Award

Ask AI about this notice

Summarise, research or assess it with AI

View Markdown

Share this notice

Send this contract to a colleague

PCI QSA pro 2026

Glasgow City Council

This public procurement record has 2 releases in its history.

Award

07 Sep 2026 at 01:00

OJEU - F3 - Contract Award Notice
Tender

15 Apr 2026 at 01:00

OJEU - F2 - Contract Notice
Summary of the contracting process

Glasgow City Council, with Glasgow Life (Culture & Sport Glasgow), procured PCI Qualified Security Assessor services for Glasgow. The appointed supplier is required to validate the council’s compliance with the current Payment Card Industry Data Security Standard (PCI DSS), protect cardholder data and produce the required Attestation of Compliance and Report on Compliance for both roles held by the council. The single service covers scoping and readiness review, on-site assessment activities, technical testing, documentation and reporting, Approved Scanning Vendor scanning, and ongoing ad-hoc support. This is an information security compliance and assurance requirement, with related service classifications covering IT security consultancy, technical testing and business consultancy. Delivery is for the council’s operations in Glasgow.

The procurement is complete and has been awarded following a one-stage open procedure. One lot was evaluated on quality and price, weighted 50% and 45% respectively. Eight electronic bids were received, all from small and medium-sized enterprises. The submission deadline and bid opening were 19 May 2026 at 12:00, and the award period began the same day. 1 Sequence Cyber Limited was selected. The contract was signed on 11 August 2026, is active, and is valued at £275,404. The estimated procurement value was £450,000. The contract runs from 11 June 2026 to 11 June 2029, with an option for Glasgow City Council to extend it by up to 24 months in total. Bids had to remain valid until 16 September 2026.

This opportunity demonstrates established demand from Glasgow’s public-sector organisations for end-to-end PCI DSS assurance rather than a narrow audit. Credible suppliers need Qualified Security Assessor capability, with the expertise and capacity to deliver readiness and scoping work, on-site assessment, technical testing, ASV scanning, formal compliance reporting and continuing ad-hoc support. The requirement favours teams able to protect and assess cardholder data across complex council operations and produce both AoC and RoC documentation. Suppliers would need to identify named staff and their qualifications, maintain the required financial standing and insurance cover, and show two comparable examples delivered within the previous three years. Each example needed to demonstrate work for a client of similar size or complexity, including relevant subcontractor arrangements where applicable.

How relevant is this notice?

Notice Information

Notice Title

PCI QSA pro 2026

Notice Description

Glasgow City Council requires s supplier to validate its compliance with the current version of the PCI Data Security Standard (PCI DSS), ensure protection of cardholder data, and obtain the necessary documentation Attestation of Compliance (AoC) and Report on Compliance (RoC) for both roles the council holds. This procurement will be conducted via the Public Contracts Scotland - Tender portal (PCS-T). We will apply a one stage Open procedure. Bidders must self-certify their adherence to the conditions of participation via the SPD in PSC-T, and may be required to submit Means of Proof before contract award. Bidders must refer to the specific requirements listed in Section III in this OJEU Contract Notice when completing the SPD in PCS-T.

Lot Information

Lot 1

The council invites tender bids for the provision of PCI QSA pro 2026.Glasgow City Council requires a Qualified Security Assessor to validate Glasgow City Council's compliance with the current version of the Payment Card Industry Data Security Standard (PCI DSS), ensure the protection of cardholder data, and obtain the required documentation, including the Attestation of Compliance (AoC) and Report on Compliance (RoC), for both roles the Council holds. At a high level the Services will consist of: i. Scoping and Readiness Review ii. Onsite Assessment Activities iii. Technical Testing iv. Documentation and Reporting v. ASV Scanning vi. Ongoing Support (Ad-hoc support) For further information please see the GCC006549CPU PCI QSA pro 2026 - ITT on public contract Scotland tender -PCST. Economic operators may be excluded from this competition if they are in any of the situations referred to in regulation 58 of the Public Contracts (Scotland) Regulations 2015.

Renewal: Option to extend for periods of up to an additional 24 months (in total) at the sole discretion of Glasgow City Council.

