---
title: "Penetration testing/IT Health Checks 2026"
ocid: "ocds-b5fd17-f92e1abb-2e96-4cc4-bd97-5e3383e7b55c"
canonical_url: "https://d3tenders.com/contract/?ocid=ocds-b5fd17-f92e1abb-2e96-4cc4-bd97-5e3383e7b55c"
markdown_url: "https://d3tenders.com/contract/ocds-b5fd17-f92e1abb-2e96-4cc4-bd97-5e3383e7b55c.md"
json_url: "https://d3tenders.com/contract/ocds-b5fd17-f92e1abb-2e96-4cc4-bd97-5e3383e7b55c.json"
source: "Contracts Finder"
current_stage: "Award"
buyer: "Driver and Vehicle Standards Agency"
published: "2026-09-22"
---

# Penetration testing/IT Health Checks 2026

Buyer: Driver and Vehicle Standards Agency  
Current stage: Award  
OCID: ocds-b5fd17-f92e1abb-2e96-4cc4-bd97-5e3383e7b55c

[View canonical contract page](https://d3tenders.com/contract/?ocid=ocds-b5fd17-f92e1abb-2e96-4cc4-bd97-5e3383e7b55c)  
[Download OCDS JSON](https://d3tenders.com/contract/ocds-b5fd17-f92e1abb-2e96-4cc4-bd97-5e3383e7b55c.json)

## Summary

The Driver and Vehicle Standards Agency (DVSA) procured penetration testing and IT health checks, classified as computer audit and testing services. The work is intended to assess the security and resilience of the agency’s information technology through security testing and health-check activity. Delivery covers the United Kingdom, the Channel Islands, the Isle of Man, Europe, British Overseas Territories and other locations worldwide. This is a public-sector cyber security services requirement for a supplier able to operate across a wide geographical footprint and support DVSA’s technology assurance needs. The procurement is categorised as services and was structured as a call-off from the Crown Commercial Service Cyber Security 3 framework, RM3764iii. It was suitable for small and medium-sized enterprises, making it relevant to established specialist cyber security consultancies as well as larger testing providers.

The procurement is complete and has been awarded following a selective call-off from the Cyber Security 3 framework, RM3764iii. Bids were due by 29 May 2026 at 2pm. DVSA awarded the contract to Instil Software Limited on 27 August 2026 for £533,333.33 including the stated currency of GBP. The contract runs from 27 August 2026 to 26 August 2028. The original procurement estimate was £533,333 GBP. One supplier is identified as the award recipient. The published information describes the requirement as penetration testing and IT health checks, but does not set out separate lots or detailed scoring criteria. The process therefore demonstrates a framework-based, selective route rather than an open competition, with supplier selection made through the relevant framework call-off arrangements.

This award is evidence of sustained demand from DVSA for specialist cyber security assurance, rather than a one-off purchase of general IT support. Suppliers well placed for a future requirement would need demonstrable capability in penetration testing, IT health checks, computer audit and technical security testing, with the operational capacity to support a major public-sector organisation. The broad delivery footprint means credible providers should be able to work across the UK and potentially internationally, either directly or through an established delivery network. The successful supplier is an SME, showing that the requirement can be delivered by a focused specialist rather than only a large systems integrator. Competitors should also understand and be able to use the relevant CCS cyber security framework call-off route, and should be prepared to provide repeatable, well-governed testing and assurance services at substantial scale.

## Notice

THIS WAS A CALL - OFF FROM A CCS FRAMEWORK CYBER SECURITY 3 RM3764iii

## Key Details

| Field | Value |
| --- | --- |
| Publication source | Contracts Finder |
| Latest notice | https://www.contractsfinder.service.gov.uk/Notice/2b9321c1-1326-4797-8337-5c6f00b037d1 |
| Notice type | Award Notice |
| Procurement type | Framework |
| Procurement category | Services |
| Procurement method | Selective |
| Procurement method details | Call-off from a framework agreement |
| Tender suitability | SME |
| Awardee scale | SME |
| All stages | Award |

## Dates

| Field | Value |
| --- | --- |
| Publication date | 22 Sep 2026 |
| Submission deadline | Not specified |
| Future notice date | Not specified |
| Award date | 27 Aug 2026 |
| Contract period | 27 Aug 2026 - 26 Aug 2028 |
| Recurrence | Not specified |

## Values

| Field | Value |
| --- | --- |
| Tender value | £533,333 |
| Lots value | Not specified |
| Awards value | £533,333 |
| Contracts value | Not specified |

## Status

| Field | Value |
| --- | --- |
| Tender status | Complete |
| Lots status | Not specified |
| Awards status | Active |
| Contracts status | Not specified |

## Buyer

| Field | Value |
| --- | --- |
| Main buyer | Driver and Vehicle Standards Agency |
| Locality | BRISTOL |
| Postcode area | Bristol |
| Postcode | BS5 0DA |
| Country | England |
| ITL 1 | TLK South West (England) |
| ITL 2 | TLK5 West of England |
| ITL 3 | TLK51 Bristol, City of |
| Local authority | Bristol, City of |
| Electoral ward | Lawrence Hill |
| Westminster constituency | Bristol East |
| Delivery location | Not specified |

## Supplier

| Field | Value |
| --- | --- |
| Number of suppliers | 1 |
| Supplier names | INSTIL SOFTWARE LIMITED |

## CPV Codes

### Divisions

- 72 - IT services: consulting, software development, Internet and support

### Codes

- 72800000 - Computer audit and testing services

## Release History

- 22 Sep 2026 at 11:28 - Award - Award Notice - https://www.contractsfinder.service.gov.uk/Notice/2b9321c1-1326-4797-8337-5c6f00b037d1

## Documents

- https://www.contractsfinder.service.gov.uk/Notice/2b9321c1-1326-4797-8337-5c6f00b037d1
  22nd September 2026 - Awarded contract notice on Contracts Finder
- https://www.contractsfinder.service.gov.uk/Notice/Attachment/743b3e65-9428-431d-95c3-f97beab8d598
  n/a

## Provenance

This Markdown file is an alternate public rendering of the D3 Tenders contract record. The canonical page is https://d3tenders.com/contract/?ocid=ocds-b5fd17-f92e1abb-2e96-4cc4-bd97-5e3383e7b55c. The underlying structured data is available as OCDS JSON at https://d3tenders.com/contract/ocds-b5fd17-f92e1abb-2e96-4cc4-bd97-5e3383e7b55c.json.