How Do Security Companies Get Contracts in the UK?

Last updated: 29 October 2026

Security companies get contracts through four main routes: public sector tenders published on portals such as Find a Tender and Contracts Finder, direct private sector sales and referrals, subcontracting under larger prime contractors, and framework agreements like Crown Commercial Service's security services deal. Central government bodies must publish contracts above £12,000 on Contracts Finder, and larger contracts above roughly £139,688 go on Find a Tender (2026).

Key Takeaways

• Central government bodies must publish contracts above £12,000 on Contracts Finder, while UK-wide contracts above approximately £139,688 for goods and services must appear on Find a Tender, per PSIP (2026).
• From 1 January 2026, contracts worth £207,720 or more (inc VAT) from councils, NHS trusts and housing associations must be published on Find a Tender, according to CleanTender (2026).
• Councils and NHS trusts must publish notifiable security contracts worth £30,000 or more (inc VAT) under the Procurement Act 2023, while central government's threshold starts at £12,000, per CleanTender (2026).
• Most formal tenders are scored on a published price/quality split, commonly somewhere between 60/40 and 30/70, per Pulse Operations's guide, How to win your next security tender.
• There are over 500,000 individual SIA operative licences in force, covering door supervisors, security guards, CCTV operators and more, per the SIA Annual Report 2024-25, cited by CleanTender (2026).

What are the main routes security companies use to win contracts?

A route to contract, in security procurement, is one of the distinct channels — public tender, private sale, referral or subcontract — through which a guarding or patrol firm secures signed work. Most established UK security companies run all four simultaneously rather than relying on one.

Public sector tenders are formal, published procurement exercises run by councils, NHS trusts, police forces, transport authorities and central government departments. They're the most regulated route, governed since 2023 by the Procurement Act 2023, and they reward firms that can evidence compliance and quality rather than just quote a day rate.

Private sector direct sales cover everything from a shopping centre approaching a guarding firm directly to a construction site manager needing keyholding cover. There's no statutory procurement process — decisions are commercial, often faster, and relationship-driven.

Referrals come from existing clients, insurance brokers, facilities management partners and even rival firms who are full on capacity. In a market with over 34,000 private security firms operating globally as of 2026 managing more than 150,000 active contracts, per Market Growth Reports (2026), reputation travels fast in a crowded field.

Subcontracting means a smaller firm delivers under a larger prime contractor's name — useful for breaking into sectors or regions where a firm lacks the track record or scale to bid directly, and a common first step for SIA-licensed operators without SIA Approved Contractor Scheme (ACS) status.

A West London mixed-use development run by Priority First — the founding team's own operation behind Pulse Operations, disclosed here as it always is — illustrates the private, relationship-led route. The client didn't run a formal tender; it wanted proof that 152 checkpoints across retail, residential, plant rooms and service yards were genuinely being walked, not just invoiced. That trust, built on evidence rather than a procurement process, is how a large share of UK security contracts actually change hands.

How do security companies find and bid for public sector contracts?

Public sector procurement in the UK runs through a small number of named, searchable government portals, and finding the right one depends on contract value and buyer type. Find a Tender is the GOV.UK service for above-threshold notices; Contracts Finder covers lower-value English public sector opportunities.

Thresholds matter because they determine where a contract must legally be advertised. Central government bodies must publish contracts above £12,000 on Contracts Finder, while UK-wide contracts above approximately £139,688 for goods and services must be published on Find a Tender (2026). From 1 January 2026, contracts worth £207,720 or more (inc VAT) from councils, NHS trusts and housing associations must also appear on Find a Tender (2026). Below that, councils and NHS trusts must still publish notifiable security contracts worth £30,000 or more (inc VAT), per the CleanTender (2026) guide, as part of the transparency duties under the Procurement Act 2023.

