Carrying out penetration tests

This tender, published under an open procedure (Offenes Verfahren) and governed by the VgV (Vergabeverordnung - Regulation on Public Procurement), is from Germany and concerns the execution of penetration tests. The contracting authority is seeking professional cybersecurity services to assess the security posture of its IT systems, networks, and applications. Penetration testing, also known as ethical hacking, involves simulating cyber-attacks to identify vulnerabilities that could be exploited by malicious actors. Typical requirements for such a service include defining the scope of testing (e.g., external network, internal network, web applications, APIs), employing industry-standard methodologies (e.g., OWASP, PTES), providing detailed reports on identified vulnerabilities, their severity, and actionable remediation recommendations. Bidders will be assessed on their technical expertise, certifications (e.g., OSCP, CEH), experience in performing similar tests for public sector or large organizations, and their proposed testing approach and reporting format. The goal is to proactively enhance the security defenses of the contracting authority.