Council and Public Body Tenders: What a Penetration Test Requirement Asks For

No single rule decides this. A council or public body tender asks for a penetration test because the buyer wrote it into its own specification, so the tender wording is the rule you work to. Some name the NCSC CHECK scheme, some name a CREST-accredited company, and some name neither. Read the exact wording first, then match the accreditation it names.

Does a council or public body tender have to ask for a penetration test?

No law we can point to makes every public body tender include a penetration test. The ask comes from the buyer’s own risk assessment, a framework call-off, or a security schedule in the contract. The NCSC does give central government a steer: it recommends that HMG organisations use testers and companies which are part of the CHECK scheme.

That recommendation is in the NCSC’s penetration testing guidance, which also explains why buyers commission a test at all. The guidance says penetration testing should be viewed as a method for gaining assurance in your organisation’s vulnerability assessment and management processes, not as a primary method for identifying vulnerabilities. So a tender that asks for a test is usually asking for independent assurance, not a substitute for patching and scanning.

The same guidance is clear about timing. A test can only validate that systems are not vulnerable to known issues on the day of the test. Buyers who understand that tend to ask for a test after a significant change, before go-live, or at a set interval, and they write that into the specification.

What does a tender actually ask for?

Tenders ask for the same handful of things in different words: a scope, the types of testing, a named accreditation or qualification, a report format, and a price format. The Government Commercial Agency publishes a template that shows the questions public buyers are prompted to answer, which is a good guide to what lands in your inbox.

The agency, which was the Crown Commercial Service until 1 April 2026, runs the Cyber Security Services 3 agreement (RM3764.3). It lists penetration testing, including the NCSC assured service CHECK and IT health check, among the services buyers can shortlist suppliers for. The agreement page also carries a template statement of requirements for penetration testing. In that template the buyer is prompted to state, among other things:

• The purpose of the test, such as gaining assurance in the organisation’s vulnerability management.
• Any regulatory requirements behind it, such as Cyber Essentials, Cyber Essentials Plus, a CHECK requirement or a sector regulator.
• What is in scope, what is out of scope, and what is optional.
• The types of testing required, and any special conditions such as out of hours testing.
• How findings are reported, for example with CHECK or CVSS scores.
• Qualifications for the testers, such as CHECK accreditation or CHECK team leaders, and quality standards such as ISO 9001.
• Security requirements for the supplier’s staff, including any clearance level.
• The price format, such as a fixed price or a day rate, usually excluding VAT.

These are the prompts in the template, not a statement of what every tender says. A council tender written without the template may ask for less, or for something different. In our experience, the lines that decide who can bid are the accreditation line and the scope line, so read those two first.

Tenders also ask about things that are not penetration tests. Cyber Essentials Plus is a hands-on assessor audit and a different thing, and the Public Services Network and the Cyber Assessment Framework each have their own evidence routes. We cover those separately: see Cyber Essentials and G-Cloud 15, PSN connections and penetration testing and the NCSC Cyber Assessment Framework and penetration testing.

Who can carry out the test?

It depends on what the requirement states. Public sector organisations can use a CREST-accredited company or a CHECK provider, depending on what their requirement states. EJN Labs is CREST-accredited. Where a tender names CHECK, bid with a CHECK provider. Where it names CREST, a CREST-accredited company meets it.

The NCSC describes CHECK as the scheme under which NCSC assured companies can conduct authorised penetration tests of public sector and CNI systems and networks. It says the scheme has been developed specifically for central government departments, public sector bodies and organisations forming the UK’s critical national infrastructure. Penetration testing itself, it adds, can be undertaken by any organisation wanting to test its cyber security.

That gives you a simple way to read a tender. If the specification says CHECK, the buyer has chosen the scheme built for public sector testing. If it says CREST, the buyer has chosen an accreditation that is separate from CHECK. If it names neither, ask the buyer through the clarification process which they intend, because the answer changes who can bid. A separate guide to CREST and CHECK compares the two.

Two practical checks help whichever route applies. First, find the legal entity that holds the accreditation and confirm it on the scheme’s own register. Second, if the tender asks for named team members with a qualification, confirm who will actually do the work before you commit.

What should a public body test?

