For each agreed testing scope, the NHS Scotland Health Boards requires a written CHECK report with CVSS (latest version throughout the contract) score and recommendations for each reported vulnerability. The report is to be provided to the designated Information Asset Owner for each system and to the NHS Scotland Health Board’s representative (this will be agreed with the winning supplier) within 5 working days of the completion of testing.

The contract was advertised through the Public Contracts Scotland – Tender Portal through the Scottish Government DPS Lot 3 Cybersecurity