Official UK procurement notice
Network and Information Security (NIS) Audit Services for HSCNI
Authority: Regional Business Services Organisation Procurement and Logistics Service (Central government)
What is being bought2 lots · detail below
Published requirement descriptionAn Assured Audit Service Provider from the National Cyber Security Centre (NCSC) Cyber Resilience Audit Scheme is to complete an on-site Network and Information Security (NIS) Compliance Audit of the essential service and supporting network and information systems. The objective of the NIS Audit Services is to assist the NIS Competent Authority (CA) in assessing the OES level of compliance with regulation 10 of the Network and Information Systems Regulations 2018. The Compliance Audit will use the (NCSC) Cyber Assessment Framework (CAF) which determines the minimum standard expected from the OES. Assessment will be made against each Contributing Outcome and associated Indicators of Good Practice (IGP) and “Not Good” practice as outlined in the CAF. The scope of the NIS Compliance Audit is to be against the OES essential service, as defined by the OES. This will encompass all critical network and information systems and processes necessary for the continued delivery of the essential service.
CPV: Computer audit and testing services · Computer audit services · IT services: consulting, software development, Internet and support · Information technology requirements review services · Project management consultancy services · Software integration consultancy services · Software programming and consultancy services · Systems and technical consultancy services
Lots and requirements (2)Procurement structure
2 lots · all with a published value (£450,000 together) · same evaluation weights on every lotLot #1BHSCT, NIASAwardedRenewalPublished value£150,000
The source published no individual description for this lot.
Lot #2SEHSCT, SHSCT, WHSCT, NHSCTAwardedRenewalPublished value£300,000
The source published no individual description for this lot.
What it takes to wini
How this buyer will score bids.
The evaluation criteria and weights exactly as published on the notice, grouped by family (price, quality, social value and so on).
Evaluation split and conditions of participation as published; the tender pack may add morei
How this buyer will score bids.
The evaluation criteria and weights exactly as published on the notice, grouped by family (price, quality, social value and so on).
Published sub-criteria (5)
- AC01 - Methodology: 10%
- AC02 – Project Plan: 25%
- AC03 – Associated Risks: 25%
- Price: 30%
- Social Value: 10%
Published award criteria (5)
- AC01 - Methodology
- AC02 – Project Plan
- AC03 – Associated Risks
- Price
- Social Value
- Price carries 30 of 100 points: a 10% discount moves about 3 points. The method statement decides this lot, not the discount.
Price arithmetic assumes straight proportional scoring; the tender pack may use another formula.
Procedure terms & legal framework
From the official record- Procedure method
- Open procedure
- Legal basis
- UKPGA · 2023/54 Procurement Act 2023
- Procurement category
- Services
- Notice status
- Awarded
- Procurement threshold
- Above threshold (FTS publication)
- Regulatory regime
- Standard
- Commercial structure
- Stand-alone contract (no framework)
- Competition type
- Competitive procedure
- GPA / WTO covered
- Unspecified in notice
- Recurring procurement
- Unspecified in notice
- First published
- 7 Jul 2025, 13:27 BST
- Last source update
- 27 May 2026, 10:14 BST
- Award evaluation window
- Submission end – 30 Apr 2026
- Authority reference
6190559- FTS notice number
2026/S 000-018049- Latest notice
- Contract details notice (UK7)
- Classification (CPV)
- Delivery area
- Official registry OCID
ocds-h6vhtk-0559e2Find a Tender- Contract terms summary
One invoice per Trust to be submitted upon the completion of Final Audit Report
How it was run
Official notice- Submission deadline
- 26 Mar 2026, 15:00 GMT
- Clarification deadline
- 13 Mar 2026, 15:00 GMT
- Submission channel
- Official e-sourcing portal
- Electronic submission
- Allowed
- Accepted languages
- en
Timeline
7 Jul 2025 → 27 May 2026 · 10 dates- Planning notice published7 Jul 2025, 13:27 BST
- Market engagement25 Jul 2025, 23:59 BST
This is a Prior Information Notice to seek engagement with the market place to gather information associated with the supply and delivery of a Network and Information Systems (NIS) Compliance Audit. To this end the Business Services Organisation, Procurement and Logistics Service on behalf of Health and Social Care Northern Ireland (HSCNI), wish to engage with potential suppliers to obtain a market view of the potential requirements through the completion of a Questionnaire. Any interested suppliers are required to submit their response through the eTendersNI secure messaging area of the Call for Tender (CfT) Ref: 6008215. All correspondence in relation to this Pre-Market Engagement exercise must be communicated via the eTendersNI secure messaging area. Suppliers will be required to submit their completed Questionnaire no later than 3pm on 25 July 2025. To register on eTendersNI and access the Questionnaire, please use the following link: - etendersni.gov.uk ↗ and locate CfT Ref: 6008215. Suppliers should also note that any interest shown does not constitute a commitment to participate in any future tendering exercise.
