The public sector spends billions on IT every year and a significant portion goes to small and specialist suppliers. G-Cloud and the Digital Marketplace have made it genuinely easier for smaller businesses to access central government and NHS IT work.
Government IT contracts include managed IT services, helpdesk support, cloud migrations, cyber security assessments, software development, data services and digital transformation programmes. Work comes from local authorities, NHS trusts, schools, central government agencies and arm's length bodies.
IT is the sector where the route to market differs most from the rest of public procurement, and understanding that difference is worth more than any bid writing skill. Most government technology spend does not go through conventional open tenders at all. It goes through G-Cloud, a catalogue framework where suppliers list their services and buyers purchase directly without running a competition.
Getting onto G-Cloud is free, open to any size of company including sole traders, and involves completing a self-declaration and writing service descriptions rather than competing against other bidders. There is no cap on how many suppliers are accepted. For a small technology business this is the single highest-return few days of work available in public sector selling.
Cyber Essentials Plus has moved from desirable to effectively mandatory across government IT procurement. Any contract involving access to government data will require it, and increasingly buyers will not proceed without it. It costs comparatively little and takes a few weeks. ISO 27001 is the next step up and opens larger NHS and central government work.
Where full tenders do run, they are often for managed services, specific development projects or transformation programmes. Public sector experience helps but is not required for a first bid — what buyers want to see is that you understand their constraints around accessibility standards, data residency, procurement rules and legacy integration.
£20,000 to £1M+
G-Cloud is a government framework where suppliers list cloud and digital services in a catalogue and public sector buyers purchase directly without running a full tender. It is free to apply, open to companies of any size including sole traders, and there is no limit on the number of accepted suppliers. For most small IT businesses it is the single most valuable route into public sector work.
Almost certainly yes. Cyber Essentials is required for most government contracts involving handling of government data, and Cyber Essentials Plus, which includes an external technical audit, is increasingly specified as mandatory rather than desirable. Certification typically takes a few weeks.
Yes. There is no minimum company size for G-Cloud, and many small and specialist suppliers hold public sector contracts. For larger tendered contracts, turnover requirements may apply, but the catalogue route via G-Cloud has no such barrier.
ISO 27001 is the international standard for information security management. It is not always mandatory but is frequently requested for contracts involving sensitive data, particularly in the NHS and central government. It is a bigger commitment than Cyber Essentials, typically taking several months and requiring an external audit.
Yes. Public sector websites and applications must meet WCAG 2.2 AA under the Public Sector Bodies Accessibility Regulations. Tenders routinely include a scored question on how you deliver and test for accessibility, so it is worth having a prepared answer.
Through a mixture of G-Cloud, NHS-specific frameworks, and their own tenders and dynamic purchasing systems. Individual trusts procure independently, which means there are many separate buyers rather than one central one — an advantage for smaller suppliers who can build relationships regionally.