UK public sector IT spend exceeds £15 billion a year, flowing mostly through Crown Commercial Service frameworks rather than open tendering. The main routes for tech SMEs are G-Cloud (cloud catalogue), Digital Outcomes & Specialists (DOS, day-rate work), and Public Sector Resourcing (PSR, contingent labour). Cyber Essentials is the mandatory baseline; Cyber Essentials Plus and ISO 27001 are required for higher-risk work.
The UK government IT procurement landscape
UK central government and the wider public sector spend more than £15 billion a year on technology. The vast majority flows through Crown Commercial Service (CCS) frameworks rather than open tendering — meaning the route to winning gov IT contracts is rarely "respond to a tender notice" and more often "get onto the right framework and respond to call-offs".
The Government's policy direction has explicitly favoured SMEs in IT procurement since the 2010s. The cloud-first policy, the open standards approach, and the SME spend targets (33% of central government spend by value) have created real opportunities for technology SMEs that get the structural pieces right.
The biggest barrier isn't capability — UK tech SMEs are routinely more agile and more specialised than the system integrators. The barrier is procurement structure: frameworks, certifications, and the right shape of bid response.
Certifications required for IT contracts
IT procurement has different cert requirements than construction or FM — the baseline is information security, not health and safety.
- Cyber Essentials — mandatory baseline for all UK gov contracts handling data (anything above OFFICIAL classification).
- Cyber Essentials Plus — required for higher-risk data handling. Most NHS and central government work.
- ISO 27001 — information security management. Increasingly the bar for any data-handling contract above £100K.
- ISO 9001 — quality management. Standard PQQ requirement across most digital frameworks.
The main frameworks for IT SMEs
G-Cloud
G-Cloud is the largest cloud services framework in UK government. It's open to any UK-registered cloud services supplier and operates as a catalogue — once accepted, your services appear in the Digital Marketplace and buyers call off directly. There are three lots: Cloud Hosting (Lot 1), Cloud Software (Lot 2), and Cloud Support (Lot 3). Most SMEs apply to whichever lot fits, or multiple. The framework refreshes roughly every 18 months — applications open in waves, so timing matters.
Digital Outcomes & Specialists (DOS)
DOS is the framework for procuring digital and technology professionals — research, design, development, security, performance analysis, user research. Buyers post opportunities to the Digital Marketplace, suppliers respond, and a shortlist of three is invited to interview. Faster than traditional tender process, smaller contracts on average. Particularly favourable to SMEs because the framework caps contract sizes that day-rate work; major SI firms don't dominate as they do elsewhere.
Public Sector Resourcing (PSR)
PSR is the framework for contingent labour — short-term contractors and specialists. Run by HM Cabinet Office. For tech SMEs offering specific expertise (cybersecurity, data, AI/ML, devops), PSR opens up day-rate work across central government without a separate framework application per department.
Direct award and below-threshold
Below the £138K threshold (services), departments can directly procure without a framework. Below-threshold opportunities don't appear on Find a Tender Service but do appear on Contracts Finder. For specialist SMEs, building direct relationships with department procurement teams via these smaller contracts is often the way into larger framework work later.
Contract values and what's realistic for your size
IT contract values vary enormously by lot and procurement type. G-Cloud cloud software contracts can run from £5,000 to several million; DOS day-rate specialist work averages £50,000 to £300,000; major framework contracts (e.g. NHS national contracts) run to £10M+.
For SMEs, the sweet spot is sub-£500K contracts — high enough to be commercially meaningful, low enough to avoid competing with the major SIs. Most G-Cloud call-offs and a large share of DOS contracts fall in this range.
Social value and Net Zero in IT bids
Central government bids weight social value at 10% minimum. For IT contracts, the social value commitments that score well include hiring apprentices in technology, working with local schools on digital skills, supporting Net Zero through low-carbon hosting and energy-efficient infrastructure, and giving pro bono technology support to community organisations.
Buyers want measurable, contract-linked commitments. "We will sponsor 10 hours of monthly cybersecurity mentoring at three local schools during the contract" beats "We support digital skills". See our tender response writing guide for the scoring detail.
How ENKII helps IT services SMEs
ENKII aggregates IT and digital tenders from all UK procurement portals plus Digital Marketplace G-Cloud and DOS opportunities. Your readiness score is calculated per opportunity: cert match, capacity fit, past contract relevance, and lot eligibility.
For G-Cloud and DOS specifically, ENKII surfaces when application windows open so you don't miss the framework refresh. The cert gaps it flags align directly to information security requirements rather than the construction-baseline certifications that don't apply to tech contracts.
Frequently asked questions
Do I need to be on G-Cloud and DOS, or pick one?
If you sell cloud products or services, G-Cloud. If you sell professional services (day-rate developers, designers, analysts), DOS. Many SMEs are on both because they offer both. Application processes are separate but both refresh on similar cycles.
What's the difference between G-Cloud and Digital Marketplace?
Digital Marketplace is the website. G-Cloud is the framework (the contracts vehicle). Buyers shop on Digital Marketplace for services from G-Cloud-accepted suppliers. Same thing in practice — apply to G-Cloud, your services list on Digital Marketplace.
Is Cyber Essentials Plus harder to get than standard Cyber Essentials?
Yes, but not enormously. Plus adds an independent technical verification (remote scan + short call) to the self-assessment questionnaire. Typically 2–4 extra weeks and £1,000–£2,000 extra cost. NHS and central government contracts increasingly require it; if those are your target buyers, get Plus from the start.
How often does G-Cloud refresh?
Currently roughly every 18 months — G-Cloud 14 in 2024, G-Cloud 15 in 2026, etc. Applications close, the framework runs for ~12 months as new buyers call off, then a new wave opens. Miss the window and you wait. ENKII tracks open framework windows so you don't miss the next refresh.