AWARD OUTCOME
What happened
DVSA has published an active award to KPMG LLP for penetration testing and IT health checks under the CCS Cyber Security 3 framework (RM3764iii). The published award value is £533,333.33 and the stated period runs from 29 September 2026 to 28 September 2028.
Published outcomeKPMG LLP is the sole named supplier on the single published award.
Market significanceThis is a UK public-sector cyber assurance call-off, classified as computer audit and testing services, with delivery locations stated across the UK and other territories.
AWARDED SUPPLIERS AND LOTS
1 supplier record analysed
KPMG LLP
99% confidenceAward ocds-b5fd17-759e7abd-b298-495c-ba18-a5c52bc820c4-1 · 533333.33 GBP · active award
View supporting evidence
The single active award names KPMG LLP as supplier and gives an award value of £533,333.33. Supplier verification identifies KPMG LLP (company number OC301540) by exact-name match.
LIFECYCLE
Award or contract stage
Notice status
99% confidenceAwarded contract notice; award status active
View supporting evidence
The process display status is "awarded" and the award record status is "active".
Award recorded
98% confidence29 September 2026
View supporting evidence
The award record date is 2026-09-29T00:00:00+01:00.
Notice published
99% confidence9 October 2026
View supporting evidence
The award notice datePublished is 2026-10-09T09:11:09+01:00.
Contract signature
99% confidenceUnknown
View supporting evidence
The supplied award notice data does not explicitly state that a contract was signed.
Stated contract start
98% confidence29 September 2026
View supporting evidence
The published contract period start date is 2026-09-29T00:00:00+01:00.
Stated contract end
98% confidence28 September 2028
View supporting evidence
The published contract period end date is 2028-09-28T23:59:59+01:00.
VALUES
Published values explained
Published award value
99% confidence£533,333.33 GBP
View supporting evidence
The sole award value is stated as amount 533333.33, currency GBP.
Value allocation
97% confidenceAllocated to the sole published award and supplier
View supporting evidence
One award is supplied, naming one supplier, KPMG LLP.
Pricing breakdown
99% confidenceUnknown
View supporting evidence
No rate card, pricing schedule, tax treatment, or cost breakdown is supplied in the published data.
TIMELINE
Procurement timeline
Bid submission deadline
98% confidence29 May 2026, 14:00 BST
View supporting evidence
The tender period end date is 2026-05-29T14:00:00+01:00.
Award date
98% confidence29 September 2026
View supporting evidence
The award record is dated 2026-09-29T00:00:00+01:00.
Stated service period
98% confidence29 September 2026 to 28 September 2028
View supporting evidence
The published contract period gives these start and end dates.
Award notice publication
99% confidence9 October 2026
View supporting evidence
The award notice was published at 2026-10-09T09:11:09+01:00.
SCOPE
What was awarded
Requirement
99% confidencePenetration testing and IT health checks
View supporting evidence
The procurement title is "Penetration testing/IT Health Checks 2026".
Service classification
99% confidenceCPV 72800000 — Computer audit and testing services
View supporting evidence
The primary CPV classification is 72800000 with this description.
Framework
99% confidenceCCS Cyber Security 3 (RM3764iii) call-off
View supporting evidence
The description states that this was a call-off from CCS Framework Cyber Security 3 RM3764iii.
Delivery geography
96% confidenceUnited Kingdom, Channel Islands, Isle of Man, British Overseas Territories, Europe and Rest of the World
View supporting evidence
These countries/regions are listed as delivery addresses in the tender item.
Lot structure
99% confidenceNo lot allocation published
View supporting evidence
No lots are supplied and the award has no lot IDs.
PROCEDURE
Procedure and competition
Procurement method
99% confidenceSelective
View supporting evidence
The published procurement method is "selective".
Procedure detail
99% confidenceCall-off from a framework agreement
View supporting evidence
The procurement method details state "Call-off from a framework agreement".
SME suitability flag
95% confidenceYes
View supporting evidence
The tender suitability field marks SME as true.
VCSE suitability flag
95% confidenceNo
View supporting evidence
The tender suitability field marks VCSE as false.
Bidder count and evaluation results
99% confidenceUnknown
View supporting evidence
No number of bids, evaluation scores, ranking, or award rationale is supplied.
CONTRACT TERMS
Published contract terms
Term
97% confidenceApproximately 24 months
View supporting evidence
The stated period runs from 29 September 2026 to 28 September 2028.
Extension options
99% confidenceUnknown
View supporting evidence
No extension or option terms are supplied.
Contract form and signature status
99% confidenceUnknown
View supporting evidence
The supplied award notice does not provide executed-contract or signature information.
COMMERCIAL VIEW
Commercial observations
Route to market
98% confidenceFramework call-off rather than an open standalone procedure
View supporting evidence
The notice identifies the procurement as a selective call-off from a framework agreement.
Commercial visibility
97% confidenceA total award value and term are published, but detailed deliverables and pricing are not
View supporting evidence
The notice provides title, classification, value and period but no detailed specification or price breakdown.
DATA QUALITY
Gaps and source limitations
Award versus contract execution
99% confidenceThe record supports an active published award and stated service period, not an explicit statement of signed contract execution.
View supporting evidence
The award status is active, but no signature or executed-contract field is supplied.
Published scope detail
99% confidenceInformation not supplied in the published notice: detailed testing scope, deliverables, volumes and service levels.
View supporting evidence
Only the title, brief framework call-off description and CPV classification are provided.
Competition data
99% confidenceInformation not supplied in the published notice: bid count, evaluation methodology, scores and award rationale.
View supporting evidence
No such fields are present in the supplied data.
Lot and pricing detail
99% confidenceInformation not supplied in the published notice: lot allocation, individual work-package values and price breakdown.
View supporting evidence
No lots are supplied and no pricing detail beyond the total award value is present.
SOURCE DATA LIMITATIONS
Information not supplied in the published notice
- The published data does not explicitly confirm that a contract was signed or executed; it supports an active award and a stated contract period.
- No detailed statement of work, testing volumes, performance measures, pricing breakdown, bid count, scores, award rationale, extension options or renewal plan is supplied.
- No lot titles or lot-level allocation is published.
MARKET THEMES
Relevant award themes
DVSAKPMG LLPpenetration testingIT health checksCCS Cyber Security 3RM3764iiicomputer audit and testing services
COMMON QUESTIONS
About this award
Who won the DVSA penetration testing and IT health checks award?
KPMG LLP is the sole named supplier on the published active award.
What is the published award value?
The published value is £533,333.33 GBP.
Was this an open tender?
No. The notice describes it as a selective call-off from a framework agreement, CCS Cyber Security 3 RM3764iii.
When does the stated contract period end?
The published end date is 28 September 2028.
ProcuraAxis award analysis supplements, but does not replace, the official award notice, contract data or procurement documents. “Awarded” does not by itself prove that a contract has been signed.