Public sector penetration testing procurement in Ontario

Ontario public bodies do not buy testing the way a company does. The rules that decide who can bid, at what value, and where the report may be stored sit in procurement directives and in FIPPA or MFIPPA, not in the security requirement itself.

Last reviewed 2026-08-31Written by Jacob Masse, TrazTech Inc.

An Ontario public body buying a penetration test runs a competitive process whose shape is set by value, not by risk. Below roughly $100,000 CAD most broader public sector organisations may invite a small number of suppliers. Above it, and above the trade agreement threshold that sits a little higher and is adjusted every two years, the requirement goes out openly on the provincial tenders portal. Nothing about that is specific to security, which is why security buyers and finance departments talk past each other on timelines.

Which Ontario bodies buy this, and under which rules

The phrase "Ontario public sector" covers organisations with very different procurement obligations. Work out which one you are dealing with first. It decides the paperwork and the timeline.

Health information is the fork that matters most. A hospital is a health information custodian under PHIPA, and a testing firm that touches records in that environment is normally an agent or a service provider under the Act, which brings written terms about use, retention and secure disposal that a standard statement of work does not contain. If your test scope includes a clinical system, expect the contract to be negotiated by a privacy office rather than by procurement.

Vendor of record and why it decides who bids

Ontario makes heavy use of pre-qualified supplier arrangements. A vendor of record arrangement is competed once, and for its term the buyer can go to the firms on it through a much shorter second-stage process instead of running a fresh open competition. For a testing firm this is the whole game: if the category you sell into is covered by an arrangement you are not on, you will watch requirements you could have delivered go to firms already qualified, and there is no appeal against that.

1. Find out whether the work you sell sits inside an existing arrangement, and when that arrangement expires. Refresh windows are the only entry point.
2. Register on the provincial tenders portal and set alerts on the security and professional services categories, not on the word pentest, which almost never appears in a title.
3. Read one closed solicitation in full before writing anything. The mandatory requirements are where bids die, and they are usually about insurance, references and screening rather than technical merit.
4. Confirm you can meet the screening and insurance conditions before bidding. Commercial general liability and professional liability limits are stated in the documents and are not negotiable after the fact.
5. Price on the published evaluation weighting. Where price is forty per cent of the score, a strong technical response that is twice the median price loses to a competent one at the median.

What the security requirement usually says

Ontario solicitations for testing are typically written by a security team and reviewed by procurement, which produces a recognisable shape. Expect named methodology requirements, usually the OWASP testing guide or NIST SP 800-115, named certifications for the assigned testers, a requirement that findings be manually verified, and a mandatory retest. That last one appears more often in public sector documents than in private ones, and the retest and remediation verification terms are worth pricing carefully because the obligation can run months past the report.

The clause most often missed by bidders is about where the evidence lives. FIPPA and MFIPPA do not impose a general rule that records must stay in Canada, but a great many Ontario institutions impose one by contract anyway, and some health sector agreements go further. Read the data handling schedule before you price, since a requirement to keep all working notes, screenshots and the draft report inside Canadian infrastructure changes which tooling you may use.

If you are the Ontario buyer rather than the bidder

Two things from the buying side. Write the scope before the solicitation. A requirement that says "penetration testing services" with no asset list produces bids that cannot be compared and an award that gets challenged. The scoping questionnaire produces a scope document you can attach as an appendix, which is the cheapest way to get comparable pricing.

And separate the annual test from the ongoing work. Ontario institutions routinely bundle a penetration test, a vulnerability management service and advisory hours into one award, then discover the test is a small part of a large contract and the testing quality was never evaluated. What the different products are is set out on assessment versus test, and pricing for each is on penetration testing cost in Canada.

Common questions