IT services tenders cover work such as managed IT support, software development, web design, cyber security and network installation, bought by central government, the NHS, councils and other public bodies. This page shows live notices, explains exactly when Cyber Essentials is needed under PPN 014, and sets out how MSPs and consultancies can win public sector IT work, through open tenders and through frameworks such as G-Cloud. Our tender eligibility checker is coming soon. Until then, tell us your trade and postcode to join the free weekly list of live tenders, starting soon.
What buyers usually ask IT suppliers for
Data security is the main theme for IT buyers, and much of it has a policy or legal basis. The tender pack sets out whatever else a particular buyer wants.
Cyber Essentials and Cyber Essentials Plus
PPN 014 applies to central government departments, their agencies, non-departmental public bodies and NHS bodies. It asks them to require Cyber Essentials where a contract involves citizens’ personal information, government staff personal information, ICT designed to store or process data at OFFICIAL level, or information about the day-to-day business of government. The list isn’t exhaustive. Certification must be renewed annually, and evidence is needed before contract award. Other public sector bodies may adopt the same approach, so a council might ask for it too.
The PPN gives worked examples in its Annex A. Contracts it treats as in scope include CV-writing services for citizens returning to work, contact-centre services that give advice to individuals, and staff car hire, because in each case the supplier holds personal data. It also gives an example where Cyber Essentials is not the right test: ICT support that includes legacy IT, because legacy systems can’t meet the requirements, though overarching requirements may still apply to the relevant areas.
If you don’t hold the certificate, the PPN says suppliers can show equivalent controls, which should normally be verified by a technically competent, independent third party. Cyber Essentials Plus always requires that verification. In practice, getting certified before you bid is simpler than arguing equivalence mid-tender. We explain it in Cyber Essentials for government contracts.
Data protection and the data protection fee
If you handle personal data, the Data Protection Act 2018 applies, and the Data Protection (Charges and Information) Regulations 2018 set out the data protection fee. Check whether you have to pay it, and expect questions on how you store, access and delete client data.
ISO 27001
ISO 27001 is a separate standard from Cyber Essentials, so holding one doesn’t answer a pack question about the other. Some buyers ask for it. We make no claim about how many, so check the pack.
Technology Code of Practice
The Technology Code of Practice says projects needing Cabinet Office spend control approval must consider all of its points. If you sell to central government, expect the buyer to ask how your solution fits that approach, so read the code before you write your answers.
Insurance and turnover
Professional indemnity and cyber cover, and minimum turnover, are set contract by contract. We can’t source typical figures. Check the pack. See professional indemnity insurance.
Few notices say any of this up front. In the week to 10 Oct 2026, 29 of the 470 live notices in our data (about 6%) stated named certifications in the notice itself (as of 10 Oct 2026). The rest is in the pack.
How to win IT services contracts
G-Cloud and the Digital Marketplace versus open tenders
The Digital Marketplace hosts government frameworks such as G-Cloud and Digital Outcomes and Specialists, and all public sector organisations can use it. Buyers can buy through a framework instead of running an open tender, so some work never goes to an open tender. Frameworks open and close on their own schedules, so check the current dates on the marketplace before you plan around one. Open notices are a second route. Watch both.
PPN 014 covers G-Cloud too. Suppliers on G-Cloud agreements must show they comply with the Government’s Cloud Security Principles (paragraph 25). Holding Cyber Essentials is not a condition of the G-Cloud agreement itself, but buyers should check that a supplier is managing relevant cyber risks effectively before they award a call-off contract (paragraphs 26 and 27). So be ready to describe your security controls in plain terms, whichever route you take.
Lots and below-threshold IT work
Buyers must consider lots, or give reasons for not using them, so a large IT contract may be split by service, site or technology. From 1 January 2026, services contracts fall under the full Act rules at £135,018 including VAT for central government and £207,720 for other authorities. Below that, when tenders are invited the buyer can’t restrict who may tender by assessing suitability (Welsh devolved buyers follow their own rules, and call-offs from frameworks are excluded).
If a buyer advertises a below-threshold contract worth £12,000 or more (central government, including NHS trusts) or £30,000 or more (other authorities), including VAT, it must first publish a below-threshold tender notice. Buyers can also invite quotes from chosen suppliers without advertising. Small IT contracts are where a micro-MSP can compete on equal terms.
Team up for the big ones
A contract that is too large for one small MSP may still be reachable as a subcontractor or as part of a consortium. Agree who holds the contract, who carries the security obligations and how data is handled between you before you submit, and check the pack for any limits on subcontracting.
Be ready before the notice appears
Gather your evidence before a deadline is close. Have your certificates, policies, insurance documents and two or three relevant case studies in one folder. Because Cyber Essentials evidence is needed before award where PPN 014 applies, certification isn’t something to start once you’ve won.
Social value for central-government contracts
Central government departments, their agencies and non-departmental public bodies must give social value at least a 10% weighting on above-threshold contracts where it is relevant (PPN 002). For an IT supplier that can mean apprenticeships, local hiring or digital skills. Be specific and measurable rather than aspirational.
Register on the Central Digital Platform
It is free, and buyers need your unique identifier before award.
If you sell software products rather than services, see software tenders.
Questions
Do I need Cyber Essentials to bid for public sector IT work?
Not for every contract. PPN 014 applies to central government departments, agencies, non-departmental public bodies and NHS bodies where a contract involves things like citizens' personal data, government staff personal data, ICT at OFFICIAL level or government business information. Where it applies, evidence is needed before award.
Cyber Essentials or Cyber Essentials Plus: which do buyers want?
The buyer decides and states it in the tender pack. PPN 014 refers to Cyber Essentials and Cyber Essentials Plus as the quickest and most effective way to show the technical requirements are met. It also says suppliers can show equivalent controls, which should normally be verified by a technically competent independent third party.
Is G-Cloud the only way to sell IT services to government?
No. Public sector buyers can use frameworks on the Digital Marketplace, such as G-Cloud, and they also run their own tenders. Some IT opportunities appear as open notices, so watch both routes.
Do councils have to follow PPN 014?
No. Central government and NHS bodies are in scope, and other public sector bodies may choose to adopt the same approach. A council might still ask for Cyber Essentials, so read the tender pack.
Can a small MSP bid for part of a large IT contract?
Sometimes. Buyers must consider splitting a contract into lots, or give reasons for not doing so. Look for lots by service or area that match your team. Subcontracting to a larger supplier is another route in.