Beyond the two main portals, security firms targeting specific sectors should also watch:

• The Crown Commercial Service security services framework (RM6262), used by public bodies to call off manned guarding without running a full fresh tender
• The Defence Sourcing Portal, for MOD-related guarding and access control contracts
• Devolved portals — Public Contracts Scotland, Sell2Wales, and eTendersNI — for work outside England

Registering on these portals, setting CPV codes (the EU-derived classification codes used to flag security services notices) and setting alerts is free. The real cost is in bid writing, which is why many firms without a dedicated bids function start on frameworks or through subcontracting before bidding solo.

What licences and accreditations do companies need before they can tender?

An SIA licence, issued by the Security Industry Authority under the Private Security Industry Act 2001, is the individual qualification every door supervisor, security guard or CCTV operator must hold before working in a licensable role. There are over 500,000 individual operative licences in force covering these roles, per the SIA Annual Report 2024-25, cited by CleanTender (2026) — but individual licensing is only the starting gate for a company bidding on contracts.

Beyond individual licensing, buyers typically screen bidders against a pass/fail selection questionnaire before quality is even scored. Per Pulse Operations's guide, How to win your next security tender, these gates commonly include SIA Approved Contractor Scheme (ACS) status, BS 7858 screening records (the British Standard for vetting security personnel), adequate insurance, financial standing, health & safety and GDPR policies, warmed-up references, and — for publicly accessible venues — readiness under the Terrorism (Protection of Premises) Act 2025, often referred to as Martyn's Law.

The SIA's own commercial activity shows how material ACS has become: the concession contract to deliver ACS assessment services was estimated at a total value of £12,500,000 over a four-year term, per the Find a Tender / Security Industry Authority notice (2024). Many public sector tenders now require ACS status or evidence of equivalent standards as a precondition to bid at all.

Crucially, clearing these gates doesn't win a contract — it only earns the right to be scored on quality. As Pulse Operations founder Mo Hassan puts it: "A lapsed licence or an incomplete screening file walking onto a client site is how contracts end. Track vetting to a clearance date and hold people off the roster automatically until every check is clear — deployment discipline shouldn't depend on someone remembering." A compliance runway exists precisely to stop that gap — tracking SIA, BS 7858, DBS, right to work, training and Martyn's Law assessments on one expiries timeline rather than scattered spreadsheets.

What is included in a security services tender and how should firms structure the response?

A security services tender (also called an RFP, or Request for Proposal) is a formal document a buyer publishes setting out the scope of work, the evaluation criteria, and the deadline for submissions. It typically includes a specification of sites and hours, a pricing schedule, a selection questionnaire, and a set of quality questions scored against published criteria.

Once the pass/fail gates are cleared, Pulse Operations's guide notes that four or five quality questions typically decide the contract: service delivery, mobilisation, TUPE (Transfer of Undertakings — Protection of Employment, the law governing staff transfer on re-tenders), management information and reporting, and social value. On most re-tenders, the incumbent's existing staff transfer to the new contractor under TUPE, which means mobilisation planning has to account for inherited teams, not just new recruits.

In public-sector tenders, social value carries explicit weighting, often 10% or more, per Pulse Operations's guide — meaning a bid's community impact, apprenticeships or local employment commitments can swing the outcome even when price and core service quality are closely matched between bidders.

The strongest responses prove claims rather than assert them. Mo Hassan makes the point directly: "Every bid says professional, SIA-licensed, 24/7 control room — so none of it scores. Walk in with evidence instead: photo-verified patrols, delivered-vs-contract numbers, and a portal login the evaluators can open themselves. Proof the incumbent can't match changes the conversation." This is the practical difference between a bid that reads well and one that scores well — and it's why Pulse Operations built its client portal around delivered-vs-contract reporting rather than generic claims of quality. Readers preparing a live bid can download Pulse Operations's full guide, How to win your next security tender, for the pre-tender checklist.

How does pricing versus quality affect who wins a security contract?

Price/quality weighting is the published split a procurement evaluator uses to score bids, and under the Procurement Act 2023's "most advantageous tender" standard it rarely favours the cheapest bidder outright. Most formal tenders are decided on a split commonly ranging from 60/40 to 30/70 in favour of quality, per Pulse Operations's guide.

