Software tenders cover licences, SaaS subscriptions, bespoke development and support, bought by councils, NHS bodies, central government and other public buyers. Your chances depend on the buyer’s security expectations, how it handles data and accessibility, and whether it buys through G-Cloud or an open tender. This page sets out what each buyer type is likely to ask for, with a link to the government source for every rule. The notice and the tender pack have the detail that decides your bid.
What buyers usually ask software suppliers for
Security, data and accessibility questions can all come up in a software tender. Which ones apply depends on who the buyer is, and the detail is usually in the pack, not the notice.
Cyber Essentials and Cyber Essentials Plus
PPN 014 applies to central government departments, their executive agencies and non-departmental public bodies, and NHS bodies. It points to Cyber Essentials or Cyber Essentials Plus where a contract involves citizens’ personal data, government staff data, ICT systems that store or process data at the OFFICIAL level, or day-to-day government business. It applies only to contracts with those characteristics, and the PPN says in-scope buyers must not take a blanket approach.
The difference between the two levels, per the PPN’s annex: basic Cyber Essentials is a questionnaire verified by an independent certification body, and Cyber Essentials Plus adds remote and on-site vulnerability testing. Our page on Cyber Essentials covers how to get it.
PPN 014 doesn’t name councils. A council may still ask for it, so check the pack rather than assuming either way.
Data protection and hosting
If your software processes personal data, the Data Protection Act 2018 applies. Buyers may ask where data is hosted, who your sub-processors are and how you handle a data breach. Hosting location requirements are in the pack, so check them before you price.
The Technology Code of Practice
The Technology Code of Practice is a cross-government standard for how technology is designed, built and bought. It says that you must consider all of its points as part of the Cabinet Office spend control process, and that it should be used for all technology projects. Its 13 points include accessibility, open standards, cloud first, security and privacy. The Code also describes itself as the agreed standard used for the Local Digital Declaration, so it is not only a central-government document. We can’t tell you that a council must follow the Code, but a buyer may reference it. Read the pack for the standards it names.
Accessibility
The Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018 put obligations on public sector bodies. These include making websites and mobile applications accessible and publishing an accessibility statement. If your product is public-facing, expect questions on how it helps the buyer meet those duties. The pack should say which standard it expects.
ISO 27001
If the pack names ISO 27001, don’t assume anything beyond what it states. Check whether it asks for certification with your bid or evidence of a security management approach, and whether a pending certificate is accepted.
How to win software contracts
In the week to 10 Oct 2026 there were 11 live software notices in our data (as of 10 Oct 2026). The sample is small, so we don’t quote a typical contract value.
G-Cloud versus open tenders
The Digital Marketplace is where public sector organisations find cloud hosting, software and support. G-Cloud is one of the frameworks listed there. The page says suppliers on the Digital Marketplace are on G-Cloud, Digital Outcomes and Specialists, or the Crown Hosting Data Centres framework. Check which G-Cloud iteration is open on the day you read this. If a buyer goes to open tender instead, the notice will say so.
Under PPN 014, suppliers on G-Cloud agreements must demonstrate that they comply with the government’s Cloud Security Principles. Have that evidence to hand before you apply.
If your product is part of a wider IT contract, see IT services tenders. For security-specific work, see cyber security tenders, and for websites and portals, web design and development tenders.
Below-threshold council purchases
Smaller purchases fall under the below-threshold rules. If a buyer advertises a contract worth £12,000 or more (central government, including NHS trusts) or £30,000 or more (others), including VAT, it must first publish a below-threshold tender notice. Buyers can also invite quotes from chosen suppliers without advertising. Schools are outside the regime.
A buyer can’t add a separate supplier-suitability stage before inviting tenders. For a small vendor, the lighter process means a clear, well-evidenced response can compete. Read the notice to see how it will be scored. Our tender eligibility checker is coming soon. Until then, tell us your trade and postcode to join the free weekly list of live tenders, starting soon.
Demos, pilots and implementation plans
A buyer may award to the most advantageous tender: the one that meets its requirements and best satisfies the award criteria. In a software tender those criteria might include a scored demonstration, a pilot, or an implementation plan. Check the pack for what is scored and how it is weighted.
If there’s a demo, script it around the buyer’s stated use cases, not your feature list. For the implementation plan, name the people, the dates and what you need from the buyer. Say what happens at go-live, and how support is handled after.
Questions
Do I need to be on G-Cloud to sell software to government?
No. G-Cloud is one of the frameworks listed on the Digital Marketplace, where public bodies find cloud hosting, software and support. Buyers can also run their own open tenders. Being on G-Cloud is one route to market, and which one a buyer uses is shown in the notice. Check which G-Cloud iteration is open on the day you read this.
Does my software need Cyber Essentials for public sector contracts?
Only where the buyer requires it. PPN 014 covers central government departments, executive agencies and non-departmental public bodies, and NHS bodies. It points to Cyber Essentials or Cyber Essentials Plus for contracts involving certain personal data or ICT systems handling OFFICIAL-level data, and it says not to take a blanket approach. Other buyers, such as councils, set their own requirements in the pack.
What accessibility standards apply to public sector software?
The Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018 put obligations on public sector bodies, including making websites and mobile applications accessible and publishing an accessibility statement. If your software is public-facing, expect the buyer to ask how it supports that. Check the pack for the standard it names.
Are council software contracts advertised below the main thresholds?
Sometimes. If a buyer outside central government advertises a contract worth £30,000 or more, including VAT, it must first publish a below-threshold tender notice (£12,000 or more for central government, including NHS trusts). Buyers can also invite quotes from chosen suppliers without advertising, at any below-threshold value. The below-threshold rules also bar a separate supplier-suitability stage before tenders are invited.