Continuous Testing (PTaaS) Service Agreement

IMPORTANT: Please read this section before deciding whether you wish to register for this event. This tender is for a new direct contract for a Continuous Testing supplier to implement and provide a fully governed continuous testing framework for IT covering penetration testing, red/purple team exercises, cyber stress testing, vulnerability discovery and remediation re-testing.

The preferred supplier must support red and purple team testing that will include a multi phase continuous testing model (e.g. tag and release), where red team activity transitions into purple teaming upon detection, and findings are shared in cycle while testing continues across subsequent phases. The service must include active collaboration with Thames Water teams during purple team activities, including validation of controls, detection capability, and response processes.

The solution must demonstrate clear human oversight across testing, validation, and remediation activities, with automation used to support workflows (e.g. tracking, reporting, prioritisation) but not to replace core testing, validation, or assurance activities. The supplier must support collaborative remediation and retesting, ensuring findings are handed over, validated, and retested with Thames Water teams, with end to end traceability through to closure.

The following conditions would be considered as some of key requirements for a supplier to meet to be considered for this opportunity: • Availability of a yearly penetration test as a minimum • A fully functional PTaaS service that can deliver service in line with applicable cadences • A qualified, accredited and suitably vetted PTaaS support team Thames Water reserves the right to refine the award criteria. Please note that that deadline for asking for access to the PSQ & submitting of the PSQ is Tuesday, 3 November 2026, at 12 p.m.