The arithmetic matters more than it first appears. On a 40/60 price-quality split, a bid priced 5% higher that scores one grade better on quality wins comfortably, according to the same guide. That means a firm undercutting on day rate alone, without matching evidence of service delivery, mobilisation planning and reporting quality, is often optimising for the smaller half of the scorecard.

A prestige central-London residential estate running 16 buildings on one nightly round, served by Priority First, shows what "evidence-backed quality" looks like in practice rather than theory. The client's core question wasn't about price — it was "can you prove every building gets its patrols, every night?" Setting each building up as its own site with its own checkpoints, evidence trail and recurring-findings detection answered that directly, and the estate can now see per-building delivered-vs-contract figures in its portal rather than ringing the office. That kind of answer is what fills a quality score; undercutting on price alone can't replicate it.

What checks should a buyer carry out before awarding a security contract?

Due diligence, in a security procurement context, is the set of verification steps a client runs on a shortlisted bidder before signing — checking that what's written in the tender response is actually true in practice. Buyers increasingly go beyond paper policies to ask for records.

A thorough buyer check typically covers:

• SIA licence validity for every named or proposed officer, checked against the SIA's public register
• BS 7858 screening records per individual, not a policy document asserting that screening happens
• Insurance certificates — public and employers' liability, at levels matching contract risk
• Financial standing — credit checks, accounts, and evidence the firm can mobilise without cash-flow strain
• References from live or recent contracts, ideally contactable directly rather than curated quotes
• Evidence of patrol and incident reporting, not just a claim of "24/7 monitoring"
• Martyn's Law readiness where the site is a publicly accessible venue under the Terrorism (Protection of Premises) Act 2025

The honest answer to "how do you check patrol evidence is real" has shifted in the last few years. Per Pulse Operations's guide, How to prove patrols actually happened, a signed paper log is trivially easy to fill in from the mess room at the end of a shift, and once a client has been burned by a gap between the log and reality, they stop trusting paperwork entirely. Tag scans aren't much stronger: a tag scan tells a buyer a phone was held near a tag at a moment in time, not that a person was genuinely present and alert — and tags get painted over, ripped off, or sit in dead signal spots. A watermarked photo — stamped with the officer, the site and checkpoint, GPS coordinates and a precise timestamp — carries the actual condition observed, which is why buyers running serious due diligence increasingly ask to see one.

How do security companies retain and renew contracts once won?

Contract retention, in security services, means keeping a client's business through contract renewal points rather than losing it to a re-tender or termination for cause. Renewal is rarely about price alone — it's usually about whether the delivered service matched what was promised at mobilisation.

Pulse Operations advises that common reasons contracts aren't renewed include missed patrols that only surface as disputes, compliance lapses (an expired SIA licence or an incomplete BS 7858 file discovered mid-contract), poor incident response times, and a lack of visible reporting that leaves the client unable to answer "are we actually getting what we're paying for?" without phoning the contractor's office.

A retail and residential courtyard account run by Priority First shows what the alternative looks like. Concierge work — parcels, keys, contractor access — is largely invisible until something goes wrong, and the busiest parcel operation on the books needed a proper chain of custody rather than a shelf and a shrug. Every delivery is now logged on arrival with a photo and signed out on collection, so any of the seven officers covering the site can pick up exactly where the last left off with zero knowledge loss. That kind of continuity — proof that survives staff turnover — is what keeps a client renewing rather than re-tendering.

Retention also depends on catching small problems before they become contract-ending ones. A tamper-evident daily occurrence book and a live control room that flags a missed checkpoint immediately, rather than at a morning debrief six weeks later, turns a potential dispute into a same-day fix. Pulse Operations built its mobile patrol & keyholding service around exactly this logic — evidence and continuity that outlast any single officer's shift.

