PCI DSS

Certification & assessment schemes · awarded by PCI Security Standards Council QSA · serves: Payment security assessors

Notices demanding it: 132; a floor
Said “must”: 24; explicit obligation
Open right now: 0
Value gated: £148m; a floor

Published values on the notices that demand it — a floor, not a total.

The demand curve

Notices demanding it per 10,000 published, by year — rate-normalised so corpus growth never masquerades as demand. Complete years only.

2.0

0.7

1.3

0.8

1.8

1.4

1.7

2019202020212022202320242025

The pale bars are 2025 onward. The Procurement Act went live on 24 February 2025 and changed how notices are written, so the step across that date is partly a change in convention and not only a change in demand. We have not measured how much of it is which, so please do not read this as a trend.

The receipts

Notices that demand it, and the sentence each demand was found in. Nothing is counted here without one.

RTPI Content Management Systems, Ticket Vending Machines, Electronic Ticket Machines, Accessible Rail Information and Support Units, and Transport and Data Managed Servicesmandatory
SMART APPLICATIONS MANAGEMENT LIMITED
Machines must support ITSO smartcards, EMV contactless, mobile ticketing (QR, barcode, NFC), and cash, while integrating with back-office systems for revenue and data exchange in line with ITSO, PCI-DSS, and BODS.
Library Customer Self Service- Kiosks and RFID Provisionmandatory
KENT COUNTY COUNCIL
To comply with KCC ICT systems security requirements, any solution must be PCI-DSS (credit card) and PAD-DSS (RFID device) compliant.
Further Competition Tender for the Provision of Networked EPOS Tills and Back Office Management Softwaremandatory
National Museums Liverpool
The EPOS Solution for Catering and Events must comply with key industry standards, including complying to PCI DSS and has clear procedures to maintain the security of highly sensitive client information including personal information in accordance with Data Protection Legislation.
Leisure Management System - AWARDmandatory
University of Cumbria
The solution must be PCI DSS compliant, and the vendor must hold Cyber Essentials Plus accreditation or comparable certification.
The Department for Work and Pensions: Secure Card Payment Services Procurementmandatory
Department for Work and Pensions
The new SCPS Contract is required to ensure continuing capability for the DWP to receive customer payments in a PCI DSS compliant manner and provide all Outbound Telephone calls for the DWP.
Card Not Present (CNP) Payment Gateway Servicesmandatory
Transport for London
(Representational state transfer)REST/(Simple object access protocol)SOAP over (Hypertext Transfer Protocol Secure)HTTPs and must comply fully with (Payment Card Industry Data Security Standard)PCI-DSS.
T HCO21-158 Integrated Leisure Management Software Solution Tendermandatory
Derry City and Strabane District Council
The solution must be PCI DSS (Payment Card Industry Data Security Standard) compliant, and the vendor must hold ISO27001 certification or a comparable certified ISMS (information security management system).
The Department for Work and Pensions: Secure Card Payment Services Procurementmandatory
DEPARTMENT FOR WORK AND PENSIONS
The new SCPS contract is required to ensure continuing capability for DWP to receive customer payments in a PCI DSS compliant manner and route all related outbound telephony calls via a PCI DSS compliant service provider.
EPOS-053-2022mandatory
MANCHESTER CENTRAL CONVENTION COMPLEX LIMITED
Taking payments is an integral part of the EPOS system so it must be able to integrate to a selection of card payment providers, all of whom must be PCI DSS and EMV compliant.
Payment Gateway and Fraud Enginemandatory
London North Eastern Railway Ltd.
Provider MUST be fully PCI DSS compliant and fully regulated to tier 1 from the outset - compliance must be maintained at all times throughout the contract and will be required to supply comliance evidence on an at least annual basis.
Card Payments and Merchant Acquiring Servicesmandatory
Progress Housing Group
Must be fully compliant with the Payment Card Industry Data Security Standard (PCI DSS) compliant.
Cambridge City Council - Card Payment Processing Services for Multi-storey car parksmandatory
Cambridgeshire District Councils
This service must fully comply with the Payment Card Industry Data Security Standards (PCI DSS P2PE), or have a system that gives the same level and operation of P2PE, that will meet the Council's requirements.

See it live

No open tenders demand it at this moment — the list updates continuously.

Browse the tenders →

Tell us what you already hold and we will show you which of these notices you were already eligible for — and what one more certificate would open.

Get set up free →

Method: Every count here is a floor. We match the text of the notice, and a notice description is a summary — most tender packs demand things it never mentions.“Said must” counts only explicit obligation language in the matched sentence itself; anything ambiguous is counted as a mention, never as mandatory. Trend compares rates per 10,000 notices per complete calendar year.