---
title: "Static application security testing"
ocid: "ocds-b5fd17-4ec8ba4c-79bb-42cf-b485-efedb8b540d1"
canonical_url: "https://d3tenders.com/contract/?ocid=ocds-b5fd17-4ec8ba4c-79bb-42cf-b485-efedb8b540d1"
markdown_url: "https://d3tenders.com/contract/ocds-b5fd17-4ec8ba4c-79bb-42cf-b485-efedb8b540d1.md"
json_url: "https://d3tenders.com/contract/ocds-b5fd17-4ec8ba4c-79bb-42cf-b485-efedb8b540d1.json"
source: "Contracts Finder"
current_stage: "Award"
buyer: "POLICE DIGITAL SERVICE"
published: "2026-08-13"
---

# Static application security testing

Buyer: POLICE DIGITAL SERVICE  
Current stage: Award  
OCID: ocds-b5fd17-4ec8ba4c-79bb-42cf-b485-efedb8b540d1

[View canonical contract page](https://d3tenders.com/contract/?ocid=ocds-b5fd17-4ec8ba4c-79bb-42cf-b485-efedb8b540d1)  
[Download OCDS JSON](https://d3tenders.com/contract/ocds-b5fd17-4ec8ba4c-79bb-42cf-b485-efedb8b540d1.json)

## Summary

The Police Digital Service procured an enterprise-grade software platform providing Static Application Security Testing (SAST) and Software Composition Analysis (SCA). The service is intended to secure and improve software across a complex policing environment by integrating security scanning into Azure DevOps pipelines. It is designed to apply build-time security and code-quality gates, identifying vulnerabilities, code smells and dependency risks before software is deployed. The platform also supports multiple programming languages and frameworks, allowing scanning to be standardised across diverse services. The requirement is classified as software and information systems and falls within services procurement. Delivery is for the Police Digital Service in the United Kingdom. The procurement was suitable for small and medium-sized enterprises.

The procurement is complete and was awarded to Softcat PLC on 26 June 2026. It used a selective procedure as a call-off from a framework agreement. The tender submission deadline was 5 June 2026 at 2pm. The awarded contract value is £19,750. The contract period runs from 1 July 2026 to 30 June 2027. One supplier was selected for the requirement. The award covers the SAST and SCA software platform and associated service described for the Police Digital Service. The published outcome records the award as active, with the contract running for one year. The procurement was categorised as a services requirement rather than goods or works.

This award demonstrates a defined public-sector demand for application security tooling that can operate within Azure DevOps and support secure software development at scale. Competitors seeking similar work with the Police Digital Service would need a credible SAST and SCA platform, with dependable scanning for vulnerabilities, code quality issues and software dependencies before deployment. Broad support for programming languages and frameworks would be important because the buyer operates diverse services. Suppliers should also be able to demonstrate how their tooling supports consistent security gates, remediation workflows, NCSC-aligned secure development principles, and defensible audit and compliance requirements in a policing environment. The requirement was considered suitable for SMEs, so a focused specialist with the necessary enterprise capability could be relevant when comparable demand returns.

## Notice

PDS requires an enterprise-grade platform for Static Application Security Testing (SAST) and Software Composition Analysis (SCA), which is essential for maintaining secure and compliant software across a complex policing environment. By embedding the software into Azure DevOps pipelines, we can enforce consistent security and code quality gates at build time, ensuring vulnerabilities, code smells, and dependency risks are identified early and remediated before deployment. This aligns directly with NCSC secure development principles and supports defensible audit and compliance requirements. Additionally, the software's deep support for multiple languages and frameworks allows us to standardise scanning across diverse services

## Key Details

| Field | Value |
| --- | --- |
| Publication source | Contracts Finder |
| Latest notice | https://www.contractsfinder.service.gov.uk/Notice/721f6931-0b23-48b0-8cda-44c11281592b |
| Notice type | Award Notice |
| Procurement type | Framework |
| Procurement category | Services |
| Procurement method | Selective |
| Procurement method details | Call-off from a framework agreement |
| Tender suitability | SME |
| Awardee scale | Large |
| All stages | Award |

## Dates

| Field | Value |
| --- | --- |
| Publication date | 13 Aug 2026 |
| Submission deadline | 5 Jun 2026 |
| Future notice date | Not specified |
| Award date | 26 Jun 2026 |
| Contract period | 1 Jul 2026 - 30 Jun 2027 |
| Recurrence | Not specified |

## Values

| Field | Value |
| --- | --- |
| Tender value | £19,750 |
| Lots value | Not specified |
| Awards value | £19,750 |
| Contracts value | Not specified |

## Status

| Field | Value |
| --- | --- |
| Tender status | Complete |
| Lots status | Not specified |
| Awards status | Active |
| Contracts status | Not specified |

## Buyer

| Field | Value |
| --- | --- |
| Main buyer | POLICE DIGITAL SERVICE |
| Locality | LONDON |
| Postcode area | Central London |
| Postcode | EC2M 4WN |
| Country | England |
| ITL 1 | TLI London |
| ITL 2 | TLI4 Inner London - East |
| ITL 3 | TLI43 Haringey and Islington |
| Local authority | Islington |
| Electoral ward | Clerkenwell |
| Westminster constituency | Islington South and Finsbury |
| Delivery location | Not specified |

## Supplier

| Field | Value |
| --- | --- |
| Number of suppliers | 1 |
| Supplier names | Softcat PLC |

## CPV Codes

### Divisions

- 48 - Software package and information systems

### Codes

- 48000000 - Software package and information systems

## Release History

- 13 Aug 2026 at 10:30 - Award - Award Notice - https://www.contractsfinder.service.gov.uk/Notice/721f6931-0b23-48b0-8cda-44c11281592b

## Documents

- https://www.contractsfinder.service.gov.uk/Notice/721f6931-0b23-48b0-8cda-44c11281592b
  13th August 2026 - Awarded contract notice on Contracts Finder

## Provenance

This Markdown file is an alternate public rendering of the D3 Tenders contract record. The canonical page is https://d3tenders.com/contract/?ocid=ocds-b5fd17-4ec8ba4c-79bb-42cf-b485-efedb8b540d1. The underlying structured data is available as OCDS JSON at https://d3tenders.com/contract/ocds-b5fd17-4ec8ba4c-79bb-42cf-b485-efedb8b540d1.json.