Award

Ask AI about this notice

Summarise, research or assess it with AI

View Markdown

Share this notice

Send this contract to a colleague

PCI DSS Attestation contract

H M Revenue & Customs

This public procurement record has 2 releases in its history.

AwardUpdate

25 Sep 2026 at 13:01

Award Notice
Award

21 Jul 2026 at 15:24

Award Notice
Summary of the contracting process

HM Revenue & Customs procured PCI DSS assessment and compliance services to support its annual payment-card security certification. The work covers reviews of HMRC’s e-commerce, telephone payment and point-of-sale channels; assessments against PCI DSS standards; site audits where required; compliance advice and recommendations; and preparation of Reports of Compliance and Attestations of Compliance. This is a specialist information technology security and compliance service, delivered for HMRC in the United Kingdom.

The procurement is complete and was awarded to Protection Group International Ltd, an SME, following a direct award under the Public Contracts Regulations 2015. The award date was 21 July 2026. The contract runs from 21 July 2026 to 21 July 2029, with a stated value of £102,345. The requirement was described as a single service contract, rather than divided into lots. The published procurement information identifies SME suitability and says the work supports annual PCI DSS certification; it does not set out further evaluation criteria or supplier eligibility conditions.

This award demonstrates recurring demand from HMRC for external PCI DSS assurance across several types of payment channel. Suppliers seeking to compete if the requirement returns to market would need credible expertise in PCI DSS assessment and compliance, the ability to review e-commerce, telephone payment and point-of-sale environments, and capacity to carry out site audits where needed. They would also need to provide practical compliance advice and recommendations and produce formal Reports of Compliance and Attestations of Compliance. The direct award route used for this contract is relevant evidence of how this particular requirement was placed; the award itself does not establish a competitive evaluation model for a future procurement. The SME suitability recorded for the requirement indicates that smaller suppliers may be relevant competitors.

How relevant is this notice?

Notice Information

Notice Title

PCI DSS Attestation contract

Notice Description

This is a service contract with PGI for the provision of PCI DSS assessment and compliance services to support HMRC's annual PCI DSS certification requirements. The services include reviewing HMRC's payment channels (E-commerce, Telephone Payments and Point of Sale), assessing compliance against PCI DSS standards, conducting site audits where required, providing compliance advice and recommendations, and producing the necessary Reports of Compliance (ROC) and Attestations of Compliance (AOC). The contract has a value of PS102,345 over a 36-month term. These contract was awarded following a direct award.

Notice Details

Publication & Lifecycle

Open Contracting ID
ocds-b5fd17-c7e49934-dfbe-41ca-bb92-ca3c6aaf5b6c
Publication Source
Contracts Finder
Latest Notice
https://www.contractsfinder.service.gov.uk/Notice/c384c827-991e-4f32-9353-32e5d55428c5
Current Stage
Award
All Stages
Award

Procurement Classification

Notice Type
Award Notice
Procurement Type
Standard
Procurement Category
Services
Procurement Method
Not Specified
Procurement Method Details
Other - Direct award PCR 2015
Tender Suitability
SME
Awardee Scale
SME

Common Procurement Vocabulary (CPV)

CPV Divisions

72 - IT services: consulting, software development, Internet and support

CPV Codes

72222100 - Information systems or technology strategic review services

Notice Value(s)

Tender Value
£102,345 £100K-£500K
Lots Value
Not specified
Awards Value
£102,345 £100K-£500K
Contracts Value
Not specified

Notice Dates

Publication Date
25 Sep 20261 weeks ago
Submission Deadline
Not specified
Future Notice Date
Not specified
Award Date
21 Jul 20262 months ago
Contract Period
21 Jul 2026 - 21 Jul 2029 3-4 years
Recurrence
Not specified

Notice Status

Tender Status
Complete
Lots Status
Not Specified
Awards Status
Active
Contracts Status
Not Specified

Buyer & Supplier

Contracting Authority (Buyer)

Main Buyer
H M Revenue & Customs
Contact Name
Available with D3 Tenders Premium →
Contact Email
Available with D3 Tenders Premium →
Contact Phone
Available with D3 Tenders Premium →

Buyer Location

Locality
LONDON
Postcode
SW1A 2BQ
Postcode Area
South West London
Country
England
Major Region (ITL 1)
TLI London
Basic Region (ITL 2)
TLI3 Inner London - West
Small Region (ITL 3)
TLI35 Westminster and City of London
Delivery Location
Not specified
Local Authority
Westminster
Electoral Ward
St James's
Westminster Constituency
Cities of London and Westminster

Supplier Information

Number of Suppliers
1
Supplier Name

Protection Group International

Further Information

Notice Documents

Open Contracting Data Standard (OCDS)

View full OCDS Record for this contracting process

JSON Markdown

The Open Contracting Data Standard (OCDS) is a framework designed to increase transparency and access to public procurement data in the public sector. It is widely used by governments and organisations worldwide to report on procurement processes and contracts.

Loading OCDS record...