- Tender notice published240 days ago27 Feb 2026, 15:21 GMT
- Clarification questions by226 days ago13 Mar 2026, 15:00 GMT
- Submission deadline213 days ago26 Mar 2026, 15:00 GMT
- Assessment summaries sent182 days ago27 Apr 2026, 00:00 BST
- Contract starts179 days ago30 Apr 2026, 00:00 BST
- Award decision expected by178 days ago30 Apr 2026, 23:59 BST
- Standstill ends168 days ago10 May 2026, 23:59 BST
- Latest notice published152 days ago27 May 2026, 10:14 BST
Notice history
10 events · 4 releases on Find a Tender · since 7 Jul 2025- Preliminary market engagement notice published7 Jul 2025, 13:27 BSTUK2
- Tender notice published27 Feb 2026, 15:21 GMTUK4
- Published value published: £450,00027 Feb 2026, 15:21 GMT
- Status changed to active27 Feb 2026, 15:21 GMT
- Procurement method changed27 Feb 2026, 15:21 GMT
- Deadline published: 26 Mar 2026, 15:00 GMT27 Feb 2026, 15:21 GMT
- Contract award notice published27 Apr 2026, 16:31 BSTUK6
- Status changed to complete27 Apr 2026, 16:31 BST
- Contract signature expected11 May 2026, 23:59 BSTscheduled
- Contract details notice published27 May 2026, 10:14 BSTUK7
Routine re-releases (4)
- 2025-07: 1 release · 7 Jul 2025
Commercial outcome & contract awards
Published awards, contracts and bid statistics, not a forecast| Awarded to | Value | Date | Status |
|---|---|---|---|
| Lot 1 · BHSCT, NIAS1 award | |||
| Arcanum Information Security LtdSME12 May 2026 – 11 May 2030 · up to 11 May 2031Extensions: The inclusion of a 12-month extension option is primarily to provide flexibility in the event that follow-up audit schedules are adjusted or delayed. Audit timelines can shift due to factors such as resource availability, changes in regulatory requirements, or unforeseen operational constraints. By allowing for an extension, we ensure continuity of service without the need for a new procurement process, maintain compliance with NIS obligations, and avoid any gaps that could impact audit readiness or certification status. | £150,000 | 24 Apr 2026 | Awarded |
| Lot 2 · SEHSCT, SHSCT, WHSCT, NHSCT1 award | |||
| Arcanum Information Security LtdSME12 May 2026 – 11 May 2030 · up to 11 May 2031Extensions: The inclusion of a 12-month extension option is primarily to provide flexibility in the event that follow-up audit schedules are adjusted or delayed. Audit timelines can shift due to factors such as resource availability, changes in regulatory requirements, or unforeseen operational constraints. By allowing for an extension, we ensure continuity of service without the need for a new procurement process, maintain compliance with NIS obligations, and avoid any gaps that could impact audit readiness or certification status | £300,000 | 24 Apr 2026 | Awarded |
Contracts
Lot 1: BHSCT, NIAS · Arcanum Information Security LtdSME
- Signed
- 11 May 2026
- Value
- £150,000
- Period
- 18 May 2026 – 17 May 2030 · up to 17 May 2031 with extensions
- Status
- active
- Extensions
- The inclusion of a 12-month extension option is primarily to provide flexibility in the event that follow-up audit schedules are adjusted or delayed. Audit timelines can shift due to factors such as resource availability, changes in regulatory requirements, or unforeseen operational constraints. By allowing for an extension, we ensure continuity of service without the need for a new procurement process, maintain compliance with NIS obligations, and avoid any gaps that could impact audit readiness or certification status.
2 agreed KPIs: Completion of audits in accordance with the agreed audit plan and timetable · Final Audit reports submitted in full by Monday 30th November 2026
- Completion of audits in accordance with the agreed audit plan and timetable, 100% of audits completed by their scheduled due dates
- Final Audit reports submitted in full by Monday 30th November 2026, 100% of audit reports submitted to Trust by Monday 30th November 2026
Lot 2: SEHSCT, SHSCT, WHSCT, NHSCT · Arcanum Information Security LtdSME
- Signed
- 11 May 2026
- Value
- £300,000
- Period
- 18 May 2026 – 17 May 2030 · up to 17 May 2031 with extensions
- Status
- active
- Extensions
- The inclusion of a 12-month extension option is primarily to provide flexibility in the event that follow-up audit schedules are adjusted or delayed. Audit timelines can shift due to factors such as resource availability, changes in regulatory requirements, or unforeseen operational constraints. By allowing for an extension, we ensure continuity of service without the need for a new procurement process, maintain compliance with NIS obligations, and avoid any gaps that could impact audit readiness or certification status.
2 agreed KPIs: Completion of audits in accordance with the agreed audit plan and timetable · Final Audit reports submitted in full by Monday 30th November 2026
- Completion of audits in accordance with the agreed audit plan and timetable, 100% of audits completed by their scheduled due dates
- Final Audit reports submitted in full by Monday 30th November 2026, 100% of audit reports submitted to Trust by Monday 30th November 2026
Bid statistics published by the authority
| Lot | Bids | SME | VCSE | Valid bid range |
|---|---|---|---|---|
| 1 · BHSCT, NIAS | 2final-stage tenders | 1 | 0 | — |
| 2 · SEHSCT, SHSCT, WHSCT, NHSCT | 2final-stage tenders | 1 | 0 | — |
Contracting authority & participating public bodies
Bidders & participating suppliers
1 commercial party on the notice- ARCANUM INFORMATION SECURITY LIMITEDAwarded supplier
Official documents & specifications (6)
Official links; attachments are not copiedNotices published for this procedure
- Contract details notice Contract details notice on Find a Tender
- Contract details notice Contract details notice on Find a Tender
- Contract award notice Contract award notice on Find a Tender
- Contract award notice Contract award notice on Find a Tender
- Tender notice Tender notice on Find a Tender
- Preliminary market engagement notice Preliminary market engagement notice on Find a Tender