Public tender now requires compliance with the penetration testing circular, what do we need at our scale?

Tender commissions are extremely strict when checking circular compliance. If the TSE-approved firm's stamp and the certified testers' registration numbers are not included in the report, your submission will be eliminated immediately during the technical evaluation. Under no circumstances should you submit that report from the freelancer.

We gathered quotes from three TSE-approved firms for a similar tender last month. For a scope covering two web apps and a single server, the quotes came in at 55,000 TL, 75,000 TL, and 90,000 TL. If there are fewer than 15 days left before the tender deadline, firms may also charge a rush fee.

Copy-paste the penetration testing clause from the specifications directly to at least two TSE-approved firms. They will send you a scoping form. If you exclude non-essential modules while filling it out, you will cut down both the testing duration and your overall costs.

Will your software be deployed on local servers inside the public agency's own data center, or will you deliver it as a cloud service? For on-prem installations, source code analysis and application testing are sometimes sufficient, whereas external hosting mandates infrastructure testing as well.

There are plenty of players on the market slapping the TSE logo on their websites while subbing out the actual work. Before signing any contract verify for yourself whether the firm is listed on the official TSE directory of active, registered penetration testing organizations and avoid paying cuts to middlemen.

During our first public tender we didn't know the proper procedures and submitted a report from an ordinary cybersecurity agency. The tender commission disqualified our bid due to the lack of document standards. We couldn't even contest it; the 30,000 TL we spent went down the drain, along with 6 months of tender prep. In public procurement, you must follow the rules to the letter.

The TSE-approved firm requirement is non-negotiable; also, make sure the test date on the report falls within the retroactive 6- or 12-month validity window specified in the tender documentation.

You're right. Taking measures without an inventory leaves doors you haven't seen open.

If I were you, I'd go this route.

My question might sound amateurish, sorry about that. The harder it is to reverse a decision, the slower you should make it.

I'm also curious if anyone does it differently.

Timely topic. Don't rely on a single measure; go layer by layer.

If you post the result here, it will help others too.

let me write how its done in practice. like having backups accessible on the same network and with the same identity makes them part of the target.

hope this helps.

You're right.

I've been dealing with this for a long time. Trying to do this alone is the most expensive way.

Proven by experience.

i agree, and Id like to emphasize that. btw processes without records never improve, because you dont know what to fix.

if the notifciation path is long notifications don't arrive; missing notifications mean delayed incident detection. honestly if I were you I'd go this route.

I agree.

I have no experience with penetration testing circular, so Im asking. like the biggest time-waster for us was not knowing who had the final say.

Good luck with that.

there's a trap here let me mention it then the answer varies greatly by industry; there is no one-size-fits-all rule.

hope this helps.

Good call starting this thread.