How to bid for security contracts in the UK

UK public buyers spend about £1.2 billion a year on private security. Manned guarding at council civic centres. Mobile patrol on housing estates. Concierge in NHS Trust receptions. CCTV monitoring in city-centre control rooms. Door supervision at leisure centres. Most of it goes to a handful of national contractors who learned to bid 30 years ago and a long tail of regional SMEs who keep winning on local presence and TUPE knowledge.

Bidding for it isn't the same as bidding for cleaning. Security adds three regimes on top of the Procurement Act 2023. SIA licensing for every operative. The ACS Approved Contractor Scheme audit on the company. And BS 7858 vetting that buyers will check on every name on the rota.

Here's the path. What to gather. Where to look. What gets you binned.

• Every front-line operative needs an individual SIA licence under the Private Security Industry Act 2001. The company needs ACS (Approved Contractor Scheme) for any meaningful public-sector work.
• BS 7858 vetting on every name. Buyers will spot-check it. A failed reference on a guard you put forward is a discretionary exclusion ground.
• Manned guarding CPVs: 79710 (security services), 79711 (alarm monitoring), 79713 (guard services), 79714 (surveillance), 79715 (patrol). Soft FM bundles often sit under 79993.
• Public liability £10m is the security floor. Employer's liability £10m. Most local authorities ask for both.
• TUPE applies to almost every public-sector security re-tender. The incumbent's staff transfer to you on existing terms. Get the ELI (Employee Liability Information) inside the 28-day window or you're bidding blind.
• Hourly rate floor in 2026 is around £12.21 (NLW). Realistic public-sector charge-out is £14 to £18 per officer-hour depending on shift pattern, training, and uplift.

What's in this guide¶

• What public buyers buy under "security"
• SIA licensing in plain English
• ACS, the Approved Contractor Scheme
• BS standards every security buyer references
• Insurance and indemnity (the £10m floor)
• Where security tenders live
• TUPE, the bit most new bidders trip on
• Pricing manned guarding without going broke
• Common SQ questions for security
• Procurement Act 2023 + AI disclosure
• First-time bidder paperwork checklist

What public buyers buy under "security"¶

"Security contract" is loose. Most public buyers procure one or two of the following.

• Manned guarding. Static officers at a fixed site. Reception, gate, internal patrol. Council civic centres, NHS Trust head offices, leisure centres, schools out of hours.
• Mobile patrol. A van crew that visits multiple sites overnight. Housing estates, retail parks, council depots, school estates.
• Key holding and alarm response. The crew that turns up when an alarm goes off. Often paired with mobile patrol.
• CCTV monitoring. Public-space surveillance from a control room. Local-authority town-centre cameras, NHS Trust security operations centres.
• Door supervision. Leisure centres, council-run nightclubs (rare), licensed council events.
• Close protection. Senior politicians, judges, witnesses. Niche, restricted, usually direct-award.
• Concierge and front-of-house. Reception duties with security duties layered on. Care homes, university halls, mixed-use council buildings.

Each one carries its own SIA licence sub-category and its own buyer expectations. A bid for manned guarding at a primary school is not the same kind of bid as one for CCTV monitoring at a city-centre operations room. Read the spec. Match the response.

SIA licensing in plain English¶

The Private Security Industry Act 2001 made it illegal to work in front-line security in the UK without an individual licence from the Security Industry Authority (SIA). It's not a company licence. Every operative needs one in their pocket while on duty.

Front-line licences cover named roles.

• Door Supervision (DS), licensed premises, public events.
• Security Guard (SG), manned guarding, static officer, gate work.
• Public Space Surveillance (CCTV), operating CCTV equipment to monitor public space, usually from a control room.
• Close Protection (CP), bodyguarding individuals.
• Cash and Valuables in Transit (CVIT), armoured-van crews.
• Key Holding (KH), alarm response, key custody.

A non-front-line licence covers managers, supervisors, and directors of a regulated company. They don't need it to do the work, they need it because they direct people who do. Three-year licence cycle. Renewal needs the SIA-approved training updated.

Bidding tip: in your SQ, name the licence sub-categories your team holds. Don't write "all our staff hold SIA licences". Write "100% of front-line operatives hold a current SIA SG (Security Guard) licence; 100% of CCTV monitoring staff hold an SIA CCTV licence; supervisors hold SIA non-front-line licences". The buyer's evaluator can score that. They can't score the vague version.

