IT support tenders cover managed IT services, helpdesk, network support, and device and server support, bought by schools, academy trusts, councils and NHS bodies. This page lists live notices matched to support codes rather than software licences, explains when Cyber Essentials is asked for under PPN 014, and covers the points that decide support bids: service levels, staff transfers and onboarding costs. Our tender eligibility checker is coming soon. Until then, tell us your trade and postcode to join the free weekly list of live tenders, starting soon.
What buyers usually ask IT support suppliers for
Security comes first, then insurance and vetting. Most of it sits in the pack, not the notice: in the week to 10 Oct 2026, 29 of the 470 live notices in our data (about 6%) named certifications.
Cyber Essentials and Cyber Essentials Plus (PPN 014)
PPN 014 applies from 24 February 2025 to central government departments, executive agencies, non-departmental public bodies and NHS bodies. They are asked to require Cyber Essentials, or equivalent controls, where a contract involves citizens’ or government staff personal information, ICT systems that store or process OFFICIAL-level data, or information about the day-to-day business of government. Certification is renewed annually, and evidence of Cyber Essentials (or equivalent) is needed before award. Cyber Essentials Plus adds remote and on-site vulnerability testing and is meant for higher-risk contracts. Equivalent controls should normally be verified by a technically competent, independent third party.
The PPN says the scheme shouldn’t be applied to all contracts as a matter of course. Its examples include ICT support with legacy IT: legacy systems can’t meet Cyber Essentials, so the PPN suggests Cyber Essentials for the relevant areas and effective alternative controls for the rest. Other bodies, such as councils and schools, may follow the same approach, so read the pack. See Cyber Essentials for government contracts.
ISO 27001 and data protection
ISO 27001 is a separate standard from Cyber Essentials, so holding one doesn’t answer a question about the other. Some packs ask for it, and we make no claim about how many. If you support systems that hold personal data, the Data Protection Act 2018 applies, and the Data Protection (Charges and Information) Regulations 2018 set out the data protection fee. Expect questions on admin access, data deletion and how you keep one client’s data apart from another’s.
DBS for engineers on school sites
Engineers who visit schools or healthcare sites may be asked for background checks. The DBS offers basic, standard, enhanced, and enhanced-with-barred-lists checks. Standard and enhanced checks are only for certain roles, and Scotland and Northern Ireland have different rules. The pack should say which level it expects and when it must be in place, so check before you assign engineers.
Insurance
Professional indemnity and cyber cover are set by the buyer, so check the pack. See professional indemnity insurance. If you employ staff, employers’ liability insurance is compulsory for employers in Great Britain, with limited exemptions (the 1969 Act). The gov.uk page gives the legal minimum cover, so check your policy against it. See public liability and employers’ liability cover.
Service levels
Support contracts are scored on service levels: response and resolution times by priority, opening hours, reporting and how failures are put right. Price the hours you can staff, and look for service credits or penalties in the pack before you commit.
How to win IT support contracts
Smaller contracts and schools
Smaller support contracts can sit below the thresholds. From 1 January 2026, services contracts fall under the full Act rules at £135,018 including VAT for central government and £207,720 for other authorities. Below that, when a buyer invites tenders, section 85 bars a separate suitability stage before tenders are submitted, but the buyer can still assess suitability at the award stage (Welsh devolved buyers follow their own rules, and call-offs from frameworks are excluded).
If a buyer advertises a below-threshold contract worth £12,000 or more (central government, including NHS trusts) or £30,000 or more (other authorities), including VAT, it must first publish a below-threshold tender notice (section 87). Buyers can also invite quotes from chosen suppliers without advertising. Procurement by a school is outside these rules, so check how the named buyer buys.
Frameworks and call-offs
Some support is bought through frameworks, where each job is a call-off awarded with or without competition among the appointed suppliers. If that is the route, getting onto the framework is the real contest. G-Cloud is one such route on the Digital Marketplace, so check which G-Cloud iteration is open. PPN 014 says suppliers on G-Cloud agreements must show they comply with the Government’s Cloud Security Principles.
TUPE where in-house staff transfer
If in-house IT staff might move to you, TUPE may apply. A service provision change needs an organised grouping of employees whose principal purpose is the client’s work, and the work can’t be a single short-term task or wholly or mainly the supply of goods. Ask for staffing information early and price for it.
Social value
Central government departments, their executive agencies and non-departmental public bodies must give social value at least a 10% weighting on above-threshold contracts where it is relevant and proportionate (PPN 002). NHS bodies are outside its scope. For an MSP that might mean apprenticeships or digital skills for local people. Be specific and measurable.
Pitfalls to check before you commit
- Unpriced onboarding. Transition, asset discovery and documentation take time. Price them.
- Licence pass-through. Check whether software licences sit in your price or are billed at cost.
- SLA penalties. Read what a missed target costs you, and how it is measured, before you agree.
Who issues IT support tenders
Schools, academy trusts, councils and NHS bodies buy support. IT services (division 72) had 30 live notices in the week to 10 Oct 2026, and support is a subset of that. For related work, see IT services tenders, cyber security tenders, software tenders and website development tenders.
Questions
Do I need Cyber Essentials to bid for public sector IT support?
Not for every contract. PPN 014 covers central government departments, executive agencies, non-departmental public bodies and NHS bodies, and points to Cyber Essentials where a contract involves things like citizens' personal information or ICT systems handling OFFICIAL-level data. It says the scheme shouldn't be applied to all contracts as a matter of course. Councils and schools can still ask for it, so check the pack.
Is Cyber Essentials Plus required, or is basic Cyber Essentials enough?
The buyer decides and says so in the pack. PPN 014 describes Cyber Essentials Plus as a more rigorous assessment for higher-risk contracts: it adds remote and on-site vulnerability testing to the same technical controls. Where you hold neither, the PPN lets you show equivalent controls, which should normally be verified by a technically competent, independent third party.
Where do schools and academy trusts advertise IT support contracts?
Where a notice is published it appears on Find a Tender or Contracts Finder, and the live list on this page draws on both. We can't give a rule for schools: the Procurement Act's below-threshold rules don't apply to procurement by a school, so how a school buys depends on its own policies and on the buyer named in the notice.
Does TUPE apply when taking over an IT support contract?
It can. A service provision change needs an organised grouping of employees whose principal purpose is the client's work, and the work must not be a single short-term task or wholly or mainly the supply of goods. If in-house IT staff might transfer, ask the buyer for staffing information early and price for it.
Can a small MSP win NHS or council IT contracts?
Yes, it is possible. On above-threshold contracts, buyers must consider splitting contracts into lots. Below the thresholds, section 85 bars a separate suitability stage before tenders are submitted, but a buyer that invites tenders can still assess suitability at the award stage (Welsh devolved buyers and framework call-offs are excluded). Look for lots or smaller contracts that match your team, and read the service levels before you price.