# Provision of Army Digital Services Security & Vulnerability Assessments Specialist & Technical Capability \(DInfoCom/0212\)

> Contract award record from UK public-sector procurement sources.

## Key facts

- Public buyer: [MINISTRY OF DEFENCE](/buyers/ministry-of-defence/contract-awards)
- Contract winner: [NCC GROUP SECURITY SERVICES LIMITED](/contract-winners/ncc-group-security-services/public-sector-contract-awards)
- Award value: £459,000
- Tender value: £459,000
- Award date: 27 July 2022
- Published: 21 September 2022
- Contract start: 1 October 2022
- Contract end: 30 September 2024
- Stage: awarded
- Procurement category: services
- Notice ID: 496afb84-832e-49e2-a8cb-a5b6430f5aa6-573277
- OCID: ocds-b5fd17-78275948-9210-49c0-92c9-c610861b6a45

## Description

There is a requirement for specialist technical assistance to provide code assisted Vulnerability Assessments \(VA\) and Penetration Testing \(PT\) security assessments on both new and in-service applications/infrastructure\. Security assessments, PT's and VA's are used to identify vulnerabilities in code and infrastructure \(networks, servers, operating systems and applications\) that could potentially be exploited\. Attackers can be hackers trying to gain access into our network or systems, state sponsored activists or an insider threat\. They will aim to either extract information that is held on applications and hosting environments or cause extensive disruption to services\. ADS has 2 hosting environments, the Army Hosting Environment \(AHE\) and Joint Server Farm \(JSF\)\. The JSF is accessible from the internet via the Defence Gateway and holds information classified at Official\. The AHE holds Official, Secret and Sensitive Personal Information which if extracted would not only be damaging to the Army's reputation, it could jeopardise potential operations\. It could also incur fines from the Information Commissioner if there were a breach of personal information\. An attack to disrupt any of the services ADS provides would significantly erode the Army's ability to operate, as many of the systems support day to day activities and processes\. It is therefore imperative that vulnerabilities are identified and remedied/mitigated to reduce the risk of these occurrences\. All new applications expecting to be hosted on the AHE or the JSF must have a vulnerability assessment before being allowed onto the environment to ensure there are no weaknesses which could potentially allow an attacker access to the wider infrastructure and applications\. Existing applications, hosting environments and platforms must be VA'd on a rolling programme to ensure any changes do not increase vulnerability and potential for being attacked\.

## Related contract awards

- [AWS Direct Connect](/contracts/ocds-b5fd17-fabccdc0-7367-4298-98fe-e292fc1aa6d2): MINISTRY OF DEFENCE
- [NOVUS Should Cost Model](/contracts/ocds-b5fd17-3343cead-19de-486b-b0b7-5ae4abd8030b): MINISTRY OF DEFENCE
- [715904572 \(DInfoCom/0332\) - The Provision of Fixed Voice Official Site Surveys \(UK 07\)](/contracts/ocds-b5fd17-ad1141d5-0a7b-4987-b1ce-0453c67316d8): Ministry of Defence
- [Cyber Incident Response Service](/contracts/ocds-b5fd17-f6f8578c-7217-4c29-960e-c0a7a2fb635e): UK SHARED BUSINESS SERVICES LIMITED
- [UKRI Penetration Testing Services](/contracts/ocds-b5fd17-02ab3ede-3735-4f6d-a280-5b5eea766387): UK SHARED BUSINESS SERVICES LIMITED
- [UKRI-6204 Set of Facilitated NCSC CAF Workshops](/contracts/ocds-b5fd17-6e125bf8-b7e2-4d83-a8d7-42c56448342f): UK Research and Innovation

## Source

[View the original notice on Contracts Finder](https://www.contractsfinder.service.gov.uk/Notice/496afb84-832e-49e2-a8cb-a5b6430f5aa6-573277)