ACS, the Approved Contractor Scheme¶

The SIA also runs ACS. Voluntary on paper, effectively mandatory in public-sector procurement. ACS is a company-level audit (independent assessor, annual review) against operational, training, and management standards. It's the security-industry equivalent of CHAS or Constructionline plus an extra layer.

Most public-sector security tenders ask for ACS as a minimum standard at SQ stage. Some specify a minimum ACS score (the assessor scores you across nine indicators; 175 is a common floor, 200+ is competitive). Frameworks at NHS Shared Business Services, Crown Commercial Service RM6248 (Facilities Management Services), and most county council framework agreements ask for ACS.

If you're not on ACS, you're not winning any public-sector security work above £25,000 ish. Get on it before you bid, not after.

BS standards every security buyer references¶

Public-sector security specs lean on a small set of British Standards. You don't need every one for every contract. You need to know which ones the buyer cites and meet those.

• BS 7858, Screening of individuals working in a secure environment. Vetting standard. Five-year work history check, two named referees, identity verification, criminal record check. Ends every public-sector security contract that touches schools, NHS, courts, or central government.
• BS 7499, Code of practice for static guarding, mobile patrol, and key-holding. The operational baseline.
• BS 7960, Code of practice for door supervision (license-required door supervision premises).
• BS 7958, CCTV operations in public space surveillance. Required for any council-run public-space CCTV control room.
• BS 5979, Code of practice for the planning and operation of remote centres for alarm systems (alarm receiving centres).
• BS 8418, Detector-Activated Security Remote Surveillance Systems. The CCTV-to-police-response chain.
• ISO 18788, Management system for private security operations. The international cousin of BS 7499. Useful on contracts that touch infrastructure or international supply chains.

When the spec quotes one of these, your method statement should use the same number. "Vetting carried out to BS 7858:2019" beats "thorough vetting".

Insurance and indemnity¶

The security floor on insurance is higher than cleaning.

• Public liability: £10 million standard. Some council framework agreements ask for £15 million on city-centre patrol or large estates.
• Employer's liability: £10 million. Statutory minimum is £5m but the public-sector norm is £10m.
• Professional indemnity: £2 million typical. Required when the contract involves risk assessment, security audit, or design work.
• Crime (fidelity) cover: £100,000 to £250,000 depending on whether you're handling cash or keys.

Get the broker to write a single Insurance Schedule that lists all four cover types with current expiry dates. Upload it to your Central Digital Platform profile. You'll attach it to every bid.

Where UK security tenders live¶

Same five free portals as every other public-sector procurement. The CPV codes change.

Set saved-search alerts on Find a Tender (every UK public + utilities contract over £139,688 incl. VAT) and Contracts Finder (English central + local-authority work down to £12,000 thresholds). Add Public Contracts Scotland, Sell2Wales, and eTendersNI for the devolved nations. All free.

If you want a soft-FM-vertical view that filters CPV-pure security plus the adjacent verticals you'd realistically bid on (cleaning, grounds, waste, FM bundles), our live tender directory runs that filter by default. For the deeper take on what the Procurement Act 2023 changed, the government contracts guide covers the regime end-to-end.

TUPE, the bit most new bidders trip on¶

TUPE (Transfer of Undertakings (Protection of Employment) Regulations 2006) applies to almost every public-sector security re-tender. When the contract changes hands, the incumbent contractor's staff transfer to you on their existing terms and conditions. You inherit their pay rate, their pension, their holiday balance, their length-of-service rights.

Three things matter for the bid.

• Employee Liability Information (ELI). The incumbent must give you the staff list, pay rates, pension status, and disciplinary history at least 28 days before the transfer. Demand it during the tender process if the buyer hasn't included it. You can't price the bid without it.
• Inherited cost base. If the incumbent has been paying £14.50 an hour to staff who've been on site for 12 years, you're paying £14.50 from day one. You cannot drop their pay, change their holiday, or cut their hours without a clear ETO (Economic, Technical, Organisational) reason that survives a tribunal.
• Pension. Many incumbent staff are in the LGPS (Local Government Pension Scheme) or a defined-benefit scheme on "admitted body" status. You may have to keep them in it. Get the actuary's certificate before pricing.

Bid feedback patterns: SMEs lose security tenders not because their methodology is weak but because they price as if TUPE doesn't apply, then find out it does and either pull out (which gets you a contractual headache) or run the contract at a loss for two years until they can renegotiate.

Pricing manned guarding without going broke¶

Manned guarding pricing is hourly. The buyer wants a charge-out rate per officer-hour, often broken down by shift type.

Build the rate from the ground up.

