cyber essentials plus certification. This to include cloud applications and our minimal on premises presence (located in London, Bristol, Manchester and York). Skills & Experience • Excellent understanding of mixed cloud and on-premise networks • Good Knowledge of NCSC security principles and best practice • Must be able to return any media containing data collected during the testing. Nice to Haves • Knowledge of HMG baseline cyber security standards • Experience of working with small government or public sector organisations Work Location ORR HQ is in London but we also have 5 other locations. 2 of these locations do not have on premise equipment and access is via Gov Wi-Fi only. Working Arrangments A period of time working with the team remotely and if necessary on-site. Drafting the report (offsite) and then initial presentation of the findings via VC. May require on-site presentation (at HQ) of full findings. Security Clearance Security check (SC) equivalence by recognised provider. Additional T&Cs Organisation bidding for the work will need to be Check accredited and membership of CISP desirable. No. of Specialists to Evaluate 3 Cultural Fit Criteria • Ability to work with our technical team (2 members) against a background of daily operational priorities. • Confident and with good communications skills. Evaluation Weighting Technical competence 40% Cultural fit 20% Price 40% Questions from Suppliers 1. Is there an incumbent If you mean do we already have a company doing this for us at the moment. The answer is no. 2. Is there a max budget (day rate) for this? All responses will be assessed and where compelling benefits or cost profiles are demonstrated this will be taken into account in accordance with the assessment criteria. 3. Can you clarify if you are looking for an individual or an organisation to provide the contract? We would prefer an organisation. 4. Is there any reason you are not using Cyber Security Services 3 Framework set up specifically with qualified CHECK approved suppliers? We procure across several frameworks. In this instance we have chosen to use *this* framework due to the ease with which we can build on, and adapt, previous requirements into a more mature specification that meets our current needs.