Cyber security tenders cover penetration testing, IT health checks, security monitoring, incident response, security software and consultancy. The CPV 2008 list has no dedicated cyber code, so the live list on this page combines a few specific codes with a title-keyword filter on IT services notices. It can miss a notice that uses neither. Below: what buyers ask cyber suppliers for, including Cyber Essentials under PPN 014, and how small firms win. Our tender eligibility checker is coming soon. Until then, tell us your trade and postcode to join the free weekly list of live tenders, starting soon.
What buyers usually ask cyber security suppliers for
A security firm is asked about its own security as well as its service. The pack sets the detail. These are the points we can source.
Cyber Essentials and Cyber Essentials Plus for your own firm
Selling security services doesn’t exempt you from the buyer’s own security questions. PPN 014 applies from 24 February 2025 to central government departments, executive agencies, non-departmental public bodies and NHS bodies. They are asked to require Cyber Essentials, or equivalent controls, where a contract involves, for example, citizens’ personal information or ICT systems that store or process OFFICIAL-level data. A testing firm that holds client data or reports may meet those characteristics.
Certification is renewed annually, and evidence of Cyber Essentials (or equivalent) is needed before award. Cyber Essentials Plus adds remote and on-site vulnerability testing. A Cyber Essentials certificate covers the legal entity that holds it, and PPN 014 advises buyers to consider whether third parties that will share the data also need certification (Annex C Q8), so check whether subcontractors or freelancers you bring in would need it too. The PPN also says the scheme shouldn’t be applied to every contract as a matter of course. See Cyber Essentials for government contracts.
ISO 27001
ISO 27001 is a separate standard from Cyber Essentials. Some packs name it, and we make no claim about how many. If yours does, check whether it asks for certification with your bid or evidence of a security management approach, and whether a pending certificate is accepted.
Government-assured testing schemes and staff clearance
Government buyers may ask for assured testing schemes or cleared staff. We haven’t sourced the scheme details for this page, so we name none. Read the pack for exactly what it asks, whether it applies to the firm or to individual testers, and how long it takes to get, because a gap can rule you out before the evaluation starts.
Insurance
Professional indemnity and cyber cover are set by the buyer, and we can’t give typical figures. A test can disrupt a live system, so read the limits and exclusions in the pack closely. See professional indemnity insurance.
Few notices say any of this up front. In the week to 10 Oct 2026, 29 of the 470 live notices in our data (about 6%) named certifications in the notice itself. The rest is in the pack.
How to win cyber security contracts
Lots, frameworks and quick quotes
On above-threshold contracts, buyers must consider lots, or give reasons for not using them, so a security contract may be split into testing, monitoring and incident response. Bid where your team is strongest. Some security work is bought through frameworks, where each job is a call-off, so getting onto the framework can matter more than the call-off itself.
From 1 January 2026, services contracts fall under the full Act rules at £135,018 including VAT for central government and £207,720 for other authorities. Below that, when a buyer invites tenders, section 85 bars a separate suitability stage before tenders are submitted, but the buyer can still assess suitability at the award stage (Welsh devolved buyers follow their own rules, and call-offs from frameworks are excluded). If a buyer advertises a below-threshold contract worth £12,000 or more (central government, including NHS trusts) or £30,000 or more (other authorities), including VAT, it must first publish a below-threshold tender notice (section 87). Buyers can also invite quotes from chosen suppliers without advertising.
Evidence: methodology, sample reports and team certifications
Evaluators want to see how you work. Set out your methodology step by step, include a redacted sample report, and list the certifications held by the people who will do the work, with names and roles. Say how findings are rated, how quickly critical issues are reported and how you handle client data.
Social value: skills and training
Central government departments, their executive agencies and non-departmental public bodies must give social value at least a 10% weighting on above-threshold contracts where it is relevant and proportionate (PPN 002). NHS bodies are outside its scope. For a security firm that might mean apprenticeships, placements or training in security skills for local people. Be specific and measurable.
Pitfalls to check before you commit
- Scope creep. Pin down what is in and out: the number of systems, applications and environments, and whether authenticated testing is included.
- Retest pricing. Check whether retesting is in the price or charged separately, and within what window.
- Out-of-hours testing windows. Evening and weekend testing costs staff time, so price it.
Who issues cyber security tenders
Public buyers of every kind commission security work, from central government to councils. IT services (division 72) had 30 live notices in the week to 10 Oct 2026, and cyber security is only part of that. For related work, see IT services tenders, IT support tenders and software tenders.
Questions
Is there a CPV code for cyber security?
No. The CPV 2008 list has no dedicated cyber code. The live list on this page uses a few specific codes (security software and data security software development, computer audit and testing services, and security software packages) plus a title-keyword filter on IT services notices, using terms such as cyber, penetration test, IT health check, security operations, incident response and ISO 27001. A notice that uses neither the codes nor those words won't appear.
Do cyber security suppliers need Cyber Essentials Plus themselves?
Only if the buyer asks. PPN 014 points central government departments, executive agencies, non-departmental public bodies and NHS bodies to Cyber Essentials, or equivalent controls, for contracts with certain characteristics, and describes Cyber Essentials Plus as the more rigorous assessment for higher-risk contracts. Check the pack for which level it names.
Where are penetration testing contracts advertised?
Notices appear on Find a Tender and Contracts Finder. Some testing is bought through frameworks, and below the thresholds a buyer can invite quotes from chosen suppliers without advertising. Titles vary, with terms such as IT health check, security testing and vulnerability assessment all in use, so watch more than one phrase.
Can a small cyber consultancy win public sector work?
Yes, it is possible. On above-threshold contracts, buyers must consider splitting a contract into lots. Before inviting tenders for a below-threshold contract they must consider the barriers small firms face. Look for a testing, monitoring or advisory lot that matches your team, or a smaller contract below the thresholds.
Is ISO 27001 required for government security contracts?
Not as a general rule we can source. Some packs name it, so check whether the buyer wants certification with your bid or evidence of a security management approach, and whether a pending certificate is accepted. PPN 014 is about Cyber Essentials, not ISO 27001.