External Penetration Testing and Secure Code Review Services

⁠⁠⁠Overview

The Clean Energy Regulator (CER) is seeking the services of one or more suitably qualified suppliers to provide external penetration testing and secure code review services for CER digital systems and platforms on a recurring basis across the 2026–27 financial year.

Testing activities under this procurement will be conducted on a planned, periodic basis, with defined, targeted testing activities occurring each quarter, aligned to CER priorities.

Objectives

The objective of this procurement is to obtain independent assurance regarding the security posture of selected CER services and to identify vulnerabilities requiring remediation as part of CER's ongoing Authority to Operate (AtO) and continuous monitoring obligations.

Scope

The scope includes:

• Targeted penetration testing of web applications, portals, APIs, and supporting services
• Targeted secure code reviews, focused on high‑risk functionality and previously identified issue classes

Systems and Capabilities to be Tested

The agency operates predominantly on a Microsoft Azure platform, with Microsoft Dynamics 365 (CRM) as the core system of record for users, organisations and scheme administration, integrated with Entra ID B2C for secure external authentication. User portals and .NET APIs are hosted in Azure and exposed via Azure API Management.

Testing will include the following CER systems and capabilities:

• Public‑facing and authenticated online portals
• Registries supporting environmental and energy schemes
• APIs used for system‑to‑system integration, including those accessed by external parties
• Data services and data access mechanisms
• Select new initiatives

Deliverables

For each testing activity or work package undertaken under this procurement, the supplier must provide the following deliverables, unless otherwise agreed in writing with CER:

• Penetration Testing Plan
• Penetration Testing Report
• Code Review Report (where applicable)
• Close‑Out and Reporting Support

Contractor Requirements

• Tenderers are invited to respond primarily on a fixed price basis. Where a Time and Materials approach is proposed, tenderers must clearly justify why this model represents better value for money for CER
• CER permits the use of artificial intelligence (AI) enabled tools by tenderers and suppliers to support the delivery of services under this procurement
• CER information, data, code, or testing artefacts must not be input into public or consumer AI services where data may be retained, reused, or used for training purposes
• AI models will be reviewed by CER prior to use

Instructions to Tenderers

CER is under no obligation to award work to a single supplier, or to award all services described in this procurement to any one supplier. Selection of one or more suppliers will be based on CER's assessment of value for money, capability, capacity, and alignment with CER's testing requirements at the time of engagement.

Government Furnished Items

The agency will provide:

• CER workstation / laptop
• CER user account
• Access to relevant environments (including allow listing tester external IP addresses)
• CER Program Wiki access
• M365 Copilot access to support understanding documentation
• eCarbon Authority to Operate documentation
• Previous penetration test reports
• Quarterly ACSC CHIPs reporting
• Access to relevant design documentation (Architecture Document Catalog - Overview)
• Complete list of API end points
• Access to relevant GitHub repositories augmented with GitHub Copilot where requested
• Relevant accounts with certificates
• Relevant non-production environments
• Test accounts as required
• Stakeholder engagement plan
• A CER engagement manager to facilitate the activity