Find a TenderAwarded without competition

Published 15 Apr 2026, 10:22 BST

Official UK procurement notice

Future of Cyber Compliance

Official notice

Authority: Department for Transport (Central government)

ServicesAward procedure without prior publication of a call for competition

Sectors: Business Services & Consultancy (79) Delivery: London (UKI)

Awarded value£346,000published contract · exc. VAT

Awarded 14 Apr 2026no call for competition

Awarded to KPMG

What is being bought

Published requirement description

Awarded contract to a supplier to undertake a business review of the Cyber Compliance Regulatory and Organisational Requirements

CPV: Business and management consultancy and related services

The lotProcurement structure

single lot · no lot value published

Lot #1This work aims to examine and deliver a set of options that outline the core minimumAwarded

This work aims to examine and deliver a set of options that outline the core minimum

capacity and capability needed to provide an effective regulator under NIS for Road,

Rail and Maritime. Regulation of aviation under NIS is out of scope of this project.

This work will need to:

articulate the duties the regulator will need to fulfill, noting not only the changes

under the Cyber Security & Resilience (NIS) Bill, but the potential for changes to

designation thresholds that may increase the number of regulated operators or

bring future transport sub-sectors into scope.

examine how other cyber regulators operate and are adapting to legislative

changes and consider the benefits of enforcement delivered through a range of

delivery partners. This may include expanding the remit of other existing

regulators to include cyber security as well as delivering some duties through

commercial partners (such as audits).

Delivery: London

Procedure terms & legal framework

From the official record

Procedure method: Award procedure without prior publication of a call for competition
Legal basis: CELEX · 32014L0024 Public Contracts Regulations 2015 (Directive 2014/24/EU)
Procurement category: Services
Notice status: Awarded without competition
Procurement threshold: Unspecified in notice
Regulatory regime: Standard
Commercial structure: Stand-alone contract (no framework)
Competition type: Direct award (no call for competition)
GPA / WTO covered: Yes (GPA)
Recurring procurement: Unspecified in notice
First published: 15 Apr 2026, 10:22 BST
Last source update: 15 Apr 2026, 10:22 BST
FTS notice number: 2026/S 000-034044
Classification (CPV): Business and management consultancy and related services
Delivery area: London (UKI)
Official registry OCID: ocds-h6vhtk-06829b Find a Tender

Why no open competition: The procurement falls outside the scope of application of the directive
Published justification: Undertaken the procurement via an existing Government Commercial Agency Framework

Commercial outcome & contract awards

Published awards, contracts and bid statistics, not a forecast

Awards 1

Awarded value £346,0001 contract exc. VAT

Bids received 8

Contracts signed 1latest 14 Apr 2026

Awarded to	Value	Date	Status
KPMG	£346,000 †	—	Awarded

Contracts

Future of Cyber Compliance · KPMG
Signed
14 Apr 2026
Value
£346,000
Status
active

Bid statistics published by the authority

Bids	SME	VCSE	Valid bid range
8bids	—	—	—

Contracting authority & participating public bodies

Department for Transport

Contracting authorityCentral GovernmentBody governed by public lawEconomic affairs London, London, SW1P 4DRContact email

Dispute resolution & review bodies

Cabinet OfficeReview body London

Bidders & participating suppliers

1 commercial party on the notice

KPMG LLPAwarded supplier London, London

Official documents & specifications

Official links; attachments are not copied

No document links were published on the notice.