1. Direct wage. National Living Wage in 2026 is £12.21 per hour for over-21s. Public-sector security usually pays above NLW because of TUPE inheritance. Assume £13 to £15 per hour for new hires.
2. Holiday accrual. 28 days statutory equals roughly 12% on top.
3. Employer's NI. 13.8% above the secondary threshold.
4. Pension auto-enrolment. 3% employer minimum on qualifying earnings.
5. Sick pay reserve. 2 to 4% depending on contract length.
6. Training and licensing. SIA renewal every 3 years (~£190), plus annual refresher training, plus first-aid renewals. Allow 2% of wage cost.
7. Uniform, equipment, radios. £200 to £400 per officer per year.
8. Management overhead. Operations, supervision, payroll, HR. 10 to 15%.
9. Insurance, ACS, software, vehicle. 4 to 6%.
10. Profit margin. 5 to 8% is typical for SME security. Below 5% you're undercutting yourself; above 10% you're losing on price.

Realistic public-sector charge-out in 2026: £14 to £18 per officer-hour for routine static guarding. £18 to £22 for higher-risk patrol or ARC-monitored response. Night and weekend uplifts of 10 to 15% are normal.

Don't try to win on price alone. Most public-sector security awards run on weighted MEAT. Quality and social value carry 50 to 70% of the score. A price 5% above the lowest bidder still wins if your method statement and TOMs commitments score better.

Hard-won lesson

Common SQ questions for security¶

Public-sector security SQs ask the same questions in slightly different orders. Build a stock answer for each. Tweak per contract.

• How do you vet officers? Answer: BS 7858:2019 with named verification steps. Five-year work history, two referees, ID, DBS Enhanced where children or vulnerable adults are involved.
• How do you train? SIA licensing baseline plus per-contract induction. Conflict management, customer service, fire safety, first aid, equality and diversity refresher annually.
• How do you supervise? Named contract manager, named area supervisor, named on-call manager. Site visits monthly, audited check-calls hourly, body-cam and DAR (Daily Activity Report) review weekly.
• How do you handle TUPE? Day-1 transfer plan with the incumbent. Consultation meetings with transferring staff. ELI integration into your payroll. Keep pay, terms, pension. ETO changes flagged early.
• How do you measure performance? Named KPIs. Attendance compliance (target 99.5%). Incident response times. Audit scores. Quarterly review with named operational and contractual stakeholders.
• How do you handle complaints? Named complaint route, 24-hour response target, root-cause analysis, action tracking, monthly KPI report.
• Social value? SMART local commitments. Local hire targets, community engagement, environmental fleet plan.

Procurement Act 2023 and AI disclosure¶

All the Procurement Act 2023 stuff applies. Three procedures (Open, Competitive Flexible, Direct Award). Central Digital Platform once-only registration. Schedules 6 and 7 exclusion grounds. PPN 002 social value mandatory from 1 October 2025. PPN 017 AI disclosure.

The full breakdown sits in the government contracts guide. Security buyers apply the same regime. Two security notes worth flagging: contract performance notices are usually triggered when KPI failure means staff turnover above the contractual threshold, and the central debarment list catches security suppliers fast when they breach licensing or vetting standards.

First-time bidder paperwork checklist¶

1. Companies House registration. Last two years of audited or certified accounts.
2. Public liability £10m, employer's liability £10m, professional indemnity £2m.
3. ACS Approved Contractor Scheme certification. Score on the certificate.
4. SIA licence list. Front-line and non-front-line, by sub-category, with renewal dates.
5. BS 7858 vetting policy and procedure. Dated, version-controlled.
6. BS 7499 (or BS 7960 / BS 7958 / BS 5979 depending on contract type) operational policy.
7. ISO 9001 (Quality Management). Increasingly mandatory above £100k.
8. ISO 14001 (Environmental). Asked for on most council and NHS framework agreements.
9. ISO 45001 (Occupational H&S). Replaces OHSAS 18001.
10. Modern Slavery Act, Equal Opportunities, H&S, Environmental policies.
11. Two or three reference contacts on similar contracts. Named, contactable, willing.
12. DBS policy. Enhanced DBS for any contract touching schools, NHS, courts, vulnerable adults.
13. TUPE process. Documented transfer methodology with named consultant or HR lead.

On the SSIP shopping decision, our best SSIP scheme for small business UK comparison covers CHAS, SMAS, SafeContractor, and Constructionline. For the bid-writing economics, bid writer vs AI bid tool has the maths.

If you're moving from "interested" to "writing the response", register on CleanTender and run a free fit check on the next live security tender that catches your eye.