Penetration Testing Tenders

Two ways in. Watch the portals for live ITHC and penetration testing notices, or move earlier and follow the buyers who retender on an annual cycle. Stotles pulls notices from 100+ portals and sits them next to the strategy documents and budget papers that show the work coming. Platform-wide, 2,163 notices are open right now. Start with what is open, then track the buyers behind it.

In practice, yes. An IT Health Check, written ITHC, is the UK public sector name for a scope-defined penetration test run once a year, usually to keep a Public Services Network connection or to meet the NHS Data Security and Protection Toolkit. Buyers ask for testers accredited under the NCSC CHECK scheme. Notice titles use the two terms interchangeably, so searching for one and not the other misses a large part of the market.

The two that recur are 72800000 (Computer audit and testing services) and 72254100 (Systems testing services). Plenty of notices are filed under the much broader parent IT services heading instead, and some carry no code at all. Alongside the keyword filter for this page, 72800000 appears on 112 notices and 72254100 on 38, so codes narrow the picture rather than describe it. Keywords do the work here.

There are 1,447 notices on record for this filter, 854 of them awards and 55 still at the pre-tender stage. Six sit at the open stage, which is what an annual testing cycle looks like: small contracts, awarded quickly, then retendered. The awards are the more useful half. They show who tests for which buyer and when the current term runs out.

Accreditation first. Many notices restrict bidders to NCSC CHECK or equivalent accredited testers, and a lot of the work is called off a cyber security framework or a dynamic purchasing system rather than run as an open competition. Then read the scope, because an external infrastructure and web application test is a different job from a full estate review or a red team exercise. Platform-wide, 2 award notices were published in the last seven days, and recent awards are the quickest way to see how buyers word the requirement.