---
title: "Local Government Cyber Incident Reponse"
ocid: "ocds-b5fd17-af5c8f12-b7a9-472d-b173-0da8bfd27805"
canonical_url: "https://d3tenders.com/contract/?ocid=ocds-b5fd17-af5c8f12-b7a9-472d-b173-0da8bfd27805"
markdown_url: "https://d3tenders.com/contract/ocds-b5fd17-af5c8f12-b7a9-472d-b173-0da8bfd27805.md"
json_url: "https://d3tenders.com/contract/ocds-b5fd17-af5c8f12-b7a9-472d-b173-0da8bfd27805.json"
source: "Contracts Finder"
current_stage: "Award"
buyer: "MINISTRY OF HOUSING, COMMUNITIES AND LOCAL GOVERNMENT"
published: "2025-09-16"
---

# Local Government Cyber Incident Reponse

Buyer: MINISTRY OF HOUSING, COMMUNITIES AND LOCAL GOVERNMENT  
Current stage: Award  
OCID: ocds-b5fd17-af5c8f12-b7a9-472d-b173-0da8bfd27805

[View canonical contract page](https://d3tenders.com/contract/?ocid=ocds-b5fd17-af5c8f12-b7a9-472d-b173-0da8bfd27805)  
[Download OCDS JSON](https://d3tenders.com/contract/ocds-b5fd17-af5c8f12-b7a9-472d-b173-0da8bfd27805.json)

## Summary

The Ministry of Housing, Communities and Local Government (MHCLG) has completed the procurement process for a Cyber Incident Response service aimed at supporting English local authorities in handling sophisticated cyberattacks. The contract, valued at £18.5 million, involves a one-year duration with an option for four additional one-year extensions. The procurement was conducted using a selective method through a call-off from the Crown Commercial Service RM3764.3 Cyber Security Services 3 DPS, classifying under the CPV code 72222300 for Information Technology Services. The service will be activated based on classifications by the National Cyber Security Centre and will be integrated into existing incident management processes, offering 24/7 access. This opportunity will see KPMG LLP providing these vital services, with operations commencing on 1st September 2025 and concluding on 31st August 2026, primarily targeting the region of England.

This tender presents significant opportunities for large-scale IT service providers specialising in cyber security. Engaging with this contract allows businesses to align with government standards, significantly amplifying their market presence and credibility. Companies experienced in dynamic purchasing systems and those willing to coordinate closely with the Ministry and local authorities will find this an optimal chance for expansion. The ongoing support required by the contract could facilitate businesses in fostering strong, long-lasting relationships with governmental bodies, thereby enhancing their portfolio in the public sector domain. This initiative not only underpins a proactive defence stance against cyber threats but also encourages innovation and expertise exchange in the technology service industry.

## Notice

The Ministry of Housing, Communities and Local Government (MHCLG) require a Cyber Incident Response (CIR) service to operate on behalf of the local government sector. MHCLG are looking to ensure that English local authorities receive support to respond to the most sophisticated and bespoke cyberattacks. MHCLG will use the National Cyber Security Centre's (NCSC's) framework for classifying incidents to activate the service at C3 and above, or at a lower level as MHCLG see necessary. To align this approach with other government departments and the advice of the NCSC (that all UK organisations use an NCSC-assured Cyber Incident Response provider when dealing with cyber incidents) a NCSC Assured Service Provider (ASP) is required. The supplier will work with MHCLG to introduce the service to local government, and we will look to integrate the service into existing incident management processes for 24/7 access. Local authorities will report incidents to the NCSC and once the NCSC have categorised the incident and the threshold for service activation is met, or MHCLG approve a below threshold activation, local authorities will be eligible to receive incident response support. The contract will be for one-year, with the option to extend for up to four additional years in one-yearly increments. MHCLG will appoint two suppliers. Service activation will rotate between these. In the instance of an event impacting many local authority organisations at once, both suppliers may be deployed. Additional information: This contract is a call off from the Crown Commercial Service RM3764.3 Cyber Security Services 3 DPS.

## Key Details

| Field | Value |
| --- | --- |
| Publication source | Contracts Finder |
| Latest notice | https://www.contractsfinder.service.gov.uk/Notice/a257e855-e405-40f8-9586-a8d60e9df439 |
| Notice type | Award Notice |
| Procurement type | Dynamic |
| Procurement category | Services |
| Procurement method | Selective |
| Procurement method details | Call-off from a dynamic purchasing system |
| Tender suitability | Not specified |
| Awardee scale | Large |
| All stages | Award |

## Dates

| Field | Value |
| --- | --- |
| Publication date | 16 Sep 2025 |
| Submission deadline | 12 Feb 2025 |
| Future notice date | Not specified |
| Award date | 28 Aug 2025 |
| Contract period | 31 Aug 2025 - 31 Aug 2026 |
| Recurrence | Not specified |

## Values

| Field | Value |
| --- | --- |
| Tender value | £18,500,000 |
| Lots value | Not specified |
| Awards value | £18,500,000 |
| Contracts value | Not specified |

## Status

| Field | Value |
| --- | --- |
| Tender status | Complete |
| Lots status | Not specified |
| Awards status | Active |
| Contracts status | Not specified |

## Buyer

| Field | Value |
| --- | --- |
| Main buyer | MINISTRY OF HOUSING, COMMUNITIES AND LOCAL GOVERNMENT |
| Locality | LONDON |
| Post town | South West London |
| Postcode | SW1P 4DF |
| Country | England |
| ITL 1 | TLI London |
| ITL 2 | TLI3 Inner London - West |
| ITL 3 | TLI35 Westminster and City of London |
| Local authority | Westminster |
| Electoral ward | St James's |
| Westminster constituency | Cities of London and Westminster |
| Delivery location | TLC North East (England), TLD North West (England), TLF East Midlands (England), TLG West Midlands (England), TLH East (England), TLJ South East (England), TLK South West (England) |

## Supplier

| Field | Value |
| --- | --- |
| Number of suppliers | 1 |
| Supplier names | KPMG |

## CPV Codes

### Divisions

- 72 - IT services: consulting, software development, Internet and support

### Codes

- 72222300 - Information technology services

## Release History

- 16 Sep 2025 at 10:41 - AwardUpdate - Award Notice - https://www.contractsfinder.service.gov.uk/Notice/a257e855-e405-40f8-9586-a8d60e9df439
- 4 Sep 2025 at 14:32 - Award - Award Notice - https://www.contractsfinder.service.gov.uk/Notice/a257e855-e405-40f8-9586-a8d60e9df439

## Documents

- https://www.contractsfinder.service.gov.uk/Notice/a257e855-e405-40f8-9586-a8d60e9df439
  16th September 2025 - Awarded contract notice on Contracts Finder
- https://www.contractsfinder.service.gov.uk/Notice/Attachment/712f830e-b955-44a9-a61f-c47cc5366b67
  Copy of final Order Form.

## Provenance

This Markdown file is an alternate public rendering of the D3 Tenders contract record. The canonical page is https://d3tenders.com/contract/?ocid=ocds-b5fd17-af5c8f12-b7a9-472d-b173-0da8bfd27805. The underlying structured data is available as OCDS JSON at https://d3tenders.com/contract/ocds-b5fd17-af5c8f12-b7a9-472d-b173-0da8bfd27805.json.