The Planning Inspectorate is seeking proposals from qualified and experienced suppliers for the provision of penetration testing services. As a Public Sector organisation, we recognise the importance of safeguarding our information assets, protecting our infrastructure, and ensuring the confidentiality, integrity, and availability of our systems and data. In response to the evolving cyber threat landscape and the need to maintain robust security assurance, the Planning Inspectorate's requires the delivery of penetration testing services to proactively identify vulnerabilities, assess the effectiveness of existing security controls, improve resilience across services, and mitigate risks posed by potential cyber threats. Through the identification and remediation of vulnerabilities, the services will assist in reducing the likelihood of a costly data breach or disruption to business operations, and in turn enable the appropriate identification, assessment, and management of cyber risk across the organisation. This requirement is also informed by applicable security and regulatory expectations, including alignment with recognised government guidance and assurance schemes for penetration testing, ensuring that Planning Inspectorate continues to meet expected standards for secure system operation and risk management.

Web Application, Application Programming Interface (API), Infrastructure, Large Language Model (LLM), and Cloud Testing (including Microsoft 365 and Microsoft Azure environments) The supplier shall conduct thorough and methodical penetration testing across Web Applications, Application Programming Interfaces, internal and external infrastructure, Large Language Model implementations, and cloud platforms (including Microsoft 365 and Microsoft Azure). This shall include both authenticated and unauthenticated testing, as well as internal and external perspectives, to ensure a comprehensive assessment of the organisation's attack surface. Internal and external testing coverage Testing shall encompass both external threat scenarios (simulating attacks from outside the organisation) and internal threat scenarios (simulating insider threats or compromised credentials), ensuring a holistic evaluation of security posture across all layers of the environment. Vulnerability validation and re-testing The supplier shall validate identified vulnerabilities through controlled exploitation techniques to confirm their existence and potential impact. Following remediation, the supplier shall perform re-testing activities to verify that vulnerabilities have been effectively addressed and that no residual risk remains. Authorisation and non-disruptive testing All testing activities must be formally authorised in advance and conducted in a controlled and non-disruptive manner, ensuring no adverse impact on live services, business operations, or data integrity. The supplier shall adhere to agreed rules of engagement, change control processes, and escalation procedures throughout the engagement.