Test the systems that hold citizen data and the routes into them. For a council or arm’s-length body that usually means the citizen-facing portals first, then the staff systems behind them, then the connections to other bodies. Scope it system by system, because a tender that says “all systems” cannot be priced.

• Citizen service portals. Planning, licensing and benefits services, including citizen identity, household links, case confidentiality and delegated authority.
• Casework and case management systems. Case assignment, sensitive notes, attachment access, bulk exports and third-party access.
• Cross-government and supplier APIs. The interfaces to other departments, identity providers and supplier systems. See API penetration testing.
• Internal network and Active Directory. Segregation, privileged access and remote access pathways.
• Cloud configuration. AWS, Azure and GCP, with attention to UK region and audit logging.
• Staff phishing resilience. Simulations using lures such as supplier-payment fraud.

What evidence do you hand back to the buyer?

Hand back a dated report with the scope, the method, each finding with a severity score, and what has been fixed since. If the tender asks for a particular scoring format, such as CVSS, say so in your response. A retest report shows the buyer which findings are closed, which is what most evaluators want to see.

Practice varies, so treat this as practice rather than a rule. Some buyers ask for the full report under a confidentiality agreement. Others accept a summary letter that names the scope, the date and the testing company. A sample report in your tender response shows the buyer what they would receive, and a signed letter of attestation gives their assurance team a single page to file. Ask the buyer which form they will accept before you commission the work.

What does it cost?

Price follows the number of testing days, and the number of days follows the scope. UK day rates for CREST-accredited penetration testing typically run £1,100 to £1,400. The pricing page shows typical engagement lengths for each type of test, and the quote form gives an exact figure for your scope.

How EJN Labs approaches testing for public sector bodies

EJN Labs is a CREST-accredited UK penetration testing company with a dedicated public sector service for central government suppliers, local authorities, arm’s-length bodies and blue-light services. We test citizen portals, casework systems, cross-government APIs, internal networks, cloud configuration and staff phishing resilience.

The work is done by UK-based, CREST-certified testers. You get a fixed price for a defined scope, findings in a client portal as they are confirmed, CVSS-scored findings with a walkthrough call, and the report on the last day of testing. Retests are free until findings are resolved, and there are no out-of-hours, callout, cancellation or rescheduling fees. Testing is safe by default on production, with no denial of service, and out of hours slots are available.

Frequently Asked Questions

Does a council have to commission a penetration test?

We know of no rule that names a penetration test for every council. The NCSC recommends that HMG organisations use testers and companies which are part of the CHECK scheme. For a council, the ask usually comes from its own risk assessment, a contract security schedule or a framework call-off.

Should a public body choose a CHECK provider or a CREST-accredited company?

Public sector organisations can use a CREST-accredited company or a CHECK provider, depending on what their requirement states. EJN Labs is CREST-accredited. Where the tender names CHECK, use a CHECK provider. Where it names CREST, a CREST-accredited company meets it. If it names neither, ask the buyer which they intend.

Is a penetration test the same as Cyber Essentials Plus?

No. Cyber Essentials Plus is a hands-on assessor audit against a fixed set of controls. A penetration test is an attempt to breach your systems the way an adversary would. Public sector tenders often ask for Cyber Essentials Plus, a penetration test, or both, so check which the specification names.

Can we answer a tender with last year’s penetration test report?

That depends on the wording. The NCSC says a test can only validate that systems are not vulnerable to known issues on the day of the test, so buyers often ask for a recent report or one dated after a significant change. Read the evidence line in the tender and ask the buyer through clarification if the date is not stated.

What should we put in our own statement of requirements?

State the purpose, the systems in and out of scope, the types of testing, the accreditation you will accept, the reporting format and the price format. The Government Commercial Agency’s template statement of requirements for penetration testing prompts for each of these. Naming the accreditation you will accept avoids clarification questions later.

Get a quote for your tender

Tell us which systems are in scope and what the tender says about accreditation. Request a fixed-price quote and we will come back with the number of days, the price and the earliest start date.

Related: Penetration Testing Cost for UK Councils and Public Bodies, Best Penetration Testing Companies for the UK Public Sector and Government Suppliers, penetration testing for UK public sector and government suppliers, CREST and CHECK penetration testing compared, the NCSC Cyber Assessment Framework and penetration testing and Cyber Essentials Plus.