---
title: "Penetration testing/IT Health Checks 2026"
ocid: "ocds-b5fd17-759e7abd-b298-495c-ba18-a5c52bc820c4"
canonical_url: "https://d3tenders.com/contract/?ocid=ocds-b5fd17-759e7abd-b298-495c-ba18-a5c52bc820c4"
markdown_url: "https://d3tenders.com/contract/ocds-b5fd17-759e7abd-b298-495c-ba18-a5c52bc820c4.md"
json_url: "https://d3tenders.com/contract/ocds-b5fd17-759e7abd-b298-495c-ba18-a5c52bc820c4.json"
source: "Contracts Finder"
current_stage: "Award"
buyer: "Driver and Vehicle Standards Agency"
published: "2026-10-09"
---

# Penetration testing/IT Health Checks 2026

Buyer: Driver and Vehicle Standards Agency  
Current stage: Award  
OCID: ocds-b5fd17-759e7abd-b298-495c-ba18-a5c52bc820c4

[View canonical contract page](https://d3tenders.com/contract/?ocid=ocds-b5fd17-759e7abd-b298-495c-ba18-a5c52bc820c4)  
[Download OCDS JSON](https://d3tenders.com/contract/ocds-b5fd17-759e7abd-b298-495c-ba18-a5c52bc820c4.json)

## Summary

DVSA (the Driver and Vehicle Standards Agency) procured penetration testing and IT health checks to assess the security of its IT systems. This is a cyber-security testing service, classified as computer audit and testing services. The requirement was delivered for DVSA, with delivery locations stated to include the United Kingdom, Europe, the Channel Islands, the Isle of Man, British Overseas Territories and the rest of the world. The procurement was a call-off from the Crown Commercial Service Cyber Security 3 framework. It therefore concerned specialist testing and assurance work delivered under that framework, rather than a standalone open competition. The listed scope identifies penetration testing and IT health checks; no more detailed breakdown of systems, testing methods or deliverables is described.

The procurement is complete and has been awarded to KPMG LLP. The award was made on 29 September 2026, for £533,333.33. The contract period runs from 29 September 2026 to 28 September 2028. The estimated procurement value was also £533,333.33. This was a selective call-off from a framework agreement, not a new open tender. The tender submission deadline was 29 May 2026 at 2pm. The available evaluation and award information does not set out specific scoring criteria. The service was marked as suitable for small and medium-sized enterprises, although the selected supplier was a large organisation. There are no separate lots or multiple awardees reported.

This award shows that DVSA buys penetration testing and IT health checks through the Cyber Security 3 framework, with a contract spanning multiple delivery locations. Suppliers seeking to compete for the same requirement when it returns to market would need to provide credible specialist cyber-security testing and assurance, with the capacity to support the geographic reach indicated. The stated SME suitability suggests that smaller firms may be able to meet the requirement, either directly or as part of a delivery team, while the award demonstrates that a large supplier was selected for this call-off. The procurement provides evidence of demand for these specific testing services at a substantial scale. Relevant experience delivering penetration testing and IT health checks for public-sector IT environments would be commercially pertinent.

## Notice

THIS WAS A CALL - OFF FROM A CCS FRAMEWORK CYBER SECURITY 3 RM3764iii

## Key Details

| Field | Value |
| --- | --- |
| Publication source | Contracts Finder |
| Latest notice | https://www.contractsfinder.service.gov.uk/Notice/5504362d-70e2-4f39-8aa8-45e464b6ae93 |
| Notice type | Award Notice |
| Procurement type | Framework |
| Procurement category | Services |
| Procurement method | Selective |
| Procurement method details | Call-off from a framework agreement |
| Tender suitability | SME |
| Awardee scale | Large |
| All stages | Award |

## Dates

| Field | Value |
| --- | --- |
| Publication date | 9 Oct 2026 |
| Submission deadline | Not specified |
| Future notice date | Not specified |
| Award date | 29 Sep 2026 |
| Contract period | 29 Sep 2026 - 28 Sep 2028 |
| Recurrence | Not specified |

## Values

| Field | Value |
| --- | --- |
| Tender value | £533,333 |
| Lots value | Not specified |
| Awards value | £533,333 |
| Contracts value | Not specified |

## Status

| Field | Value |
| --- | --- |
| Tender status | Complete |
| Lots status | Not specified |
| Awards status | Active |
| Contracts status | Not specified |

## Buyer

| Field | Value |
| --- | --- |
| Main buyer | Driver and Vehicle Standards Agency |
| Locality | BRISTOL |
| Postcode area | Bristol |
| Postcode | BS5 0DA |
| Country | England |
| ITL 1 | TLK South West (England) |
| ITL 2 | TLK5 West of England |
| ITL 3 | TLK51 Bristol, City of |
| Local authority | Bristol, City of |
| Electoral ward | Lawrence Hill |
| Westminster constituency | Bristol East |
| Delivery location | Not specified |

## Supplier

| Field | Value |
| --- | --- |
| Number of suppliers | 1 |
| Supplier names | KPMG LLP |

## CPV Codes

### Divisions

- 72 - IT services: consulting, software development, Internet and support

### Codes

- 72800000 - Computer audit and testing services

## Release History

- 9 Oct 2026 at 09:11 - Award - Award Notice - https://www.contractsfinder.service.gov.uk/Notice/5504362d-70e2-4f39-8aa8-45e464b6ae93

## Documents

- https://www.contractsfinder.service.gov.uk/Notice/5504362d-70e2-4f39-8aa8-45e464b6ae93
  9th October 2026 - Awarded contract notice on Contracts Finder
- https://www.contractsfinder.service.gov.uk/Notice/Attachment/aeacb64d-3048-4824-af7b-8315b5fb5346
  n/a

## Provenance

This Markdown file is an alternate public rendering of the D3 Tenders contract record. The canonical page is https://d3tenders.com/contract/?ocid=ocds-b5fd17-759e7abd-b298-495c-ba18-a5c52bc820c4. The underlying structured data is available as OCDS JSON at https://d3tenders.com/contract/ocds-b5fd17-759e7abd-b298-495c-ba18-a5c52bc820c4.json.