Security testing and review of NSI Rainbow MS3 environment

NS&I

What the buyer published

NS&I Security would like a provider to assess the following (not exhaustive):

Identity & Access Management (IAM) Assessment

Endpoint & Device Security Assessment

Email & Phishing Protection Assessment

Data Security & Data Protection Assessment

Security Monitoring & SIEM Assessment

Zero Trust & Network Security Assessment

An empty stage is useful. For example, no tender stage usually means the buyer used a framework or gave the contract directly.

◌ Planning none

◌ Tender none

● Award on record

● End date 24 Apr 2025, expected

Judged against the rules we publish. How we decide.

Penetration testing A security test of a set scope, such as a pen test, IT health check or red team.

Governance, risk and audit Certification, audit, risk assessment or advice on how security is run, such as ISO 27001, Cyber Essentials or CAF.

Multi-service and framework contracts A framework or call-off contract that many buyers can use.