Your security contract-winning checklist

• Register on Find a Tender and Contracts Finder, and set alerts for relevant CPV codes
• Confirm every proposed officer holds a valid SIA licence and check the SIA public register before quoting
• Hold BS 7858 screening records per individual, not a generic policy statement
• Secure or evidence progress towards SIA Approved Contractor Scheme (ACS) status if targeting public sector work
• Prepare a Martyn's Law position for any publicly accessible venue under the Terrorism (Protection of Premises) Act 2025
• Build a reference list of contactable, live clients before a tender deadline arrives
• Replace generic quality claims with evidence — photo-verified patrols, delivered-vs-contract reporting, a live portal login evaluators can open themselves
• Price against the published quality weighting, not against the cheapest competitor alone

FAQ

How do security companies get new contracts?

Security companies get new contracts through public sector tenders on portals like Find a Tender and Contracts Finder, direct private sector sales, client and broker referrals, and subcontracting under larger prime contractors. Most established firms use several of these routes at once rather than relying on one.

How do security companies get government contracts?

Security companies get government contracts by registering on Find a Tender and Contracts Finder, monitoring notices against their SIA licensing and ACS status, and submitting bids that clear mandatory pass/fail gates before being scored on price and quality. Central government must publish contracts above £12,000 on Contracts Finder, per PSIP (2026).

Is SIA ACS accreditation required to win security tenders?

SIA Approved Contractor Scheme (ACS) status isn't legally mandatory for every tender, but many public sector buyers treat it as a pass/fail requirement before quality scoring begins. Firms without ACS often enter the market through subcontracting or private sector work first.

How long does the procurement process take from tender publication to contract start?

Timescales vary by contract value and buyer, but public sector security tenders typically run from several weeks for submission, through evaluation and moderation, to a mobilisation period before the contract start date. Larger or re-tendered contracts, especially those involving TUPE transfers, usually need longer mobilisation windows to onboard transferring staff.

What does it cost a security company to bid for and mobilise a new contract?

Bid costs include staff time for bid writing, any ACS assessment fees, insurance adjustments for new sites, and recruitment or uniform costs for mobilisation — these vary significantly by contract size and aren't standardised industry-wide. The larger ongoing cost is usually compliance infrastructure: screening, licensing checks and reporting systems that buyers expect to see evidenced throughout the contract, not just at tender stage.

Who is responsible for business development and bid writing in a security company?

Responsibility varies by company size: larger firms run dedicated bid teams or business development managers, while smaller firms often have the operations director or owner write bids alongside day-to-day running of contracts. Either way, winning tenders increasingly depends on having verifiable service delivery evidence ready before the bid deadline, not assembled at the last minute.

What common mistakes cause security companies to lose contracts or fail tenders?

Common mistakes include generic quality answers that make unverifiable claims, missing a pass/fail gate like BS 7858 screening records or valid insurance, underpricing without matching evidence of quality, and poor references. Per Pulse Operations's guide, How to win your next security tender, evaluators can't score assertions — only evidence.

Securing your next contract with Pulse Operations

Winning a security contract is only half the job — proving delivery is what keeps it. Pulse Operations exists because the founding team ran into this exact problem inside Priority First, its own London security and FM operation, where clients stopped trusting paper logs and started asking for proof.

Every checkpoint on Pulse Operations is completed only by a mandatory watermarked photograph — officer, site, GPS, time — with no QR or NFC tag scanning by design, because a scan proves a phone was nearby, not that an officer was present and alert. Across live operations, 96.2% of checkpoints carry a watermarked photo over a trailing 90-day period as of July 2026 — see the current figures at the benchmark page.

If you're preparing a tender response or trying to win back a client's confidence mid-contract, get a demonstration of the client portal and see what delivered-vs-contract reporting looks like under your own brand — book a call with Pulse Operations or explore published pricing directly.

Related Reading

• Case Study Format for Security Tenders (UK Guide 2026)
• ERP for Security Guard Companies: UK Buyer's Guide 2026
• Bid Writing for Security Companies: UK Guide 2026

★ Add pulse-operations.co.uk as a preferred source on Google