Notice Details

Publication & Lifecycle

Open Contracting ID
ocds-r6ebe6-0000827084
Publication Source
Public Contracts Scotland
Latest Notice
https://www.publiccontractsscotland.gov.uk/search/show/search_view.aspx?ID=SEP563967
Current Stage
Award
All Stages
Tender, Award

Procurement Classification

Notice Type
OJEU - F3 - Contract Award Notice
Procurement Type
Standard
Procurement Category
Services
Procurement Method
Open
Procurement Method Details
Open procedure
Tender Suitability
Not specified
Awardee Scale
SME

Common Procurement Vocabulary (CPV)

CPV Divisions

72 - IT services: consulting, software development, Internet and support

79 - Business services: law, marketing, consulting, recruitment, printing and security

CPV Codes

72220000 - Systems and technical consultancy services

72222300 - Information technology services

79411000 - General management consultancy services

Notice Value(s)

Tender Value
£450,000 £100K-£500K
Lots Value
£450,000 £100K-£500K
Awards Value
Not specified
Contracts Value
£275,404 £100K-£500K

Notice Dates

Publication Date
7 Sep 20261 months ago
Submission Deadline
19 May 2026Expired
Future Notice Date
Not specified
Award Date
Not specified
Contract Period
11 Jun 2026 - 11 Jun 2029 3-4 years
Recurrence
This contract has an initial term of 36 months with options to extend for periods of up to 24 months (in total). Reprocurement may therefore take place any time from 2030 onwards.

Notice Status

Tender Status
Complete
Lots Status
Complete
Awards Status
Not Specified
Contracts Status
Active

Buyer & Supplier

Contracting Authority (Buyer)

Main Buyer
Glasgow City Council
Additional Buyers

Glasgow Life (Culture & Sport Glasgow)

Contact Name
Available with D3 Tenders Premium →
Contact Email
Available with D3 Tenders Premium →
Contact Phone
Available with D3 Tenders Premium →

Buyer Location

Locality
GLASGOW
Postcode
G2 1DU
Postcode Area
Glasgow
Country
Scotland
Major Region (ITL 1)
TLM Scotland
Basic Region (ITL 2)
TLM3 West Central Scotland
Small Region (ITL 3)
TLM32 Glasgow City
Delivery Location
TLM82 Glasgow City
Local Authority
Glasgow City
Electoral Ward
Anderston/City/Yorkhill
Westminster Constituency
Glasgow North East

Supplier Information

Number of Suppliers
1
Supplier Name

1 Sequence Cyber Limited

Further Information

Notice Documents

  • https://www.publiccontractsscotland.gov.uk/search/show/search_view.aspx?ID=APR553880
    PCI QSA pro 2026 - Glasgow City Council requires s supplier to validate its compliance with the current version of the PCI Data Security Standard (PCI DSS), ensure protection of cardholder data, and obtain the necessary documentation Attestation of Compliance (AoC) and Report on Compliance (RoC) for both roles the council holds. This procurement will be conducted via the Public Contracts Scotland - Tender portal (PCS-T). We will apply a one stage Open procedure. Bidders must self-certify their adherence to the conditions of participation via the SPD in PSC-T, and may be required to submit Means of Proof before contract award. Bidders must refer to the specific requirements listed in Section III in this OJEU Contract Notice when completing the SPD in PCS-T.
  • https://www.publiccontractsscotland.gov.uk/search/show/search_view.aspx?ID=SEP563967
    PCI QSA pro 2026 - Glasgow City Council requires s supplier to validate its compliance with the current version of the PCI Data Security Standard (PCI DSS), ensure protection of cardholder data, and obtain the necessary documentation Attestation of Compliance (AoC) and Report on Compliance (RoC) for both roles the council holds. This procurement will be conducted via the Public Contracts Scotland - Tender portal (PCS-T). We will apply a one stage Open procedure. Bidders must self-certify their adherence to the conditions of participation via the SPD in PSC-T, and may be required to submit Means of Proof before contract award. Bidders must refer to the specific requirements listed in Section III in this OJEU Contract Notice when completing the SPD in PCS-T.

Open Contracting Data Standard (OCDS)

View full OCDS Record for this contracting process

JSON Markdown

The Open Contracting Data Standard (OCDS) is a framework designed to increase transparency and access to public procurement data in the public sector. It is widely used by governments and organisations worldwide to report on procurement processes and contracts.

Loading OCDS record...